Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
dropper.exe

Overview

General Information

Sample name:dropper.exe
Analysis ID:1582958
MD5:a2d2d6a7f9b52b27a32a93bb3bca4d47
SHA1:9c2c72f0f8c3faffb3601b9e5762a7c97afebcf5
SHA256:c138bac3528a45a5a1fd624fd0b9526d61503dc5a7674aef195fa3cf33c44f71
Infos:

Detection

Score:84
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Allocates memory in foreign processes
Changes security center settings (notifications, updates, antivirus, firewall)
Creates a thread in another existing process (thread injection)
Disable Windows Defender real time protection (registry)
Disables Windows Defender (deletes autostart)
Found direct / indirect Syscall (likely to bypass EDR)
Injects code into the Windows Explorer (explorer.exe)
Tries to delay execution (extensive OutputDebugStringW loop)
Writes to foreign memory regions
AV process strings found (often used to terminate AV products)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Creates or modifies windows services
Detected potential crypto function
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Enables debug privileges
Enables driver privileges
Enables security privileges
Found dropped PE file which has not been started or loaded
Found evasive API chain checking for process token information
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries disk information (often used to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Uncommon Svchost Parent Process
Uses Microsoft's Enhanced Cryptographic Provider

Classification

Process Tree

  • System is w10x64native
  • dropper.exe (PID: 8420 cmdline: "C:\Users\user\Desktop\dropper.exe" MD5: A2D2D6A7F9B52B27A32A93BB3BCA4D47)
    • conhost.exe (PID: 8428 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • cmd.exe (PID: 8568 cmdline: "C:\Windows\System32\cmd.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 8576 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
      • winlogon.exe (PID: 892 cmdline: winlogon.exe MD5: A987B43E6A8E8F894B98A3DF022DB518)
      • lsass.exe (PID: 956 cmdline: C:\Windows\system32\lsass.exe MD5: 15A556DEF233F112D127025AB51AC2D3)
        • MpCmdRun.exe (PID: 8792 cmdline: "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable MD5: B3676839B2EE96983F9ED735CD044159)
          • conhost.exe (PID: 8800 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
      • svchost.exe (PID: 612 cmdline: C:\Windows\system32\svchost.exe -k DcomLaunch -p MD5: F586835082F632DC8D9404D83BC16316)
      • fontdrvhost.exe (PID: 688 cmdline: "fontdrvhost.exe" MD5: AB7AB4CF816D091EEE234C1D9BC4FD13)
      • fontdrvhost.exe (PID: 1012 cmdline: "fontdrvhost.exe" MD5: AB7AB4CF816D091EEE234C1D9BC4FD13)
      • svchost.exe (PID: 1060 cmdline: C:\Windows\system32\svchost.exe -k RPCSS -p MD5: F586835082F632DC8D9404D83BC16316)
      • svchost.exe (PID: 1112 cmdline: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM MD5: F586835082F632DC8D9404D83BC16316)
      • dwm.exe (PID: 1180 cmdline: "dwm.exe" MD5: 5C27608411832C5B39BA04E33D53536C)
      • svchost.exe (PID: 1260 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc MD5: F586835082F632DC8D9404D83BC16316)
      • svchost.exe (PID: 1308 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts MD5: F586835082F632DC8D9404D83BC16316)
      • svchost.exe (PID: 1360 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService MD5: F586835082F632DC8D9404D83BC16316)
      • svchost.exe (PID: 1368 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc MD5: F586835082F632DC8D9404D83BC16316)
      • svchost.exe (PID: 1420 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule MD5: F586835082F632DC8D9404D83BC16316)
      • IntelCpHDCPSvc.exe (PID: 1460 cmdline: C:\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_3ea756ac68d34d21\IntelCpHDCPSvc.exe MD5: B6BAD2BD8596D9101874E9042B8E2D63)
      • svchost.exe (PID: 1468 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem MD5: F586835082F632DC8D9404D83BC16316)
      • svchost.exe (PID: 1520 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc MD5: F586835082F632DC8D9404D83BC16316)
      • svchost.exe (PID: 1564 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog MD5: F586835082F632DC8D9404D83BC16316)
      • svchost.exe (PID: 1656 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS MD5: F586835082F632DC8D9404D83BC16316)
      • igfxCUIService.exe (PID: 1724 cmdline: C:\Windows\System32\DriverStore\FileRepository\cui_dch.inf_amd64_2e49f48165b8de10\igfxCUIService.exe MD5: 91038D45A86B5465E8B7E5CD63187150)
      • IntelCpHeciSvc.exe (PID: 1732 cmdline: C:\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_3ea756ac68d34d21\IntelCpHeciSvc.exe MD5: 3B0DF35583675DE5A08E8D4C1271CEC0)
      • svchost.exe (PID: 1768 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager MD5: F586835082F632DC8D9404D83BC16316)
      • svchost.exe (PID: 1852 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p -s nsi MD5: F586835082F632DC8D9404D83BC16316)
      • svchost.exe (PID: 1892 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p MD5: F586835082F632DC8D9404D83BC16316)
      • svchost.exe (PID: 1952 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp MD5: F586835082F632DC8D9404D83BC16316)
      • svchost.exe (PID: 2008 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes MD5: F586835082F632DC8D9404D83BC16316)
      • svchost.exe (PID: 1156 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder MD5: F586835082F632DC8D9404D83BC16316)
      • svchost.exe (PID: 1396 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache MD5: F586835082F632DC8D9404D83BC16316)
      • svchost.exe (PID: 2168 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc MD5: F586835082F632DC8D9404D83BC16316)
      • svchost.exe (PID: 2276 cmdline: C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm MD5: F586835082F632DC8D9404D83BC16316)
      • svchost.exe (PID: 2368 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc MD5: F586835082F632DC8D9404D83BC16316)
      • svchost.exe (PID: 2412 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc MD5: F586835082F632DC8D9404D83BC16316)
      • svchost.exe (PID: 2476 cmdline: C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache MD5: F586835082F632DC8D9404D83BC16316)
      • svchost.exe (PID: 2572 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p MD5: F586835082F632DC8D9404D83BC16316)
      • svchost.exe (PID: 2664 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p MD5: F586835082F632DC8D9404D83BC16316)
      • svchost.exe (PID: 2672 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p MD5: F586835082F632DC8D9404D83BC16316)
      • svchost.exe (PID: 2704 cmdline: C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository MD5: F586835082F632DC8D9404D83BC16316)
      • svchost.exe (PID: 2740 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection MD5: F586835082F632DC8D9404D83BC16316)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

Sigma detected: Uncommon Svchost Parent Process
Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\svchost.exe -k DcomLaunch -p, CommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch -p, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8568, ParentProcessName: cmd.exe, ProcessCommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch -p, ProcessId: 612, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Multi AV Scanner detection for submitted file
Source: dropper.exeVirustotal: Detection: 12%Perma Link
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF71C0897B0 BCryptGenRandom,SystemFunction036,BCryptGenRandom,SystemFunction036,0_2_00007FF71C0897B0
Source: C:\Windows\System32\cmd.exeCode function: 3_2_0000018B3C40B080 BCryptGenRandom,SystemFunction036,BCryptGenRandom,SystemFunction036,3_2_0000018B3C40B080
Source: C:\Windows\System32\cmd.exeCode function: 3_2_00007FFBFD5CB080 BCryptGenRandom,SystemFunction036,BCryptGenRandom,SystemFunction036,3_2_00007FFBFD5CB080
Source: dropper.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\winload_prod.pdbTCDE.@ source: svchost.exe, 00000016.00000000.1980287685.000001FE41048000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3721582776.000001FE41048000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\winload_prod.pdb source: svchost.exe, 00000016.00000000.1980287685.000001FE41048000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3721582776.000001FE41048000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: dropper.pdb source: dropper.exe
Source: Binary string: rnlmp.pdbxC4 source: svchost.exe, 00000016.00000002.3723062033.000001FE41057000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000000.1980368839.000001FE41057000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: WINLOA~1.PDBwinload_prod.pdb source: svchost.exe, 00000016.00000002.3723062033.000001FE41057000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000000.1980368839.000001FE41057000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: *@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\47114209A62F3B9930F6B8998DFD4A991\ntkrnlmp.pdb source: svchost.exe, 00000016.00000000.1980206855.000001FE4102A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3719951023.000001FE4102A000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: dll.pdb source: dropper.exe, 00000000.00000003.1855774737.00000236C9808000.00000004.00000020.00020000.00000000.sdmp, dropper.exe, 00000000.00000002.1857886263.00000236C9857000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000003.00000002.3723910614.0000018B3C42B000.00000002.00000001.01000000.00000005.sdmp, cmd.exe, 00000003.00000002.3713846370.0000018B3A167000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 00000003.00000002.3731019737.00007FFBFD5EB000.00000002.00000001.01000000.00000005.sdmp, tempdll.dll.0.dr
Source: Binary string: ntkrnlmp.pdb source: svchost.exe, 00000016.00000002.3723062033.000001FE41057000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000000.1980368839.000001FE41057000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062.pdb source: svchost.exe, 00000016.00000000.1980287685.000001FE41048000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3721582776.000001FE41048000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\47114209A62F3B9930F6B8998DFD4A991 source: svchost.exe, 00000016.00000000.1980287685.000001FE41048000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3721582776.000001FE41048000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\download.error source: svchost.exe, 00000016.00000000.1980287685.000001FE41048000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3721582776.000001FE41048000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: .@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb source: svchost.exe, 00000016.00000002.3723062033.000001FE41057000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000000.1980368839.000001FE41057000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: *@\??\C:\Users\user\AppData\Local\Temp\symsrv.dllp.pdb source: svchost.exe, 00000016.00000000.1980482592.000001FE4106C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3725498971.000001FE4106C000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: *@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb source: svchost.exe, 00000016.00000002.3723062033.000001FE41057000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000000.1980368839.000001FE41057000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\download.errorj source: svchost.exe, 00000016.00000000.1980287685.000001FE41048000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3721582776.000001FE41048000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: dll.pdb' source: dropper.exe, 00000000.00000003.1855774737.00000236C9808000.00000004.00000020.00020000.00000000.sdmp, dropper.exe, 00000000.00000002.1857886263.00000236C9857000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000003.00000002.3723910614.0000018B3C42B000.00000002.00000001.01000000.00000005.sdmp, cmd.exe, 00000003.00000002.3713846370.0000018B3A167000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 00000003.00000002.3731019737.00007FFBFD5EB000.00000002.00000001.01000000.00000005.sdmp, tempdll.dll.0.dr
Source: Binary string: ,@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: svchost.exe, 00000016.00000002.3723062033.000001FE41057000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000000.1980368839.000001FE41057000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\47114209A62F3B9930F6B8998DFD4A991\ntkrnlmp.pdb source: svchost.exe, 00000016.00000000.1980206855.000001FE4102A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3719951023.000001FE4102A000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\47114209A62F3B9930F6B8998DFD4A991\download.error source: svchost.exe, 00000016.00000000.1980206855.000001FE4102A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3719951023.000001FE4102A000.00000004.00000001.00020000.00000000.sdmp
Source: C:\Windows\System32\cmd.exeCode function: 3_2_0000018B3C417090 OutputDebugStringW,CloseHandle,memset,FindFirstFileW,FindClose,3_2_0000018B3C417090
Source: Joe Sandbox ViewIP Address: 1.1.1.1 1.1.1.1
Source: Joe Sandbox ViewIP Address: 1.1.1.1 1.1.1.1
Source: lsass.exe, 00000006.00000002.3748011679.000001F2E2200000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000000.1908009573.000001F2E2200000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: lsass.exe, 00000006.00000000.1906488047.000001F2E1888000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000002.3739196122.000001F2E20C2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000003.3217007845.000001F2E20C2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000000.1907287496.000001F2E2068000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000000.1908009573.000001F2E2200000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000002.3748011679.000001F2E2259000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000000.1907351514.000001F2E20C2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000002.3722300328.000001F2E1888000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000002.3737265635.000001F2E2068000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0B
Source: lsass.exe, 00000006.00000002.3739196122.000001F2E20C2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000000.1906172737.000001F2E1800000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000003.3217007845.000001F2E20C2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000002.3716790665.000001F2E1800000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000000.1908009573.000001F2E2200000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000002.3748011679.000001F2E2259000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000000.1907351514.000001F2E20C2000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG3.crt0B
Source: lsass.exe, 00000006.00000002.3748011679.000001F2E2200000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000002.3739196122.000001F2E20C2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000003.3217007845.000001F2E20C2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000000.1908009573.000001F2E2200000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000000.1907351514.000001F2E20C2000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2SecureServerCA-2.crt0
Source: lsass.exe, 00000006.00000000.1906488047.000001F2E1888000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000003.3217007845.000001F2E2094000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000002.3722300328.000001F2E1888000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000002.3739196122.000001F2E2095000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000000.1907351514.000001F2E2095000.00000004.00000001.00020000.00000000.sdmp, dwm.exe, 0000000E.00000000.1930929743.000002736F820000.00000004.00000001.00020000.00000000.sdmp, dwm.exe, 0000000E.00000002.3787235451.000002736F820000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: lsass.exe, 00000006.00000003.3217007845.000001F2E2094000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000002.3739196122.000001F2E2095000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000000.1907351514.000001F2E2095000.00000004.00000001.00020000.00000000.sdmp, dwm.exe, 0000000E.00000000.1930929743.000002736F820000.00000004.00000001.00020000.00000000.sdmp, dwm.exe, 0000000E.00000002.3787235451.000002736F820000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: lsass.exe, 00000006.00000002.3748011679.000001F2E2200000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000000.1908009573.000001F2E2200000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: lsass.exe, 00000006.00000000.1906488047.000001F2E1888000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000002.3739196122.000001F2E20C2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000003.3217007845.000001F2E20C2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000000.1907287496.000001F2E2068000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000000.1908009573.000001F2E2200000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000002.3748011679.000001F2E2259000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000000.1907351514.000001F2E20C2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000002.3722300328.000001F2E1888000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000002.3737265635.000001F2E2068000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl0
Source: lsass.exe, 00000006.00000002.3739196122.000001F2E20C2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000000.1906172737.000001F2E1800000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000003.3217007845.000001F2E20C2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000002.3716790665.000001F2E1800000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000000.1908009573.000001F2E2200000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000002.3748011679.000001F2E2259000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000000.1907351514.000001F2E20C2000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG3.crl0
Source: lsass.exe, 00000006.00000002.3748011679.000001F2E2200000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000002.3739196122.000001F2E20C2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000003.3217007845.000001F2E20C2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000000.1908009573.000001F2E2200000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000000.1907351514.000001F2E20C2000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigicertSHA2SecureServerCA-1.crl0?
Source: lsass.exe, 00000006.00000002.3748011679.000001F2E2200000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000000.1908009573.000001F2E2200000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: lsass.exe, 00000006.00000002.3748011679.000001F2E2200000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000002.3739196122.000001F2E20C2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000003.3217007845.000001F2E20C2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000000.1908009573.000001F2E2200000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000000.1907351514.000001F2E20C2000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigicertSHA2SecureServerCA-1.crl0~
Source: svchost.exe, 00000025.00000000.2035922851.000001C82F495000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000025.00000002.2241407674.000001C82F42A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000025.00000002.2242080776.000001C82F495000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000025.00000000.2035347461.000001C82F42A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000025.00000000.2035968508.000001C82F4BB000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ctldl.windowsupdate.com/
Source: lsass.exe, 00000006.00000000.1907578317.000001F2E20F6000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000002.3742434209.000001F2E20F6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: lsass.exe, 00000006.00000002.3724864000.000001F2E18CE000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000000.1906599240.000001F2E18CE000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: lsass.exe, 00000006.00000000.1906270895.000001F2E182E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000002.3718575754.000001F2E182E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702
Source: lsass.exe, 00000006.00000002.3720198630.000001F2E1850000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000000.1906371373.000001F2E1850000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512
Source: lsass.exe, 00000006.00000000.1906270895.000001F2E182E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000002.3718575754.000001F2E182E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: dropper.exeString found in binary or memory: http://ns.adobe.
Source: svchost.exe, 00000025.00000000.2035406193.000001C82F440000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000025.00000002.2241469753.000001C82F440000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com/
Source: lsass.exe, 00000006.00000000.1906488047.000001F2E1888000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000002.3748011679.000001F2E2200000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000002.3739196122.000001F2E20C2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000000.1906172737.000001F2E1800000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000003.3217007845.000001F2E20C2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000002.3716790665.000001F2E1800000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000000.1907287496.000001F2E2068000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000000.1908009573.000001F2E2200000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000002.3748011679.000001F2E2259000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000000.1907351514.000001F2E20C2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000002.3722300328.000001F2E1888000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000002.3737265635.000001F2E2068000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
Source: lsass.exe, 00000006.00000002.3748011679.000001F2E2200000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000002.3739196122.000001F2E20C2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000003.3217007845.000001F2E20C2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000000.1908009573.000001F2E2200000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000000.1907351514.000001F2E20C2000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0H
Source: svchost.exe, 0000001B.00000002.3734901120.000002182FDD0000.00000002.00000001.00040000.00000000.sdmpString found in binary or memory: http://schemas.micro
Source: lsass.exe, 00000006.00000000.1906270895.000001F2E182E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000002.3718575754.000001F2E182E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000002.3720198630.000001F2E1850000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000000.1906371373.000001F2E1850000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policy
Source: lsass.exe, 00000006.00000002.3720198630.000001F2E1850000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000000.1906371373.000001F2E1850000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: lsass.exe, 00000006.00000000.1906270895.000001F2E182E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000002.3718575754.000001F2E182E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000002.3720198630.000001F2E1850000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000000.1906371373.000001F2E1850000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/07/securitypolicy
Source: lsass.exe, 00000006.00000000.1906270895.000001F2E182E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000002.3718575754.000001F2E182E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: lsass.exe, 00000006.00000000.1906270895.000001F2E182E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000002.3718575754.000001F2E182E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/wsdl/erties
Source: lsass.exe, 00000006.00000002.3718575754.000001F2E182E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/wsdl/soap12/
Source: lsass.exe, 00000006.00000000.1906270895.000001F2E182E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000002.3718575754.000001F2E182E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/wsdl/soap12/P
Source: lsass.exe, 00000006.00000002.3748011679.000001F2E2200000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000002.3739196122.000001F2E20C2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000003.3217007845.000001F2E20C2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000000.1908009573.000001F2E2200000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000000.1907351514.000001F2E20C2000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com/CPS0
Source: svchost.exe, 00000022.00000000.2026897865.000001EA50A23000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000022.00000002.3781446748.000001EA50A23000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000022.00000002.3781727466.000001EA50A49000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.msftconnecttest.com/
Source: svchost.exe, 00000022.00000002.3774288001.000001EA4FED8000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000022.00000000.2026006981.000001EA4FEF3000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000022.00000000.2025747991.000001EA4FED8000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000022.00000002.3776099400.000001EA4FEF3000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.msftconnecttest.com/connecttest.txt
Source: lsass.exe, 00000006.00000003.3217007845.000001F2E2094000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000002.3739196122.000001F2E2095000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000000.1907351514.000001F2E2095000.00000004.00000001.00020000.00000000.sdmp, dwm.exe, 0000000E.00000000.1930929743.000002736F820000.00000004.00000001.00020000.00000000.sdmp, dwm.exe, 0000000E.00000002.3787235451.000002736F820000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.quovadis.bm0
Source: svchost.exe, 00000007.00000002.3753664786.0000028186647000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000007.00000000.1913342661.0000028186647000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.onenote.net/livetile/?Language=
Source: dropper.exe, tempdll.dll.0.drString found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
Source: svchost.exe, 0000002A.00000000.2058607590.000001E74C423000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3778892876.000001E74C423000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://excel.office.comSRD1%
Source: svchost.exe, 00000025.00000002.2241407674.000001C82F42A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000025.00000000.2035347461.000001C82F42A000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/
Source: lsass.exe, 00000006.00000003.3217007845.000001F2E2094000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000002.3739196122.000001F2E2095000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000000.1907351514.000001F2E2095000.00000004.00000001.00020000.00000000.sdmp, dwm.exe, 0000000E.00000000.1930929743.000002736F820000.00000004.00000001.00020000.00000000.sdmp, dwm.exe, 0000000E.00000002.3787235451.000002736F820000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ocsp.quovadisoffshore.com0
Source: svchost.exe, 0000002A.00000000.2051366875.000001E74AE65000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://outlook.com
Source: svchost.exe, 0000002A.00000000.2052912145.000001E74B900000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.3114422886.000001E74B903000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002A.00000000.2058607590.000001E74C423000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.3114855996.000001E74B92D000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3749777532.000001E74B931000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3778892876.000001E74C423000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://outlook.comSRD1-
Source: svchost.exe, 0000002A.00000000.2051366875.000001E74AE65000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://outlook.comcom
Source: svchost.exe, 0000002A.00000000.2058607590.000001E74C423000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3778892876.000001E74C423000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://powerpoint.office.comSRD13
Source: svchost.exe, 00000007.00000000.1913080338.0000028186600000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3750551577.0000028186600000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://spclient.wg.spotify.com/v1/live-tile-xml?region=
Source: svchost.exe, 00000007.00000000.1915700291.0000028186CAF000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3769748764.0000028186CAF000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2524514466.0000028186CAF000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://windows.msn.cn/shellRESP
Source: svchost.exe, 00000007.00000000.1915700291.0000028186CAF000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3769748764.0000028186CAF000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2524514466.0000028186CAF000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://windows.msn.com/shell
Source: Microsoft-Windows-PushNotification-Platform%4Operational.evtx.23.drString found in binary or memory: https://wns2-ch1p.notify.windows.com/?token=AwYAAABRgjxu7x%2fdyWqbOoAAI8Gcd5ckhbCzw7F7Uxfu5MqaJ5M0DU
Source: Microsoft-Windows-PushNotification-Platform%4Operational.evtx.23.drString found in binary or memory: https://wns2-ch1p.notify.windows.com/?token=AwYAAACOo%2bDpegMJ4mimyuZb31GqC7oXjlMabDDVUR8qnW8cVhNR3Y
Source: svchost.exe, 0000002A.00000000.2057998047.000001E74C168000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://word.office.com
Source: svchost.exe, 0000002A.00000000.2057998047.000001E74C168000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://word.office.com.com
Source: svchost.exe, 0000002A.00000002.3725499698.000001E74AE77000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002A.00000000.2051421492.000001E74AE77000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002A.00000000.2058607590.000001E74C423000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002A.00000000.2054757075.000001E74BBEF000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3778892876.000001E74C423000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://word.office.comSRD1#
Source: svchost.exe, 0000002A.00000002.3757690094.000001E74BA23000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002A.00000000.2053698567.000001E74BA23000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.office.com/pwaimages
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF71C077DF0 memset,OutputDebugStringW,memset,OutputDebugStringW,memset,OutputDebugStringW,CreateToolhelp32Snapshot,memset,OutputDebugStringW,Module32FirstW,memset,memset,OutputDebugStringW,memset,OutputDebugStringW,OutputDebugStringW,memset,memset,OutputDebugStringW,OutputDebugStringW,memset,OutputDebugStringW,memset,memset,OutputDebugStringW,OutputDebugStringW,memset,OutputDebugStringW,memset,OutputDebugStringW,memset,OutputDebugStringW,memcmp,memcmp,memcmp,memset,memset,OutputDebugStringW,memset,memset,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,Module32NextW,memset,OutputDebugStringW,NtClose,memset,OutputDebugStringW,0_2_00007FF71C077DF0
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF71C07A6C0 memset,OutputDebugStringW,memset,OutputDebugStringW,memset,OutputDebugStringW,memset,OutputDebugStringW,memset,OutputDebugStringW,memset,OutputDebugStringW,memset,OutputDebugStringW,NtOpenFile,memset,memset,OutputDebugStringW,OutputDebugStringW,NtCreateSection,memset,memset,OutputDebugStringW,OutputDebugStringW,GetCurrentProcess,NtMapViewOfSection,NtClose,0_2_00007FF71C07A6C0
Source: C:\Windows\System32\cmd.exeCode function: 3_2_0000018B3C417490 NtReadFile,WaitForSingleObject,RtlNtStatusToDosError,3_2_0000018B3C417490
Source: C:\Windows\System32\cmd.exeCode function: 3_2_0000018B3C4120D0 NtReadFile,WaitForSingleObject,RtlNtStatusToDosError,3_2_0000018B3C4120D0
Source: C:\Windows\System32\cmd.exeCode function: 3_2_0000018B3C4175B0 NtWriteFile,WaitForSingleObject,RtlNtStatusToDosError,GetModuleHandleW,FormatMessageW,GetLastError,3_2_0000018B3C4175B0
Source: C:\Windows\System32\cmd.exeCode function: 3_2_00007FFBFD5D75B0 NtWriteFile,WaitForSingleObject,RtlNtStatusToDosError,GetModuleHandleW,FormatMessageW,GetLastError,3_2_00007FFBFD5D75B0
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF71C0713500_2_00007FF71C071350
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF71C0895400_2_00007FF71C089540
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF71C072DA00_2_00007FF71C072DA0
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF71C0721C00_2_00007FF71C0721C0
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF71C077DF00_2_00007FF71C077DF0
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF71C0754000_2_00007FF71C075400
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF71C074E400_2_00007FF71C074E40
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF71C0774800_2_00007FF71C077480
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF71C07A6C00_2_00007FF71C07A6C0
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF71C076AE00_2_00007FF71C076AE0
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF71C084D100_2_00007FF71C084D10
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF71C1C7CF00_2_00007FF71C1C7CF0
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF71C1A19500_2_00007FF71C1A1950
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF71C1A35200_2_00007FF71C1A3520
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF71C1A1F200_2_00007FF71C1A1F20
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF71C0847500_2_00007FF71C084750
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF71C1C75300_2_00007FF71C1C7530
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF71C1A2D800_2_00007FF71C1A2D80
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF71C1A0D700_2_00007FF71C1A0D70
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF71C1BE3D00_2_00007FF71C1BE3D0
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF71C1B87A00_2_00007FF71C1B87A0
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF71C1A30500_2_00007FF71C1A3050
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF71C1A04200_2_00007FF71C1A0420
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF71C1A22200_2_00007FF71C1A2220
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF71C1A26300_2_00007FF71C1A2630
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF71C1AFC300_2_00007FF71C1AFC30
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF71C1C26800_2_00007FF71C1C2680
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF71C1A32900_2_00007FF71C1A3290
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF71C1A1C600_2_00007FF71C1A1C60
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF71C084A900_2_00007FF71C084A90
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF71C1A38700_2_00007FF71C1A3870
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF71C1A12B00_2_00007FF71C1A12B0
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF71C0856F00_2_00007FF71C0856F0
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF71C1CDF100_2_00007FF71C1CDF10
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF71C1A2AF00_2_00007FF71C1A2AF0
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF71C1B16F00_2_00007FF71C1B16F0
Source: C:\Windows\System32\cmd.exeCode function: 3_2_0000018B3C40E2703_2_0000018B3C40E270
Source: C:\Windows\System32\cmd.exeCode function: 3_2_0000018B3C40CC703_2_0000018B3C40CC70
Source: C:\Windows\System32\cmd.exeCode function: 3_2_0000018B3C4062703_2_0000018B3C406270
Source: C:\Windows\System32\cmd.exeCode function: 3_2_0000018B3C3F4E403_2_0000018B3C3F4E40
Source: C:\Windows\System32\cmd.exeCode function: 3_2_0000018B3C419EA03_2_0000018B3C419EA0
Source: C:\Windows\System32\cmd.exeCode function: 3_2_0000018B3C400CA03_2_0000018B3C400CA0
Source: C:\Windows\System32\cmd.exeCode function: 3_2_0000018B3C40C6A03_2_0000018B3C40C6A0
Source: C:\Windows\System32\cmd.exeCode function: 3_2_0000018B3C3FCC303_2_0000018B3C3FCC30
Source: C:\Windows\System32\cmd.exeCode function: 3_2_0000018B3C401E303_2_0000018B3C401E30
Source: C:\Windows\System32\cmd.exeCode function: 3_2_0000018B3C4184403_2_0000018B3C418440
Source: C:\Windows\System32\cmd.exeCode function: 3_2_0000018B3C40D8403_2_0000018B3C40D840
Source: C:\Windows\System32\cmd.exeCode function: 3_2_0000018B3C405E403_2_0000018B3C405E40
Source: C:\Windows\System32\cmd.exeCode function: 3_2_0000018B3C3F74803_2_0000018B3C3F7480
Source: C:\Windows\System32\cmd.exeCode function: 3_2_0000018B3C3F6AE03_2_0000018B3C3F6AE0
Source: C:\Windows\System32\cmd.exeCode function: 3_2_0000018B3C425D003_2_0000018B3C425D00
Source: C:\Windows\System32\cmd.exeCode function: 3_2_0000018B3C429F103_2_0000018B3C429F10
Source: C:\Windows\System32\cmd.exeCode function: 3_2_0000018B3C4004B03_2_0000018B3C4004B0
Source: C:\Windows\System32\cmd.exeCode function: 3_2_0000018B3C40BAC03_2_0000018B3C40BAC0
Source: C:\Windows\System32\cmd.exeCode function: 3_2_0000018B3C403CC03_2_0000018B3C403CC0
Source: C:\Windows\System32\cmd.exeCode function: 3_2_0000018B3C40DAD03_2_0000018B3C40DAD0
Source: C:\Windows\System32\cmd.exeCode function: 3_2_0000018B3C3FE6D03_2_0000018B3C3FE6D0
Source: C:\Windows\System32\cmd.exeCode function: 3_2_0000018B3C4218D03_2_0000018B3C4218D0
Source: C:\Windows\System32\cmd.exeCode function: 3_2_0000018B3C40CF703_2_0000018B3C40CF70
Source: C:\Windows\System32\cmd.exeCode function: 3_2_0000018B3C40B1703_2_0000018B3C40B170
Source: C:\Windows\System32\cmd.exeCode function: 3_2_0000018B3C4287703_2_0000018B3C428770
Source: C:\Windows\System32\cmd.exeCode function: 3_2_0000018B3C40D3803_2_0000018B3C40D380
Source: C:\Windows\System32\cmd.exeCode function: 3_2_0000018B3C4243803_2_0000018B3C424380
Source: C:\Windows\System32\cmd.exeCode function: 3_2_0000018B3C420D803_2_0000018B3C420D80
Source: C:\Windows\System32\cmd.exeCode function: 3_2_0000018B3C3F13503_2_0000018B3C3F1350
Source: C:\Windows\System32\cmd.exeCode function: 3_2_0000018B3C40DDA03_2_0000018B3C40DDA0
Source: C:\Windows\System32\cmd.exeCode function: 3_2_0000018B3C4049A03_2_0000018B3C4049A0
Source: C:\Windows\System32\cmd.exeCode function: 3_2_0000018B3C3F2DA03_2_0000018B3C3F2DA0
Source: C:\Windows\System32\cmd.exeCode function: 3_2_0000018B3C3FF9403_2_0000018B3C3FF940
Source: C:\Windows\System32\cmd.exeCode function: 3_2_0000018B3C3FA5E03_2_0000018B3C3FA5E0
Source: C:\Windows\System32\cmd.exeCode function: 3_2_0000018B3C40C0003_2_0000018B3C40C000
Source: C:\Windows\System32\cmd.exeCode function: 3_2_0000018B3C3F21C03_2_0000018B3C3F21C0
Source: C:\Windows\System32\cmd.exeCode function: 3_2_0000018B3C405A203_2_0000018B3C405A20
Source: C:\Windows\System32\cmd.exeCode function: 3_2_0000018B3C400A203_2_0000018B3C400A20
Source: C:\Windows\System32\cmd.exeCode function: 3_2_0000018B3C4175B03_2_0000018B3C4175B0
Source: C:\Windows\System32\cmd.exeCode function: 3_2_0000018B3C40C9B03_2_0000018B3C40C9B0
Source: C:\Windows\System32\cmd.exeCode function: 3_2_0000018B3C4029B03_2_0000018B3C4029B0
Source: C:\Windows\System32\cmd.exeCode function: 3_2_0000018B3C40E5C03_2_0000018B3C40E5C0
Source: C:\Windows\System32\cmd.exeCode function: 3_2_0000018B3C4007D03_2_0000018B3C4007D0
Source: C:\Windows\System32\cmd.exeCode function: 3_2_0000018B3C3F54003_2_0000018B3C3F5400
Source: C:\Windows\System32\cmd.exeCode function: 3_2_0000018B3C40DFE03_2_0000018B3C40DFE0
Source: C:\Windows\System32\cmd.exeCode function: 3_2_0000018B3C4277E03_2_0000018B3C4277E0
Source: C:\Windows\System32\cmd.exeCode function: 3_2_0000018B3C427FE03_2_0000018B3C427FE0
Source: C:\Windows\System32\cmd.exeCode function: 3_2_0000018B3C3F7DF03_2_0000018B3C3F7DF0
Source: C:\Windows\System32\cmd.exeCode function: 3_2_00007FFBFD5B54003_2_00007FFBFD5B5400
Source: C:\Windows\System32\cmd.exeCode function: 3_2_00007FFBFD5B21C03_2_00007FFBFD5B21C0
Source: C:\Windows\System32\cmd.exeCode function: 3_2_00007FFBFD5C29B03_2_00007FFBFD5C29B0
Source: C:\Windows\System32\cmd.exeCode function: 3_2_00007FFBFD5B74803_2_00007FFBFD5B7480
Source: C:\Windows\System32\cmd.exeCode function: 3_2_00007FFBFD5B4E403_2_00007FFBFD5B4E40
Source: C:\Windows\System32\cmd.exeCode function: 3_2_00007FFBFD5C1E303_2_00007FFBFD5C1E30
Source: C:\Windows\System32\cmd.exeCode function: 3_2_00007FFBFD5C0CA03_2_00007FFBFD5C0CA0
Source: C:\Windows\System32\cmd.exeCode function: 3_2_00007FFBFD5B13503_2_00007FFBFD5B1350
Source: C:\Windows\System32\cmd.exeCode function: 3_2_00007FFBFD5CC0003_2_00007FFBFD5CC000
Source: C:\Windows\System32\cmd.exeCode function: 3_2_00007FFBFD5E77E03_2_00007FFBFD5E77E0
Source: C:\Windows\System32\cmd.exeCode function: 3_2_00007FFBFD5CDFE03_2_00007FFBFD5CDFE0
Source: C:\Windows\System32\cmd.exeCode function: 3_2_00007FFBFD5CE5C03_2_00007FFBFD5CE5C0
Source: C:\Windows\System32\cmd.exeCode function: 3_2_00007FFBFD5CDDA03_2_00007FFBFD5CDDA0
Source: C:\Windows\System32\cmd.exeCode function: 3_2_00007FFBFD5D75B03_2_00007FFBFD5D75B0
Source: C:\Windows\System32\cmd.exeCode function: 3_2_00007FFBFD5CC9B03_2_00007FFBFD5CC9B0
Source: C:\Windows\System32\cmd.exeCode function: 3_2_00007FFBFD5CCC703_2_00007FFBFD5CCC70
Source: C:\Windows\System32\cmd.exeCode function: 3_2_00007FFBFD5CE2703_2_00007FFBFD5CE270
Source: C:\Windows\System32\cmd.exeCode function: 3_2_00007FFBFD5C62703_2_00007FFBFD5C6270
Source: C:\Windows\System32\cmd.exeCode function: 3_2_00007FFBFD5D84403_2_00007FFBFD5D8440
Source: C:\Windows\System32\cmd.exeCode function: 3_2_00007FFBFD5CD8403_2_00007FFBFD5CD840
Source: C:\Windows\System32\cmd.exeCode function: 3_2_00007FFBFD5C5E403_2_00007FFBFD5C5E40
Source: C:\Windows\System32\cmd.exeCode function: 3_2_00007FFBFD5C5A203_2_00007FFBFD5C5A20
Source: C:\Windows\System32\cmd.exeCode function: 3_2_00007FFBFD5E5D003_2_00007FFBFD5E5D00
Source: C:\Windows\System32\cmd.exeCode function: 3_2_00007FFBFD5E9F103_2_00007FFBFD5E9F10
Source: C:\Windows\System32\cmd.exeCode function: 3_2_00007FFBFD5CBAC03_2_00007FFBFD5CBAC0
Source: C:\Windows\System32\cmd.exeCode function: 3_2_00007FFBFD5E18D03_2_00007FFBFD5E18D0
Source: C:\Windows\System32\cmd.exeCode function: 3_2_00007FFBFD5CDAD03_2_00007FFBFD5CDAD0
Source: C:\Windows\System32\cmd.exeCode function: 3_2_00007FFBFD5D9EA03_2_00007FFBFD5D9EA0
Source: C:\Windows\System32\cmd.exeCode function: 3_2_00007FFBFD5CC6A03_2_00007FFBFD5CC6A0
Source: C:\Windows\System32\cmd.exeCode function: 3_2_00007FFBFD5C04B03_2_00007FFBFD5C04B0
Source: C:\Windows\System32\cmd.exeCode function: 3_2_00007FFBFD5E43803_2_00007FFBFD5E4380
Source: C:\Windows\System32\cmd.exeCode function: 3_2_00007FFBFD5E0D803_2_00007FFBFD5E0D80
Source: C:\Windows\System32\cmd.exeCode function: 3_2_00007FFBFD5CD3803_2_00007FFBFD5CD380
Source: C:\Windows\System32\cmd.exeCode function: 3_2_00007FFBFD5CCF703_2_00007FFBFD5CCF70
Source: C:\Windows\System32\cmd.exeCode function: 3_2_00007FFBFD5CB1703_2_00007FFBFD5CB170
Source: C:\Users\user\Desktop\dropper.exeProcess token adjusted: Load DriverJump to behavior
Source: C:\Users\user\Desktop\dropper.exeProcess token adjusted: SecurityJump to behavior
Source: System.evtx.23.drBinary string: \Device\HarddiskVolume4\Windows\SysWOW64\tzutil.exe
Source: Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx.23.drBinary string: 1\Device\HarddiskVolume4\Windows\SysWOW64\curl.exe?\Device\HarddiskVolume4\Program Files (x86)\AutoIt3\AutoIt3.exeD
Source: Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx.23.drBinary string: 1\Device\HarddiskVolume4\Windows\SysWOW64\curl.exe?\Device\HarddiskVolume4\Program Files (x86)\AutoIt3\AutoIt3.exed
Source: System.evtx.23.drBinary string: C:\Device\HarddiskVolume4K
Source: Microsoft-Windows-SMBServer%4Operational.evtx.23.drBinary string: \Device\NetbiosSmb
Source: System.evtx.23.drBinary string: \\?\Volume{cb7fdaf7-d8ae-4a24-98ab-ca007942ac33}\Device\HarddiskVolume1m
Source: Microsoft-Windows-SMBServer%4Operational.evtx.23.drBinary string: computer WORKGROUP:\Device\NetBT_Tcpip_{68C65ED0-D5FC-471F-BF0F-95C04D2E3B08}
Source: System.evtx.23.drBinary string: \Device\HarddiskVolume4\Program Files (x86)\AutoIt3\AutoIt3.exe
Source: Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx.23.drBinary string: 1\Device\HarddiskVolume4\Windows\SysWOW64\curl.exe?\Device\HarddiskVolume4\Program Files (x86)\AutoIt3\AutoIt3.exe
Source: Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.23.drBinary string: \\?\Volume{cb7fdaf7-d8ae-4a24-98ab-ca007942ac33}\Device\HarddiskVolume1an
Source: Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx.23.drBinary string: 1\Device\HarddiskVolume4\Windows\System32\curl.exe?\Device\HarddiskVolume4\Program Files (x86)\AutoIt3\AutoIt3.exe
Source: Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx.23.drBinary string: 1\Device\HarddiskVolume4\Windows\System32\curl.exe?\Device\HarddiskVolume4\Program Files (x86)\AutoIt3\AutoIt3.exeo
Source: Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.23.drBinary string: C:\Device\HarddiskVolume4
Source: Microsoft-Windows-CodeIntegrity%4Operational.evtx.23.drBinary string: J\Device\HarddiskVolume4\Program Files (x86)\Joebox\driver\joeboxdriver.sys
Source: System.evtx.23.drBinary string: \\?\Volume{cb7fdaf7-d8ae-4a24-98ab-ca007942ac33}\Device\HarddiskVolume1iceV
Source: Security.evtx.23.drBinary string: \Device\HarddiskVolume4\Program Files (x86)\Joebox\driver\joeboxdriver.sys
Source: Security.evtx.23.drBinary string: \Device\HarddiskVolume4\Windows\System32\drivers\filetrace.syscom
Source: System.evtx.23.drBinary string: .\Device\HarddiskVolume2\EFI\Microsoft\Boot\BCD~
Source: Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx.23.drBinary string: 1\Device\HarddiskVolume4\Windows\SysWOW64\curl.exe?\Device\HarddiskVolume4\Program Files (x86)\AutoIt3\AutoIt3.exeo
Source: Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx.23.drBinary string: 1\Device\HarddiskVolume4\Windows\SysWOW64\curl.exe?\Device\HarddiskVolume4\Program Files (x86)\AutoIt3\AutoIt3.exeT_AH**
Source: Microsoft-Windows-CodeIntegrity%4Operational.evtx.23.drBinary string: >\Device\HarddiskVolume4\Windows\System32\drivers\filetrace.sys
Source: Microsoft-Windows-SmbClient%4Connectivity.evtx.23.drBinary string: :\Device\NetBT_Tcpip_{68C65ED0-D5FC-471F-BF0F-95C04D2E3B08}
Source: classification engineClassification label: mal84.evad.winEXE@7/60@0/1
Source: C:\Windows\System32\cmd.exeCode function: 3_2_0000018B3C4175B0 NtWriteFile,WaitForSingleObject,RtlNtStatusToDosError,GetModuleHandleW,FormatMessageW,GetLastError,3_2_0000018B3C4175B0
Source: C:\Windows\System32\cmd.exeCode function: 3_2_0000018B3C400CA0 OutputDebugStringW,LsaOpenPolicy,GetCurrentProcess,OpenProcessToken,GetTokenInformation,LsaAddAccountRights,LsaClose,LsaClose,LsaClose,memset,OutputDebugStringW,memset,OutputDebugStringW,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,memset,OutputDebugStringW,memset,memset,OutputDebugStringW,OutputDebugStringW,3_2_0000018B3C400CA0
Source: C:\Windows\System32\cmd.exeCode function: 3_2_00007FFBFD5C0CA0 OutputDebugStringW,LsaOpenPolicy,GetCurrentProcess,OpenProcessToken,GetTokenInformation,LsaAddAccountRights,LsaClose,LsaClose,LsaClose,memset,OutputDebugStringW,memset,OutputDebugStringW,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,memset,OutputDebugStringW,memset,memset,OutputDebugStringW,OutputDebugStringW,3_2_00007FFBFD5C0CA0
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF71C077DF0 memset,OutputDebugStringW,memset,OutputDebugStringW,memset,OutputDebugStringW,CreateToolhelp32Snapshot,memset,OutputDebugStringW,Module32FirstW,memset,memset,OutputDebugStringW,memset,OutputDebugStringW,OutputDebugStringW,memset,memset,OutputDebugStringW,OutputDebugStringW,memset,OutputDebugStringW,memset,memset,OutputDebugStringW,OutputDebugStringW,memset,OutputDebugStringW,memset,OutputDebugStringW,memset,OutputDebugStringW,memcmp,memcmp,memcmp,memset,memset,OutputDebugStringW,memset,memset,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,Module32NextW,memset,OutputDebugStringW,NtClose,memset,OutputDebugStringW,0_2_00007FF71C077DF0
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8428:304:WilStaging_02
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:8800:304:WilStaging_02
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8576:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:8800:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8576:304:WilStaging_02
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8428:120:WilError_03
Source: C:\Users\user\Desktop\dropper.exeFile created: C:\Windows\Temp\tempdll.dllJump to behavior
Source: dropper.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\dropper.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: C:\Windows\System32\svchost.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Windows\System32\svchost.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: dropper.exeVirustotal: Detection: 12%
Source: unknownProcess created: C:\Users\user\Desktop\dropper.exe "C:\Users\user\Desktop\dropper.exe"
Source: C:\Users\user\Desktop\dropper.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\dropper.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\lsass.exeProcess created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\dropper.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe"Jump to behavior
Source: C:\Users\user\Desktop\dropper.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\Desktop\dropper.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Users\user\Desktop\dropper.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\Desktop\dropper.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\cmd.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Windows\System32\cmd.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\cmd.exeSection loaded: edgegdi.dllJump to behavior
Source: C:\Windows\System32\cmd.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Windows\System32\cmd.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: mpclient.dllJump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: secur32.dllJump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: edgegdi.dllJump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: version.dllJump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: userenv.dllJump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: gpapi.dllJump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: wbemcomn.dllJump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: amsi.dllJump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: profapi.dllJump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: wscapi.dllJump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: netutils.dllJump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: slc.dllJump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: sppc.dllJump to behavior
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: dropper.exeStatic PE information: Virtual size of .text is bigger than: 0x100000
Source: dropper.exeStatic PE information: Image base 0x140000000 > 0x60000000
Source: dropper.exeStatic file information: File size 3219456 > 1048576
Source: dropper.exeStatic PE information: Raw size of .text is bigger than: 0x100000 < 0x15e000
Source: dropper.exeStatic PE information: Raw size of .rdata is bigger than: 0x100000 < 0x1a7400
Source: dropper.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: dropper.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\winload_prod.pdbTCDE.@ source: svchost.exe, 00000016.00000000.1980287685.000001FE41048000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3721582776.000001FE41048000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\winload_prod.pdb source: svchost.exe, 00000016.00000000.1980287685.000001FE41048000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3721582776.000001FE41048000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: dropper.pdb source: dropper.exe
Source: Binary string: rnlmp.pdbxC4 source: svchost.exe, 00000016.00000002.3723062033.000001FE41057000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000000.1980368839.000001FE41057000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: WINLOA~1.PDBwinload_prod.pdb source: svchost.exe, 00000016.00000002.3723062033.000001FE41057000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000000.1980368839.000001FE41057000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: *@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\47114209A62F3B9930F6B8998DFD4A991\ntkrnlmp.pdb source: svchost.exe, 00000016.00000000.1980206855.000001FE4102A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3719951023.000001FE4102A000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: dll.pdb source: dropper.exe, 00000000.00000003.1855774737.00000236C9808000.00000004.00000020.00020000.00000000.sdmp, dropper.exe, 00000000.00000002.1857886263.00000236C9857000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000003.00000002.3723910614.0000018B3C42B000.00000002.00000001.01000000.00000005.sdmp, cmd.exe, 00000003.00000002.3713846370.0000018B3A167000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 00000003.00000002.3731019737.00007FFBFD5EB000.00000002.00000001.01000000.00000005.sdmp, tempdll.dll.0.dr
Source: Binary string: ntkrnlmp.pdb source: svchost.exe, 00000016.00000002.3723062033.000001FE41057000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000000.1980368839.000001FE41057000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062.pdb source: svchost.exe, 00000016.00000000.1980287685.000001FE41048000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3721582776.000001FE41048000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\47114209A62F3B9930F6B8998DFD4A991 source: svchost.exe, 00000016.00000000.1980287685.000001FE41048000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3721582776.000001FE41048000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\download.error source: svchost.exe, 00000016.00000000.1980287685.000001FE41048000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3721582776.000001FE41048000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: .@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb source: svchost.exe, 00000016.00000002.3723062033.000001FE41057000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000000.1980368839.000001FE41057000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: *@\??\C:\Users\user\AppData\Local\Temp\symsrv.dllp.pdb source: svchost.exe, 00000016.00000000.1980482592.000001FE4106C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3725498971.000001FE4106C000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: *@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb source: svchost.exe, 00000016.00000002.3723062033.000001FE41057000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000000.1980368839.000001FE41057000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\download.errorj source: svchost.exe, 00000016.00000000.1980287685.000001FE41048000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3721582776.000001FE41048000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: dll.pdb' source: dropper.exe, 00000000.00000003.1855774737.00000236C9808000.00000004.00000020.00020000.00000000.sdmp, dropper.exe, 00000000.00000002.1857886263.00000236C9857000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000003.00000002.3723910614.0000018B3C42B000.00000002.00000001.01000000.00000005.sdmp, cmd.exe, 00000003.00000002.3713846370.0000018B3A167000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 00000003.00000002.3731019737.00007FFBFD5EB000.00000002.00000001.01000000.00000005.sdmp, tempdll.dll.0.dr
Source: Binary string: ,@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: svchost.exe, 00000016.00000002.3723062033.000001FE41057000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000000.1980368839.000001FE41057000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\47114209A62F3B9930F6B8998DFD4A991\ntkrnlmp.pdb source: svchost.exe, 00000016.00000000.1980206855.000001FE4102A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3719951023.000001FE4102A000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\47114209A62F3B9930F6B8998DFD4A991\download.error source: svchost.exe, 00000016.00000000.1980206855.000001FE4102A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3719951023.000001FE4102A000.00000004.00000001.00020000.00000000.sdmp
Source: C:\Users\user\Desktop\dropper.exeFile created: C:\Windows\Temp\tempdll.dllJump to dropped file
Source: C:\Users\user\Desktop\dropper.exeFile created: C:\Windows\Temp\tempdll.dllJump to dropped file
Source: C:\Windows\System32\cmd.exeRegistry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinDefendJump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Program Files\Windows Defender\MpCmdRun.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

