Windows Analysis Report
runtime.exe

Overview

General Information

Sample name: runtime.exe
Analysis ID: 1541872
MD5: f299098a2f6fbaa7902f87344c965525
SHA1: 8b7e39918834826b0497243862b40671444fe939
SHA256: a799052d8068f5f2ecfefee27c690abb3f3de90bbd98e5b0a4459f0827b3fec2
Tags: antivmexestealeruser-Exteron01
Infos:

Detection

Score: 64
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Malicious sample detected (through community Yara rule)
AI detected suspicious sample
Machine Learning detection for sample
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Yara signature match

Classification

AV Detection
barindex
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 97.7% probability
Machine Learning detection for sample
Source: runtime.exe Joe Sandbox ML: detected
Source: unknown HTTPS traffic detected: 162.159.138.232:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: runtime.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: blah.pdb source: runtime.exe
Source: Binary string: blah.pdb- source: runtime.exe
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: POST /api/webhooks/1299085791254937640/Kk0DcgSpuWBwS9yryFX1nlEjkFwrVh2is32Q3WMk6aukk3R6R7FDurnupZArnouhEkR5 HTTP/1.1content-type: multipart/form-data; boundary=3d28d627302b1d54-3080abd9c0330841-eabd41003bdf51bb-1e53a08729f1926dcontent-length: 509accept: */*host: discord.com
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 162.159.138.232 162.159.138.232
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic DNS traffic detected: DNS query: discord.com
Source: global traffic DNS traffic detected: DNS query: 241.42.69.40.in-addr.arpa
Source: unknown HTTP traffic detected: POST /api/webhooks/1299085791254937640/Kk0DcgSpuWBwS9yryFX1nlEjkFwrVh2is32Q3WMk6aukk3R6R7FDurnupZArnouhEkR5 HTTP/1.1content-type: multipart/form-data; boundary=3d28d627302b1d54-3080abd9c0330841-eabd41003bdf51bb-1e53a08729f1926dcontent-length: 509accept: */*host: discord.com
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 25 Oct 2024 07:11:16 GMTContent-Type: application/jsonContent-Length: 45Connection: closeCache-Control: public, max-age=3600, s-maxage=3600strict-transport-security: max-age=31536000; includeSubDomains; preloadx-ratelimit-bucket: 3d2712a9e4fe17cc9d3fed4a8e672e5fx-ratelimit-limit: 5x-ratelimit-remaining: 4x-ratelimit-reset: 1729840277x-ratelimit-reset-after: 1via: 1.1 googlealt-svc: h3=":443"; ma=86400CF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IIP0D3aRQk1L8yXSNpYeaAjncrxByOMzUuOTJYf1Wi6GWpGqortYvk7BdDgt9jMyKoTcsEy5TMHF3uleOOXQiZzwkvZXIIyBDTGNb4LywP%2B0jM262N2y9Ghb5WB6"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}X-Content-Type-Options: nosniffSet-Cookie: __cfruid=672774b61d688e89340cc611b24790905df7aefa-1729840276; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneContent-Security-Policy: frame-ancestors 'none'; default-src 'none'Set-Cookie: _cfuvid=Fm4XHW3.LuKeG.98VTGt97lVmseXkzzkM6wIbRC1bbA-1729840276066-0.0.1.1-604800000; path=/; domain=.discord.com; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 8d80643cebfc2cc7-DFW
Source: runtime.exe, 00000000.00000003.2195626457.00000250EB311000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2203375590.00000250EB6F0000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2203375590.00000250EB6FF000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2193659488.00000250EB302000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2195626457.00000250EB302000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: runtime.exe, 00000000.00000003.2195626457.00000250EB311000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2203375590.00000250EB6F0000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2203375590.00000250EB6FF000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2193659488.00000250EB302000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2195626457.00000250EB302000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: runtime.exe, 00000000.00000003.2193659488.00000250EB302000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl4.digic
Source: runtime.exe, 00000000.00000003.2193659488.00000250EB302000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl4.digiccom/
Source: runtime.exe, 00000000.00000003.2195626457.00000250EB311000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2203375590.00000250EB6F0000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2203375590.00000250EB6FF000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2193659488.00000250EB302000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2195626457.00000250EB302000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: runtime.exe, 00000000.00000003.2195626457.00000250EB311000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2203375590.00000250EB6F0000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2203375590.00000250EB6FF000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2193659488.00000250EB302000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2195626457.00000250EB302000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0
Source: runtime.exe, 00000000.00000003.2207099867.00000250EB69E000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2193659488.00000250EB302000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com1.3.6.1.5.5.7.48.2http://cacerts.digicert.com/DigiCertGlobalRootG2.crt
Source: runtime.exe, 00000000.00000003.2193659488.00000250EB302000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: runtime.exe, 00000000.00000003.2203375590.00000250EB6F0000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2195626457.00000250EB302000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: runtime.exe, 00000000.00000002.2238055806.00000250EB1E3000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2236714574.00000250EB618000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://discord.com/api/webhooks/1299085791254937640/Kk0DcgSpuWBwS9yryFX1nlEjkFwrVh2is32Q3WMk6aukk3R
Source: runtime.exe String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
Source: unknown Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown HTTPS traffic detected: 162.159.138.232:443 -> 192.168.2.6:49712 version: TLS 1.2

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: runtime.exe, type: SAMPLE Matched rule: OlympicDestroyer Payload Author: kevoreilly
Source: 0.2.runtime.exe.7ff7aa2b0000.0.unpack, type: UNPACKEDPE Matched rule: OlympicDestroyer Payload Author: kevoreilly
Source: 0.0.runtime.exe.7ff7aa2b0000.0.unpack, type: UNPACKEDPE Matched rule: OlympicDestroyer Payload Author: kevoreilly
Sample file is different than original file name gathered from version info
Source: runtime.exe, 00000000.00000003.2203375590.00000250EB78A000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameApplicationFrameHost.exej% vs runtime.exe
Source: runtime.exe, 00000000.00000003.2195109691.00000250EB39C000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameApplicationFrameHost.exej% vs runtime.exe
Yara signature match
Source: runtime.exe, type: SAMPLE Matched rule: OlympicDestroyer_1 author = kevoreilly, description = OlympicDestroyer Payload, cape_type = OlympicDestroyer Payload
Source: 0.2.runtime.exe.7ff7aa2b0000.0.unpack, type: UNPACKEDPE Matched rule: OlympicDestroyer_1 author = kevoreilly, description = OlympicDestroyer Payload, cape_type = OlympicDestroyer Payload
Source: 0.0.runtime.exe.7ff7aa2b0000.0.unpack, type: UNPACKEDPE Matched rule: OlympicDestroyer_1 author = kevoreilly, description = OlympicDestroyer Payload, cape_type = OlympicDestroyer Payload
Source: runtime.exe Binary string: Failed to open \Device\Afd\Mio: Pb:@
Source: runtime.exe Binary string: CompletionPorthandle\Device\Afd\Mio
Source: classification engine Classification label: mal64.spyw.evad.winEXE@2/3@2/1
Source: C:\Users\user\Desktop\runtime.exe File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data_copy Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2680:120:WilError_03
Source: runtime.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\runtime.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: runtime.exe, 00000000.00000000.2158386030.00007FF7AA5CE000.00000002.00000001.01000000.00000003.sdmp, runtime.exe, 00000000.00000002.2239057789.00007FF7AA5CE000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: runtime.exe, 00000000.00000000.2158386030.00007FF7AA5CE000.00000002.00000001.01000000.00000003.sdmp, runtime.exe, 00000000.00000002.2239057789.00007FF7AA5CE000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: runtime.exe, 00000000.00000000.2158386030.00007FF7AA5CE000.00000002.00000001.01000000.00000003.sdmp, runtime.exe, 00000000.00000002.2239057789.00007FF7AA5CE000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: runtime.exe, 00000000.00000000.2158386030.00007FF7AA5CE000.00000002.00000001.01000000.00000003.sdmp, runtime.exe, 00000000.00000002.2239057789.00007FF7AA5CE000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: runtime.exe, 00000000.00000000.2158386030.00007FF7AA5CE000.00000002.00000001.01000000.00000003.sdmp, runtime.exe, 00000000.00000002.2239057789.00007FF7AA5CE000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: runtime.exe, 00000000.00000000.2158386030.00007FF7AA5CE000.00000002.00000001.01000000.00000003.sdmp, runtime.exe, 00000000.00000002.2239057789.00007FF7AA5CE000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: Login Data_copy0.0.dr, Login Data_copy.0.dr Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: runtime.exe, 00000000.00000000.2158386030.00007FF7AA5CE000.00000002.00000001.01000000.00000003.sdmp, runtime.exe, 00000000.00000002.2239057789.00007FF7AA5CE000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: runtime.exe String found in binary or memory: aifcaiffairapplication/vnd.adobe.air-application-installer-package+zip
Source: runtime.exe String found in binary or memory: aifcaiffairapplication/vnd.adobe.air-application-installer-package+zip[
Source: runtime.exe String found in binary or memory: ghfapplication/vnd.groove-help
Source: runtime.exe String found in binary or memory: installapplication/x-install-instructions
Source: runtime.exe String found in binary or memory: /load_hpack; header malformed -- pseudo not at head of blockp
Source: unknown Process created: C:\Users\user\Desktop\runtime.exe "C:\Users\user\Desktop\runtime.exe"