Malware Analysis System Evasion

barindex
Tries to delay execution (extensive OutputDebugStringW loop)
Source: C:\Users\user\Desktop\dropper.exeSection loaded: OutputDebugStringW count: 1228
Source: C:\Windows\System32\cmd.exeSection loaded: OutputDebugStringW count: 1973
Source: C:\Users\user\Desktop\dropper.exeDropped PE file which has not been started: C:\Windows\Temp\tempdll.dllJump to dropped file
Source: C:\Windows\System32\cmd.exeCheck user administrative privileges: GetTokenInformation,DecisionNodesgraph_3-11435
Source: C:\Windows\System32\svchost.exe TID: 2444Thread sleep time: -30000s >= -30000sJump to behavior
Source: C:\Windows\System32\svchost.exeFile opened: PhysicalDrive0Jump to behavior
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\cmd.exeCode function: 3_2_0000018B3C417090 OutputDebugStringW,CloseHandle,memset,FindFirstFileW,FindClose,3_2_0000018B3C417090
Source: lsass.exe, 00000006.00000002.3723138243.000001F2E18A6000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: pvmicshutdownNT SERVICE
Source: svchost.exe, 00000017.00000002.3721796406.00000174A5442000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000017.00000000.1984815923.00000174A5442000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: @Microsoft-Windows-Hyper-V-Hypervisor
Source: lsass.exe, 00000006.00000002.3723138243.000001F2E18A6000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: pvmicvssNT SERVICE
Source: svchost.exe, 00000007.00000002.3755225460.000002818667E000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: vmicshutdown
Source: svchost.exe, 0000000C.00000000.1922864973.0000022F57C2A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.3772917471.0000022F57C2A000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWp
Source: svchost.exe, 00000007.00000000.1912424622.0000028185C35000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: $@vmicheartbeat
Source: svchost.exe, 00000007.00000000.1912424622.0000028185C35000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: vmicvss
Source: svchost.exe, 0000000C.00000000.1922864973.0000022F57C2A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.3772917471.0000022F57C2A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000022.00000002.3771718250.000001EA4FE6A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000022.00000002.3771358684.000001EA4FE2B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000022.00000000.2025380455.000001EA4FE6A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000022.00000002.3773189917.000001EA4FEA2000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000022.00000000.2025317936.000001EA4FE2B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002B.00000002.3722940511.000002ED9A05E000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002B.00000000.2061981874.000002ED9A05E000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
Source: svchost.exe, 00000020.00000000.2019711355.000001F362600000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcUmRdpServiceDsSvcfhsvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionsvsvcStorSvcWwanSvcvmicvssDevQueryBrokerNgcSvcsysmainNetmanTabletInputServicePcaSvcDisplayEnhancementServiceIPxlatCfgSvcDeviceAssociationServiceNcbServiceEmbeddedModeSensorServicewlansvcCscServiceWPDBusEnumMixedRealityOpenXRSvc
Source: lsass.exe, 00000006.00000002.3723138243.000001F2E18A6000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: pvmicheartbeatNT SERVICE
Source: svchost.exe, 00000007.00000000.1912424622.0000028185C35000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: @vmicshutdown
Source: lsass.exe, 00000006.00000002.3717662966.000001F2E1813000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000000.1906220696.000001F2E1813000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.3715759126.0000023634813000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000000.1926273911.0000023634813000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.3717941517.000001EA7E22B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000010.00000000.1963378516.000001EA7E22B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.3717173017.0000027621429000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000000.1964854274.0000027621429000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000013.00000000.1970766916.00000147A345A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.3723906951.00000147A345A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000017.00000002.3721796406.00000174A5442000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: svchost.exe, 00000007.00000002.3755225460.000002818667E000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: vmicheartbeat
Source: svchost.exe, 00000007.00000000.1912424622.0000028185C35000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: @vmicheartbeat
Source: C:\Windows\System32\cmd.exeProcess information queried: ProcessInformationJump to behavior
Source: C:\Windows\System32\svchost.exeProcess queried: DebugPortJump to behavior
Source: C:\Windows\System32\svchost.exeProcess queried: DebugPortJump to behavior
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF71C1C6E94 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF71C1C6E94
Source: C:\Windows\System32\cmd.exeCode function: 3_2_0000018B3C400CA0 OutputDebugStringW,LsaOpenPolicy,GetCurrentProcess,OpenProcessToken,GetTokenInformation,LsaAddAccountRights,LsaClose,LsaClose,LsaClose,memset,OutputDebugStringW,memset,OutputDebugStringW,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,memset,OutputDebugStringW,memset,memset,OutputDebugStringW,OutputDebugStringW,3_2_0000018B3C400CA0
Source: C:\Users\user\Desktop\dropper.exeProcess token adjusted: DebugJump to behavior
Source: C:\Windows\System32\cmd.exeProcess token adjusted: DebugJump to behavior
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF71C1C6E94 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF71C1C6E94
Source: C:\Windows\System32\cmd.exeCode function: 3_2_0000018B3C42726C IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,3_2_0000018B3C42726C
Source: C:\Windows\System32\cmd.exeCode function: 3_2_00007FFBFD5E726C IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,3_2_00007FFBFD5E726C
Source: C:\Users\user\Desktop\dropper.exeMemory allocated: page read and write | page guardJump to behavior