Source: C:\Users\user\Desktop\runtime.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\runtime.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\runtime.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Users\user\Desktop\runtime.exe Section loaded: pdh.dll Jump to behavior
Source: C:\Users\user\Desktop\runtime.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Users\user\Desktop\runtime.exe Section loaded: vcruntime140.dll Jump to behavior
Source: C:\Users\user\Desktop\runtime.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\runtime.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\runtime.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Users\user\Desktop\runtime.exe Section loaded: perfos.dll Jump to behavior
Source: C:\Users\user\Desktop\runtime.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\runtime.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\runtime.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\runtime.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\runtime.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\runtime.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\runtime.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\runtime.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\Desktop\runtime.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\Desktop\runtime.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\runtime.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\runtime.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Users\user\Desktop\runtime.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\runtime.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\runtime.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\runtime.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\runtime.exe Section loaded: cryptnet.dll Jump to behavior
Source: C:\Users\user\Desktop\runtime.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: runtime.exe Static PE information: Virtual size of .text is bigger than: 0x100000
Source: runtime.exe Static PE information: Image base 0x140000000 > 0x60000000
Source: runtime.exe Static file information: File size 4795392 > 1048576
Source: runtime.exe Static PE information: Raw size of .text is bigger than: 0x100000 < 0x31c200
Source: runtime.exe Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0x13e600
Source: runtime.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: runtime.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: blah.pdb source: runtime.exe
Source: Binary string: blah.pdb- source: runtime.exe

Malware Analysis System Evasion
barindex
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: runtime.exe Binary or memory string: PROCEXP64.EXEPROCEXP.EXEPROCMON.EXEPROCMON64.EXEPESTUDIO.EXEKSDUMPER.EXEPRL_CC.EXEPRL_TOOLS.EXEPE-SIEVE64.EXEHOLLOWS_HUNTER32.EXEMONETA64.EXEFAKENET.EXEWIRESHARK.EXEVBOXSERVICE.EXEVMWAREUSER.EXEVMTOOLSD.EXEVMWARETRAY.EXEVMSRVC.EXEVGAUTHSERVICE.EXEVBOXTRAY.EXEC:\USERS\DOHANYZOE\.CARGO\REGISTRY\SRC\INDEX.CRATES.IO-6F17D22BBA15001F\ANTILYSIS-0.1.2\SRC\LIB.RS
Source: runtime.exe, 00000000.00000002.2238083196.00000250EB231000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2237021435.00000250EB231000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2237262559.00000250EB231000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: gaGWfVqqYuH/A7XSSjYMFTLKZ4wZnSoDq3yWLctBu1VqqSoq0Tvls2kackMH2VC0hk6yY6kauAdK1YEOJdCBUz5rjqnXCsiOI9ty3S7bjmWQ0fkccAYVJE2NYXm7oaGpGZZBZqsZFINmRi/NhkE1JoKGaDoNszmOabSeDdNsdoAhqa2JxMTaA32gVAQwqd4QAI0UvWkTXdZhkfoZE6U0TaBamt16Vgy7Kc+2bWdgVDaVbdMg11EGdjlGh/5rjBlWtPTGGGxHNbizVc+K4jRUVDSTT3vVbplmc1ptQzHMhkq26tgGqaRUL+CemIWyQ90yoB9UqAgwD2rDipajW1qjB902uTNXg7QsQ2sxWAq3YukomCXHGWjQSrFLQ1myYjesoGsa962KwFIMp+UakCJDy6odhtAaM2XJMqa+HpVhGlpTBxNKtWbKVFWnXk2yIcO0TXrFkVXy1YpAk83mIA1b0dWmADin2Ry0amE1qdpAr8eo0kxiMuSSRsf0NpQyVNXQyV9LAsQESKgDDWxvI+5plRl0mqyGVphMRWs8q6am0mSrpUR0YjkNNeEv5G7awCnfaJaJwFQPjJtiAJ5SpmbKttIMZpYu80BSdSqT7Rsuq+o8GtZ9WpgqUKjFMBRL1uXGutdkzajoHcuBUZyBXTwqKixgDQxyV54KHBvuiWWsly+og4Ep/POJh2vbgHq2cPEnsU5NpTT0E7eb7hgDW4yBv9DhxgOKJnbxBmnBgRS1lGtbWAgU/kzxaGoyOahRPGoy5RS4kFALDm+SUrolLecKY4quXOi6Zcu6pL3Jy6Vumhe6ptiWJaUsY/k8iJZEIJuy5CmBjUiiXuiqqUPlzySOMjdXXw0ZJOQE0tubykzHhgxVtWxFchxjpSH0oB0Ly5Qc/22OWXDQhwVrS/OFt7Rs1cIzQpwp5c7vqRsFazcP4oit3SB0N3m8CMIQFI7hKBIWmEYBmHo0TEVic19bKhaNwjAR3fJkEMaks+aAVJrLylug2cYF9Y8OAmWpLk1ZJwU0w5GcxYItHRoTsgYWBNMsF2tKJXrbBj/G763c/PcNSwOWvRqvwTqBZTLo9/oZ5KvXlPlByrz8dZOGGcQgucCWvqvNNT5O3VEcyTdt31cd6tZQHZiOzQcZC8E22ETZKkgudAP+oUn2G+KcQQbBErMtKVCZBX1tsjmSu2SuFLZCAqXhI9FKzFE906Z2Be2GpMiub+uyTB2beHZ83XMdHeNHIAN/4LMoDxZbf05vsAqlTzcMWZ5kn2EQvW8S382ZMJYjBW++Y1oatCZgYUqKp9u6TaNSIF2TEDvtQNfQGaUsS7L0JVKfbZGyWA+S5rE3OIx9oWGlORaMqS90h6xgIArp0pvuywtTd7hyCA1zsj5AzYXmAOlYkuN5JpKphnYFwV7y48/ITdP4M/PSOAzJ/HkaLJcsjdjnhQbDyaoUAa+FMRwoWhJBvMnzeLkMaVCYG1NaWHN/aSrkxVjgiuRb9tsS8Q4WhQcbkim7iMoyOZgJl5OYrQOnOTSVgGNwOB/E3uIC6RH4THKNpfamWGBHPLBt6Lhm3xM34g7ygXlCorNUKYPh8ZZ5braau967FwbeO5o1pHIsdubrKoaNNYEeMvcDymdblm2CC0Q5VXMkOQgYohlMadka/PhNe/MD3YKpEXhNQ4LhdYiADEA6OJjsMUXFJKIDUh4dyJpiEbehY8xIhAvThNKKRcv0Q3mFBaMYnhF4fO1h6ZMFsw1XStckRVu+LYDkoBAWriOp3mrhmjo9a+gZHWRMVWxqhmGkwPDYyjKMCw0Og3WVeEka+xsvn29TtmTfWbTJ0IYJkyXVZTogEvk0Ug/cTvdVBjxCPm0bNBY/sA3VxFhkhdzQsFcLBz6uGXB1DV0nbobJw9jhNYa0gG/En+48ZFhmCFIXmuZoqiopbM5c3YRODtzXlizVX/mAitADqNeW5oaJtWpjpinGWLCK8urG3jKNN0mmupGvcU5HlXybvdFUXWgqEhdpkMfvjkkaEbCSfMYSxkL4HWyoXAB1G5hDlqeMuUnwoUAFmVChtHrzZUujZ1qMtmQuVsgyJgRjoLosLTOWYnCQQNUD+mHRChOMZhQemhTYAQZgYPXrgAlY7arGVNjsQrU1hANJXXgrvFAvKP9iwWKe4wjrnFHs+Z6nrkdzDfsQ7pfwBivJDdeBjyC8ZBrYMHeatMrX4SJ1l2vEDg/GZZwN3qvaQEOk1nsYI0nQhADMY/hZsIxYmq3ilFF3yHgGzY6tEzFmBea/UBzFhAmYb1oqHrA2HYnHoIDc0qDg5jN/iSm+UGwHYbQqqkRJVpdhCsWfEsDQs2YatlmgMvGsygRH9PIZM241n1Wg2QJriGdD15v8AEBGUz5wmlUAhSdeuRka5XGneIZTmGpDHsAMQJpeyqP8xYFGCRUAjTnqs8pnAw7ZfJaRM+v+EFLwrtaPnqkMBbgxavDBYWANPixOUg4B+VzjJUjJYCBsUJclzNAchyM4pexDM02OhsoxyzrVD0C6Arsg91oEjxRVPKLcNQkNKVbxTCUW6soC2egIZoCPA7t4NFXTGOgK4Ztqmq9iAIBoyJ0taxTdWMw6zUbRFVnX0UrMS8+qbjpa49lGwqehC3MjgPLqrkBUFpyDPwpFUfupRlk6QW9NIcWAwPgjCgxdK6okaC1DF0K1ohFZDl5jASmKR3itQzUXpUraHaACX6vQ/9XAsTV4DSBo7dk3QZrlT5uo4dswPOpnsJUzg7nmNYtWoEgESZWcUTH2xOwuFIKgJgfVnHTK+JLmAb/RowJPMKhAsCv3xIKp3A3J0bIrT6Kneikg7dvk+GJmkHFttaJEguSLSv129ueZxPU8u/jjbOh58SbK79gHC6fbyHtiXugGa2piEQXxG+bmG0Cus4t/nq2zXfIR5aooh8B19rBJQYmQ20FEfz4uFqfTRmf/+lM6Ex746uEtS7v0ouFUMm83c8HpZ5PQzRdxuv47EQAZ9PEP/ZL6ecyVbL+8hOSJ
Source: runtime.exe, 00000000.00000003.2172560634.00000250E9907000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: main Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation Snapshot4888Active Tsc Count Snapshot4890HWP Request MSR Context Switches/sec4892Guest Run Time4894Idle Time4896% Total Run Time4898% Hypervisor Run Time4900% Guest Run Time4902% Idle Time4904Total Interrupts/sec4788Hyper-V Hypervisor4790Logical Processors4792Partitions4794Total Pages4796Virtual Processors4798Monitored Notifications4800Modern Standby Entries4802Platform Idle Transitions4804HypervisorStartupCost4906Hyper-V Hypervisor Root Partition4908Virtual Processors4910Virtual TLB Pages4912Address Spaces4914Deposited Pages4916GPA Pages4918GPA Space Modifications/sec4920Virtual TLB Flush Entires/sec4922Recommended Virtual TLB Size49244K GPA pages49262M GPA pages49281G GPA pages4930512G GPA pages49324K device pages49342M device pages49361G device pages4938512G device pages4940Attached Devices4942Device Interrupt Mappings4944I/O TLB Flushes/sec4946I/O TLB Flush Cost4948Device Interrupt Errors4950Device DMA Errors4952Device Interrupt Throttle Events4954Skipped Timer Ticks4956Partition Id4958Nested TLB Size4960Recommended Nested TLB Size4962Nested TLB Free List Size4964Nested TLB Trimmed Pages/sec4966Pages Shattered/sec4968Pages Recombined/sec4970I/O TLB Flushes Base4972Hyper-V Hypervisor Root Virtual Processor4974Total Run Time4976Hypervisor Run Time4978Remote Node Run Time4980Normalized Run Time4982Ideal Cpu4984Hypercalls/sec4986Hypercalls Cost4988Page Invalidations/sec4990Page Invalidations Cost4992Control Register Accesses/sec4994Control Register Accesses Cost4996IO Instructions/sec4998IO Instructions Cost5000HLT Instructions/sec5002HLT Instructions Cost5004MWAIT Instructions/sec5006MWAIT Instructions Cost5008CPUID Instructions/sec5010CPUID Instructions Cost5012MSR Accesses/sec5014MSR Accesses Cost5016Other Intercepts/sec5018Other Intercepts Cost5020External Interrupts/sec5022External Interrupts Cost5024Pending Interrupts/sec5026Pending Interrupts Cost5028Emulated Instructions/sec5030Emulated Instructions Cost5032Debug Register Accesses/sec5034Debug Register Accesses Cost5036Page Fault Intercepts/sec5038Page Fault Intercepts Cost5040NMI Interrupts/sec5042NMI Interrupts Cost5044Guest Page Table Maps/sec5046Large Page TLB Fills/sec5048Small Page TLB Fills/sec5050Reflected Guest Page Faults/sec5052APIC MMIO Accesses/sec5054IO Intercept Messages/sec5056Memory Intercept Messages/sec5058APIC EOI Accesses/sec5060Other Messages/sec5062Page Table Allocations/sec5064Logical Processor Migrations/sec5066Address Space Evictions/sec5068Address Space Switches/sec5070Address Domain Flushes/sec5072Address Space Flushes/sec5074Global GVA Range Flushes/sec5076Local Flushed GVA Ranges/sec5078Page Table Evictions/sec5080Page Table Reclamations/sec508
Source: runtime.exe, 00000000.00000003.2172143994.00000250EB1E0000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2183551030.00000250EB1E8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4
Source: runtime.exe, 00000000.00000003.2212094875.00000250E98AC000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2200613737.00000250E989D000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2197752137.00000250EB37E000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000002.2237736020.00000250E98A8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V VM Vid PartitionaA
Source: runtime.exe, 00000000.00000003.2212094875.00000250E98AC000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2200613737.00000250E989D000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2197752137.00000250EB37E000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000002.2237736020.00000250E98A8000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000002.2237651519.00000250E983C000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2197752137.00000250EB30D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V Dynamic Memory Integration Service
Source: runtime.exe, 00000000.00000003.2212094875.00000250E98AC000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2200613737.00000250E989D000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2197752137.00000250EB37E000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000002.2237736020.00000250E98A8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V Hypervisor Root Virtual Processor
Source: runtime.exe, 00000000.00000003.2212094875.00000250E98AC000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2200613737.00000250E989D000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2197752137.00000250EB37E000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000002.2237736020.00000250E98A8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: X2Hyper-V VM Vid Partition
Source: runtime.exe, 00000000.00000003.2170967884.00000250E9918000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation Snapshot4888Active Tsc Count Snapshot4890HWP Request MSR Context Switches/sec4892Guest Run Time4894Idle Time4896% Total Run Time4898% Hypervisor Run Time4900% Guest Run Time4902% Idle Time4904Total Interrupts/sec4788Hyper-V Hypervisor4790Logical Processors4792Partitions4794Total Pages4796Virtual Processors4798Monitored Notifications4800Modern Standby Entries4802Platform Idle Transitions4804HypervisorStartupCost4906Hyper-V Hypervisor Root Partition4908Virtual Processors4910Virtual TLB Pages4912Address Spaces4914Deposited Pages4916GPA Pages4918GPA Space Modifications/sec4920Virtual TLB Flush Entires/sec4922Recommended Virtual TLB Size49244K GPA pages49262M GPA pages49281G GPA pages4930512G GPA pages49324K device pages49342M device pages49361G device pages4938512G device pages4940Attached Devices4942Device Interrupt Mappings4944I/O TLB Flushes/sec4946I/O TLB Flush Cost4948Device Interrupt Errors4950Device DMA Errors4952Device Interrupt Throttle Events4954Skipped Timer Ticks4956Partition Id4958Nested TLB Size4960Recommended Nested TLB Size4962Nested TLB Free List Size4964Nested TLB Trimmed Pages/sec4966Pages Shattered/sec4968Pages Recombined/sec4970I/O TLB Flus
Source: runtime.exe, 00000000.00000003.2212094875.00000250E98AC000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2200613737.00000250E989D000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2197752137.00000250EB37E000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000002.2237736020.00000250E98A8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V Hypervisor Root Partitionl1E
Source: runtime.exe, 00000000.00000003.2212094875.00000250E98AC000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2200613737.00000250E989D000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2197752137.00000250EB37E000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000002.2237736020.00000250E98A8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: THyper-V Hypervisor Root Virtual Processor
Source: runtime.exe, 00000000.00000003.2212094875.00000250E98AC000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2200613737.00000250E989D000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2197752137.00000250EB37E000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000002.2237736020.00000250E98A8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: JHyper-V Hypervisor Logical Processor
Source: runtime.exe, 00000000.00000003.2212094875.00000250E98AC000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2200613737.00000250E989D000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2197752137.00000250EB37E000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000002.2237736020.00000250E98A8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VHyper-V Dynamic Memory Integration ServiceDLr;
Source: runtime.exe, 00000000.00000003.2212094875.00000250E98AC000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2200613737.00000250E989D000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2197752137.00000250EB37E000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000002.2237736020.00000250E98A8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: 2Hyper-V VM Vid Partition.dlljN
Source: runtime.exe, 00000000.00000003.2212094875.00000250E98AC000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2200613737.00000250E989D000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2197752137.00000250EB37E000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000002.2237736020.00000250E98A8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V Hypervisor Logical Processor.mui+Jd;
Source: runtime.exe, 00000000.00000003.2212094875.00000250E98AC000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2200613737.00000250E989D000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2197752137.00000250EB37E000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000002.2237736020.00000250E98A8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V Virtual Machine Bus PipeslND;
Source: runtime.exe, 00000000.00000003.2212094875.00000250E98AC000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2200613737.00000250E989D000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2197752137.00000250EB37E000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000002.2237736020.00000250E98A8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: DHyper-V Virtual Machine Bus Pipes