HIPS / PFW / Operating System Protection Evasion

barindex
Allocates memory in foreign processes
Source: C:\Users\user\Desktop\dropper.exeMemory allocated: C:\Windows\System32\cmd.exe base: 18B3A020000 protect: page read and writeJump to behavior
Creates a thread in another existing process (thread injection)
Source: C:\Users\user\Desktop\dropper.exeThread created: C:\Windows\System32\cmd.exe EIP: 191604F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 191604F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 191604F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 191604F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 191604F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 191604F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 191604F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 191604F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 191604F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 191604F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 191604F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 191604F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 191604F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 191604F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 191604F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 191604F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 191604F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 191604F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 191604F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 191604F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 191604F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 191604F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 191604F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 191604F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 191604F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 191604F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 191604F0Jump to behavior
Disables Windows Defender (deletes autostart)
Source: C:\Windows\System32\cmd.exeRegistry value deleted: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender DisableAntiSpywareJump to behavior
Found direct / indirect Syscall (likely to bypass EDR)
Source: C:\Users\user\Desktop\dropper.exeNtUnmapViewOfSection: Direct from: 0x7FF71C07F895Jump to behavior
Source: C:\Users\user\Desktop\dropper.exeNtWriteVirtualMemory: Direct from: 0x7FF71C07D1CAJump to behavior
Source: C:\Users\user\Desktop\dropper.exeNtAllocateVirtualMemory: Direct from: 0x7FF71C07D186Jump to behavior
Source: C:\Users\user\Desktop\dropper.exeNtUnmapViewOfSection: Direct from: 0x7FF71C079E44Jump to behavior
Source: C:\Users\user\Desktop\dropper.exeNtClose: Direct from: 0x7FF71C079F34
Source: C:\Users\user\Desktop\dropper.exeNtProtectVirtualMemory: Direct from: 0x7FFC1A122651Jump to behavior
Source: C:\Users\user\Desktop\dropper.exeNtCreateFile: Direct from: 0x7FF71C1AE4B5Jump to behavior
Source: C:\Users\user\Desktop\dropper.exeNtAllocateVirtualMemory: Direct from: 0x7FF71C07F744Jump to behavior
Source: C:\Users\user\Desktop\dropper.exeNtClose: Direct from: 0x7FF71C1A86C5
Source: C:\Users\user\Desktop\dropper.exeNtSetInformationThread: Direct from: 0x7FF71C1C6A77Jump to behavior
Source: C:\Users\user\Desktop\dropper.exeNtQueryInformationProcess: Direct from: 0x7FF71C07F72FJump to behavior
Source: C:\Users\user\Desktop\dropper.exeNtProtectVirtualMemory: Direct from: 0x7FF71C07DD04Jump to behavior
Source: C:\Users\user\Desktop\dropper.exeNtWriteFile: Direct from: 0x7FF71C1AE647Jump to behavior
Source: C:\Users\user\Desktop\dropper.exeNtClose: Direct from: 0x7FF71C07C0A3
Source: C:\Users\user\Desktop\dropper.exeNtCreateThreadEx: Direct from: 0x7FF71C07D41AJump to behavior
Source: C:\Users\user\Desktop\dropper.exeNtMapViewOfSection: Direct from: 0x7FF71C07FC02Jump to behavior
Source: C:\Users\user\Desktop\dropper.exeNtAllocateVirtualMemory: Direct from: 0x7FF71C083E39Jump to behavior
Injects code into the Windows Explorer (explorer.exe)
Source: C:\Windows\System32\cmd.exeMemory written: PID: 5000 base: 2D90000 value: 43Jump to behavior
Writes to foreign memory regions
Source: C:\Users\user\Desktop\dropper.exeMemory written: C:\Windows\System32\cmd.exe base: 18B3A020000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\winlogon.exe base: 217D54C0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\lsass.exe base: 1F2E1F10000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 28186B40000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\fontdrvhost.exe base: 2664CA80000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\fontdrvhost.exe base: 13D7E420000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 22F57BF0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 23634780000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\dwm.exe base: 27375B10000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 1F9BDA90000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 1EA7E1E0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 276213D0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 17CF7270000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 147A41E0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_3ea756ac68d34d21\IntelCpHDCPSvc.exe base: 15E1D4E0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 2BCBDFE0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 1FE41EF0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 174A53F0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 2A5DC270000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\DriverStore\FileRepository\cui_dch.inf_amd64_2e49f48165b8de10\igfxCUIService.exe base: 16695DE0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_3ea756ac68d34d21\IntelCpHeciSvc.exe base: 1DA59730000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 218305B0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 18FDB8C0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 24A877A0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 1F1365E0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 1B0005F0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 1F363390000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 1F716BC0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 1EA50670000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 25D4D760000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 29DAC1E0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 1C82FD20000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 2428F430000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 1E5211A0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 261E89D0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 14EC7EA0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 1E74B710000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 2ED99FF0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 2633A390000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\spoolsv.exe base: 600000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 1793BD30000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 1B89A750000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 2C20FEF0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 1DD2AFC0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 2767ECF0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 2A88ACA0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 1C659020000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 276A72E0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 19A21740000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\DriverStore\FileRepository\igcc_dch.inf_amd64_78ff17a5ea060c5f\OneApp.IGCC.WinService.exe base: 2BE79EF0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 1EBECEE0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 201793A0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\DriverStore\FileRepository\dal.inf_amd64_ffc75848a6342fdf\jhi_service.exe base: 1DE56380000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 1CD5C3B0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 24C0F740000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 26CF5F30000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\sihost.exe base: 18DC9C20000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 1E73DC50000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe base: 1730000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 1F5D6DE0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 1D21E4E0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 220F8E20000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 2C49DD90000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\ctfmon.exe base: 1D5CADF0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\explorer.exe base: 2D90000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\DriverStore\FileRepository\cui_dch.inf_amd64_2e49f48165b8de10\igfxEM.exe base: 1AC38D60000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 237ABA50000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: 1FBA9F50000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 2BD913F0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: 13685FD0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 1FE60EE0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 1D227BC0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 1D599050000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe base: 1472FBA0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\SettingSyncHost.exe base: 16547A50000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: 1DF631D0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 1EF1DBD0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\audiodg.exe base: 1EDF6860000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\dllhost.exe base: 177B1280000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 1F9D0970000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\smartscreen.exe base: 18664C90000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe base: 600000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 2C7370C0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 1E79B880000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: 1F9A3570000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\ApplicationFrameHost.exe base: 1EE56C40000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\oobe\UserOOBEBroker.exe base: 2685ABB0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 24AD9080000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 231C3350000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 1B0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\conhost.exe base: 17246820000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\dllhost.exe base: 18A4F660000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 1A5CC100000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 242AC3F0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 1ED267F0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: FE0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: 5B0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: C20000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: 1070000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: 590000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: F50000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: 7D0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: ED0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: 500000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: DB0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: 970000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: BB0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: 3B0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: 7F0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: DF0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: 1B0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: 500000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: 1A0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: EF0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: 980000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: 1330000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: 690000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: 1410000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: A00000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: 11B0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: 930000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: 370000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: 780000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: 830000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: 550000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: 13F0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: 12E0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: D50000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: 590000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: 1330000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: 780000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: 500000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: 10E0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: 370000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: D50000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: BB0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: AD0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: D00000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: 610000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: 1330000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: F10000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: 560000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: 710000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: 970000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: E60000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: 740000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: 1350000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: F80000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: C00000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: E40000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: 1300000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: E70000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: A30000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: 5D0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: B20000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: 600000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: D60000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: D40000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: 1080000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: B10000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: 740000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: 1390000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: E00000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: 1400000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: 1140000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: 7A0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: F10000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: 15C0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: 15A0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: DA0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: DA0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: 700000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: A30000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: 770000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: FC0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: 7C0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: 710000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: B60000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: 1040000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: 1200000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: DD0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\xlhcdIWgLWGwuhJsFxDzcSHbAunxGDVrKhKIRJvwcGhPiH\dZnuwWDiBQtInGlCOSs.exe base: 3C0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 194B1A60000Jump to behavior
Source: C:\Windows\System32\lsass.exeMemory written: C:\Program Files\Windows Defender\MpCmdRun.exe base: 2819CD40000Jump to behavior
Source: C:\Windows\System32\lsass.exeMemory written: C:\Windows\System32\svchost.exe base: 22F57B70000Jump to behavior
Source: winlogon.exe, 00000005.00000002.3741583459.00000217D60B0000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000005.00000000.1903787911.00000217D60B0000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 0000000E.00000002.3779215296.000002736D770000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Shell_TrayWnd
Source: winlogon.exe, 00000005.00000002.3741583459.00000217D60B0000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000005.00000000.1903787911.00000217D60B0000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 0000000E.00000002.3779215296.000002736D770000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: NProgram Manager
Source: winlogon.exe, 00000005.00000002.3741583459.00000217D60B0000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000005.00000000.1903787911.00000217D60B0000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 0000000E.00000002.3779215296.000002736D770000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
Source: dwm.exe, 0000000E.00000000.1945726898.0000027375289000.00000004.00000001.00020000.00000000.sdmp, dwm.exe, 0000000E.00000002.3818930873.0000027375289000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Program Managerx
Source: winlogon.exe, 00000005.00000002.3741583459.00000217D60B0000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000005.00000000.1903787911.00000217D60B0000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 0000000E.00000002.3779215296.000002736D770000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF71C1C6D6C GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,0_2_00007FF71C1C6D6C

Lowering of HIPS / PFW / Operating System Security Settings

barindex
Changes security center settings (notifications, updates, antivirus, firewall)
Source: C:\Windows\System32\cmd.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center FirewallOverrideJump to behavior
Disable Windows Defender real time protection (registry)
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows DefenderRegistry value created: DisableAntiSpyware 1Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows DefenderRegistry value created: DisableAntiVirus 1Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngineRegistry value created: MpEnablePus 1Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time ProtectionRegistry value created: DisableBehaviorMonitoring 1Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time ProtectionRegistry value created: DisableIOAVProtection 1Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time ProtectionRegistry value created: DisableOnAccessProtection 1Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time ProtectionRegistry value created: DisableRealtimeMonitoring 1Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time ProtectionRegistry value created: DisableScanOnRealtimeEnable 1Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\ReportingRegistry value created: DisableEnhancedNotifications 1Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNetRegistry value created: DisableBlockAtFirstSeen 1Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNetRegistry value created: SpynetReporting 1Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNetRegistry value created: SubmitSamplesConsent 1Jump to behavior
Source: Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.23.drBinary or memory string: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2108.7-0\MsMpEng.exe
Source: MpCmdRun.exe, 00000009.00000003.1922664711.000002819C54A000.00000004.00000001.00020000.00000000.sdmp, MpCmdRun.exe, 00000009.00000003.1921725510.000002819C552000.00000004.00000001.00020000.00000000.sdmp, MpCmdRun.exe, 00000009.00000002.1924123066.000002819C54A000.00000004.00000001.00020000.00000000.sdmp, MpCmdRun.exe, 00000009.00000003.1922229934.000002819C552000.00000004.00000001.00020000.00000000.sdmp, MpCmdRun.exe, 00000009.00000003.1921379425.000002819C54A000.00000004.00000001.00020000.00000000.sdmp, MpCmdRun.exe, 00000009.00000002.1924123066.000002819C552000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: C:\Program Files\Windows Defender\MpCmdRun.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Program Files\Windows Defender\MpCmdRun.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts1
Windows Management Instrumentation		1
Windows Service		1
Access Token Manipulation		1
Masquerading		OS Credential Dumping1
System Time Discovery		Remote Services1
Archive Collected Data		2
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault Accounts1
Native API		1
LSASS Driver		1
Windows Service		13
Virtualization/Sandbox Evasion		LSASS Memory61
Security Software Discovery		Remote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAt1
DLL Side-Loading		42
Process Injection		31
Disable or Modify Tools		Security Account Manager13
Virtualization/Sandbox Evasion		SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook1
Abuse Elevation Control Mechanism		1
Access Token Manipulation		NTDS3
Process Discovery		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script1
LSASS Driver		42
Process Injection		LSA Secrets1
Remote System Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts1
DLL Side-Loading		1
Abuse Elevation Control Mechanism		Cached Domain Credentials1
File and Directory Discovery		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup Items1
Bypass User Account Control		1
DLL Side-Loading		DCSync22
System Information Discovery		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
Bypass User Account Control		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1582958 Sample: dropper.exe Startdate: 01/01/2025 Architecture: WINDOWS Score: 84 36 Multi AV Scanner detection for submitted file 2->36 9 dropper.exe 2 2->9         started        process3 file4 32 C:\Windows\Temp\tempdll.dll, PE32+ 9->32 dropped 40 Writes to foreign memory regions 9->40 42 Allocates memory in foreign processes 9->42 44 Tries to delay execution (extensive OutputDebugStringW loop) 9->44 46 2 other signatures 9->46 13 cmd.exe 21 1 9->13         started        16 conhost.exe 9->16         started        signatures5 process6 signatures7 48 Changes security center settings (notifications, updates, antivirus, firewall) 13->48 50 Disables Windows Defender (deletes autostart) 13->50 52 Injects code into the Windows Explorer (explorer.exe) 13->52 54 4 other signatures 13->54 18 lsass.exe 13->18 injected 21 svchost.exe 13->21 injected 24 conhost.exe 13->24         started        26 35 other processes 13->26 process8 dnsIp9 38 Writes to foreign memory regions 18->38 28 MpCmdRun.exe 1 18->28         started        34 1.1.1.1 CLOUDFLARENETUS Australia 21->34 signatures10 process11 process12 30 conhost.exe 28->30         started       

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
dropper.exe12%VirustotalBrowse

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://excel.office.comSRD1%0%Avira URL Cloudsafe
https://powerpoint.office.comSRD130%Avira URL Cloudsafe
http://schemas.micro0%Avira URL Cloudsafe
https://word.office.com.com0%Avira URL Cloudsafe
https://outlook.comcom0%Avira URL Cloudsafe
https://outlook.comSRD1-0%Avira URL Cloudsafe
https://word.office.comSRD1#0%Avira URL Cloudsafe
http://ns.adobe.0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
https://word.office.comsvchost.exe, 0000002A.00000000.2057998047.000001E74C168000.00000004.00000001.00020000.00000000.sdmpfalse
    		high
    http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702lsass.exe, 00000006.00000000.1906270895.000001F2E182E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000002.3718575754.000001F2E182E000.00000004.00000001.00020000.00000000.sdmpfalse
      		high
      https://windows.msn.com/shellsvchost.exe, 00000007.00000000.1915700291.0000028186CAF000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3769748764.0000028186CAF000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2524514466.0000028186CAF000.00000004.00000001.00020000.00000000.sdmpfalse
        		high
        http://schemas.xmlsoap.org/ws/2004/09/policylsass.exe, 00000006.00000000.1906270895.000001F2E182E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000002.3718575754.000001F2E182E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000002.3720198630.000001F2E1850000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000000.1906371373.000001F2E1850000.00000004.00000001.00020000.00000000.sdmpfalse
          		high
          http://schemas.xmlsoap.org/wsdl/ertieslsass.exe, 00000006.00000000.1906270895.000001F2E182E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000002.3718575754.000001F2E182E000.00000004.00000001.00020000.00000000.sdmpfalse
            		high
            https://wns2-ch1p.notify.windows.com/?token=AwYAAACOo%2bDpegMJ4mimyuZb31GqC7oXjlMabDDVUR8qnW8cVhNR3YMicrosoft-Windows-PushNotification-Platform%4Operational.evtx.23.drfalse
              		high
              https://outlook.comcomsvchost.exe, 0000002A.00000000.2051366875.000001E74AE65000.00000004.00000001.00020000.00000000.sdmpfalse
              • Avira URL Cloud: safe
              		unknown
              https://docs.rs/getrandom#nodejs-es-module-supportdropper.exe, tempdll.dll.0.drfalse
                		high
                https://www.office.com/pwaimagessvchost.exe, 0000002A.00000002.3757690094.000001E74BA23000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002A.00000000.2053698567.000001E74BA23000.00000004.00000001.00020000.00000000.sdmpfalse
                  		high
                  http://schemas.xmlsoap.org/ws/2005/02/trustlsass.exe, 00000006.00000002.3720198630.000001F2E1850000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000000.1906371373.000001F2E1850000.00000004.00000001.00020000.00000000.sdmpfalse
                    		high
                    http://schemas.microsvchost.exe, 0000001B.00000002.3734901120.000002182FDD0000.00000002.00000001.00040000.00000000.sdmpfalse
                    • Avira URL Cloud: safe
                    		unknown
                    https://outlook.comsvchost.exe, 0000002A.00000000.2051366875.000001E74AE65000.00000004.00000001.00020000.00000000.sdmpfalse
                      		high
                      http://schemas.xmlsoap.org/ws/2005/07/securitypolicylsass.exe, 00000006.00000000.1906270895.000001F2E182E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000002.3718575754.000001F2E182E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000002.3720198630.000001F2E1850000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000000.1906371373.000001F2E1850000.00000004.00000001.00020000.00000000.sdmpfalse
                        		high
                        https://word.office.com.comsvchost.exe, 0000002A.00000000.2057998047.000001E74C168000.00000004.00000001.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        https://excel.office.comSRD1%svchost.exe, 0000002A.00000000.2058607590.000001E74C423000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3778892876.000001E74C423000.00000004.00000001.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        http://schemas.xmlsoap.org/wsdl/soap12/lsass.exe, 00000006.00000002.3718575754.000001F2E182E000.00000004.00000001.00020000.00000000.sdmpfalse
                          		high
                          https://spclient.wg.spotify.com/v1/live-tile-xml?region=svchost.exe, 00000007.00000000.1913080338.0000028186600000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3750551577.0000028186600000.00000004.00000001.00020000.00000000.sdmpfalse
                            		high
                            http://schemas.xmlsoap.org/wsdl/lsass.exe, 00000006.00000000.1906270895.000001F2E182E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000002.3718575754.000001F2E182E000.00000004.00000001.00020000.00000000.sdmpfalse
                              		high
                              https://powerpoint.office.comSRD13svchost.exe, 0000002A.00000000.2058607590.000001E74C423000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3778892876.000001E74C423000.00000004.00000001.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://schemas.xmlsoap.org/wsdl/soap12/Plsass.exe, 00000006.00000000.1906270895.000001F2E182E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000002.3718575754.000001F2E182E000.00000004.00000001.00020000.00000000.sdmpfalse
                                		high
                                https://outlook.comSRD1-svchost.exe, 0000002A.00000000.2052912145.000001E74B900000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.3114422886.000001E74B903000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002A.00000000.2058607590.000001E74C423000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.3114855996.000001E74B92D000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3749777532.000001E74B931000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3778892876.000001E74C423000.00000004.00000001.00020000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                https://windows.msn.cn/shellRESPsvchost.exe, 00000007.00000000.1915700291.0000028186CAF000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000007.00000002.3769748764.0000028186CAF000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000007.00000003.2524514466.0000028186CAF000.00000004.00000001.00020000.00000000.sdmpfalse
                                  		high
                                  http://www.quovadis.bm0lsass.exe, 00000006.00000003.3217007845.000001F2E2094000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000002.3739196122.000001F2E2095000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000000.1907351514.000001F2E2095000.00000004.00000001.00020000.00000000.sdmp, dwm.exe, 0000000E.00000000.1930929743.000002736F820000.00000004.00000001.00020000.00000000.sdmp, dwm.exe, 0000000E.00000002.3787235451.000002736F820000.00000004.00000001.00020000.00000000.sdmpfalse
                                    		high
                                    https://word.office.comSRD1#svchost.exe, 0000002A.00000002.3725499698.000001E74AE77000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002A.00000000.2051421492.000001E74AE77000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002A.00000000.2058607590.000001E74C423000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002A.00000000.2054757075.000001E74BBEF000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3778892876.000001E74C423000.00000004.00000001.00020000.00000000.sdmpfalse
                                    • Avira URL Cloud: safe
                                    		unknown
                                    https://wns2-ch1p.notify.windows.com/?token=AwYAAABRgjxu7x%2fdyWqbOoAAI8Gcd5ckhbCzw7F7Uxfu5MqaJ5M0DUMicrosoft-Windows-PushNotification-Platform%4Operational.evtx.23.drfalse
                                      		high
                                      http://docs.oasis-open.org/ws-sx/ws-trust/200512lsass.exe, 00000006.00000002.3720198630.000001F2E1850000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000000.1906371373.000001F2E1850000.00000004.00000001.00020000.00000000.sdmpfalse
                                        		high
                                        http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdlsass.exe, 00000006.00000000.1906270895.000001F2E182E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000002.3718575754.000001F2E182E000.00000004.00000001.00020000.00000000.sdmpfalse
                                          		high
                                          http://ns.adobe.dropper.exefalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          https://ocsp.quovadisoffshore.com0lsass.exe, 00000006.00000003.3217007845.000001F2E2094000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000002.3739196122.000001F2E2095000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000006.00000000.1907351514.000001F2E2095000.00000004.00000001.00020000.00000000.sdmp, dwm.exe, 0000000E.00000000.1930929743.000002736F820000.00000004.00000001.00020000.00000000.sdmp, dwm.exe, 0000000E.00000002.3787235451.000002736F820000.00000004.00000001.00020000.00000000.sdmpfalse
                                            		high

                                            World Map of Contacted IPs

                                            • No. of IPs < 25%
                                            • 25% < No. of IPs < 50%
                                            • 50% < No. of IPs < 75%
                                            • 75% < No. of IPs

                                            Public IPs

                                            IPDomainCountryFlagASNASN NameMalicious
                                            1.1.1.1
                                            		unknownAustralia
                                            		13335CLOUDFLARENETUSfalse

                                            General Information

                                            Joe Sandbox version:41.0.0 Charoite
                                            Analysis ID:1582958
                                            Start date and time:2025-01-01 05:35:52 +01:00
                                            Joe Sandbox product:CloudBasic
                                            Overall analysis duration:0h 11m 40s
                                            Hypervisor based Inspection enabled:false
                                            Report type:full
                                            Cookbook file name:default.jbs
                                            Analysis system description:Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 128, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
                                            Run name:Run with higher sleep bypass
                                            Number of analysed new started processes analysed:7
                                            Number of new started drivers analysed:0
                                            Number of existing processes analysed:0
                                            Number of existing drivers analysed:0
                                            Number of injected processes analysed:37
                                            Technologies:
                                            • HCA enabled
                                            • EGA enabled
                                            • AMSI enabled
                                            Analysis Mode:default
                                            Analysis stop reason:Timeout
                                            Sample name:dropper.exe
                                            Detection:MAL
                                            Classification:mal84.evad.winEXE@7/60@0/1
                                            EGA Information:
                                            • Successful, ratio: 100%
                                            HCA Information:Failed
                                            Cookbook Comments:
                                            • Found application associated with file extension: .exe
                                            • Sleeps bigger than 100000000ms are automatically reduced to 1000ms
                                            • Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

                                            Warnings

                                            • Exclude process from analysis (whitelisted): dllhost.exe
                                            • Excluded domains from analysis (whitelisted): ctldl.windowsupdate.com
                                            • Not all processes where analyzed, report is missing behavior information
                                            • Report size exceeded maximum capacity and may have missing behavior information.

                                            Simulations

                                            Behavior and APIs

                                            ⊘No simulations

                                            Joe Sandbox View / Context

                                            IPs

                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                            1.1.1.16fW0GedR6j.xlsGet hashmaliciousUnknownBrowse
                                            • 1.1.1.1/ctrl/playback.php
                                            PO-230821_pdf.exeGet hashmaliciousFormBook, NSISDropperBrowse
                                            • www.974dp.com/sn26/?kJBLpb8=qaEGeuQorcUQurUZCuE8d9pas+Z0M0brqtX248JBolEfq8j8F1R9i1jKZexhxY54UlRG&ML0tl=NZlpi
                                            AFfv8HpACF.exeGet hashmaliciousUnknownBrowse
                                            • 1.1.1.1/
                                            INVOICE_90990_PDF.exeGet hashmaliciousFormBookBrowse
                                            • www.quranvisor.com/usvr/?mN9d3vF=HHrW7cA9N4YJlebHFvlsdlDciSnnaQItEG8Ccfxp291VjnjcuwoPACt7EOqEq4SWjIf8&Pjf81=-Zdd-V5hqhM4p2S
                                            Go.exeGet hashmaliciousUnknownBrowse
                                            • 1.1.1.1/

                                            Domains

                                            ⊘No context

                                            ASNs

                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                            CLOUDFLARENETUS1.ps1Get hashmaliciousUnknownBrowse
                                            • 172.67.144.62
                                            https://gogl.to/3HGTGet hashmaliciousCAPTCHA Scam ClickFixBrowse
                                            • 188.114.97.3
                                            setup.exeGet hashmaliciousUnknownBrowse
                                            • 104.21.30.45
                                            U1jaLbTw1f.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                            • 104.21.38.84
                                            rename_me_before.exeGet hashmaliciousPython Stealer, Exela StealerBrowse
                                            • 162.159.128.233
                                            Loader.exeGet hashmaliciousLummaCBrowse
                                            • 104.21.48.1
                                            https://thetollroads.com-wfmo.xyz/usGet hashmaliciousUnknownBrowse
                                            • 104.17.25.14
                                            http://img1.wsimg.com/blobby/go/9b6ed793-452c-4f8f-8f80-6847f4d114d7/downloads/71318864754.pdfGet hashmaliciousUnknownBrowse
                                            • 104.16.123.96
                                            decrypt.exeGet hashmaliciousUnknownBrowse
                                            • 104.21.16.1
                                            decrypt.exeGet hashmaliciousUnknownBrowse
                                            • 104.21.16.1

                                            JA3 Fingerprints

                                            ⊘No context

                                            Dropped Files

                                            ⊘No context

                                            Created / dropped Files

                                            C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log

                                            Download File
                                            Process:C:\Program Files\Windows Defender\MpCmdRun.exe
                                            File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                            Category:modified
                                            Size (bytes):41762
                                            Entropy (8bit):3.240653854231866
                                            Encrypted:false
                                            SSDEEP:384:L+7H+hH+hR+hM+hJ+hS+hh+hB+h3+hV+h4+hU+hV+hy+hRU3+h5U8W+hnw:GV83w
                                            MD5:68900116987BA4A9FAE2B7A3FE156C74
                                            SHA1:5E4D6BDA13569ED306976E5C12F65EFE742CFE80
                                            SHA-256:72A09926F99207102030A1AC471A98AE363CBD199A18D01ED70A2238A2D27C65
                                            SHA-512:F7B4A93B36EAF38A4A7F76841FDFCC09737895959E89919D5F577BE6B6F271BF3D3980F826416546A5181BE2AFEF993DAEDBB253236105AC8EC6E4797239FEBC
                                            Malicious:false
                                            Preview:..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.m.p.c.m.d.r.u.n...e.x.e.". .-.w.d.e.n.a.b.l.e..... .S.t.a.r.t. .T.i.m.e.:. .. S.a.t. .. A.u.g. .. 0.5. .. 2.0.2.3. .2.2.:.0.4.:.5.2.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....W.D.E.n.a.b.l.e.....*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*. .W.S.C. .S.t.a.t.e. .I.n.f.o. .*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.....*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*. .A.n.t.i.V.i.r.u.s.P.r.o.d.u.c.t. .*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.*.....d.i.s.p.l.a.y.N.a.m.e. .=. .[.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.].....p.a.t.h.T.o.S.i.g.n.e.d.P.r.o.d.u.c.t.E.x.e. .=. .[.w.i.n.d.o.w.s.d.

                                            C:\Windows\System32\winevt\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx

                                            Download File
                                            Process:C:\Windows\System32\svchost.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):65536
                                            Entropy (8bit):4.319528316227881
                                            Encrypted:false
                                            SSDEEP:192:Cf8V7IF0RuqHQOnbgpib8AtYl+HDJ86PL+2SSD2Czp0gy16ZcC0/oUhQXzgwPtFt:dhkyHQOLt5jR7zpkYQ9+M/TG6OtiY
                                            MD5:D4672A4FF2FAD33B30F7DB9459BE77C7
                                            SHA1:58B66708E4ABDD64CCB7BC0F80E6EDE20FDF633D
                                            SHA-256:A4B7E010FEC2B54853C8A94C97140DCAE7AF81E07CB6CD823FB48CBC99866200
                                            SHA-512:FC288D186A31DDDC1F180BC3B493ECEAD3BEBA69BF7127D17312CBD37BAD3B49C37F71891448F8029C681219EDBA95F69EF48F06B934695BAF3EE89EE6BD69F7
                                            Malicious:false
                                            Preview:ElfChnk.u...............u............................O!.........................................................................................0.......................X...=...........................................................................................................................f...............?...........................m...................M...F...............................................................&...............................9...........................).......................**......u.........K.i........./X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                            C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx

                                            Download File
                                            Process:C:\Windows\System32\svchost.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):65536
                                            Entropy (8bit):1.4716976636035206
                                            Encrypted:false
                                            SSDEEP:384:IhBNimLN3UN3pNINcN3uN36ZN3fcN3dN3xzN3lN3RN3sN3YN3zN3TN3JN3xN3kNa:IAaC30SyTx57f6u5Z3/y2FpwsDZ0c
                                            MD5:A8000F250409496B9A7F5BD597D5ABD8
                                            SHA1:8ABB504A7782DD64253EFB3F25DCEFF077ECC054
                                            SHA-256:9F1A6231FEB657782C6F48692424FCC375464652041ED05656147126CABC3454
                                            SHA-512:AAFF5A590477880886C84E7889B7903BFABF85B3A40DFFFE09EE1CD72769CD8FA48B48229011FE8444EC4AA7B0344CB57D0ABD8A698736ED3A2D957D68B8713A
                                            Malicious:false
                                            Preview:ElfChnk._.......y......._.......y............G..xI.....q...................................................................../.................,.......................T...=...........................................................................................................................f...............?...........................m...................M...F...............................................................&...................................................................................**......_..........f,........./X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                            C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx

                                            Download File
                                            Process:C:\Windows\System32\svchost.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):65536
                                            Entropy (8bit):4.331054699031641
                                            Encrypted:false
                                            SSDEEP:384:4hKVQV7VdVdEV/jVAVjVKV+VsV6VxVpV5mVmVoVJVsVuVSVRVLViVfV3VFVd1Vtd:4f6tRq6
                                            MD5:A55F8FE23CE5534171D362488404A038
                                            SHA1:4D37770F8C1AC150CB96D6FF334C4ECD8544725A
                                            SHA-256:4B760E945407E37F03019186E44A4AB1831D95FA6E07BEF1ED59483772E93D53
                                            SHA-512:934786A1A185B4941F3943ADCF474BBA5440122940FF47F12816DA0E8ADF8BF28C47F2E6A30DBFBC0E82F086319C7F6D56CD901681C9D21446FCCCCF85D455CC
                                            Malicious:false
                                            Preview:ElfChnk.|(.......(......|(.......(..........hj..0l.../.....................................................................P.4P................0.......................X...=...........................................................................................................................f...............?...........................m...................M...F...............................................................&............................................&...............................#......**......|(........<Q.9......../X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                            C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx

                                            Download File
                                            Process:C:\Windows\System32\svchost.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):65536
                                            Entropy (8bit):4.393617986341297
                                            Encrypted:false
                                            SSDEEP:1536:Jl1fni2TDyiWAZfBzB6BbB2e7KBa23KDi/OyazwNJCmikDw:tfjDyeA
                                            MD5:684F8C8E5B777AE473F6D8AC6AB6E4CE
                                            SHA1:BB634D7D1397B7B822C33E07E08850A43775FA88
                                            SHA-256:B07928E2E9AC6AEB8D8363D49BADABDF9F5943676373E623DD0FC96FC5D26F79
                                            SHA-512:29650A5F0CB1CE6A28A98D251B97308FF0A82AAE9AA6E48D84C8727D1083607148F70F4620801F36618070A9AECBE1059691A15B1BF3864FD9D7E08CD3AFD6FA
                                            Malicious:false
                                            Preview:ElfChnk..'.......'.......'.......(..........................................................................................9.................J.......................r...=...........................................................................................................................f...............?...........................m...................M...F...............................3W..#>.......................N..&........................................8...;.......@......;5...........`..........**.......'........~........./X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                            C:\Windows\System32\winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx

                                            Download File
                                            Process:C:\Windows\System32\svchost.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):65536
                                            Entropy (8bit):2.339644599529794
                                            Encrypted:false
                                            SSDEEP:384:Whm+iMNEi1itiXiYiAiQiCiYiXiviCiriMiKiYili+iciSiVciji/DiQisiKi7iX:W8
                                            MD5:28598A748F427C73513FC87068EA82DC
                                            SHA1:AE7D5EDE9D2A8240F2215186F602CB00C3B9C765
                                            SHA-256:7B09A1235F2CC8CAF0EFF9B84BA168D9F46D09A6B50C3E334D9BF82CBC3A8688
                                            SHA-512:4FBC3222E003E693A489833D1641A7F23450DE58FFA456EAD9A9CECD5793DD101048516FBD48FDE06F322F4FB4E5A0A9284E8E07242208F9EDCB209D5A843486
                                            Malicious:false
                                            Preview:ElfChnk.........3...............3........... z..h|...Nu.....................................................................W/S.............................................=...........................................................................................................................f...............?...................................b...........M...F...........................................................&.......................................................................................**..X..............w............>.&.........>..'.W.U2..9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                            C:\Windows\System32\winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Telemetry.evtx

                                            Download File
                                            Process:C:\Windows\System32\svchost.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):65536
                                            Entropy (8bit):4.451479939821543
                                            Encrypted:false
                                            SSDEEP:384:8hI3c6dh3O3Km30v3635B33H353X3g3J3N33Lv3j3j3A3730j3ue3H3T39z3IM3g:8kqL+Tl5qhdWFgwc4MElvawvMLkA
                                            MD5:A043D303D4C9DA5A22FC14B661C4A393
                                            SHA1:E149DBA3095BC8BA07CD0F5CFE09F4B7ACDCCF42
                                            SHA-256:6593B544BC940CD488D47B0D36C31D0269871E42F71CD5AC2774D78D3C5B5F7D
                                            SHA-512:8D607A1095C7B02876A1AE19EBF37864E9B057D79EAA57062535A24CEADC5B482D8210374A995E64CB1C29C450C3E4B1E36729A48930B3DE751499D50C7A9089
                                            Malicious:false
                                            Preview:ElfChnk.........^...............^...........`.......,Yb.....................................................................0i..............................................=...............u...........................................................................................................H...............?...............................................M...F...........................................&................9......................................................................j...............**.................*T.........B...&.......B...._.X.$.]...+........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                            C:\Windows\System32\winevt\Logs\Microsoft-Windows-Audio%4Operational.evtx

                                            Download File
                                            Process:C:\Windows\System32\svchost.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):65536
                                            Entropy (8bit):4.226677464865844
                                            Encrypted:false
                                            SSDEEP:768:ePcpk0+dC1RzsZrczv9ezTjlRLD1xzzmfgO5WJ:Z4PTjX
                                            MD5:FC8CA3DFF09ADBEDE628B106B4597313
                                            SHA1:B0AD82EE2CFF205CCA2C5B1D3CA791FC23F9D5F6
                                            SHA-256:6472E3A750522192B679E582BF92BD37C4EF4DCBF1EEF5191223D759D9A57215
                                            SHA-512:EA11AA30021EB02BAC718D84E4074AD8A20B40D0E4FEE658165B12B90EC125219D6BDA00889096008072A5FB5D30A95EDC04F597BEB08F69C4D2D32DFE0FA10C
                                            Malicious:false
                                            Preview:ElfChnk......................................&...(..........................................................................U..........................................4...=...........................................................................................................................f...............?...........................m...................M...F...............................................................&...................................................................................**...............q..f........./X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                            C:\Windows\System32\winevt\Logs\Microsoft-Windows-CloudStore%4Operational.evtx

                                            Download File
                                            Process:C:\Windows\System32\svchost.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):65536
                                            Entropy (8bit):2.9544721950362107
                                            Encrypted:false
                                            SSDEEP:768:Nl/LLKiILbXvvvD7rrXuXtPPrzbvjPH7bP3:SiZX
                                            MD5:C8B3960B94D7F6EDAA166EF1202406F3
                                            SHA1:F5591DEE9A209D016B692615143C9730AA9D55D0
                                            SHA-256:C25D251B2D4AE5EE578A9577E5C8B0AC03C52AFBF59734A2B28176C2E7E26DDC
                                            SHA-512:EE2DB1F7F731588EDE16BFDC4CEF1289F65E90107EABD1E02E7A60D78A0B7811CC831799777D432BAFB0C2E5AC5420B3818B73904ED4B663AA27B524B8CFF057
                                            Malicious:false
                                            Preview:ElfChnk.........................................p....6?"....................................................................._n................0.......................X...=...........................................................................................................................f...............?...........................m...................M...F...............................................................&...................................................................................**.................g,........./X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                            C:\Windows\System32\winevt\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx

                                            Download File
                                            Process:C:\Windows\System32\svchost.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):67560
                                            Entropy (8bit):2.501237128881698
                                            Encrypted:false
                                            SSDEEP:384:FoOKxioshuoS9VoryorOoroortorVorVorNorrmo4oruorlIoreorNorworgorDY:xsWqGO
                                            MD5:3E77A28B0BFCE52470724A95E6BCDD4E
                                            SHA1:C259387A8268FE547AB71BC87FE098F58502D38A
                                            SHA-256:F7363078A70C7E344C3769D8C456EF74621778FE3AA42EA32A9E4E09D4676A63
                                            SHA-512:31DD6A64E3BD8676A4ABB7806BC65ED0ECE5DD2B6A1A0CEF0281BD2DC87F84462F96B679E8B0390EA17550E53018B04A9B013C1BF71D53B8E81375910E752080
                                            Malicious:false
                                            Preview:ElfChnk.........M...............M............}......\j.!........................................................................................:.......................b...=...........................................................................................................................f...............?...........................m...................M...F...................................................................................................................E{..............................**......L............\......../X.P................................................................>.......V...X.!..e...................\.....7.[.....7.[..........L....................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.C.o.d.e.I.n.t.e.g.r.i.t.y..k.N.<.D..97d>7.M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.C.o.d.e.I.n.t.e.g.r.i.t.y./.O.p.e.r.a.t.i.o.n.a.l...!>.E{......!>....[.U.....i...........|...:....A..3...b...%....=.......F.i.l.e.N.a.m.e.L.e.n.g.t.h.......A..3...b...%....=.......F.i.l.e.N

                                            C:\Windows\System32\winevt\Logs\Microsoft-Windows-Containers-BindFlt%4Operational.evtx

                                            Download File
                                            Process:C:\Windows\System32\svchost.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):65536
                                            Entropy (8bit):2.2039706117410094
                                            Encrypted:false
                                            SSDEEP:384:DhNPmP1PKPvPZl5P8P7PAPt/PU+PKP1PEPNPaPQPiPqPFDPhP6PwPXPaPZ8PWPC/:DDlvUGLpF
                                            MD5:01661CE82111D233D0EDD419D5119BE8
                                            SHA1:D353582E7C5A15D58F1CC0B61F84C9CB36DB5D56
                                            SHA-256:F63A28F35F0A819019B94902F2D1AD2EAA3F1BD882F52743576794F5CC2C6C1E
                                            SHA-512:4AB3A013426A5539FC24C3187862AFB3DAF182A87DF3F325F2134100B80B42620665B6B754F847E870391B9BCD1960ABF1CB750069A8F67B62B362812775453C
                                            Malicious:false
                                            Preview:ElfChnk.........G...............G........... t...u....y^....................................................................slG.................N...........................=...........................................................................................................................f...............?...........................m...................M...F.......................&...................................................................................................'.......................**..x...........B...S...........w.&.........w..._.|.1+O.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                            C:\Windows\System32\winevt\Logs\Microsoft-Windows-Containers-Wcifs%4Operational.evtx

                                            Download File
                                            Process:C:\Windows\System32\svchost.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):65536
                                            Entropy (8bit):2.17749851276607
                                            Encrypted:false
                                            SSDEEP:768:LDbHtuYYZAqRidVY4HdYWgML/chv4PzSw05Wt19M6vz73mA4+9AxNAVBBBxZvaVL:M27
                                            MD5:2377A2986E7562AE209B0C7B1A9FB116
                                            SHA1:4100CDE39988A94E0F2C2E567A318A3072152C93
                                            SHA-256:F386C4F023E9249BFD51CFC86DA2F37A92C3A3D23706E13C8542642E06FCE35A
                                            SHA-512:FA9CC58025A745C55293FEBB0E25A4A3951F530219089E7FFCDB4DF48D175DB46889A1F6E47E67BB7CBD5C0E3C328B50E973DF1FBF7C99D37D2C4AFADF3485EE
                                            Malicious:false
                                            Preview:ElfChnk.........G...............G............q..ps....Y2....................................................................ZTUd................F...........................=...........................................................................................................................f...............?...........................m...................M...F.......................&...........................................................................................................................**..p...........!|..S...........w.&.........w..._.|.1+O.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                            C:\Windows\System32\winevt\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx

                                            Download File
                                            Process:C:\Windows\System32\svchost.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):65536
                                            Entropy (8bit):4.726256666452321
                                            Encrypted:false
                                            SSDEEP:384:vhch15hHh0hUh4hlhhhFhhNhPhLh1hthlh6hah+hFh1hVhEhUhMhFhJhKhthPFhz:vyyi
                                            MD5:58B669122D78B3DBC15B26B13AF24F1F
                                            SHA1:52C2EC46954527FADF36B293332C2CCE523777BE
                                            SHA-256:B67D0314B2BA9EA66FB0C9FB2CC2D2E05A96FA214D111C37A8D3BE64911E393C
                                            SHA-512:31F9EFE9996C1BD72A41695551224BD25EB5CF404CB084B71224C010BBF2B7F0BC69D14E6E4D1FF08A73FC22E528D0CD52F0A20335CEA8E1D658FA9A5E392747
                                            Malicious:false
                                            Preview:ElfChnk.....................................h...X...H.;......................................................................U..................(.......................P...=...........................................................................................................................f...............?...........................m...................M...F...................................................!i..........&...................................................................................**..X........................./X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                            C:\Windows\System32\winevt\Logs\Microsoft-Windows-Crypto-NCrypt%4Operational.evtx

                                            Download File
                                            Process:C:\Windows\System32\svchost.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):65536
                                            Entropy (8bit):0.8000892145505037
                                            Encrypted:false
                                            SSDEEP:384:Agh7YJVYV4YcYIjYkYVpYsqYVyYV3YVfYVRYVIY:hfvzDWeM
                                            MD5:FB8EF4A38E3FDC0525A34D554965F5DB
                                            SHA1:A94D7E99F0C785FA7E8700735D612B24A61F0A0D
                                            SHA-256:AEE82412CDCD6B69164AE9131AEDA1D7C1316EC37C362C7F5F786B15CF116DB2
                                            SHA-512:221CE10A5DB5F0C7A9EAC4C29C40F804916F95E385907402FBF69CA5F2E528A31B4CB4BE921C92DF06C036ACF7BE7FB0BEA9EDE8DB72B56AB8B561CDEA9CC93B
                                            Malicious:false
                                            Preview:ElfChnk.z...............z...................@!.. #...c......................................................................(.$.................,.......................T...=...........................................................................................................................f...............?...........................m...................M...F...............................................................&...................................................................................**..h...z.........i._........./X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                            C:\Windows\System32\winevt\Logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx

                                            Download File
                                            Process:C:\Windows\System32\svchost.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):65536
                                            Entropy (8bit):2.7003053530983316
                                            Encrypted:false
                                            SSDEEP:384:4hDCq2cCp1Cz2TCLqCM2CZCjiCsCblCnC/iCsCe5CECOwCFCkUCXCUoCjCtorCrd:4UEJ2R
                                            MD5:C139622E93B5FD9CFDD9861EBDEBB7D7
                                            SHA1:7A96E25885C5667A9022273ACB5BE12FC467F18E
                                            SHA-256:12994B3B000A318C63A1EA41B34820B84186111C8E4AA4ADDEA949A0D873A01A
                                            SHA-512:E1BC89BCE5C12B6725DB9A451C90D1315AEF81D347F2E726C1BC9339DAA86C0785DC9DB68CC619A6268264449166A86F34D45AC1222FD14BD8B29150557BCFC3
                                            Malicious:false
                                            Preview:ElfChnk.m...............m...........................1.5......................................................................B&............................................=...........................................................................................................................f...............?...........................m...................M...F...............................................................&...................................................................................**.. ...m.........*13........./X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                            C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx

                                            Download File
                                            Process:C:\Windows\System32\svchost.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):65536
                                            Entropy (8bit):4.954738911318435
                                            Encrypted:false
                                            SSDEEP:768:Gey39iM13dtfbSqyYcQGXrlhmQHZHm43/0YOb5UAqw/OAwuM2eWE:qSE
                                            MD5:95A466B0BE361D1512D025A2838AEE69
                                            SHA1:2008DD4422B6179F7BC616DA8C95E38656EA890D
                                            SHA-256:E7F45E387F04CADA57890034DFEFBAC8549877E2F9E84BD2CDA04E623D94E153
                                            SHA-512:E45129A9C4ADE748EA1428168C20D32D950E445942274378F7AEA91FCAD03AF88A2D85CE152CD9D855A8E128432A08DDD3D0ACD24043BE240D02B25EA35B896A
                                            Malicious:false
                                            Preview:ElfChnk.........F...............F...................z.........................................................................4.................,.......................T...=...........................................................................................................................f...............?...........................m...................M...F...................................................................................................................................................**..x...........&............./X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                            C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx

                                            Download File
                                            Process:C:\Windows\System32\svchost.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):65536
                                            Entropy (8bit):4.4726235874707605
                                            Encrypted:false
                                            SSDEEP:384:bh8kbAP1gjk+Jk+yk/3Suhfmk+Adk+AkKuIk+2hk+Dk+rk+4k+ik+8k+4k+Uk+Rh:bNAP1EHDzS0IpmjmoToEEltkV48m
                                            MD5:AC26D50D2D3912FE86A16EA4CBCB5F9A
                                            SHA1:312BCCC2C32A6CA888D0C61E3A7D665981196861
                                            SHA-256:4A27E235296E1A88F972B757A9C5FB8541B9690E15440283BB65AE87490D4EC3
                                            SHA-512:180F745B00315C2AD63F6EB1E211516336318C635DC2B2D71828FB7276ABDFC901019FED6C069187BBC067988FCCBE23BE24A911487E5A1B7EBD55AECB80E779
                                            Malicious:false
                                            Preview:ElfChnk......................................I...K..`K..........................................................................................b...........................=...........................................................................................................................f...............?...........................m...................M...F.......................&.......................................~...................................U...............;...............................**..x............Ft.i...........w.&.........w..._.|.1+O.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                            C:\Windows\System32\winevt\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx

                                            Download File
                                            Process:C:\Windows\System32\svchost.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):65536
                                            Entropy (8bit):4.442282810864905
                                            Encrypted:false
                                            SSDEEP:384:2haEdEqXAEJVvOEJSvEqEBEENEuDEaExEOEAE7EmEizEJ6ExEZEX/+EaEF5EOcEI:2VXmIBqr97fAIiTtgT8GpO
                                            MD5:FA055F1875DD2C27B841F49DBAADB63C
                                            SHA1:949E19B4C447DD5C85BE2252866E95C57B3BADC1
                                            SHA-256:6D5BEAAB36A3B9775AB3F64C44E12F1A076384C2A63C8B4A0A4C456914DA5CB1
                                            SHA-512:51687B5B6EB2E8EBE482F2006DB2E08F1C6A6A7A153BC3A1A53C43839134F4CA835A273BF1DF5F446F970BB9AE9B56F6E24DABB2B64A43EDB8CAC815308472FE
                                            Malicious:false
                                            Preview:ElfChnk.....................................P.......%.........................................................................x................$.......................L...=...........................................................................................................................f...............?...........................m...................M...F....................#...............!...9..=................O...=...........A...?.......;..ME..........}....................'..........5...........**...............2...9......../X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                            C:\Windows\System32\winevt\Logs\Microsoft-Windows-HelloForBusiness%4Operational.evtx

                                            Download File
                                            Process:C:\Windows\System32\svchost.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):65536
                                            Entropy (8bit):2.403731301560645
                                            Encrypted:false
                                            SSDEEP:384:MhPFKlcLBKalKuDGK1GKgkKClKvQKqlKlaKu7dKrXK7CK53HKstKoIK8eKugGKID:Mz8
                                            MD5:06EC284BBE790B4A4EB25BFB420AA9CA
                                            SHA1:507F4753DCB98236B69D16A6DF4E7F60663996EF
                                            SHA-256:30EEE8BD2523D9AA31518247C2B07587AD16340F5D2FAC30321F4CF218D99FCC
                                            SHA-512:A89E0C41F6368512F39017361AD64C69F44D935DCA7D81427093B769249962394E975D9DA6A32CC224142970B642A45DB58B68063935CDBD50B08CA7E13879E8
                                            Malicious:false
                                            Preview:ElfChnk.=...............=....................x..0z.........................................................................e^..................H.......................,...=...........................................................................................................................f...............?...........................m...................M...F...............................................................&...........................................................!.......................**..x...=.......m............./X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                            C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx

                                            Download File
                                            Process:C:\Windows\System32\svchost.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):65536
                                            Entropy (8bit):4.101474498980763
                                            Encrypted:false
                                            SSDEEP:384:fh+DEfbDisDTDqDPD1DPDXDuDTDGD8DMDRDcDvDhDlDEJDpDmXDyDsD6DwDKDOD0:frqyaBHYPi
                                            MD5:8EBCD9D9ECD23CD1DAEF3EEC565599BD
                                            SHA1:96C2138B19B3C09D72F86317B471ADF8006ED01D
                                            SHA-256:2C0074D6B13635455D703154BCD6479B6E45DFCF4A2DD99336AE8F37968F9C7F
                                            SHA-512:36571B4A172C43033BE635E3F8C3F960A30FF7150C404646057BE23988A2CE9C165CA2EF57E5115611D94AF2478AD0355D90A3FB18C3054AD65699461A9374B7
                                            Malicious:false
                                            Preview:ElfChnk.........<...............<...........8........|c.....................................................................A...................$.......................L...=...........................................................................................................................f...............?...........................m...................M...F...............................................................&...................................................................................**..............F_G.4........./X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                            C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx

                                            Download File
                                            Process:C:\Windows\System32\svchost.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):65536
                                            Entropy (8bit):4.195979376606352
                                            Encrypted:false
                                            SSDEEP:384:3hdzpzAzKzyzIzazrzRztzPzxaz9OzJznzfzXz4zdz/znzYx3z9zrzmzYzwzYzXz:3K8WxvZ
                                            MD5:653A924524DAEBB7B128DF31FC7DBE43
                                            SHA1:0CA1C9DE5816405164F729D73217B069E412445C
                                            SHA-256:27567E3F1B1F16D6737D3BB03501E7972E6EDAF02E82FD0F1BDCF635EF9ACFE1
                                            SHA-512:C58997476D261F354C2DFBD43B1743A80B42D4EB9114606C7F269A98F1594064EC96E029AC4AB11C8FB6C93D4E362953A3558ABCAC5260A96E8B3A2A1B82C4CB
                                            Malicious:false
                                            Preview:ElfChnk.....................................@...0...'i%.....................................................................h>\.................<.......................d...=...........................................................................................................................f...............?...........................m...................M...F...............................................................&...................................................................................**..............,o.{........../X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                            C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx

                                            Download File
                                            Process:C:\Windows\System32\svchost.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):65536
                                            Entropy (8bit):1.7323103950661578
                                            Encrypted:false
                                            SSDEEP:384:ghXIVUtIgUIiw7jI0eICpImAIp7ITIII/IaI/I7I26pCIQvILINIhIkI8IDITI0o:gQ0V6
                                            MD5:3ACE10EB22C2787464DC588D04E84316
                                            SHA1:C94BF7631234321A4273BE7FB78EA80A8735F5E6
                                            SHA-256:9B3AB119DED3474A29711345FBFC2561F4C802895B8506032AB958D246CF1C3D
                                            SHA-512:61C743528949F327BADA2566F454AD04E7FE6396C3E7821E339757658F477DD81C37CD06F067585EF349A01C6912C67FE1423BF9A548AA1554662B7E15FB12E8
                                            Malicious:false
                                            Preview:ElfChnk.............................................,........................................................................W.e................$.......................L...=...........................................................................................................................f...............?...........................m...................M...F............................................................h......................................................................................**...9..............9......../X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                            C:\Windows\System32\winevt\Logs\Microsoft-Windows-LiveId%4Operational.evtx

                                            Download File
                                            Process:C:\Windows\System32\svchost.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):75520
                                            Entropy (8bit):5.500876324947242
                                            Encrypted:false
                                            SSDEEP:384:MhZa5k3ia5q/a5Ia5aSa5xa5Oa59a5Ta53a5aGa5Qa5la5ta5qa5Ua5aea5qa5+j:M45TMdt
                                            MD5:CAA4DBB0AE6C57EDF19AFDB016979AA2
                                            SHA1:2BF3256C90D7D0E34037EA6D0E599F4C8A84DC18
                                            SHA-256:7013F164ED680547DF6644356DA3CB3C41A4A0CF267AD0565996CC8596D8CC7D
                                            SHA-512:5C6C2EC70664C8CD93916251F21BBC2BB3B7C32A439463D31E9B8D2651D415DD00FE724D5826F772D386EADF17A7F13A741A3DBDB650E8326B8F76A053343DA3
                                            Malicious:false
                                            Preview:ElfChnk..................................... #...$...........................................................................P./........................................8...=...........................................................................................................................f...............?...........................m...................M...F...............................................................&.......................!...........................................................**................mE.[......../X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                            C:\Windows\System32\winevt\Logs\Microsoft-Windows-NCSI%4Operational.evtx

                                            Download File
                                            Process:C:\Windows\System32\svchost.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):65536
                                            Entropy (8bit):2.1077370972874387
                                            Encrypted:false
                                            SSDEEP:384:/h0QMqHM3EbMYFMOuM0cMn71MuMMxsM98M0n4MBHMovMmXMqQMrdMlOMZzMWHMBc:/ZWa
                                            MD5:31B4C50E440B12DE611B83FB80016602
                                            SHA1:4B65015C5696AB55B6A8AA904D8C5DEB01D89466
                                            SHA-256:14B007ED8B93B30280FC00050D0885A0F90AE539FC7C0BF258DCB7CD235E6449
                                            SHA-512:4DE718CC642B7C1956F53F04CE8F2F9A1CBA500239941CB58D12B9138DDE29C0F6344C008544D1B89DBB9942CB30F3C43168CC81D61B9727EAE918D131895417
                                            Malicious:false
                                            Preview:ElfChnk.........@...............@............l..Pn...1....................................................................V}.5........................................>...=...........................................................................................................................f...............?...........................m...................M...F.......................&...........................................................................................................................**..............)..S...........w.&.........w..._.|.1+O.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                            C:\Windows\System32\winevt\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx

                                            Download File
                                            Process:C:\Windows\System32\svchost.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):65536
                                            Entropy (8bit):3.283328643162027
                                            Encrypted:false
                                            SSDEEP:384:rhb1Sh151f21Q1c161J1fA1eE1cj1/q1f+1Cz1410C1F1f81H111f210111X1fIx:r6vPCDe2v/bgrJlrxbz3t3fAQmWW
                                            MD5:7F7307E6C86FE9F132853D1E323F2975
                                            SHA1:5A78B31DEA4BDA58F85C0E6368619EBBCA6D4D97
                                            SHA-256:10FB8A8A5B182302C8929149D8019A362056B120CFB42B6BC36EFA9B8175F949
                                            SHA-512:0A525DB71FBDF951D54A827D4BC6B0499CC2182C1181613B9D51889D4E3BE3ED412840769DA4FFFBBBD2F45D5955C79C7A2F04686FC921C69447E0AD0EA5DCC7
                                            Malicious:false
                                            Preview:ElfChnk.0...............0...................`.......@;.........................................................................~................0.......................X...=...........................................................................................................................f...............?...........................m...................M...F...........................................................................................1.......................................................**......0...........]........./X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                            C:\Windows\System32\winevt\Logs\Microsoft-Windows-Ntfs%4Operational.evtx

                                            Download File
                                            Process:C:\Windows\System32\svchost.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):65536
                                            Entropy (8bit):4.323491793210398
                                            Encrypted:false
                                            SSDEEP:384:ChnIFwI1IcIIIEI1InI0IXInICIWIzIOILIqIhIXIJIrIPIMIiIMI/InIFIxImIp:CuxxVaJRr
                                            MD5:F33DFD304C991F70CF569E3EBC08BE06
                                            SHA1:2373312AAC629F3FCEC47C5279C096628B663B4F
                                            SHA-256:9A65B5D927E01AB85F97EBD7CB445A3C3A06A421ADCF452D9F2F843A21891250
                                            SHA-512:2A526957145E702E64DB4B7E10B770B24E8726AC2DD01D09D4DD54659537DE4153C5E4DA0567E2814009ED468A31436BBA5C0AB0AD5A36772D5FF50C161FC5C3
                                            Malicious:false
                                            Preview:ElfChnk..................................... ........4.......................................................................E?.........................................0...=...........................................................................................................................f...............?...........................m...................M...F...............................................................&...................................................................................**..h...........r.........../X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                            C:\Windows\System32\winevt\Logs\Microsoft-Windows-Ntfs%4WHC.evtx

                                            Download File
                                            Process:C:\Windows\System32\svchost.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):65536
                                            Entropy (8bit):2.1542505361248714
                                            Encrypted:false
                                            SSDEEP:384:Z9hqILI6I6IUI+I4IZIhISCI3hUICIOIDIMIfINIEdImIDIXIjlII+I/IAIiIkIg:/HZhxKkDBhT
                                            MD5:3CEC1D686413B8E98FCBD789A56DDBE8
                                            SHA1:FA31F4C44F815458EEFAA9CC27F0DE2B4C2509A6
                                            SHA-256:85E45458806E48C42D4010DE1FBF208282294204CD3F93D808E77CE43BD49118
                                            SHA-512:4AD5C020A1949DDA42344DB8BEDE56A4799550F2670955631C9175290557516675934B8E49253BEB2C7747D94C58A54BC6E5E34F6352B1FCC965BD8AD7AB9046
                                            Malicious:false
                                            Preview:ElfChnk.........Q...............Q............o...q..-......................................................................................................................=...........................................................................................................................f...............?...........................m...................M...F.......................&...........................................................................................................................**..................S...........w.&.........w..._.|.1+O.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                            C:\Windows\System32\winevt\Logs\Microsoft-Windows-Partition%4Diagnostic.evtx

                                            Download File
                                            Process:C:\Windows\System32\svchost.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):65536
                                            Entropy (8bit):3.8996910875015867
                                            Encrypted:false
                                            SSDEEP:768:/41WS5OAT1rPgAT0nH15T0nr15T0nQ15T0nW15T0nr15T0nB15T0nh15T0nb15TT:dScA
                                            MD5:C44DE5E83424639B94A2A90268429E27
                                            SHA1:CF4EC67079E164F36E1002A27E727A65FA3E8FF7
                                            SHA-256:A6F0097EFCFE930E5DAB17B0528052C87E89411A24E3D385183DE1E40836FA0D
                                            SHA-512:9897510A9F38CAD487EE2DF982A64E6F1660693A206FB5E2891AEA61AB2CF2FABA1157F18008F8346B274358FFA27BFE3CE65A81BBCAC3F4D5BECF10F6E15BE1
                                            Malicious:false
                                            Preview:ElfChnk.Y.......[.......Y.......[............'.../.........................................................................I..Z........................................B...=...........................................................................................................................f...............?...........................m...................M...F...............................................................&...................................................................................**..8...Y........n_I.9......../X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                            C:\Windows\System32\winevt\Logs\Microsoft-Windows-PushNotification-Platform%4Operational.evtx

                                            Download File
                                            Process:C:\Windows\System32\svchost.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):90928
                                            Entropy (8bit):5.041339025991445
                                            Encrypted:false
                                            SSDEEP:768:OucC5TweYiQBFEm8wcK1vrvLcucC5TweYiQBFEz:yefQaOrDMefQA
                                            MD5:DE6AF47D6A42B858B97F61666B4BA938
                                            SHA1:BF9E4C8531B6459479F2397D64E109C87E0E8749
                                            SHA-256:E6177D5D150B222713F917F330E0AE4F603A1D5988FA185921C867801EC68363
                                            SHA-512:9D6B1B29C05A1A7F633A9EDB20A8E6081F568BD6EB1C450C47D0FD20A3CE44B966493FAB545B691E371B7107FD0F30EF4128B4574A5EF139DBBEA1F52C6DDE15
                                            Malicious:false
                                            Preview:ElfChnk..*.......*.......*.......*...........W..(Z............................................................................q.................^...........................=...........................................................................................................................f...............?...........................m...................M...F...........................................OG...................B..................................................7............K..................**..x....*......X..e.[......../X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                            C:\Windows\System32\winevt\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx

                                            Download File
                                            Process:C:\Windows\System32\svchost.exe
                                            File Type:DIY-Thermocam raw data (Lepton 2.x), scale 4-8, spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset 0.000000, slope 10384593717069655257060992658440192.000000
                                            Category:dropped
                                            Size (bytes):65536
                                            Entropy (8bit):2.0537278914911363
                                            Encrypted:false
                                            SSDEEP:384:xho8N8M8p8d8I8K8t8v681o8t8K8aI848s8D828P8N8285818n8U858w8v8yt8+w:xj31lT
                                            MD5:1820A0CC0157994DF1DE154990FF97A3
                                            SHA1:01D1E6DEDDC8F90BD6A95EB2E0029375A0DC10F6
                                            SHA-256:E715D3E2583E8E1CA7FEA44C0C15F139468BD1C3521DB27B6EB030216659FDC1
                                            SHA-512:1192793EFF5505948626915C0EB2377AED22239E4668C6D851432DD40869A14231192DE31464FF8051735802F22893CEB98C67EE2359FED7F02D6E0C759EB2B0
                                            Malicious:false
                                            Preview:ElfChnk.........@...............@...........8f...g...G(...............................................................................................................V...=...........................................................................................................................f...............?...........................m...................M...F.......................&...........................................................................................................................**..(...........e...S...........w.&.........w..._.|.1+O.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                            C:\Windows\System32\winevt\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx

                                            Download File
                                            Process:C:\Windows\System32\svchost.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):65536
                                            Entropy (8bit):4.222976581592769
                                            Encrypted:false
                                            SSDEEP:384:ahuvnvmvJvBvdvrvwvSvovl+v4v6vvvmvcMvOyv4vCvAvTvGvP+v5vRvH8vUv5v+:aNzTEejRRTR2
                                            MD5:898BE7155AF8C5210FCC3E2791555582
                                            SHA1:C1707B34EA7DBBAE820BBB46E89F07BC62D6B057
                                            SHA-256:364616EDD194F52E5BDFE5FE8DC84315A1D8083425B35477432FF2C257B46E66
                                            SHA-512:923C46440BE007B42EA6F846C0DD7608E5C5688DF6738C49DCE3BFD0DD7CAC3E957402B30FDE422AE218AD7AF02C5A829CD0E17E4EF2B07EF836D09865ADCA31
                                            Malicious:false
                                            Preview:ElfChnk.........................................P...',.........................................................................1................v...........................=...........................................................................................................................f...............?...........................m...................M...F.......................&.......................................f ..........................................................O.......................**..............l..-T...........w.&.........w..._.|.1+O.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                            C:\Windows\System32\winevt\Logs\Microsoft-Windows-SMBServer%4Operational.evtx

                                            Download File
                                            Process:C:\Windows\System32\svchost.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):65536
                                            Entropy (8bit):3.0928339855882148
                                            Encrypted:false
                                            SSDEEP:768:JS/Bp+UdTU8UqOUyGUwaUpcuUvKUruU6DUZ5UtaUKOUpSUv2UwLiUIeU7bUhCUrq:Q7rw
                                            MD5:E5E5CB492BDAFD78681C8FD31E7AF796
                                            SHA1:642AB8A4CEEE204110C55CAD1595DD56CE962933
                                            SHA-256:0505C443132FE0270224E4E107361F3D89BE1E7FE744D2EB1A13E6C0A8054120
                                            SHA-512:8C04C3B0C1AAE779639F41E760C2BDB7B4EF24A153232D8C5F5734C567425048064BCB324F985A2B90F23A876D365F1FF70E4549E2BD33543541D67F214F3532
                                            Malicious:false
                                            Preview:ElfChnk.....................................8...h..........................................................................A...................C...........................=...................................}.......................<...............................................................f...............?...............................................M...F...........................................................&.......................................................................................**..h.............h............>.&.........>..'.W.U2..9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                            C:\Windows\System32\winevt\Logs\Microsoft-Windows-SettingSync%4Debug.evtx

                                            Download File
                                            Process:C:\Windows\System32\svchost.exe
                                            File Type:data
                                            Category:modified
                                            Size (bytes):112240
                                            Entropy (8bit):4.305862504474589
                                            Encrypted:false
                                            SSDEEP:768:lGCHg0B0cWK5Pc6isrzhiGCHg0B0cWKyzR:QKGcWOPnzRKGcWDzR
                                            MD5:3E9E48F2B5F9FD54EE07B5D1EB5DA87D
                                            SHA1:F705007809C302FA95A0975D069436F890ACC4F9
                                            SHA-256:2FB086D790CE4CD94E7A4CFC79FED3F3234ACFEEF452742D4C68B8991F69AD36
                                            SHA-512:5CC2E7EF6A2B146434B57436C8C720D861358CC7D43F9CA847F59CBFE11E5E10666B8F2A10647607A94FD269BB5607B4401A4E48451E3D60FDC19B3D73BF6F2B
                                            Malicious:false
                                            Preview:ElfChnk.<.......s.......P...................h...p.... 2.....................................................................g.F.................(.......................P...=...........................................................................................................................f...............?...........................m...................M...F...........................!b..................................&............................................................;......................**.. ...P........v...9......../X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                            C:\Windows\System32\winevt\Logs\Microsoft-Windows-Shell-Core%4AppDefaults.evtx

                                            Download File
                                            Process:C:\Windows\System32\svchost.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):65536
                                            Entropy (8bit):3.4160175146429084
                                            Encrypted:false
                                            SSDEEP:1536:YjtJTcmXTfu/hD9ouzDZx+DWQeD8yiM4C0BYEeKee6lFY99PXg95RA2IektFNEfk:Y5JTcmXTfu/hD9ouzDZx+DWQeD8yiM45
                                            MD5:723728B119BF371929EEBC4AF7DD8E23
                                            SHA1:9790467B8924422CE9420E04A23282995D0E6BE3
                                            SHA-256:86A5E0A0563A4B9A748881D677E3FD97C71B9815F8853569278CE6E5B85365E7
                                            SHA-512:0D65F1405BD0CF40A82974561DD2F29545A612CBA4A4FCA0D61EE073C149490F672C1B1A742EE82A388853740CB9DD3C6B956D4250F31928FE35CACE8F5A8133
                                            Malicious:false
                                            Preview:ElfChnk.~...............~.......................x......5.....................................................................h..................0.......................X...=...........................................................................................................................f...............?...........................m...................M...F...............................................................&...................................................................................**......~.......=............./X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                            C:\Windows\System32\winevt\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx

                                            Download File
                                            Process:C:\Windows\System32\svchost.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):65536
                                            Entropy (8bit):4.462065794352662
                                            Encrypted:false
                                            SSDEEP:1536:yxRoE7CvraD3EfhdzvOpA8ZD7AlTEhHogHv874qYpihWbkKkj3fnBePkTiNVwWF/:yxRoE7CvraD3EfhdzvOpA8ZD7AlTEhIG
                                            MD5:634B7D0140C5BCDC5E09EF6A157D3CA9
                                            SHA1:FCEF7B231BF1BBB70422F3346937DF3498604A7D
                                            SHA-256:16FC44C60A15808F3D3088A7B5CA8C19293D10E2EA18C3ABB2E75FEDD49F3F08
                                            SHA-512:1742730C73164655FE80ECE6F66D4A9F899E214D7D2AEFD80B9FB0E9F96C0DF6A3411F449009DEA9761DC50204AF9BF679C9C849ABAFB54E63A47BE7F720A7CF
                                            Malicious:false
                                            Preview:ElfChnk.0&.......&......0&.......&..................s.. ....................................................................t...................0.......................X...=...........................................................................................................................f...............?...........................m...................M...F......................................................................................................................a~...y......................**......0&......\[.>.[......../X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                            C:\Windows\System32\winevt\Logs\Microsoft-Windows-ShellCommon-StartLayoutPopulation%4Operational.evtx

                                            Download File
                                            Process:C:\Windows\System32\svchost.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):65536
                                            Entropy (8bit):1.95495667152001
                                            Encrypted:false
                                            SSDEEP:384:hhq7v7l7UZ7r7B7c7li7x/7Z7Z747A7rK7Rx7fy7P7C7I7F7W7DX7z7C7B7Z7f7b:hGzb8
                                            MD5:207070F55BDD6C076F86FE1F94267FAF
                                            SHA1:4A72985E1A32E99C4DE40D5C0927DDE4A878BA21
                                            SHA-256:E3E26612DA5AD020AEF05E58C6CA078A8F0A1157419D0E8F97D90D4CD784338B
                                            SHA-512:2CF76ED0C5ACC824D5E53AE10AD75AA98EBB3DD18806288AE203E22FC1F191E90DBE2D9366A6B55DB6A6424C5CE1B24F7C96BC91B3466C9E54917BD0FC338FA4
                                            Malicious:false
                                            Preview:ElfChnk.........2...............4............\...^..0........................................................................I.I........................................0...=...........................................................................................................................f...............?...........................m...................M...F...........................................m!..................&...........................................................e.......................**............................/X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                            C:\Windows\System32\winevt\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx

                                            Download File
                                            Process:C:\Windows\System32\svchost.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):65536
                                            Entropy (8bit):4.25845726685135
                                            Encrypted:false
                                            SSDEEP:384:jhwuTDFbuJuuDu/uVuuvu7uu6uOuU/ueuu/uFuuVuauUmuPuuAutuu2kuzjuUaur:jHawuFBoRW3L463zLKxWNmu16S
                                            MD5:3C6A30703741417619F7462E41CE2BE8
                                            SHA1:5F2EC46813F9DE24921D080B6A9E91C116E378EF
                                            SHA-256:B04CFC40D01C41748662302C062156C8E1D1C840397A2613C650576626A90688
                                            SHA-512:E8F335DB3A8706DADB6788EA60F37F67BBC0C0FE6F1D09DCA6032AB1864AD6E4E626D2E714364884DF568BAA8E720F9D75056CE0BAE6139AC81812AB149D3CD9
                                            Malicious:false
                                            Preview:ElfChnk.6...............=...................8.......4.$d....................................................................H.nP........................................F...=...........................................................................................................................f...............?...........................m...................M...F...............................................................&...................................................o...............................**......=........*............/X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                            C:\Windows\System32\winevt\Logs\Microsoft-Windows-SmbClient%4Security.evtx

                                            Download File
                                            Process:C:\Windows\System32\svchost.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):65536
                                            Entropy (8bit):2.344847625579545
                                            Encrypted:false
                                            SSDEEP:384:1heu/uSuWugu5uGuFu5ut1u7su+uPudu3uxuIuTuxufvuIUubuMuBuquZu/uKu9U:1P6ZDGl
                                            MD5:8C42E74E8C66ABCDB2D6F760472D2230
                                            SHA1:A51D713DD43DDC5E6A3C13261A0A0021F3DCC5A9
                                            SHA-256:0FCC0A933EEBF5C555865DD686BD91F804B2F7344F7A241C59D43453E50AAFCF
                                            SHA-512:571089787893446D0C34C6A9D54D975D130921BD41C980388616F01C040D34C300044F1B40A79B522455C852AC7E1B7A269E98BA690815B1809A62D500B77728
                                            Malicious:false
                                            Preview:ElfChnk.........H...............H............z.. |..th./.....................................................................8..................$.......................L...=...........................................................................................................................f...............?...........................m...................M...F.......................&...........................................................................................................................**..............%,H(T...........w.&.........w..._.|.1+O.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                            C:\Windows\System32\winevt\Logs\Microsoft-Windows-StateRepository%4Operational.evtx

                                            Download File
                                            Process:C:\Windows\System32\svchost.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):65536
                                            Entropy (8bit):3.2934272914022573
                                            Encrypted:false
                                            SSDEEP:384:4ahPAodANA9APA7SjAkxArIvjA2UlA/A3AnA7ATAnALAlAfMAYQAgiA/ABAxAsAP:4a9SNmIvvfek9kOj
                                            MD5:4670D6CB2003839F80297A663BDCD516
                                            SHA1:C0F7D8BD2AA6BCD0E64A5B600AEBA1993B58F5AC
                                            SHA-256:A75A797378A25BC32A19447409D149F84DDE2E12863310EAD51E67FD37DD88C8
                                            SHA-512:08E649ED0E553EBFA6A89F71AF1B195FA71202A4CD8FEC4CDF460C5E177B04A6B36230E5F72A7E2CFC94489752DF1A55387630636CFF3E30E66305A4B7C4ACAF
                                            Malicious:false
                                            Preview:ElfChnk.........r...............r...........8.......L..P....................................................................o.:.................4.......................\...=...........................................................................................................................f...............?...........................m...................M...F...........................M........................%..........&...................................................................................**..............}y.._........./X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                            C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storage-Storport%4Health.evtx

                                            Download File
                                            Process:C:\Windows\System32\svchost.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):65536
                                            Entropy (8bit):2.4235578493494723
                                            Encrypted:false
                                            SSDEEP:384:Thk+pUYnpdo4pd+pdnpdwpdVpd+pdrpd4pdRpd/pdqpd9pdopdKpdXpd8pddpddB:TI
                                            MD5:F73A1176C1C3480A891DE6E261F5C6FF
                                            SHA1:51C172AC2988571B01854B05D9C529E5D28792BC
                                            SHA-256:06BC7D1A33F115D8AB755EBA74A5143077BD41A34E02543138C0F17385305D5E
                                            SHA-512:246B38C086949B9D9D9AA30D0D91E75049FD7A60DD1EF54B3D59CBF78CA1BEFB17A0DCE9147E3F50CDCC9DF05BA67D3751A94472807E686FB03B5D55522CB830
                                            Malicious:false
                                            Preview:ElfChnk.&.......L.......&.......L............... ...........................................................................yk2........................................:...=...........................................................................................................................f...............?...........................m...................M...F...............................................................&...................................................................................**......&.......yN..^........./X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                            C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storage-Storport%4Operational.evtx

                                            Download File
                                            Process:C:\Windows\System32\svchost.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):65536
                                            Entropy (8bit):4.1165076074122675
                                            Encrypted:false
                                            SSDEEP:384:ehmCpaKpmpL6pAsUpfwpAbdpABApAGQpTVp2LMpIJpAbWpW8pAWWpAJap8kpAE0E:ee
                                            MD5:D3ED7D15A868022FF51427F09AE9DF78
                                            SHA1:5C581BB0CB2FC5FFDD5421EDC8385E499B8E94F2
                                            SHA-256:BA1E741BDC4BE33B4990F0FC1C5EAAC2694C97E75FE5CE44FD9E259A634E2DA8
                                            SHA-512:32A5BE3C5DDC94F337AECDD6531801FCDFBF000EE74C29238A7399037747EA407E8852EBEF5713D20BF60B43133A505A3D1188D40711560A9D0E9EE45DC2BFF2
                                            Malicious:false
                                            Preview:ElfChnk.........R...............R...............X...Oq.................................................................................................................D...=...........................................................................................................................f...............?...........................m...................M...F...............................................................&...............................i'..E...............................................**..............a...f........./X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                            C:\Windows\System32\winevt\Logs\Microsoft-Windows-StorageSpaces-Driver%4Operational.evtx

                                            Download File
                                            Process:C:\Windows\System32\svchost.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):65536
                                            Entropy (8bit):4.23578961372723
                                            Encrypted:false
                                            SSDEEP:384:nhoCKCQC8CUCLCYC7CFCuC2C+CxC1Cl0Ct4CCC2C7CLCtCeCeCiCmjC0zCpDCMCY:n+fNJCRxkjZHTUL
                                            MD5:FD12E39BDD53B4F6C68308373B84AE82
                                            SHA1:F4C8B45887BA886C67B7653DC82199ABE6C03DDB
                                            SHA-256:88E417E6EA6A692171ED218CC22FCC633B490A2CC10D1E75A3BA1A80149F89E2
                                            SHA-512:0D3B6C926BF67624C1527EE849E65F3EA22C34723FF858F252E909CA25AF94815EEA64A91B163A0B8E24C217BB4A35B2A2DAB495124D114E2C550D855BFA2766
                                            Malicious:false
                                            Preview:ElfChnk.........P...............P....................8sC........................................................................................V.......................~...=...........................................................................................................................f...............?...........................m...................M...F.......................&........................................%............................................................................../...**..@.............1.S...........w.&.........w..._.|.1+O.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                            C:\Windows\System32\winevt\Logs\Microsoft-Windows-Store%4Operational.evtx

                                            Download File
                                            Process:C:\Windows\System32\svchost.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):77176
                                            Entropy (8bit):4.6717979422113025
                                            Encrypted:false
                                            SSDEEP:768:Z9snCS/9snCSTB0Fpby22wbyDEbyN/mbyZ:+CSMCSmnfigm/yk
                                            MD5:D16535BD6FC6044336C00F2DB5D4F36B
                                            SHA1:E279AB5E8079B38F6D71409A05159C227AB8FB82
                                            SHA-256:DBC9CC807201AF4CE51CFB685C077F2E988F56A6B3F27111CE7774A7E40BAF1F
                                            SHA-512:10E39ED5DDF6C4D99D810C3DF710C37C6EC2A29A2402BCEBDB0D22E00B9714792A1369774FC9B633ACC0F6741764ADF10A052BBF0C019785D0C6B0FC0EEA9EDC
                                            Malicious:false
                                            Preview:ElfChnk.M.......Z.......M.......Z...........@+..x-..*........................................................................=.~........................................4...=...........................................................................................................................f...............?...........................m...................M...F...............................................................&...................................................................................**..p...M............\......../X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                            C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storsvc%4Diagnostic.evtx

                                            Download File
                                            Process:C:\Windows\System32\svchost.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):65536
                                            Entropy (8bit):3.1233548013740915
                                            Encrypted:false
                                            SSDEEP:768:bvgffnPNm/2sY3pLwIkJ2jLHbj9fr7w2imMFopTMFw3grHUP90:EGaY
                                            MD5:18129A6AD9E0E2E9967A38CEE25610F7
                                            SHA1:660F0F224D114C6ED20719470863213729034AD3
                                            SHA-256:744B45C0DFB49E2B37EC61CA38D2F5C08C669B3D46863305155C550378F8FAEC
                                            SHA-512:2ACEF49A92DB67D284838E5EF439D70250F833FAD7599940CC368B3C42E7B04DB24E75D9F785558CBD760AB73E735CB805CC04419FA1A454927C96CCD8E2A46F
                                            Malicious:false
                                            Preview:ElfChnk.........@...............@..........................................................................................(z................. .......................H...=...........................................................................................................................f...............?...........................m...................M...F.......................&.......................................fC...................................................................1..............**................8.S...........w.&.........w..._.|.1+O.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                            C:\Windows\System32\winevt\Logs\Microsoft-Windows-TZUtil%4Operational.evtx

                                            Download File
                                            Process:C:\Windows\System32\svchost.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):65536
                                            Entropy (8bit):0.20363885681099977
                                            Encrypted:false
                                            SSDEEP:48:M4W4urP+MZQNRBEZWTENO4bpBdocjwi/6FgVt:NcKNVaO8tocV/6Fg
                                            MD5:8DF23D4FD33C7A96C88F8BEAA26D33A1
                                            SHA1:B08A40CB88ED5C8C0AD240FE4264F7782DB67323
                                            SHA-256:9E527CA6DF1111A2D5C858F34409F3A7BBEF323657B2F4A07535D11DCB58E733
                                            SHA-512:C597E0D4FFE0439C92376E8718C68CE9E391ADC0D660397D778AFAC3F38A72B726796B756FFDF2DCA410424514B1AED9C72EF5DB06F862D9F4A48641890F1F50
                                            Malicious:false
                                            Preview:ElfChnk..............................................c......................................................................8.C................. .......................H...=...........................................................................................................................f...............?...........................m...................M...F...............................................................&...................................................................................**...............f..[......../X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                            C:\Windows\System32\winevt\Logs\Microsoft-Windows-TaskScheduler%4Maintenance.evtx

                                            Download File
                                            Process:C:\Windows\System32\svchost.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):65536
                                            Entropy (8bit):4.299026542539241
                                            Encrypted:false
                                            SSDEEP:1536:XKoKKK3KOKbKrK7KAKqKpK0KXKAK8KTK+KfKvKYKqK4KGKkKhKjK9KyKeKhK1KK0:XKoKKK3KOKbKrK7KAKqKpK0KXKAK8KTP
                                            MD5:655CF07B534499B5897A98445A773894
                                            SHA1:77CD90DD0E3F2560471A19F1CB3E5D00F7FB97FC
                                            SHA-256:757F246BA51102679DA2631750560EC4E616955CA1D70855E2F71B090AA87386
                                            SHA-512:921DE3EFEF314813CCFD9C1255DC22D33638CC76AC00914389093430AAFDAF043CB8542E78DA7515B33138169A7C77C7855BD6D575F4222BAE16B5EA21E6344F
                                            Malicious:false
                                            Preview:ElfChnk.....................................`}......V.......................................................................<H^.................,...........................=...........................................................................................................................f...............?...........................m...................M...F...............................................................&...................................................................................**..H...........N..)........../X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                            C:\Windows\System32\winevt\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx

                                            Download File
                                            Process:C:\Windows\System32\svchost.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):65536
                                            Entropy (8bit):4.095482706952696
                                            Encrypted:false
                                            SSDEEP:384:oh8i4i/yi6iDiDi5iwiliM1iNiUiXKbieifiGiOiOiIiIiBigi1iVinixiEiVcio:op6xKouKN
                                            MD5:8279286FA538299CEA5E1B7A67F7D6C2
                                            SHA1:23C59B87F261098A9D8F9D151C9DA58D89115C6D
                                            SHA-256:9D7410C5B451CEB4EACD2C4C85866C50509862F12FD297E1C08093D785577765
                                            SHA-512:D2CDBC8D312DBF1CA68C5EA1B17AB2323FD09349836B599EE4AB9920A995C0A04E0BA52006E5A2742301D7007490A759774AC917BBF014A2865F301E380B334B
                                            Malicious:false
                                            Preview:ElfChnk.....................................hQ..pS............................................................................$.............................................=...........................................................................................................................f...............?...............9.......B.......................M...F...........................................................&...............................................................q.......................**..................f...........>.&.........>..'.W.U2..9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                            C:\Windows\System32\winevt\Logs\Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx

                                            Download File
                                            Process:C:\Windows\System32\svchost.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):65536
                                            Entropy (8bit):4.308195154185309
                                            Encrypted:false
                                            SSDEEP:768:cxSaa8NlaranavazaZa5agCadadaZadacaRaZasasaUaUaMacaIaYaEakaAagakz:wN+n
                                            MD5:E9DC69694D7EB393F765C92A061B1B05
                                            SHA1:BB187BF1A6C3A7597B086270B5D929625724F739
                                            SHA-256:4A8C24850B0BF12CB133D66527C22F60445FC630458852FD4639997A104298B3
                                            SHA-512:4FC135129CCB66F136CDA206D44A97951321D762E9E5DF44800AA3788BCA2CB56B3E5128F09FD0AEFBC271791346872EC032CEF6B5D68B1D3EAF0225A17C15E6
                                            Malicious:false
                                            Preview:ElfChnk./.......x.......E.......................P..........................................................................^..................`...........................=...........................................................................................................................f...............?...........................m...................M...F...............................................................&...............................................9...................................**..H...E.......3..Y.9......../X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                            C:\Windows\System32\winevt\Logs\Microsoft-Windows-User Device Registration%4Admin.evtx

                                            Download File
                                            Process:C:\Windows\System32\svchost.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):65536
                                            Entropy (8bit):3.9299077888714704
                                            Encrypted:false
                                            SSDEEP:384:FhNXDcXxzXZXeX/XOXMXauXLiXCXVX1XYXZXeX+XiXfXuXFXRX9XsX5XLXzXgXy7:FyAgGHqOT
                                            MD5:76BA72EAE141C7FB6DE412773F565CAF
                                            SHA1:87B63EFC028914E34F6E2DF282B58617DCBC7CB3
                                            SHA-256:C38FD9C6EE166B208F582F077AAD80EED644C244BB513205A53523026531FBF8
                                            SHA-512:C41CD72B9EB96894065505BB0EEB71617AA718718C179CD30D61ECF229DA6C89DFFDF34D49007FD39A44BBC288C65603DC93B77BD3EF24BF95AD48CB78AA0A82
                                            Malicious:false
                                            Preview:ElfChnk.........J...............J...........8........Y-f....................................................................._..................j...........................=...........................................................................................................................f...............?...........................m...................M...F.......................&...........................................................C...............................................................**..............C..?T...........w.&.........w..._.|.1+O.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                            C:\Windows\System32\winevt\Logs\Microsoft-Windows-User Profile Service%4Operational.evtx

                                            Download File
                                            Process:C:\Windows\System32\svchost.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):65536
                                            Entropy (8bit):4.33351270240575
                                            Encrypted:false
                                            SSDEEP:384:7h2LmImemomHmOmamCm2m2m3mnBmGqmFmJmFmKmrm2mOmsmSmmmVmghmRmBmBSXy:7/fg
                                            MD5:A3CECA86515603ACD21A5619F5FA982F
                                            SHA1:500B2E9A12AF8777926BE38BC11D271587609701
                                            SHA-256:3C746E1A34EC9CC467DDB850D98FD6C78E4CD64B42902200B223264D58921BF8
                                            SHA-512:82ED8ABA2FEE142C939563E8F105A00699CF39B87A3C1950CCC15AE83323264CE814018118CE6F7920F07B42CB603400C223D6CF8FFB00383C07D19E1948900B
                                            Malicious:false
                                            Preview:ElfChnk.........................................P....4.b.....................................................................L).................Z...........................=...........................................................................................................................f...............?...........................m...................M...F...............................................................&...............3...................................................................**................y........../X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                            C:\Windows\System32\winevt\Logs\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx

                                            Download File
                                            Process:C:\Windows\System32\svchost.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):65536
                                            Entropy (8bit):1.9858077593970604
                                            Encrypted:false
                                            SSDEEP:384:/h0h21c2kS27W2VP2en32x2U2x2V2d2N26A2q242R2V2Y2w25vb2C2k2o2g2s2Ix:/2C5
                                            MD5:EBB898FA488ABABDAB76F93EAFF3A7B4
                                            SHA1:664A9CB2580B91B05557A782EC6BB10F796B157F
                                            SHA-256:C3664CA813702F10B279E763DBA0A80AEC287C478C07883D1B385342EFD01110
                                            SHA-512:24FE4811C011BC133711BA3916F8A18C6F7D12AA2BB0875683CECC0E8A992735D9BA7BFF0CE4CCAB2D1D4DB8029254D1317278DDC7029C6AF54D6B4A8C8CAF8B
                                            Malicious:false
                                            Preview:ElfChnk......................................]..._..^.I.....................................................................)..t................L.......................t...=...........................................................................................................................f...............?...........................m...................M...F...............................%...............................&...................................................................................**................+.g........./X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                            C:\Windows\System32\winevt\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx

                                            Download File
                                            Process:C:\Windows\System32\svchost.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):116936
                                            Entropy (8bit):4.302524617140346
                                            Encrypted:false
                                            SSDEEP:384:UVhpR+daRsRjRQRPRZX8R6R/aRXRsRqRbR2R7RoR/RlR9R/RlRlRaRMR0lbRLRzH:eLlK4bLlK4R
                                            MD5:C44624B88E73C18E8DE18E55BDD1CCD1
                                            SHA1:45B102A717E24283885422BF679DE892554B96E1
                                            SHA-256:49045A895B9E750EB0EC22ECAF12EF0064C9C485BBE6168E8587E83C172FC2C8
                                            SHA-512:6F9DCE53B937FCB9402B7CC5F3ADE0AB700AC03CC0FED3C856539D2ECC0F9EC5AC1F1CFE1358974486A14D15A7CE2141B420C46B864D4B154BFE4CA74A9D4505
                                            Malicious:false
                                            Preview:ElfChnk.Z...............Z...........................#.S............................................................................................2.......@..............=..........................................S.......................%...........................J...........................f...Z...........?......................................?.......M...F...a...........}...................................y.......&.....................................................................................**..X...Z........;..9..........>.&.........>..'.W.U2..9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                            C:\Windows\System32\winevt\Logs\Microsoft-Windows-Wcmsvc%4Operational.evtx

                                            Download File
                                            Process:C:\Windows\System32\svchost.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):65536
                                            Entropy (8bit):4.386346226032655
                                            Encrypted:false
                                            SSDEEP:384:YhCh7whqhvh4h/hMNhihhiVqhXhPh5Vh+hth0qhPdh4zshS3hi9uhiZhhpYhAThc:YkMfO1mDIH4
                                            MD5:5F4B2BE9E85F278346DFE1CAF76BBCCF
                                            SHA1:0BADD0B3FC1924FE4A3AD5BB40ED1960551394DA
                                            SHA-256:23F4F1F14256E404CEE78CDC9EFB49C1B51E0C42FC9E44F463FE5FC91E593418
                                            SHA-512:D1FD10530785355578066AF943598248D46AE8C9CEDD0FD9D4FC6BAFDCF9C701E55135008BD4073D19C96BA5DA6C18A8B34B45BCD0393212428A42C6123654FC
                                            Malicious:false
                                            Preview:ElfChnk.........6...............6...........X....... .........................................................................Z.........................................l...=...........................................................................................................................f...............?...........................m...................M...F...........................................A...................&...................................................................9...............**..@...............,........./X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                            C:\Windows\System32\winevt\Logs\Microsoft-Windows-WebAuthN%4Operational.evtx

                                            Download File
                                            Process:C:\Windows\System32\svchost.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):65536
                                            Entropy (8bit):3.5472730164672246
                                            Encrypted:false
                                            SSDEEP:384:Ch2VaVYVtVbVwVoVTVJVgVZVrVdVfVKVHVl/V+VnkVkgVOVEVRVtVsVCVFVhfV5i:CWIreU7U7enh
                                            MD5:CC82A81AD0A78245AA328420E38F641E
                                            SHA1:370920E7A1718C0E2C2A5FEB2B63B703E7A16BD3
                                            SHA-256:A694AD5D2CBC8CE32A73382A5FF90762729298D812F99D317D3F15A0C474CB5E
                                            SHA-512:8C51DD6D07930259B2DD00BD3461F53EA609440966DBCB0E429F68A3CC8B800EF8BB7AA7EB48A3BCD73FEFC0015E083F4B6EF174B48F35BDE9A4EBAFCAB135E5
                                            Malicious:false
                                            Preview:ElfChnk...............................................E....................................................................,..R................&...........................=...........................................................................................................................f...............?...........................m...................M...F.......................&...........................................................................................................................**..P...........F~..S...........w.&.........w..._.|.1+O.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                            C:\Windows\System32\winevt\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx

                                            Download File
                                            Process:C:\Windows\System32\svchost.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):65536
                                            Entropy (8bit):4.28835624131716
                                            Encrypted:false
                                            SSDEEP:384:AhuZBwBQ/lrBwB7/FBwBK8bV5BwB5dYBwBkBwBHBwB/BwBGBwBkBwBd5BwBJ+Bwo:A58bSH9
                                            MD5:EC462CF0445EB4D0861CC62BE0588B64
                                            SHA1:127547AB89EE1AF7D0562BC5DBDC65E8E2242B77
                                            SHA-256:3B12D08D43163A5424C53B78CD053CA0170CBF53E96D4BA08411D32224772727
                                            SHA-512:A8FDCAC3465AD13094EDCC11B4B4DAB4C6E245D12CFE519B8496CB4F55470423973F875374D9AF5A21D29B4ACEA046E72644F7F2B92847BA78B64023B2D32650
                                            Malicious:false
                                            Preview:ElfChnk.............................................|5.......................................................................PS............................................=...........................................................................................................................f...............?...........................m...................M...F...........................W...................................&................................*..................................................**..............6\. ^........./X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                            C:\Windows\System32\winevt\Logs\Microsoft-Windows-Winlogon%4Operational.evtx

                                            Download File
                                            Process:C:\Windows\System32\svchost.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):65536
                                            Entropy (8bit):4.399143402450045
                                            Encrypted:false
                                            SSDEEP:384:Bh1wUEFUEmUEMUEgUENUEqUEqUEWUEvUESUE4UE4UE3UEbUEpUEpUE9UEgUExUEZ:BLuWRqXJQe
                                            MD5:0A6EA9FFB36FCE1CA5FC391F71CCBB07
                                            SHA1:3EC7C009F99DFDCA0F928EEE8D5BD1DEAA5D9974
                                            SHA-256:9501E606B0391138F39CCC472E00804C5F6138732F63AD4F24535A9F6C13CCE7
                                            SHA-512:60B6AD91EF3F78108D847C9B7F1E527AA6C159FBF5A52054630EC16EB594CE22A577B021113C078CA4CC078A90B5C31075F4615C45A4CE24CEA980B9875EADCF
                                            Malicious:false
                                            Preview:ElfChnk.........+...............+...........x}......s.tU........................................................................................(.......................P...=...........................................................................................................................f...............?...........................m...................M...F...............................................................&....5.......................................................3......................**.............. 2^O.9......../X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                            C:\Windows\System32\winevt\Logs\OneApp_IGCC.evtx

                                            Download File
                                            Process:C:\Windows\System32\svchost.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):65536
                                            Entropy (8bit):3.4408471966964385
                                            Encrypted:false
                                            SSDEEP:384:pw0+VsWZttC95UZhVhRoSxHJUBvv3R2ipPR7odz6L7RPLfVXYgXcIycjd52T42Si:p3sfo/0NQhxf27SVSVTuziNpBg12U
                                            MD5:44092C364E8D55775B9DDFC8D91AE97D
                                            SHA1:A19690BA05C8B6009B8F4CE070BCD4ABC8BC39BA
                                            SHA-256:0A5058FE3DC424573205F96E939213E251FD63FD2AA06F764B15C5CCF1692C63
                                            SHA-512:96D0DCF022A2A6B41241A8C820E27D5F59A5331916FFFBB36315FB943A17DC43EBB8DA4F63456BDA658AD441774D22B3079E66A09177598C1AAD762DA9C1455F
                                            Malicious:false
                                            Preview:ElfChnk.........+...............+............Y...Z..'<.......................................................................~.L............................................=...........................................................................................................................w...............P...........................~...................M...m...........................x...............................................................&.......................................................**..x............Bo.,.........|.=O&.......|.=O.s.Q...W.E........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..j............{..P.r.o.v.i.d.e.r...G....=.......K...N.a.m.e.......O.n.e.A.p.p._.I.G.C.C._.W.i.n.S.e.r.v.i.c.e..A..M............a..E.v.e.n.t.I.D...'............)...Q.u.a.l.i.f.i.e.r.s................"...............V

                                            C:\Windows\System32\winevt\Logs\Security.evtx

                                            Download File
                                            Process:C:\Windows\System32\svchost.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):69768
                                            Entropy (8bit):4.375857894739811
                                            Encrypted:false
                                            SSDEEP:384:utvFRAB9otxXtvFRAB9otx7oN0ooXooo5m8o5mAo5mXTo5mDo5m6oZeojKo5mfoR:sNAMNAmeEX1
                                            MD5:FA8BC037D057D9D3334D46D7F4BF4838
                                            SHA1:3ED570DFC2F3FDD5802C62DCABA75CFB3C97CC2E
                                            SHA-256:D216AE1017998735F234CF018CA38A9C2DB680202B8D39CF1A4B366271646AAE
                                            SHA-512:4699621E1BCDB0318FCC4DA63F8C30CCD3EC084644218F938AF2A0BA94C168E3BE976D72159FCC703F13CD44965D24084734F4D2F5E893A5BA927F59A0083D44
                                            Malicious:false
                                            Preview:ElfChnk..................~.......~...................3x........................................................................X................Z...s...h...................=...................................................N...............................................w.......4.......................-...................................[...........).......M...R...:...........................&...............................>.......................3...........................................................**.......~......<1...\............&...........0.P\...3.Du?.......A..3...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.....\...........oT..S.y.s.t.e.m....A...............{..P.r.o.v.i.d.e.r.......F=.......K...N.a.m.e.......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.E.v.e.n.t.l.o.g..........)...G.u.i.d.....&.{.f.c.6.5.d.d.d.8.-.d.6.e.f.-.4.9.6.2.-.8.3.d.5.-.6.e.5.c.f.e.9.c.e.1.

                                            C:\Windows\System32\winevt\Logs\System.evtx

                                            Download File
                                            Process:C:\Windows\System32\svchost.exe
                                            File Type:data
                                            Category:dropped
                                            Size (bytes):69616
                                            Entropy (8bit):4.4118460786111955
                                            Encrypted:false
                                            SSDEEP:768:MQvKhR8XwKiYI/fNb+tpt5dGE2LcWkW+TVid:PKz8XwK+apTW+Rid
                                            MD5:3E79B44B6FAC155318CE3D717D99A300
                                            SHA1:D8FCBCD9B625C4E9629F91A43C0DF5C48FE541DA
                                            SHA-256:DF43123880C6D39E98E42D709A886563FDF6BBABD64DC224E5C0348F3E84B9BE
                                            SHA-512:4D1738A39E286702D38F2D2C394611B5585AA401EC6B90F954B9B6DA30A06C341604BD6F5DAC92832F1832F5209632FD1B8A36D2620B351BCA5DEC5501F3FF6B
                                            Malicious:false
                                            Preview:ElfChnk..................0.......0..................7.Ag....................................................................%'kJ....................s...h...............N...=...................................................N...............................................w.......0.......................E...................................W...........).......M...3...:...................................................................&...........................................................................**.......0......h.u..\.........}.T&........}.TA.P[J.......;.......A../...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.....X...........oT..S.y.s.t.e.m....A...............{..P.r.o.v.i.d.e.r.......F=.......K...N.a.m.e.......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.E.v.e.n.t.l.o.g..........)...G.u.i.d.....&.{.f.c.6.5.d.d.d.8.-.d.6.e.f.-.4.9.6.2.-.8.3.d.5.-.6.e.5.c.f.e.9.c.e.1.

                                            C:\Windows\Temp\tempdll.dll

                                            Download File
                                            Process:C:\Users\user\Desktop\dropper.exe
                                            File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                            Category:dropped
                                            Size (bytes):327168
                                            Entropy (8bit):6.316591750729637
                                            Encrypted:false
                                            SSDEEP:6144:JuSz+RPxUiZ2qXwEhGSGvdu0n+OQmVQ6fypHixVPlnUjb9vCiH2J:JfCRPxUiZ2qAEw1vI0+O42VdSX
                                            MD5:373F9ABE64CA95F655601617BF7BCF0A
                                            SHA1:1B268C5E0D5F6D4850B317509EC7F1990A8D453C
                                            SHA-256:0B0D6A4118E25C3F4C8BEEE210F0306DC71925FF6FB952CE3F44E8A55785EDF1
                                            SHA-512:9F8F84D00492E2EDD6A059BE0F652FA269D69DC9B05B1341366A22F2179EDAD522F819484D45CD0712DA679349C271C2D97DBF0A57053148540DD0B48BC2B9FE
                                            Malicious:false
                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........R.................................................z........................Rich...........PE..d.....tg.........." ...).....^.......m.......................................0............`.........................................0...D...t...................p............ ..h...@...T.......................(.......@...............P............................text............................... ..`.rdata...3.......4..................@..@.data...............................@....pdata..p...........................@..@.reloc..h.... ......................@..B................................................................................................................................................................................................................................................................................................................

                                            Static File Info

                                            General

                                            File type:PE32+ executable (console) x86-64, for MS Windows
                                            Entropy (8bit):7.101883395513586
                                            TrID:
                                            • Win64 Executable Console (202006/5) 92.65%
                                            • Win64 Executable (generic) (12005/4) 5.51%
                                            • Generic Win/DOS Executable (2004/3) 0.92%
                                            • DOS Executable Generic (2002/1) 0.92%
                                            • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                            File name:dropper.exe
                                            File size:3'219'456 bytes
                                            MD5:a2d2d6a7f9b52b27a32a93bb3bca4d47
                                            SHA1:9c2c72f0f8c3faffb3601b9e5762a7c97afebcf5
                                            SHA256:c138bac3528a45a5a1fd624fd0b9526d61503dc5a7674aef195fa3cf33c44f71
                                            SHA512:cfc443e576b86c584575116341bb22bdf1d973069ac2a8f10295733fb82c31790015d505c0d0fee3cf500e2a6581912a01cd856d53b3f65d430bc7c9bf45bb40
                                            SSDEEP:49152:dKMfxFX/0Yaej+4sCTbi0BrK1IuNpEbdCrfAKkkhpY1uD8G9T3bgVI+DKt20MJ:dFHkeAjIBv8pYk8GxbgWt
                                            TLSH:DEE5AE16BA4659ACC05AC074834A8A73AA3574CE4B35B9FF05D486383FA9FE41F3C719
                                            File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........C...-...-...-.......-..y,...-..y....-..y)...-..y(...-.M.,...-...,.F.-...-.}.-..x/...-.Rich..-.........PE..d.....tg.........."

                                            File Icon

                                            Icon Hash:90cececece8e8eb0

                                            Static PE Info

                                            General

                                            Entrypoint:0x140156a80
                                            Entrypoint Section:.text
                                            Digitally signed:false
                                            Imagebase:0x140000000
                                            Subsystem:windows cui
                                            Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
                                            DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                                            Time Stamp:0x6774C31B [Wed Jan 1 04:22:51 2025 UTC]
                                            TLS Callbacks:0x40140a20, 0x1
                                            CLR (.Net) Version:
                                            OS Version Major:6
                                            OS Version Minor:0
                                            File Version Major:6
                                            File Version Minor:0
                                            Subsystem Version Major:6
                                            Subsystem Version Minor:0
                                            Import Hash:1ee790a9e24dcc377114ebcc153f87f0

                                            Entrypoint Preview

                                            Instruction
                                            dec eax
                                            sub esp, 28h
                                            call 00007F33CCB50558h
                                            dec eax
                                            add esp, 28h
                                            jmp 00007F33CCB500E7h
                                            int3
                                            int3
                                            int3
                                            int3
                                            int3
                                            int3
                                            int3
                                            int3
                                            int3
                                            int3
                                            int3
                                            int3
                                            int3
                                            int3
                                            int3
                                            int3
                                            int3
                                            int3
                                            int3
                                            int3
                                            nop word ptr [eax+eax+00000000h]
                                            dec eax
                                            sub esp, 10h
                                            dec esp
                                            mov dword ptr [esp], edx
                                            dec esp
                                            mov dword ptr [esp+08h], ebx
                                            dec ebp
                                            xor ebx, ebx
                                            dec esp
                                            lea edx, dword ptr [esp+18h]
                                            dec esp
                                            sub edx, eax
                                            dec ebp
                                            cmovb edx, ebx
                                            dec esp
                                            mov ebx, dword ptr [00000010h]
                                            dec ebp
                                            cmp edx, ebx
                                            jnc 00007F33CCB50288h
                                            inc cx
                                            and edx, 8D4DF000h
                                            wait
                                            add al, dh

                                            Rich Headers

                                            Programming Language:
                                            • [IMP] VS2008 SP1 build 30729

                                            Data Directories

                                            NameVirtual AddressVirtual Size Is in Section
                                            IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                            IMAGE_DIRECTORY_ENTRY_IMPORT0x3054740x140.rdata
                                            IMAGE_DIRECTORY_ENTRY_RESOURCE0x00x0
                                            IMAGE_DIRECTORY_ENTRY_EXCEPTION0x3080000xa53c.pdata
                                            IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                            IMAGE_DIRECTORY_ENTRY_BASERELOC0x3130000x1e44.reloc
                                            IMAGE_DIRECTORY_ENTRY_DEBUG0x2e41200x54.rdata
                                            IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                            IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                            IMAGE_DIRECTORY_ENTRY_TLS0x2e41800x28.rdata
                                            IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x2e3fe00x140.rdata
                                            IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                            IMAGE_DIRECTORY_ENTRY_IAT0x15f0000x400.rdata
                                            IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                            IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                            IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                            Sections

                                            NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                            .text0x10000x15df1f0x15e000d91fe1065e959bd46bd03ad2737e5e83False0.44827078683035715data6.330800773355482IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                            .rdata0x15f0000x1a73a60x1a740044cf17829938fca02b01fec552166f65False0.7778865410883048COM executable for DOS7.39075622308576IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                            .data0x3070000x4a00x2001cfce2dac0df4bde52a55f55d337956fFalse0.349609375data2.7863635849126176IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                            .pdata0x3080000xa53c0xa6002173f48ab50d83738d29d443bbaa745eFalse0.5125658885542169data6.1296309036082635IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                            .reloc0x3130000x1e440x200020161976af0e2cfc77c411b569a72db9False0.485107421875data5.351032841751557IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                            Imports

                                            DLLImport
                                            api-ms-win-core-synch-l1-2-0.dllWaitOnAddress, WakeByAddressAll, WakeByAddressSingle
                                            bcryptprimitives.dllProcessPrng
                                            bcrypt.dllBCryptGenRandom
                                            ADVAPI32.dllLsaAddAccountRights, SystemFunction036, AdjustTokenPrivileges, LookupPrivilegeValueW, LsaClose, GetTokenInformation, OpenProcessToken, LsaOpenPolicy
                                            kernel32.dllGetStdHandle, GetCurrentProcessId, QueryPerformanceFrequency, GetEnvironmentVariableW, lstrlenW, ReleaseMutex, GetCurrentDirectoryW, CreateFileW, SetLastError, GetConsoleMode, RtlVirtualUnwind, RtlLookupFunctionEntry, RtlCaptureContext, GetFullPathNameW, MultiByteToWideChar, WriteConsoleW, WideCharToMultiByte, CreateThread, GetProcAddress, GetSystemInfo, QueryPerformanceCounter, WaitForSingleObject, WaitForSingleObjectEx, LoadLibraryA, CreateMutexA, SwitchToThread, GetCurrentThread, SetThreadStackGuarantee, AddVectoredExceptionHandler, GetCurrentThreadId, GetSystemTimeAsFileTime, FormatMessageW, LoadLibraryExA, InitializeSListHead, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, HeapFree, HeapAlloc, GetProcessHeap, GetModuleFileNameW, Module32NextW, Module32FirstW, CreateToolhelp32Snapshot, GetProcessId, CloseHandle, GetLastError, GetCurrentProcess, GetModuleHandleA, VirtualQuery, GetModuleHandleW, OutputDebugStringW, SetFileInformationByHandle, HeapReAlloc, IsProcessorFeaturePresent
                                            oleaut32.dllGetErrorInfo, SysStringLen, SysFreeString
                                            api-ms-win-core-winrt-error-l1-1-0.dllRoOriginateErrorW
                                            ntdll.dllNtWriteFile, RtlNtStatusToDosError
                                            VCRUNTIME140.dllmemcmp, memcpy, _CxxThrowException, __CxxFrameHandler3, __current_exception, memset, __current_exception_context, memmove, __C_specific_handler
                                            api-ms-win-crt-string-l1-1-0.dllstrlen, wcslen
                                            api-ms-win-crt-math-l1-1-0.dllroundf, truncf, ceil, exp2f, __setusermatherr
                                            api-ms-win-crt-runtime-l1-1-0.dll_initterm, _initterm_e, exit, _exit, __p___argc, __p___argv, _cexit, terminate, _c_exit, _initialize_narrow_environment, _register_thread_local_exe_atexit_callback, _configure_narrow_argv, _set_app_type, _seh_filter_exe, _initialize_onexit_table, _crt_atexit, _register_onexit_function, _get_initial_narrow_environment
                                            api-ms-win-crt-stdio-l1-1-0.dll__p__commode, _set_fmode
                                            api-ms-win-crt-locale-l1-1-0.dll_configthreadlocale
                                            api-ms-win-crt-heap-l1-1-0.dllfree, _set_new_mode

                                            Network Behavior

                                            ⊘No network behavior found

                                            Statistics

                                            CPU Usage

                                            Click to jump to process

                                            Memory Usage

                                            Click to jump to process

                                            High Level Behavior Distribution

                                            Click to dive into process behavior distribution

                                            Behavior

                                            Click to jump to process

                                            System Behavior

                                            General

                                            Target ID:0
                                            Start time:23:37:59
                                            Start date:31/12/2024
                                            Path:C:\Users\user\Desktop\dropper.exe
                                            Wow64 process (32bit):false
                                            Commandline:"C:\Users\user\Desktop\dropper.exe"
                                            Imagebase:0x7ff71c070000
                                            File size:3'219'456 bytes
                                            MD5 hash:A2D2D6A7F9B52B27A32A93BB3BCA4D47
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Reputation:low
                                            Has exited:true

                                            General

                                            Target ID:1
                                            Start time:23:37:59
                                            Start date:31/12/2024
                                            Path:C:\Windows\System32\conhost.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                            Imagebase:0x7ff66ddc0000
                                            File size:875'008 bytes
                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Reputation:high
                                            Has exited:true

                                            General

                                            Target ID:3
                                            Start time:23:38:00
                                            Start date:31/12/2024
                                            Path:C:\Windows\System32\cmd.exe
                                            Wow64 process (32bit):false
                                            Commandline:"C:\Windows\System32\cmd.exe"
                                            Imagebase:0x7ff6cd170000
                                            File size:289'792 bytes
                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Reputation:high
                                            Has exited:false

                                            General

                                            Target ID:4
                                            Start time:23:38:00
                                            Start date:31/12/2024
                                            Path:C:\Windows\System32\conhost.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                            Imagebase:0x7ff66ddc0000
                                            File size:875'008 bytes
                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Reputation:high
                                            Has exited:false

                                            General

                                            Target ID:5
                                            Start time:23:38:05
                                            Start date:31/12/2024
                                            Path:C:\Windows\System32\winlogon.exe
                                            Wow64 process (32bit):false
                                            Commandline:winlogon.exe
                                            Imagebase:0x7ff76c770000
                                            File size:944'128 bytes
                                            MD5 hash:A987B43E6A8E8F894B98A3DF022DB518
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Reputation:moderate
                                            Has exited:false

                                            General

                                            Target ID:6
                                            Start time:23:38:05
                                            Start date:31/12/2024
                                            Path:C:\Windows\System32\lsass.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\lsass.exe
                                            Imagebase:0x7ff694dd0000
                                            File size:59'448 bytes
                                            MD5 hash:15A556DEF233F112D127025AB51AC2D3
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Reputation:moderate
                                            Has exited:false

                                            General

                                            Target ID:7
                                            Start time:23:38:06
                                            Start date:31/12/2024
                                            Path:C:\Windows\System32\svchost.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\svchost.exe -k DcomLaunch -p
                                            Imagebase:0x7ff72ee70000
                                            File size:57'360 bytes
                                            MD5 hash:F586835082F632DC8D9404D83BC16316
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Reputation:moderate
                                            Has exited:false

                                            General

                                            Target ID:8
                                            Start time:23:38:06
                                            Start date:31/12/2024
                                            Path:C:\Windows\System32\fontdrvhost.exe
                                            Wow64 process (32bit):false
                                            Commandline:"fontdrvhost.exe"
                                            Imagebase:0x7ff6a9570000
                                            File size:830'520 bytes
                                            MD5 hash:AB7AB4CF816D091EEE234C1D9BC4FD13
                                            Has elevated privileges:false
                                            Has administrator privileges:false
                                            Programmed in:C, C++ or other language
                                            Reputation:low
                                            Has exited:false

                                            General

                                            Target ID:9
                                            Start time:23:38:06
                                            Start date:31/12/2024
                                            Path:C:\Program Files\Windows Defender\MpCmdRun.exe
                                            Wow64 process (32bit):false
                                            Commandline:"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
                                            Imagebase:0x7ff657e30000
                                            File size:468'120 bytes
                                            MD5 hash:B3676839B2EE96983F9ED735CD044159
                                            Has elevated privileges:true
                                            Has administrator privileges:false
                                            Programmed in:C, C++ or other language
                                            Reputation:high
                                            Has exited:true

                                            General

                                            Target ID:10
                                            Start time:23:38:07
                                            Start date:31/12/2024
                                            Path:C:\Windows\System32\conhost.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                            Imagebase:0x7ff66ddc0000
                                            File size:875'008 bytes
                                            MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                            Has elevated privileges:true
                                            Has administrator privileges:false
                                            Programmed in:C, C++ or other language
                                            Reputation:high
                                            Has exited:true

                                            General

                                            Target ID:11
                                            Start time:23:38:07
                                            Start date:31/12/2024
                                            Path:C:\Windows\System32\fontdrvhost.exe
                                            Wow64 process (32bit):false
                                            Commandline:"fontdrvhost.exe"
                                            Imagebase:0x7ff6a9570000
                                            File size:830'520 bytes
                                            MD5 hash:AB7AB4CF816D091EEE234C1D9BC4FD13
                                            Has elevated privileges:false
                                            Has administrator privileges:false
                                            Programmed in:C, C++ or other language
                                            Reputation:low
                                            Has exited:false

                                            General

                                            Target ID:12
                                            Start time:23:38:07
                                            Start date:31/12/2024
                                            Path:C:\Windows\System32\svchost.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\svchost.exe -k RPCSS -p
                                            Imagebase:0x7ff72ee70000
                                            File size:57'360 bytes
                                            MD5 hash:F586835082F632DC8D9404D83BC16316
                                            Has elevated privileges:true
                                            Has administrator privileges:false
                                            Programmed in:C, C++ or other language
                                            Has exited:false

                                            General

                                            Target ID:13
                                            Start time:23:38:07
                                            Start date:31/12/2024
                                            Path:C:\Windows\System32\svchost.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
                                            Imagebase:0x7ff72ee70000
                                            File size:57'360 bytes
                                            MD5 hash:F586835082F632DC8D9404D83BC16316
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:false

                                            General

                                            Target ID:14
                                            Start time:23:38:07
                                            Start date:31/12/2024
                                            Path:C:\Windows\System32\dwm.exe
                                            Wow64 process (32bit):false
                                            Commandline:"dwm.exe"
                                            Imagebase:0x7ff6ac9c0000
                                            File size:94'720 bytes
                                            MD5 hash:5C27608411832C5B39BA04E33D53536C
                                            Has elevated privileges:false
                                            Has administrator privileges:false
                                            Programmed in:C, C++ or other language
                                            Has exited:false

                                            General

                                            Target ID:15
                                            Start time:23:38:11
                                            Start date:31/12/2024
                                            Path:C:\Windows\System32\svchost.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
                                            Imagebase:0x7ff72ee70000
                                            File size:57'360 bytes
                                            MD5 hash:F586835082F632DC8D9404D83BC16316
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:false

                                            General

                                            Target ID:16
                                            Start time:23:38:11
                                            Start date:31/12/2024
                                            Path:C:\Windows\System32\svchost.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
                                            Imagebase:0x7ff72ee70000
                                            File size:57'360 bytes
                                            MD5 hash:F586835082F632DC8D9404D83BC16316
                                            Has elevated privileges:false
                                            Has administrator privileges:false
                                            Programmed in:C, C++ or other language
                                            Has exited:false

                                            General

                                            Target ID:17
                                            Start time:23:38:11
                                            Start date:31/12/2024
                                            Path:C:\Windows\System32\svchost.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
                                            Imagebase:0x7ff72ee70000
                                            File size:57'360 bytes
                                            MD5 hash:F586835082F632DC8D9404D83BC16316
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:false

                                            General

                                            Target ID:18
                                            Start time:23:38:11
                                            Start date:31/12/2024
                                            Path:C:\Windows\System32\svchost.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
                                            Imagebase:0x7ff72ee70000
                                            File size:57'360 bytes
                                            MD5 hash:F586835082F632DC8D9404D83BC16316
                                            Has elevated privileges:false
                                            Has administrator privileges:false
                                            Programmed in:C, C++ or other language
                                            Has exited:false

                                            General

                                            Target ID:19
                                            Start time:23:38:11
                                            Start date:31/12/2024
                                            Path:C:\Windows\System32\svchost.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                                            Imagebase:0x7ff72ee70000
                                            File size:57'360 bytes
                                            MD5 hash:F586835082F632DC8D9404D83BC16316
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:false

                                            General

                                            Target ID:20
                                            Start time:23:38:12
                                            Start date:31/12/2024
                                            Path:C:\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_3ea756ac68d34d21\IntelCpHDCPSvc.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_3ea756ac68d34d21\IntelCpHDCPSvc.exe
                                            Imagebase:0x7ff62f000000
                                            File size:365'360 bytes
                                            MD5 hash:B6BAD2BD8596D9101874E9042B8E2D63
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:false

                                            General

                                            Target ID:21
                                            Start time:23:38:12
                                            Start date:31/12/2024
                                            Path:C:\Windows\System32\svchost.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                                            Imagebase:0x7ff72ee70000
                                            File size:57'360 bytes
                                            MD5 hash:F586835082F632DC8D9404D83BC16316
                                            Has elevated privileges:true
                                            Has administrator privileges:false
                                            Programmed in:C, C++ or other language
                                            Has exited:false

                                            General

                                            Target ID:22
                                            Start time:23:38:12
                                            Start date:31/12/2024
                                            Path:C:\Windows\System32\svchost.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                                            Imagebase:0x7ff72ee70000
                                            File size:57'360 bytes
                                            MD5 hash:F586835082F632DC8D9404D83BC16316
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:false

                                            General

                                            Target ID:23
                                            Start time:23:38:13
                                            Start date:31/12/2024
                                            Path:C:\Windows\System32\svchost.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                                            Imagebase:0x7ff72ee70000
                                            File size:57'360 bytes
                                            MD5 hash:F586835082F632DC8D9404D83BC16316
                                            Has elevated privileges:true
                                            Has administrator privileges:false
                                            Programmed in:C, C++ or other language
                                            Has exited:false

                                            General

                                            Target ID:24
                                            Start time:23:38:14
                                            Start date:31/12/2024
                                            Path:C:\Windows\System32\svchost.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                                            Imagebase:0x7ff72ee70000
                                            File size:57'360 bytes
                                            MD5 hash:F586835082F632DC8D9404D83BC16316
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:false

                                            General

                                            Target ID:25
                                            Start time:23:38:14
                                            Start date:31/12/2024
                                            Path:C:\Windows\System32\DriverStore\FileRepository\cui_dch.inf_amd64_2e49f48165b8de10\igfxCUIService.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\System32\DriverStore\FileRepository\cui_dch.inf_amd64_2e49f48165b8de10\igfxCUIService.exe
                                            Imagebase:0x7ff70b6d0000
                                            File size:399'664 bytes
                                            MD5 hash:91038D45A86B5465E8B7E5CD63187150
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:false

                                            General

                                            Target ID:26
                                            Start time:23:38:14
                                            Start date:31/12/2024
                                            Path:C:\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_3ea756ac68d34d21\IntelCpHeciSvc.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_3ea756ac68d34d21\IntelCpHeciSvc.exe
                                            Imagebase:0x7ff7c4d20000
                                            File size:521'536 bytes
                                            MD5 hash:3B0DF35583675DE5A08E8D4C1271CEC0
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:false