Source: runtime.exe, 00000000.00000003.2195626457.00000250EB311000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2203375590.00000250EB6FF000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2207099867.00000250EB6B0000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2193659488.00000250EB32E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: runtime.exe, 00000000.00000003.2170949145.00000250EB183000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2170385804.00000250EB18C000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2167618695.00000250EB181000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2167847201.00000250EB18C000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2173955232.00000250EB183000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupt
Source: runtime.exe, 00000000.00000002.2237651519.00000250E983C000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2197752137.00000250EB30D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V Hypervisor#
Source: runtime.exe, 00000000.00000003.2212094875.00000250E98AC000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2200613737.00000250E989D000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2197752137.00000250EB37E000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000002.2237736020.00000250E98A8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V VM Vid Partition1Az;
Source: runtime.exe, 00000000.00000002.2237651519.00000250E983C000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2197752137.00000250EB30D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V Hypervisor Root Partition
Source: runtime.exe, 00000000.00000003.2212094875.00000250E98AC000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2200613737.00000250E989D000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2197752137.00000250EB37E000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000002.2237736020.00000250E98A8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: sWDHyper-V Hypervisor Root PartitionSO
Source: runtime.exe, 00000000.00000003.2212094875.00000250E98AC000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2200613737.00000250E989D000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2197752137.00000250EB37E000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000002.2237736020.00000250E98A8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V Virtual Machine Bus Pipes
Source: runtime.exe, 00000000.00000003.2212094875.00000250E98AC000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2200613737.00000250E989D000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2197752137.00000250EB37E000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000002.2237736020.00000250E98A8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: THyper-V Hypervisor Root Virtual Processor~FN;
Source: runtime.exe, 00000000.00000003.2212094875.00000250E98AC000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2200613737.00000250E989D000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2197752137.00000250EB37E000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000002.2237736020.00000250E98A8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: JHyper-V Hypervisor Logical Processor
Source: runtime.exe, 00000000.00000003.2184370503.00000250EB1E1000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2183690960.00000250EB1E1000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2184096020.00000250EB1E1000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2183623307.00000250EB1E1000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V
Source: runtime.exe, 00000000.00000003.2212094875.00000250E98AC000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2200613737.00000250E989D000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2197752137.00000250EB37E000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000002.2237736020.00000250E98A8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V vkfsdoejldlmphk Bus Pipes
Source: runtime.exe, 00000000.00000003.2212094875.00000250E98AC000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2200613737.00000250E989D000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2197752137.00000250EB37E000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000002.2237736020.00000250E98A8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: AlDHyper-V Virtual Machine Bus PipesmO
Source: runtime.exe, 00000000.00000003.2212094875.00000250E98AC000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2200613737.00000250E989D000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2197752137.00000250EB37E000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000002.2237736020.00000250E98A8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VHyper-V Dynamic Memory Integration ServiceMG;
Source: runtime.exe, 00000000.00000003.2212094875.00000250E98AC000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2200613737.00000250E989D000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2197752137.00000250EB37E000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000002.2237736020.00000250E98A8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: DHyper-V Hypervisor Root PartitioncEI
Source: runtime.exe, 00000000.00000003.2212094875.00000250E98AC000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2200613737.00000250E989D000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2197752137.00000250EB37E000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000002.2237736020.00000250E98A8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: &Hyper-V Hypervisorui
Source: runtime.exe, 00000000.00000002.2237651519.00000250E983C000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2197752137.00000250EB30D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V Hypervisor Logical Processorc.sys
Source: runtime.exe, 00000000.00000003.2237137204.00000250EB642000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2237215795.00000250EB650000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllK
Source: runtime.exe, 00000000.00000003.2168249547.00000250EB1DC000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2168803108.00000250EB1DC000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2168426478.00000250EB1DC000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2170266680.00000250EB1DC000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2170097359.00000250EB1DC000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2169994828.00000250EB1DC000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2168361416.00000250EB1DC000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: kflowServiceHost 4.0.0.06244Workflows Created6246Workflows Created Per Second6248Workflows Executing6250Workflows Completed6252Workflows Completed Per Second6254Workflows Aborted6256Workflows Aborted Per Second6258Workflows In Memory6260Workflows Persisted6262Workflows Persisted Per Second6264Workflows Terminated6266Workflows Terminated Per Second6268Workflows Loaded6270Workflows Loaded Per Second6272Workflows Unloaded6274Workflows Unloaded Per Second6276Workflows Suspended6278Workflows Suspended Per Second6280Workflows Idle Per Second6282Average Workflow Load Time6284Average Workflow Load Time Base6286Average Workflow Persist Time6288Average Workflow Persist Time Base6324Terminal Services6326Active Sessions6328Inactive Sessions6330Total Sessions4806Hyper-V Hypervisor Logical Processor4808Global Time4810Total Run Time4812Hypervisor Run Time4814Hardware Interrupts/sec4816Context Switches/sec4818Inter-Processor Interrupts/sec4820Scheduler Interrupts/sec4822Timer Interrupts/sec4824Inter-Processor Interrupts Sent/sec4826Processor Halts/sec4828Monitor Transition Cost4830Context Switch Time4832C1 Transitions/sec4834% C1 Time4836C2 Transitions/sec4838% C2 Time4840C3 Transitions/sec4842% C3 Time4844Frequency4846% of Max Frequency4848Parking Status4850Processor State Flags4852Root Vp Index4854Idle Sequence Number4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Re
Source: runtime.exe, 00000000.00000003.2212094875.00000250E98AC000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2200613737.00000250E989D000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2197752137.00000250EB37E000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000002.2237736020.00000250E98A8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: &Hyper-V Hypervisorr
Source: runtime.exe, 00000000.00000003.2212094875.00000250E98AC000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2200613737.00000250E989D000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2197752137.00000250EB37E000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000002.2237736020.00000250E98A8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V Hypervisor
Source: runtime.exe, 00000000.00000003.2172378935.00000250E9921000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: umber4856Global TSC Count4858Active TSC Count4860Idle Accumulation4862Reference Cycle Count 04864Actual Cycle Count 04866Reference Cycle Count 14868Actual Cycle Count 14870Proximity Domain Id4872Posted Interrupt Notifications/sec4874Hypervisor Branch Predictor Flushes/sec4876Hypervisor L1 Data Cache Flushes/sec4878Hypervisor Immediate L1 Data Cache Flushes/sec4880Hypervisor Microarchitectural Buffer Flushes/sec4882Counter Refresh Sequence Number4884Counter Refresh Reference Time4886Idle Accumulation Snapshot4888Active Tsc Count Snapshot4890HWP Request MSR Context Switches/sec4892Guest Run Time4894Idle Time4896% Total Run Time4898% Hypervisor Run Time4900% Guest Run Time4902% Idle Time4904Total Interrupts/sec4788Hyper-V Hypervisor4790Logical Processors4792Partitions4794Total Pages4796Virtual Processors4798Monitored Notifications4800Modern Standby Entries4802Platform Idle Transitions4804HypervisorStartupCost4906Hyper-V Hypervisor Root Partition4908Virtual Processors4910Virtual TLB Pages4912Address Spaces4914Deposited Pages4916GPA Pages4918GPA Space Modifications/sec4920Virtual TLB Flush Entires/sec4922Recommended Virtual TLB Size49244K GPA pages49262M GPA pages49281G GPA pages4930512G GPA pages49324K device pages49342M device pages49361G device pages4938512G device pages4940Attached Devices4942Device Interrupt Mappings4944I/O TLB Flushes/sec4946I/O TLB Flush