                                            General

                                            Target ID:27
                                            Start time:23:38:15
                                            Start date:31/12/2024
                                            Path:C:\Windows\System32\svchost.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                                            Imagebase:0x7ff72ee70000
                                            File size:57'360 bytes
                                            MD5 hash:F586835082F632DC8D9404D83BC16316
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:false

                                            General

                                            Target ID:28
                                            Start time:23:38:15
                                            Start date:31/12/2024
                                            Path:C:\Windows\System32\svchost.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                                            Imagebase:0x7ff72ee70000
                                            File size:57'360 bytes
                                            MD5 hash:F586835082F632DC8D9404D83BC16316
                                            Has elevated privileges:true
                                            Has administrator privileges:false
                                            Programmed in:C, C++ or other language
                                            Has exited:false

                                            General

                                            Target ID:29
                                            Start time:23:38:16
                                            Start date:31/12/2024
                                            Path:C:\Windows\System32\svchost.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
                                            Imagebase:0x7ff72ee70000
                                            File size:57'360 bytes
                                            MD5 hash:F586835082F632DC8D9404D83BC16316
                                            Has elevated privileges:true
                                            Has administrator privileges:false
                                            Programmed in:C, C++ or other language
                                            Has exited:false

                                            General

                                            Target ID:30
                                            Start time:23:38:16
                                            Start date:31/12/2024
                                            Path:C:\Windows\System32\svchost.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                                            Imagebase:0x7ff72ee70000
                                            File size:57'360 bytes
                                            MD5 hash:F586835082F632DC8D9404D83BC16316
                                            Has elevated privileges:true
                                            Has administrator privileges:false
                                            Programmed in:C, C++ or other language
                                            Has exited:false

                                            General

                                            Target ID:31
                                            Start time:23:38:16
                                            Start date:31/12/2024
                                            Path:C:\Windows\System32\svchost.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                                            Imagebase:0x7ff72ee70000
                                            File size:57'360 bytes
                                            MD5 hash:F586835082F632DC8D9404D83BC16316
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:false

                                            General

                                            Target ID:32
                                            Start time:23:38:16
                                            Start date:31/12/2024
                                            Path:C:\Windows\System32\svchost.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                                            Imagebase:0x7ff72ee70000
                                            File size:57'360 bytes
                                            MD5 hash:F586835082F632DC8D9404D83BC16316
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:false

                                            General

                                            Target ID:33
                                            Start time:23:38:17
                                            Start date:31/12/2024
                                            Path:C:\Windows\System32\svchost.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
                                            Imagebase:0x7ff72ee70000
                                            File size:57'360 bytes
                                            MD5 hash:F586835082F632DC8D9404D83BC16316
                                            Has elevated privileges:true
                                            Has administrator privileges:false
                                            Programmed in:C, C++ or other language
                                            Has exited:false

                                            General

                                            Target ID:34
                                            Start time:23:38:17
                                            Start date:31/12/2024
                                            Path:C:\Windows\System32\svchost.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
                                            Imagebase:0x7ff72ee70000
                                            File size:57'360 bytes
                                            MD5 hash:F586835082F632DC8D9404D83BC16316
                                            Has elevated privileges:true
                                            Has administrator privileges:false
                                            Programmed in:C, C++ or other language
                                            Has exited:false

                                            General

                                            Target ID:35
                                            Start time:23:38:17
                                            Start date:31/12/2024
                                            Path:C:\Windows\System32\svchost.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
                                            Imagebase:0x7ff72ee70000
                                            File size:57'360 bytes
                                            MD5 hash:F586835082F632DC8D9404D83BC16316
                                            Has elevated privileges:true
                                            Has administrator privileges:false
                                            Programmed in:C, C++ or other language
                                            Has exited:false

                                            General

                                            Target ID:36
                                            Start time:23:38:18
                                            Start date:31/12/2024
                                            Path:C:\Windows\System32\svchost.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                                            Imagebase:0x7ff72ee70000
                                            File size:57'360 bytes
                                            MD5 hash:F586835082F632DC8D9404D83BC16316
                                            Has elevated privileges:true
                                            Has administrator privileges:false
                                            Programmed in:C, C++ or other language
                                            Has exited:false

                                            General

                                            Target ID:37
                                            Start time:23:38:18
                                            Start date:31/12/2024
                                            Path:C:\Windows\System32\svchost.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                                            Imagebase:0x7ff72ee70000
                                            File size:57'360 bytes
                                            MD5 hash:F586835082F632DC8D9404D83BC16316
                                            Has elevated privileges:true
                                            Has administrator privileges:false
                                            Programmed in:C, C++ or other language
                                            Has exited:true

                                            General

                                            Target ID:38
                                            Start time:23:38:18
                                            Start date:31/12/2024
                                            Path:C:\Windows\System32\svchost.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
                                            Imagebase:0x7ff72ee70000
                                            File size:57'360 bytes
                                            MD5 hash:F586835082F632DC8D9404D83BC16316
                                            Has elevated privileges:false
                                            Has administrator privileges:false
                                            Programmed in:C, C++ or other language
                                            Has exited:false

                                            General

                                            Target ID:39
                                            Start time:23:38:19
                                            Start date:31/12/2024
                                            Path:C:\Windows\System32\svchost.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                            Imagebase:0x7ff72ee70000
                                            File size:57'360 bytes
                                            MD5 hash:F586835082F632DC8D9404D83BC16316
                                            Has elevated privileges:true
                                            Has administrator privileges:false
                                            Programmed in:C, C++ or other language
                                            Has exited:false

                                            General

                                            Target ID:40
                                            Start time:23:38:19
                                            Start date:31/12/2024
                                            Path:C:\Windows\System32\svchost.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
                                            Imagebase:0x7ff72ee70000
                                            File size:57'360 bytes
                                            MD5 hash:F586835082F632DC8D9404D83BC16316
                                            Has elevated privileges:true
                                            Has administrator privileges:false
                                            Programmed in:C, C++ or other language
                                            Has exited:false

                                            General

                                            Target ID:41
                                            Start time:23:38:19
                                            Start date:31/12/2024
                                            Path:C:\Windows\System32\svchost.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                            Imagebase:0x7ff72ee70000
                                            File size:57'360 bytes
                                            MD5 hash:F586835082F632DC8D9404D83BC16316
                                            Has elevated privileges:true
                                            Has administrator privileges:false
                                            Programmed in:C, C++ or other language
                                            Has exited:false

                                            General

                                            Target ID:42
                                            Start time:23:38:20
                                            Start date:31/12/2024
                                            Path:C:\Windows\System32\svchost.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                            Imagebase:0x7ff72ee70000
                                            File size:57'360 bytes
                                            MD5 hash:F586835082F632DC8D9404D83BC16316
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:false

                                            General

                                            Target ID:43
                                            Start time:23:38:21
                                            Start date:31/12/2024
                                            Path:C:\Windows\System32\svchost.exe
                                            Wow64 process (32bit):false
                                            Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                                            Imagebase:0x7ff72ee70000
                                            File size:57'360 bytes
                                            MD5 hash:F586835082F632DC8D9404D83BC16316
                                            Has elevated privileges:true
                                            Has administrator privileges:true
                                            Programmed in:C, C++ or other language
                                            Has exited:false