Cost4948Device Interrupt Errors4950Device DMA Errors4952Device Interrupt Throttle Events4954Skipped Timer Ticks4956Partition Id4958Nested TLB Size4960Recommended Nested TLB Size4962Nested TLB Free List Size4964Nested TLB Trimmed Pages/sec4966Pages Shattered/sec4968Pages Recombined/sec4970I/O TLB Flushes Base4972Hyper-V Hypervisor Root Virtual Processor4974Total Run Time4976Hypervisor Run Time4978Remote Node Run Time4980Normalized Run Time4982Ideal Cpu4984Hypercalls/sec4986Hypercalls Cost4988Page Invalidations/sec4990Page Invalidations Cost4992Control Register Accesses/sec4994Control Register Accesses Cost4996IO Instructions/sec4998IO Instructions Cost5000HLT Instructions/sec5002HLT Instructions Cost5004MWAIT Instructions/sec5006MWAIT Instructions Cost5008CPUID Instructions/sec5010CPUID Instructions Cost5012MSR Accesses/sec5014MSR Accesses Cost5016Other Intercepts/sec5018Other Intercepts Cost5020External Interrupts/sec5022External Interrupts Cost5024Pending Interrupts/sec5026Pending Interrupts Cost5028Emulated Instructions/sec5030Emulated Instructions Cost
Source: runtime.exe Binary or memory string: procexp64.exeprocexp.exeProcmon.exeProcmon64.exepestudio.exeKsDumper.exeprl_cc.exeprl_tools.exepe-sieve64.exehollows_hunter32.exeMoneta64.exefakenet.exeWireshark.exeVBoxService.exeVMwareUser.exevmtoolsd.exeVMwareTray.exevmsrvc.exeVGAuthService.exeVBoxTray.exeC:\Users\DohanyZoe\.cargo\registry\src\index.crates.io-6f17d22bba15001f\antilysis-0.1.2\src\lib.rs
Source: runtime.exe, 00000000.00000002.2237651519.00000250E983C000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2197752137.00000250EB30D000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V Hypervisor Root Virtual Processorl
Source: runtime.exe, 00000000.00000003.2212094875.00000250E98AC000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2200613737.00000250E989D000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2197752137.00000250EB37E000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000002.2237736020.00000250E98A8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V vkfsdoejldlmphk Bus
Source: C:\Users\user\Desktop\runtime.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\runtime.exe Memory allocated: page read and write | page guard Jump to behavior
Source: runtime.exe, 00000000.00000003.2194441393.00000250EB395000.00000004.00000020.00020000.00000000.sdmp, runtime.exe, 00000000.00000003.2194441393.00000250EB308000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Shell_TrayWnd
Source: runtime.exe, 00000000.00000003.2194441393.00000250EB308000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Shell_TrayWnd&
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\runtime.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\runtime.exe Queries volume information: C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\runtime.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\runtime.exe Queries volume information: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\runtime.exe Queries volume information: C:\Users\user\Desktop\stolen_data_20241025_083429.txt VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\runtime.exe Code function: 0_2_00007FF7AA5C1924 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter, 0_2_00007FF7AA5C1924

Stealing of Sensitive Information
barindex
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Users\user\Desktop\runtime.exe File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\logins.json Jump to behavior
Source: C:\Users\user\Desktop\runtime.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data_copy Jump to behavior
Source: C:\Users\user\Desktop\runtime.exe File opened: C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Login Data Jump to behavior
Source: C:\Users\user\Desktop\runtime.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\runtime.exe File opened: C:\Users\user\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\runtime.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Users\user\Desktop\runtime.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data_copy Jump to behavior
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1541872 Sample: runtime.exe Startdate: 25/10/2024 Architecture: WINDOWS Score: 64 18 discord.com 2->18 20 241.42.69.40.in-addr.arpa 2->20 24 Malicious sample detected (through community Yara rule) 2->24 26 Machine Learning detection for sample 2->26 28 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 2->28 30 AI detected suspicious sample 2->30 7 runtime.exe 4 2->7         started        signatures3 process4 dnsIp5 22 discord.com 162.159.138.232, 443, 49712 CLOUDFLARENETUS United States 7->22 14 C:\Users\user\AppData\...\Login Data_copy, SQLite 7->14 dropped 16 C:\Users\user\AppData\...\Login Data_copy, SQLite 7->16 dropped 32 Tries to harvest and steal browser information (history, passwords, etc) 7->32 12 conhost.exe 7->12         started        file6 signatures7 process8
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
162.159.138.232
 discord.com United States
13335 CLOUDFLARENETUS false

Contacted Domains

Name IP Active
discord.com 162.159.138.232 true
241.42.69.40.in-addr.arpa unknown unknown