                                            Disassembly

                                            Reset < >

                                              Execution Graph

                                              Execution Coverage:16.6%
                                              Dynamic/Decrypted Code Coverage:0%
                                              Signature Coverage:53.8%
                                              Total number of Nodes:1306
                                              Total number of Limit Nodes:16
                                              execution_graph 7092 7ff71c1c6a80 7095 7ff71c1c6d6c 7092->7095 7096 7ff71c1c6d8f GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter 7095->7096 7097 7ff71c1c6a89 7095->7097 7096->7097 7015 7ff71c1cd540 7016 7ff71c1ce730 22 API calls 7015->7016 7017 7ff71c1cd57c 7016->7017 5679 7ff71c071350 5680 7ff71c0713b7 5679->5680 5681 7ff71c071f58 5679->5681 5686 7ff71c0713cf 5680->5686 5749 7ff71c1cdc20 5680->5749 5742 7ff71c1cd8d0 5681->5742 5684 7ff71c071fbb 5754 7ff71c1ceb00 5684->5754 5685 7ff71c0713f3 5689 7ff71c072057 5685->5689 5700 7ff71c07141f 5685->5700 5686->5684 5686->5685 5688 7ff71c071fea 5788 7ff71c0850a0 5688->5788 5770 7ff71c1ce53f 5689->5770 5692 7ff71c07209e 5694 7ff71c071ee9 5696 7ff71c071f3d 5694->5696 5759 7ff71c1cdd50 5694->5759 5695 7ff71c07200f 5697 7ff71c1ceb00 22 API calls 5695->5697 5697->5688 5700->5694 5700->5695 5703 7ff71c071eba OutputDebugStringW 5700->5703 5704 7ff71c080460 5700->5704 5731 7ff71c084d10 5700->5731 5735 7ff71c1b85f0 5700->5735 5702 7ff71c071dda memset 5702->5700 5702->5703 5703->5700 5705 7ff71c0804a4 5704->5705 5706 7ff71c0804e3 5704->5706 5707 7ff71c0804cf 5705->5707 5708 7ff71c08055d 5705->5708 5729 7ff71c080502 5706->5729 5807 7ff71c1ce525 5706->5807 5801 7ff71c1a0420 memset 5707->5801 5714 7ff71c08057e memcpy memcpy 5708->5714 5711 7ff71c0804de 5713 7ff71c0805ab memcpy 5711->5713 5712 7ff71c080a0e 5716 7ff71c1ce525 22 API calls 5712->5716 5713->5712 5717 7ff71c0805dc 5713->5717 5714->5713 5715 7ff71c080a24 5813 7ff71c1cec40 5715->5813 5721 7ff71c080a22 5716->5721 5717->5712 5717->5715 5719 7ff71c08060b 5717->5719 5719->5715 5720 7ff71c08061b memcpy memcpy 5719->5720 5722 7ff71c080668 5720->5722 5723 7ff71c080672 memcpy memset 5720->5723 5721->5700 5724 7ff71c1b85f0 22 API calls 5722->5724 5722->5729 5723->5722 5725 7ff71c080819 memset 5724->5725 5726 7ff71c08090a OutputDebugStringW 5725->5726 5727 7ff71c08085b 5725->5727 5728 7ff71c080926 5726->5728 5727->5726 5728->5729 5730 7ff71c1ceb00 22 API calls 5728->5730 5729->5700 5730->5721 5732 7ff71c084d47 5731->5732 5734 7ff71c084d58 5731->5734 6089 7ff71c1c7cf0 5732->6089 5734->5700 5739 7ff71c1b861a 5735->5739 5736 7ff71c1b8709 5736->5702 5737 7ff71c1ceb00 22 API calls 5738 7ff71c1b86d9 5737->5738 5740 7ff71c1ce525 22 API calls 5738->5740 5739->5736 5739->5737 5739->5738 5741 7ff71c1b875e 5740->5741 5741->5702 5743 7ff71c1cd901 5742->5743 5745 7ff71c1cd982 5742->5745 5744 7ff71c1cda87 5743->5744 5743->5745 5746 7ff71c1cd95d WaitOnAddress 5743->5746 5744->5680 5745->5744 5748 7ff71c1cda81 WakeByAddressAll 5745->5748 5746->5743 5747 7ff71c1cd977 GetLastError 5746->5747 5747->5743 5748->5744 5750 7ff71c1cdc49 5749->5750 5751 7ff71c1cdd3d 5750->5751 5752 7ff71c1cdcd6 WaitOnAddress 5750->5752 5751->5686 5752->5750 5753 7ff71c1cdcf3 GetLastError 5752->5753 5753->5750 5755 7ff71c1ce730 22 API calls 5754->5755 5756 7ff71c1ceb80 5755->5756 5757 7ff71c1ce730 22 API calls 5756->5757 5758 7ff71c1cebcc 5757->5758 5760 7ff71c1cddf9 5759->5760 5763 7ff71c1cdd67 5759->5763 5761 7ff71c1ce7d0 22 API calls 5760->5761 5766 7ff71c1cde11 5761->5766 5762 7ff71c1cdd8f 5765 7ff71c1cdd99 5762->5765 5767 7ff71c1cddae 5762->5767 5768 7ff71c1cddc0 WakeByAddressSingle 5762->5768 5763->5762 5764 7ff71c1cdd7a WakeByAddressSingle 5763->5764 5764->5762 5765->5767 5769 7ff71c1cdde4 WakeByAddressAll 5765->5769 5767->5696 5768->5767 5768->5769 5769->5767 5771 7ff71c1ce557 5770->5771 5772 7ff71c1ce730 22 API calls 5771->5772 5773 7ff71c1ce5bf 5772->5773 5774 7ff71c1ce730 22 API calls 5773->5774 5775 7ff71c1ce5f8 5774->5775 5776 7ff71c1ce730 22 API calls 5775->5776 5777 7ff71c1ce638 5776->5777 6112 7ff71c1be250 5777->6112 5779 7ff71c1ce64f 5780 7ff71c1ce730 22 API calls 5779->5780 5781 7ff71c1ce6a4 5780->5781 5782 7ff71c1ce7d0 22 API calls 5781->5782 5783 7ff71c1ce6ce 5782->5783 5784 7ff71c1ce730 22 API calls 5783->5784 5785 7ff71c1ce72c 5784->5785 5786 7ff71c1ad140 22 API calls 5785->5786 5787 7ff71c1ce751 5786->5787 5790 7ff71c0850ae 5788->5790 5789 7ff71c0850d7 5789->5692 5790->5789 5791 7ff71c1cddf9 5790->5791 5793 7ff71c1cdd67 5790->5793 5792 7ff71c1ce7d0 22 API calls 5791->5792 5797 7ff71c1cde11 5792->5797 5794 7ff71c1cdd8f 5793->5794 5795 7ff71c1cdd7a WakeByAddressSingle 5793->5795 5796 7ff71c1cdd99 5794->5796 5798 7ff71c1cddae 5794->5798 5799 7ff71c1cddc0 WakeByAddressSingle 5794->5799 5795->5794 5796->5798 5800 7ff71c1cdde4 WakeByAddressAll 5796->5800 5798->5692 5799->5798 5799->5800 5800->5798 5805 7ff71c1a0487 5801->5805 5802 7ff71c1a1f20 22 API calls 5802->5805 5803 7ff71c1a05af memcpy 5803->5711 5804 7ff71c1a29c0 22 API calls 5804->5805 5805->5802 5805->5803 5805->5804 5808 7ff71c1ce534 5807->5808 5809 7ff71c1ce539 5807->5809 5816 7ff71c1b8360 5808->5816 5811 7ff71c1ce53f 22 API calls 5809->5811 5812 7ff71c1ce53e 5811->5812 5814 7ff71c1ce730 22 API calls 5813->5814 5815 7ff71c1cecae 5814->5815 5819 7ff71c1ce730 5816->5819 5822 7ff71c1ad140 5819->5822 5821 7ff71c1ce751 5828 7ff71c1ac320 5822->5828 5824 7ff71c1ad15e 5825 7ff71c1ad229 5824->5825 5826 7ff71c1ce53f 22 API calls 5824->5826 5825->5821 5827 7ff71c1ad260 5826->5827 5827->5821 5839 7ff71c1ad4b0 5828->5839 5830 7ff71c1ac32f 5832 7ff71c1ac373 5830->5832 5845 7ff71c1aa010 5830->5845 5837 7ff71c1ac384 5832->5837 5853 7ff71c1aadc0 5832->5853 5838 7ff71c1ac42e 5837->5838 5856 7ff71c1ac680 5837->5856 5838->5824 5841 7ff71c1ad4d3 5839->5841 5840 7ff71c1ad522 5842 7ff71c1ad626 22 API calls 5840->5842 5841->5840 5872 7ff71c1ad626 5841->5872 5844 7ff71c1ad559 5842->5844 5844->5830 5846 7ff71c1aa060 5845->5846 5849 7ff71c1aa039 5845->5849 5847 7ff71c1ce525 22 API calls 5846->5847 5848 7ff71c1aa195 5847->5848 5848->5832 5849->5846 5852 7ff71c1aa065 5849->5852 5850 7ff71c1aa164 5850->5832 5851 7ff71c1ac560 22 API calls 5851->5852 5852->5850 5852->5851 6018 7ff71c1afc30 5853->6018 5855 7ff71c1aade1 5858 7ff71c1ac6a6 5856->5858 5857 7ff71c1ac7c5 5857->5838 5858->5857 5859 7ff71c1ac82b 5858->5859 5861 7ff71c1ac819 5858->5861 5868 7ff71c1ac7b3 5858->5868 6080 7ff71c1cecb0 5859->6080 5863 7ff71c1cec40 22 API calls 5861->5863 5863->5859 5871 7ff71c1cebd0 22 API calls 5868->5871 5871->5857 5874 7ff71c1ad661 5872->5874 5873 7ff71c1ad74b 5875 7ff71c1ad7d5 5873->5875 5876 7ff71c1ad753 5873->5876 5874->5873 5882 7ff71c1ad68f 5874->5882 5891 7ff71c1cdaf0 5874->5891 5877 7ff71c1a9ca0 22 API calls 5875->5877 5942 7ff71c1a9ca0 5876->5942 5881 7ff71c1ad7cf 5877->5881 5880 7ff71c1ad6d3 5917 7ff71c1a5c40 5880->5917 5885 7ff71c1a9ca0 22 API calls 5881->5885 5882->5880 5899 7ff71c1acc74 5882->5899 5887 7ff71c1ad87d 5885->5887 5886 7ff71c1ad71e 5886->5881 5930 7ff71c1ad8d0 5886->5930 5889 7ff71c1a5c40 22 API calls 5887->5889 5890 7ff71c1ad8b4 5889->5890 5890->5840 5893 7ff71c1cdb0b 5891->5893 5892 7ff71c1cdbdd 5892->5882 5893->5892 5894 7ff71c1cdbe8 5893->5894 5896 7ff71c1cdb92 WaitOnAddress 5893->5896 5895 7ff71c1ce730 20 API calls 5894->5895 5897 7ff71c1cdc1a 5895->5897 5896->5893 5898 7ff71c1cdbae GetLastError 5896->5898 5898->5893 5900 7ff71c1acc9e 5899->5900 5902 7ff71c1acc98 5899->5902 5900->5902 5947 7ff71c1aa1f0 5900->5947 5907 7ff71c1ace97 5902->5907 5951 7ff71c1a9410 5902->5951 5904 7ff71c1acd74 5905 7ff71c1acd98 5904->5905 5906 7ff71c1ace0c 5904->5906 5910 7ff71c1acdaf 5905->5910 5958 7ff71c1cd800 5905->5958 5908 7ff71c1acf67 2 API calls 5906->5908 5907->5880 5913 7ff71c1acdfd 5908->5913 5955 7ff71c1acf67 5910->5955 5913->5880 5918 7ff71c1a5c5a 5917->5918 5919 7ff71c1a5c5c 5917->5919 5918->5886 5920 7ff71c1cdd67 5919->5920 5921 7ff71c1cddf9 5919->5921 5923 7ff71c1cdd8f 5920->5923 5924 7ff71c1cdd7a WakeByAddressSingle 5920->5924 5963 7ff71c1ce7d0 5921->5963 5925 7ff71c1cdd99 5923->5925 5927 7ff71c1cddae 5923->5927 5928 7ff71c1cddc0 WakeByAddressSingle 5923->5928 5924->5923 5925->5927 5929 7ff71c1cdde4 WakeByAddressAll 5925->5929 5927->5886 5928->5927 5928->5929 5929->5927 5966 7ff71c1b16f0 5930->5966 5932 7ff71c1ad8e5 5933 7ff71c1a9ca0 22 API calls 5932->5933 5934 7ff71c1ad93e 5933->5934 5937 7ff71c1ad97d 5934->5937 5938 7ff71c1ad9f2 5934->5938 5935 7ff71c1ad9f0 5935->5873 5936 7ff71c1b814e 5936->5873 5937->5935 6015 7ff71c1cebd0 5937->6015 5938->5936 5939 7ff71c1ceb00 22 API calls 5938->5939 5939->5936 5943 7ff71c1a9cd7 5942->5943 5944 7ff71c1a9ce6 5943->5944 5945 7ff71c1ce730 22 API calls 5943->5945 5944->5881 5946 7ff71c1a9d8a 5945->5946 5946->5881 5948 7ff71c1aa20c 5947->5948 5950 7ff71c1aa222 5947->5950 5949 7ff71c1a7fb0 22 API calls 5948->5949 5949->5950 5950->5902 5952 7ff71c1a9427 5951->5952 5953 7ff71c1cde20 22 API calls 5952->5953 5954 7ff71c1a9464 5952->5954 5953->5954 5954->5904 5956 7ff71c1ab960 WaitOnAddress GetLastError 5955->5956 5957 7ff71c1acf90 5956->5957 5960 7ff71c1cd819 5958->5960 5959 7ff71c1cd840 5959->5910 5960->5959 5961 7ff71c1cd86c WaitOnAddress 5960->5961 5961->5960 5962 7ff71c1cd889 GetLastError 5961->5962 5962->5960 5964 7ff71c1ce730 22 API calls 5963->5964 5965 7ff71c1ce80d 5964->5965 5967 7ff71c1b16fd 5966->5967 5968 7ff71c1b179e 5967->5968 5969 7ff71c1acb60 22 API calls 5967->5969 5968->5932 5970 7ff71c1b17b2 5969->5970 5971 7ff71c1ce91c 22 API calls 5970->5971 5972 7ff71c1b17d3 5971->5972 5973 7ff71c1ce730 22 API calls 5972->5973 5981 7ff71c1b181c 5973->5981 5974 7ff71c1b1901 5974->5932 5975 7ff71c1b1b93 5976 7ff71c1ce7d0 22 API calls 5975->5976 5978 7ff71c1b18c7 5976->5978 5977 7ff71c1ce6b0 22 API calls 5977->5975 5978->5974 5979 7ff71c1ce730 22 API calls 5978->5979 5980 7ff71c1b1c28 5979->5980 5980->5980 5982 7ff71c1b1c3e 5980->5982 5983 7ff71c1c4c96 5980->5983 5984 7ff71c1cebd0 22 API calls 5980->5984 5981->5974 5981->5975 5981->5977 5981->5978 5982->5982 5985 7ff71c1cebd0 22 API calls 5982->5985 5986 7ff71c1b1c42 5982->5986 5983->5932 5984->5982 5987 7ff71c1c4d83 5985->5987 5986->5932 5988 7ff71c1c4dfb 5987->5988 5989 7ff71c1cebd0 22 API calls 5987->5989 5988->5932 5990 7ff71c1c4e38 5989->5990 5991 7ff71c1c4eab 5990->5991 5992 7ff71c1cebd0 22 API calls 5990->5992 5991->5932 5993 7ff71c1c4ee8 5992->5993 5994 7ff71c1c4f56 5993->5994 5995 7ff71c1cebd0 22 API calls 5993->5995 5994->5932 5996 7ff71c1c4f93 5995->5996 5997 7ff71c1c5006 5996->5997 5998 7ff71c1cebd0 22 API calls 5996->5998 5997->5932 5999 7ff71c1c5043 5998->5999 6000 7ff71c1c50b7 5999->6000 6001 7ff71c1cebd0 22 API calls 5999->6001 6000->5932 6002 7ff71c1c50f4 6001->6002 6003 7ff71c1c5167 6002->6003 6004 7ff71c1cebd0 22 API calls 6002->6004 6003->5932 6005 7ff71c1c51a4 6004->6005 6006 7ff71c1cebd0 22 API calls 6005->6006 6007 7ff71c1c51d5 6005->6007 6008 7ff71c1c53d2 6006->6008 6007->5932 6009 7ff71c1c5405 6008->6009 6010 7ff71c1cebd0 22 API calls 6008->6010 6009->5932 6011 7ff71c1c560d 6010->6011 6012 7ff71c1c5635 6011->6012 6013 7ff71c1cebd0 22 API calls 6011->6013 6012->5932 6014 7ff71c1c583d 6013->6014 6014->5932 6016 7ff71c1ce730 22 API calls 6015->6016 6017 7ff71c1cec3e 6016->6017 6020 7ff71c1afc46 6018->6020 6019 7ff71c1afec3 6021 7ff71c1cebd0 15 API calls 6019->6021 6025 7ff71c1afde6 6019->6025 6020->6019 6022 7ff71c1cec40 15 API calls 6020->6022 6024 7ff71c1afdcb 6020->6024 6020->6025 6021->6024 6022->6019 6023 7ff71c1cebd0 15 API calls 6029 7ff71c1b00bd 6023->6029 6024->6023 6024->6025 6025->5855 6027 7ff71c1b0292 SetLastError GetFullPathNameW 6028 7ff71c1b02bd GetLastError 6027->6028 6027->6029 6028->6029 6030 7ff71c1b0365 GetLastError 6028->6030 6029->6027 6031 7ff71c1b02d7 GetLastError 6029->6031 6032 7ff71c1b030f 6029->6032 6049 7ff71c1b0135 6029->6049 6054 7ff71c1cd260 6029->6054 6030->6049 6031->6029 6033 7ff71c1b070f 6031->6033 6035 7ff71c1b0729 6032->6035 6036 7ff71c1b0318 6032->6036 6034 7ff71c1ce7d0 15 API calls 6033->6034 6042 7ff71c1b0727 6034->6042 6037 7ff71c1cec40 15 API calls 6035->6037 6043 7ff71c1b04b6 6036->6043 6047 7ff71c1b033c 6036->6047 6037->6042 6038 7ff71c1b04c3 6039 7ff71c1b04d5 6038->6039 6040 7ff71c1cd260 15 API calls 6038->6040 6044 7ff71c1b05c2 memcpy 6039->6044 6040->6039 6041 7ff71c1b046a memcpy 6041->6038 6041->6044 6042->5855 6043->6038 6050 7ff71c1b0755 6043->6050 6046 7ff71c1b05ee 6044->6046 6044->6049 6067 7ff71c1a6a90 6046->6067 6047->6041 6052 7ff71c1b0740 6047->6052 6049->5855 6051 7ff71c1ce525 15 API calls 6050->6051 6051->6042 6053 7ff71c1ce525 15 API calls 6052->6053 6053->6042 6055 7ff71c1cd31d 6054->6055 6064 7ff71c1cd278 6054->6064 6056 7ff71c1ce525 22 API calls 6055->6056 6056->6064 6057 7ff71c1cd331 6058 7ff71c1ce525 22 API calls 6057->6058 6060 7ff71c1cd336 6058->6060 6059 7ff71c1ce525 22 API calls 6059->6057 6076 7ff71c1a7490 6060->6076 6063 7ff71c1ce730 22 API calls 6065 7ff71c1cd383 6063->6065 6064->6057 6064->6059 6066 7ff71c1cd30a 6064->6066 6066->6029 6068 7ff71c1a6b2b 6067->6068 6074 7ff71c1a6aa9 6067->6074 6069 7ff71c1ce525 22 API calls 6068->6069 6069->6074 6070 7ff71c1a6b3f 6071 7ff71c1ce525 22 API calls 6070->6071 6073 7ff71c1a6b44 6071->6073 6072 7ff71c1ce525 22 API calls 6072->6070 6074->6070 6074->6072 6075 7ff71c1a6b18 6074->6075 6075->6049 6077 7ff71c1a7498 6076->6077 6078 7ff71c1a74af 6077->6078 6079 7ff71c1a74b1 WakeByAddressSingle 6077->6079 6078->6063 6081 7ff71c1ce730 22 API calls 6080->6081 6082 7ff71c1ced1e 6081->6082 6083 7ff71c1ce730 22 API calls 6082->6083 6084 7ff71c1ced58 6083->6084 6085 7ff71c1ce730 22 API calls 6084->6085 6086 7ff71c1cedce 6085->6086 6087 7ff71c1ce730 22 API calls 6086->6087 6088 7ff71c1cee08 6087->6088 6090 7ff71c1c7d15 6089->6090 6091 7ff71c1c7d09 6089->6091 6093 7ff71c1c808c 6090->6093 6094 7ff71c1c7d5c 6090->6094 6096 7ff71c1c8063 6090->6096 6102 7ff71c1b8280 6091->6102 6093->6091 6093->6096 6094->6091 6097 7ff71c1c7d93 6094->6097 6095 7ff71c1c8167 memcpy 6101 7ff71c1c7d10 6095->6101 6096->6095 6096->6096 6096->6101 6098 7ff71c1c7db5 memset 6097->6098 6099 7ff71c1c847c 6097->6099 6098->6101 6107 7ff71c1b82d0 6099->6107 6101->5734 6103 7ff71c1b8296 6102->6103 6104 7ff71c1b828e 6102->6104 6105 7ff71c1ce730 22 API calls 6103->6105 6104->6101 6106 7ff71c1b82c8 6105->6106 6108 7ff71c1b82ea 6107->6108 6109 7ff71c1b82de 6107->6109 6110 7ff71c1ce53f 22 API calls 6108->6110 6109->6101 6111 7ff71c1b82f5 6110->6111 6113 7ff71c1ce730 22 API calls 6112->6113 6114 7ff71c1be2a4 6113->6114 6114->5779 6115 7ff71c077df0 memset OutputDebugStringW 6243 7ff71c081e40 6115->6243 6117 7ff71c077ea8 6257 7ff71c1b87a0 6117->6257 6119 7ff71c077ee5 6120 7ff71c1b85f0 22 API calls 6119->6120 6121 7ff71c077f56 memset 6120->6121 6122 7ff71c07803a OutputDebugStringW 6121->6122 6125 7ff71c077f95 6121->6125 6123 7ff71c078050 6122->6123 6277 7ff71c072990 6123->6277 6125->6122 6126 7ff71c078082 6289 7ff71c072da0 6126->6289 6128 7ff71c0780a8 6129 7ff71c0780c3 6128->6129 6637 7ff71c1a41d0 GetLastError 6128->6637 6131 7ff71c072990 35 API calls 6129->6131 6135 7ff71c07853d 6129->6135 6132 7ff71c0780f1 6131->6132 6133 7ff71c072da0 112 API calls 6132->6133 6134 7ff71c078117 6133->6134 6136 7ff71c078132 6134->6136 6638 7ff71c1a41d0 GetLastError 6134->6638 6136->6135 6138 7ff71c072990 35 API calls 6136->6138 6139 7ff71c078160 6138->6139 6140 7ff71c072da0 112 API calls 6139->6140 6141 7ff71c078186 6140->6141 6142 7ff71c0781aa 6141->6142 6639 7ff71c1a41d0 GetLastError 6141->6639 6142->6135 6144 7ff71c072990 35 API calls 6142->6144 6145 7ff71c0781dc 6144->6145 6387 7ff71c075400 6145->6387 6147 7ff71c0781f1 6148 7ff71c078209 6147->6148 6640 7ff71c1a41d0 GetLastError 6147->6640 6148->6135 6150 7ff71c078223 memset OutputDebugStringW CreateToolhelp32Snapshot 6148->6150 6151 7ff71c0784c9 memset OutputDebugStringW 6150->6151 6152 7ff71c07828f memset OutputDebugStringW 6150->6152 6641 7ff71c1a41d0 GetLastError 6151->6641 6454 7ff71c1a3ec0 memset 6152->6454 6155 7ff71c0782ef Module32FirstW 6156 7ff71c078308 6155->6156 6157 7ff71c078542 memset OutputDebugStringW 6155->6157 6158 7ff71c1b85f0 22 API calls 6156->6158 6159 7ff71c0785de 6157->6159 6160 7ff71c0783bb 6158->6160 6642 7ff71c1a41d0 GetLastError 6159->6642 6162 7ff71c1b87a0 39 API calls 6160->6162 6163 7ff71c0783e6 6162->6163 6164 7ff71c1b85f0 22 API calls 6163->6164 6165 7ff71c078462 memset 6164->6165 6166 7ff71c07867a OutputDebugStringW 6165->6166 6170 7ff71c0784a4 6165->6170 6167 7ff71c078696 6166->6167 6455 7ff71c07a6c0 6167->6455 6169 7ff71c0786d3 6171 7ff71c0787cd 6169->6171 6172 7ff71c0786e7 6169->6172 6170->6166 6174 7ff71c1b85f0 22 API calls 6171->6174 6173 7ff71c1b85f0 22 API calls 6172->6173 6175 7ff71c078766 memset 6173->6175 6176 7ff71c078868 memset 6174->6176 6177 7ff71c07896a OutputDebugStringW 6175->6177 6183 7ff71c0787a8 6175->6183 6178 7ff71c078a4a OutputDebugStringW 6176->6178 6182 7ff71c0788aa 6176->6182 6177->6135 6179 7ff71c078a66 6178->6179 6587 7ff71c076ae0 6179->6587 6181 7ff71c078a89 6184 7ff71c1b85f0 22 API calls 6181->6184 6182->6178 6183->6177 6185 7ff71c078b3c 6184->6185 6186 7ff71c1b87a0 39 API calls 6185->6186 6187 7ff71c078b60 6186->6187 6188 7ff71c1b85f0 22 API calls 6187->6188 6189 7ff71c078bdc memset 6188->6189 6190 7ff71c078cca OutputDebugStringW 6189->6190 6193 7ff71c078c1e 6189->6193 6191 7ff71c078ce6 6190->6191 6192 7ff71c07a6c0 146 API calls 6191->6192 6194 7ff71c078d23 6192->6194 6193->6190 6195 7ff71c078e1d 6194->6195 6196 7ff71c078d37 6194->6196 6198 7ff71c1b85f0 22 API calls 6195->6198 6197 7ff71c1b85f0 22 API calls 6196->6197 6199 7ff71c078db6 memset 6197->6199 6200 7ff71c078eb8 memset 6198->6200 6202 7ff71c078fba OutputDebugStringW 6199->6202 6206 7ff71c078df8 6199->6206 6201 7ff71c07912a OutputDebugStringW 6200->6201 6207 7ff71c078f01 6200->6207 6203 7ff71c079150 6201->6203 6202->6135 6204 7ff71c076ae0 36 API calls 6203->6204 6205 7ff71c079170 memset OutputDebugStringW 6204->6205 6228 7ff71c079220 6205->6228 6206->6202 6207->6201 6210 7ff71c1b85f0 22 API calls 6211 7ff71c0793bb memset 6210->6211 6212 7ff71c0794aa OutputDebugStringW 6211->6212 6213 7ff71c0793f9 6211->6213 6212->6213 6213->6212 6215 7ff71c1b87a0 39 API calls 6213->6215 6216 7ff71c1b85f0 22 API calls 6213->6216 6626 7ff71c07a570 6213->6626 6215->6213 6217 7ff71c079590 memset 6216->6217 6218 7ff71c07967a OutputDebugStringW 6217->6218 6223 7ff71c0795ce 6217->6223 6218->6223 6219 7ff71c0796ba memcmp 6219->6223 6220 7ff71c0796dd memcmp 6222 7ff71c079e30 Module32NextW 6220->6222 6220->6223 6221 7ff71c1b85f0 22 API calls 6225 7ff71c07984d memset 6221->6225 6226 7ff71c079e8d memset OutputDebugStringW 6222->6226 6222->6228 6223->6218 6223->6219 6223->6220 6223->6221 6224 7ff71c079700 memcmp 6223->6224 6227 7ff71c1b85f0 22 API calls 6223->6227 6224->6222 6224->6223 6225->6228 6229 7ff71c079dfa OutputDebugStringW 6225->6229 6230 7ff71c079efb 6226->6230 6231 7ff71c079782 memset 6227->6231 6228->6210 6228->6222 6228->6229 6240 7ff71c079c4a OutputDebugStringW 6228->6240 6241 7ff71c079d2a OutputDebugStringW 6228->6241 6242 7ff71c076ae0 36 API calls 6228->6242 6619 7ff71c084750 6228->6619 6643 7ff71c1c84f0 6228->6643 6229->6222 6229->6228 6233 7ff71c079f2b NtClose memset OutputDebugStringW 6230->6233 6232 7ff71c07993a OutputDebugStringW 6231->6232 6235 7ff71c0797c0 6231->6235 6232->6235 6233->6135 6234 7ff71c07a6c0 146 API calls 6234->6235 6235->6232 6235->6234 6236 7ff71c1b85f0 22 API calls 6235->6236 6237 7ff71c1b85f0 22 API calls 6235->6237 6238 7ff71c079a41 memset 6236->6238 6239 7ff71c079b54 memset 6237->6239 6238->6228 6238->6240 6239->6228 6239->6241 6240->6228 6241->6228 6242->6228 6244 7ff71c081e6e 6243->6244 6245 7ff71c081f4e 6244->6245 6246 7ff71c081e77 GetModuleFileNameW 6244->6246 6247 7ff71c1ce525 22 API calls 6245->6247 6248 7ff71c081e93 6246->6248 6254 7ff71c081f03 6246->6254 6249 7ff71c081f5d 6247->6249 6248->6249 6250 7ff71c081ea4 6248->6250 6251 7ff71c1cec40 22 API calls 6249->6251 6252 7ff71c1c84f0 25 API calls 6250->6252 6256 7ff71c081f71 6251->6256 6253 7ff71c081ee4 6252->6253 6255 7ff71c084750 27 API calls 6253->6255 6254->6117 6255->6254 6256->6117 6258 7ff71c1b926f 6257->6258 6259 7ff71c1b87cf 6257->6259 6260 7ff71c1ce525 22 API calls 6258->6260 6259->6258 6274 7ff71c1b87fe 6259->6274 6275 7ff71c1b8d28 6260->6275 6261 7ff71c1b9227 6261->6119 6262 7ff71c1cee10 22 API calls 6263 7ff71c1b926d 6262->6263 6263->6119 6265 7ff71c1b89dd 6684 7ff71c1cee10 6265->6684 6267 7ff71c1b83a0 22 API calls 6267->6274 6268 7ff71c1b8de5 memcpy 6268->6274 6269 7ff71c1b9034 memcpy 6269->6274 6270 7ff71c1b8916 memcpy 6270->6274 6271 7ff71c1c6240 22 API calls 6271->6274 6272 7ff71c1b8ee4 memcpy 6272->6274 6273 7ff71c1ce490 22 API calls 6273->6274 6274->6261 6274->6265 6274->6267 6274->6268 6274->6269 6274->6270 6274->6271 6274->6272 6274->6273 6274->6275 6276 7ff71c1c63c0 22 API calls 6274->6276 6668 7ff71c1c66c0 6274->6668 6275->6262 6276->6274 6278 7ff71c080460 33 API calls 6277->6278 6279 7ff71c0729e5 6278->6279 6280 7ff71c072cd8 6279->6280 6281 7ff71c0729ef 6279->6281 6282 7ff71c1ceb00 22 API calls 6280->6282 6283 7ff71c1b85f0 22 API calls 6281->6283 6285 7ff71c072d19 6282->6285 6284 7ff71c072ae4 memset 6283->6284 6286 7ff71c072bca OutputDebugStringW 6284->6286 6287 7ff71c072b23 6284->6287 6285->6126 6288 7ff71c072be0 6286->6288 6287->6286 6288->6126 6290 7ff71c1b85f0 22 API calls 6289->6290 6291 7ff71c072ee3 memset 6290->6291 6292 7ff71c072fca OutputDebugStringW 6291->6292 6295 7ff71c072f1e 6291->6295 6293 7ff71c072fed 6292->6293 6294 7ff71c07a570 23 API calls 6293->6294 6296 7ff71c073018 6294->6296 6295->6292 6297 7ff71c1b85f0 22 API calls 6296->6297 6298 7ff71c073076 memset 6297->6298 6299 7ff71c07316a OutputDebugStringW 6298->6299 6302 7ff71c0730b8 6298->6302 6300 7ff71c073186 6299->6300 6711 7ff71c076900 6300->6711 6302->6299 6303 7ff71c0731aa 6304 7ff71c1b85f0 22 API calls 6303->6304 6305 7ff71c073231 memset 6304->6305 6306 7ff71c07332a OutputDebugStringW 6305->6306 6309 7ff71c073273 6305->6309 6307 7ff71c073346 6306->6307 6720 7ff71c0721c0 6307->6720 6309->6306 6310 7ff71c073369 6378 7ff71c073378 6310->6378 6750 7ff71c080be0 6310->6750 6312 7ff71c0733ce 6313 7ff71c0733db 6312->6313 6317 7ff71c0734cc 6312->6317 6314 7ff71c1b85f0 22 API calls 6313->6314 6315 7ff71c07345e memset 6314->6315 6316 7ff71c07374a OutputDebugStringW 6315->6316 6318 7ff71c0734a7 6315->6318 6316->6378 6319 7ff71c1b85f0 22 API calls 6317->6319 6318->6316 6320 7ff71c073647 memset 6319->6320 6321 7ff71c07386a OutputDebugStringW 6320->6321 6322 7ff71c073689 6320->6322 6325 7ff71c073886 6321->6325 6322->6321 6323 7ff71c073b17 6776 7ff71c077480 6323->6776 6325->6323 6327 7ff71c073a28 6325->6327 6328 7ff71c1b85f0 22 API calls 6327->6328 6331 7ff71c073ab0 memset 6328->6331 6329 7ff71c073b2c 6333 7ff71c1b85f0 22 API calls 6329->6333 6330 7ff71c073c59 6332 7ff71c1b85f0 22 API calls 6330->6332 6334 7ff71c073dba OutputDebugStringW 6331->6334 6342 7ff71c073af2 6331->6342 6335 7ff71c073cc2 memset 6332->6335 6336 7ff71c073bbb memset 6333->6336 6339 7ff71c073dd6 6334->6339 6337 7ff71c0741aa OutputDebugStringW 6335->6337 6347 7ff71c073cfe 6335->6347 6338 7ff71c0740da OutputDebugStringW 6336->6338 6350 7ff71c073bfd 6336->6350 6340 7ff71c0741c6 6337->6340 6367 7ff71c074016 6338->6367 6802 7ff71c0856f0 6339->6802 6343 7ff71c0856f0 25 API calls 6340->6343 6342->6334 6349 7ff71c07420d GetModuleHandleW 6343->6349 6344 7ff71c073e1d GetModuleHandleW 6345 7ff71c073e3a 6344->6345 6346 7ff71c073f2f 6344->6346 6355 7ff71c1b85f0 22 API calls 6345->6355 6345->6378 6830 7ff71c1a41d0 GetLastError 6346->6830 6347->6337 6348 7ff71c1b85f0 22 API calls 6352 7ff71c0744f4 memset 6348->6352 6353 7ff71c07422a 6349->6353 6354 7ff71c074313 6349->6354 6350->6338 6357 7ff71c0745da OutputDebugStringW 6352->6357 6365 7ff71c07452d 6352->6365 6360 7ff71c1b85f0 22 API calls 6353->6360 6353->6378 6831 7ff71c1a41d0 GetLastError 6354->6831 6359 7ff71c073ecc memset 6355->6359 6358 7ff71c0745f6 6357->6358 6810 7ff71c074e40 6358->6810 6361 7ff71c073ffa OutputDebugStringW 6359->6361 6371 7ff71c073f0e 6359->6371 6363 7ff71c0742b9 memset 6360->6363 6361->6367 6366 7ff71c07441a OutputDebugStringW 6363->6366 6374 7ff71c0742f2 6363->6374 6364 7ff71c074621 6368 7ff71c07462b 6364->6368 6369 7ff71c074750 6364->6369 6365->6357 6366->6367 6367->6348 6373 7ff71c074641 VirtualQuery 6368->6373 6370 7ff71c1b85f0 22 API calls 6369->6370 6372 7ff71c0747c7 memset 6370->6372 6371->6361 6375 7ff71c074a4a OutputDebugStringW 6372->6375 6383 7ff71c074807 6372->6383 6376 7ff71c07482c 6373->6376 6377 7ff71c074660 6373->6377 6374->6366 6375->6378 6379 7ff71c1b85f0 22 API calls 6376->6379 6377->6376 6380 7ff71c07466d 6377->6380 6378->6128 6381 7ff71c0748b1 memset 6379->6381 6382 7ff71c1b85f0 22 API calls 6380->6382 6381->6375 6381->6383 6384 7ff71c0746f2 memset 6382->6384 6383->6375 6385 7ff71c074b7a OutputDebugStringW 6384->6385 6386 7ff71c07472b 6384->6386 6385->6378 6386->6385 6388 7ff71c1b85f0 22 API calls 6387->6388 6389 7ff71c0754eb memset 6388->6389 6390 7ff71c0755da OutputDebugStringW 6389->6390 6391 7ff71c075526 6389->6391 6392 7ff71c0755fd 6390->6392 6391->6390 6393 7ff71c0721c0 33 API calls 6392->6393 6394 7ff71c07561d 6393->6394 6395 7ff71c080be0 31 API calls 6394->6395 6447 7ff71c07562c 6394->6447 6396 7ff71c075674 6395->6396 6397 7ff71c075681 6396->6397 6401 7ff71c07575f 6396->6401 6398 7ff71c1b85f0 22 API calls 6397->6398 6399 7ff71c0756fa memset 6398->6399 6400 7ff71c07593a OutputDebugStringW 6399->6400 6402 7ff71c07573a 6399->6402 6400->6447 6403 7ff71c1b85f0 22 API calls 6401->6403 6402->6400 6404 7ff71c075845 memset 6403->6404 6405 7ff71c075a5a OutputDebugStringW 6404->6405 6408 7ff71c07587e 6404->6408 6406 7ff71c075a76 6405->6406 6407 7ff71c1b85f0 22 API calls 6406->6407 6409 7ff71c075b33 6407->6409 6408->6405 6410 7ff71c1b87a0 39 API calls 6409->6410 6411 7ff71c075b57 6410->6411 6412 7ff71c1b85f0 22 API calls 6411->6412 6413 7ff71c075bc9 memset 6412->6413 6414 7ff71c075cba OutputDebugStringW 6413->6414 6417 7ff71c075c05 6413->6417 6415 7ff71c075cd6 6414->6415 6416 7ff71c076900 40 API calls 6415->6416 6418 7ff71c075cfa 6416->6418 6417->6414 6419 7ff71c1b85f0 22 API calls 6418->6419 6420 7ff71c075d73 memset 6419->6420 6421 7ff71c075e5a OutputDebugStringW 6420->6421 6424 7ff71c075dac 6420->6424 6422 7ff71c075e76 6421->6422 6423 7ff71c077480 32 API calls 6422->6423 6425 7ff71c075e92 6423->6425 6424->6421 6426 7ff71c075e9c 6425->6426 6427 7ff71c075f71 memset OutputDebugStringW GetModuleHandleA 6425->6427 6428 7ff71c1b85f0 22 API calls 6426->6428 6429 7ff71c07606a 6427->6429 6434 7ff71c07602b 6427->6434 6430 7ff71c075f13 memset 6428->6430 6846 7ff71c1a41d0 GetLastError 6429->6846 6432 7ff71c07613a OutputDebugStringW 6430->6432 6438 7ff71c075f4c 6430->6438 6432->6434 6433 7ff71c074e40 32 API calls 6435 7ff71c076181 6433->6435 6434->6433 6434->6447 6436 7ff71c07629b 6435->6436 6437 7ff71c07618b 6435->6437 6439 7ff71c1b85f0 22 API calls 6436->6439 6441 7ff71c0761a1 VirtualQuery 6437->6441 6438->6432 6440 7ff71c0762ef memset 6439->6440 6444 7ff71c07654a OutputDebugStringW 6440->6444 6451 7ff71c07632f 6440->6451 6442 7ff71c076354 6441->6442 6443 7ff71c0761c0 6441->6443 6446 7ff71c1b85f0 22 API calls 6442->6446 6443->6442 6445 7ff71c0761cd 6443->6445 6444->6447 6448 7ff71c1b85f0 22 API calls 6445->6448 6449 7ff71c0763b6 memset 6446->6449 6447->6147 6450 7ff71c07623d memset 6448->6450 6449->6444 6449->6451 6452 7ff71c07666a OutputDebugStringW 6450->6452 6453 7ff71c076276 6450->6453 6451->6444 6452->6447 6453->6452 6454->6155 6456 7ff71c1b85f0 22 API calls 6455->6456 6457 7ff71c07a76a memset 6456->6457 6458 7ff71c07a85a OutputDebugStringW 6457->6458 6461 7ff71c07a7a5 6457->6461 6459 7ff71c07a87d 6458->6459 6460 7ff71c1b85f0 22 API calls 6459->6460 6462 7ff71c07a8f4 6460->6462 6461->6458 6463 7ff71c1b85f0 22 API calls 6462->6463 6464 7ff71c07a971 memset 6463->6464 6465 7ff71c07aa6a OutputDebugStringW 6464->6465 6468 7ff71c07a9b3 6464->6468 6466 7ff71c07aa9b 6465->6466 6467 7ff71c072990 35 API calls 6466->6467 6469 7ff71c07aacd 6467->6469 6468->6465 6470 7ff71c075400 99 API calls 6469->6470 6471 7ff71c07aae2 6470->6471 6472 7ff71c07ac90 6471->6472 6473 7ff71c1b85f0 22 API calls 6471->6473 6474 7ff71c072990 35 API calls 6472->6474 6586 7ff71c07ac97 6472->6586 6475 7ff71c07ab68 memset 6473->6475 6476 7ff71c07acc8 6474->6476 6477 7ff71c07ac5a OutputDebugStringW 6475->6477 6484 7ff71c07aba3 6475->6484 6478 7ff71c075400 99 API calls 6476->6478 6480 7ff71c07ac7d 6477->6480 6479 7ff71c07acdd 6478->6479 6481 7ff71c07ae90 6479->6481 6483 7ff71c1b85f0 22 API calls 6479->6483 6858 7ff71c1a41d0 GetLastError 6480->6858 6485 7ff71c072990 35 API calls 6481->6485 6481->6586 6486 7ff71c07ad6c memset 6483->6486 6484->6477 6487 7ff71c07aed3 6485->6487 6488 7ff71c07ae5a OutputDebugStringW 6486->6488 6495 7ff71c07ada7 6486->6495 6489 7ff71c075400 99 API calls 6487->6489 6490 7ff71c07ae7d 6488->6490 6491 7ff71c07aee8 6489->6491 6859 7ff71c1a41d0 GetLastError 6490->6859 6493 7ff71c07b090 6491->6493 6494 7ff71c1b85f0 22 API calls 6491->6494 6496 7ff71c072990 35 API calls 6493->6496 6493->6586 6497 7ff71c07af6e memset 6494->6497 6495->6488 6498 7ff71c07b0c8 6496->6498 6500 7ff71c07b05a OutputDebugStringW 6497->6500 6506 7ff71c07afa9 6497->6506 6499 7ff71c075400 99 API calls 6498->6499 6501 7ff71c07b0dd 6499->6501 6502 7ff71c07b07d 6500->6502 6503 7ff71c07b280 6501->6503 6505 7ff71c1b85f0 22 API calls 6501->6505 6860 7ff71c1a41d0 GetLastError 6502->6860 6503->6586 6847 7ff71c085f40 6503->6847 6508 7ff71c07b163 memset 6505->6508 6506->6500 6510 7ff71c07b24a OutputDebugStringW 6508->6510 6514 7ff71c07b19e 6508->6514 6509 7ff71c07b30a 6515 7ff71c07b326 6509->6515 6862 7ff71c084690 6509->6862 6512 7ff71c07b26d 6510->6512 6861 7ff71c1a41d0 GetLastError 6512->6861 6514->6510 6516 7ff71c1b85f0 22 API calls 6515->6516 6517 7ff71c07b41f memset 6516->6517 6518 7ff71c07b51a OutputDebugStringW 6517->6518 6525 7ff71c07b461 6517->6525 6519 7ff71c07b54a NtOpenFile 6518->6519 6520 7ff71c07b539 6518->6520 6521 7ff71c07b6e7 6519->6521 6522 7ff71c07b582 6519->6522 6520->6519 6524 7ff71c1b85f0 22 API calls 6521->6524 6523 7ff71c1b85f0 22 API calls 6522->6523 6526 7ff71c07b680 memset 6523->6526 6527 7ff71c07b753 memset 6524->6527 6525->6518 6528 7ff71c07b84a OutputDebugStringW 6526->6528 6536 7ff71c07b6c2 6526->6536 6529 7ff71c07ba0a OutputDebugStringW 6527->6529 6533 7ff71c07b795 6527->6533 6530 7ff71c07b866 6528->6530 6531 7ff71c07ba29 6529->6531 6532 7ff71c1b85f0 22 API calls 6530->6532 6535 7ff71c07ba3f NtCreateSection 6531->6535 6534 7ff71c07b8e2 6532->6534 6533->6529 6534->6586 6878 7ff71c1a47d0 6534->6878 6537 7ff71c07bbed 6535->6537 6538 7ff71c07ba8b 6535->6538 6536->6528 6539 7ff71c1b85f0 22 API calls 6537->6539 6541 7ff71c1b85f0 22 API calls 6538->6541 6542 7ff71c07bc6b memset 6539->6542 6544 7ff71c07bb86 memset 6541->6544 6545 7ff71c07be7a OutputDebugStringW 6542->6545 6557 7ff71c07bcaa 6542->6557 6547 7ff71c07bd6a OutputDebugStringW 6544->6547 6556 7ff71c07bbc8 6544->6556 6548 7ff71c07bead GetCurrentProcess NtMapViewOfSection 6545->6548 6549 7ff71c07be9c 6545->6549 6550 7ff71c07bd86 6547->6550 6551 7ff71c07c0b2 6548->6551 6552 7ff71c07bf22 6548->6552 6549->6548 6559 7ff71c1a47d0 24 API calls 6550->6559 6555 7ff71c1b85f0 22 API calls 6551->6555 6553 7ff71c07bf2d 6552->6553 6554 7ff71c07c2a3 6552->6554 6558 7ff71c1b85f0 22 API calls 6553->6558 6561 7ff71c1b85f0 22 API calls 6554->6561 6560 7ff71c07c11e 6555->6560 6556->6547 6557->6545 6562 7ff71c07bf8f 6558->6562 6563 7ff71c07bdbb 6559->6563 6564 7ff71c081ff0 2 API calls 6560->6564 6565 7ff71c07c39b 6561->6565 6855 7ff71c081ff0 memset 6562->6855 6883 7ff71c1a4490 GetErrorInfo 6563->6883 6573 7ff71c07c13d 6564->6573 6568 7ff71c081ff0 2 API calls 6565->6568 6574 7ff71c07c3ba 6568->6574 6569 7ff71c07bfae 6570 7ff71c076900 40 API calls 6569->6570 6571 7ff71c07bfdf 6570->6571 6572 7ff71c1b85f0 22 API calls 6571->6572 6575 7ff71c07c05c 6572->6575 6576 7ff71c076900 40 API calls 6573->6576 6884 7ff71c085030 6574->6884 6579 7ff71c081ff0 2 API calls 6575->6579 6577 7ff71c07c182 6576->6577 6580 7ff71c1b85f0 22 API calls 6577->6580 6582 7ff71c07c07b 6579->6582 6583 7ff71c07c21a 6580->6583 6581 7ff71c07c404 6581->6581 6584 7ff71c07c099 NtClose 6582->6584 6585 7ff71c081ff0 2 API calls 6583->6585 6584->6586 6585->6586 6586->6169 6588 7ff71c076d39 6587->6588 6589 7ff71c076b16 6587->6589 6590 7ff71c1b85f0 22 API calls 6588->6590 6591 7ff71c076b33 6589->6591 6592 7ff71c1cd8d0 3 API calls 6589->6592 6593 7ff71c076d93 memset 6590->6593 6595 7ff71c1cd800 2 API calls 6591->6595 6597 7ff71c076b48 6591->6597 6592->6591 6594 7ff71c076f3a OutputDebugStringW 6593->6594 6602 7ff71c076dcb 6593->6602 6616 7ff71c076f5b 6594->6616 6595->6597 6596 7ff71c077263 6599 7ff71c1b85f0 22 API calls 6596->6599 6597->6596 6603 7ff71c076b74 6597->6603 6598 7ff71c077017 6940 7ff71c084a90 6598->6940 6600 7ff71c0772d0 6599->6600 6604 7ff71c081ff0 2 API calls 6600->6604 6602->6594 6603->6598 6611 7ff71c1b85f0 22 API calls 6603->6611 6607 7ff71c0772f8 6604->6607 6606 7ff71c1b85f0 22 API calls 6608 7ff71c0770b4 memset 6606->6608 6610 7ff71c1ce730 22 API calls 6607->6610 6609 7ff71c07719a OutputDebugStringW 6608->6609 6615 7ff71c0770f3 6608->6615 6617 7ff71c0771b0 6609->6617 6610->6617 6612 7ff71c076e4a memset 6611->6612 6613 7ff71c076ffa OutputDebugStringW 6612->6613 6618 7ff71c076e89 6612->6618 6613->6598 6615->6609 6616->6181 6617->6616 6945 7ff71c1cd8c0 WakeByAddressSingle 6617->6945 6618->6613 6620 7ff71c084780 6619->6620 6621 7ff71c0848b8 6620->6621 6622 7ff71c0845f0 26 API calls 6620->6622 6623 7ff71c0847b4 memcpy 6620->6623 6624 7ff71c0849c1 6620->6624 6621->6228 6622->6620 6623->6620 6625 7ff71c1c84f0 25 API calls 6624->6625 6625->6621 6628 7ff71c07a5ac 6626->6628 6627 7ff71c07a5ce 6629 7ff71c1b85f0 22 API calls 6627->6629 6628->6627 6635 7ff71c07a5e3 6628->6635 6630 7ff71c07a680 6629->6630 6630->6213 6631 7ff71c07a6b0 6634 7ff71c1ce525 22 API calls 6631->6634 6632 7ff71c07a615 memcpy 6632->6630 6636 7ff71c07a6be 6634->6636 6635->6631 6635->6632 6637->6129 6638->6136 6639->6142 6640->6148 6641->6135 6642->6135 6644 7ff71c1c85c4 6643->6644 6645 7ff71c1c8507 6643->6645 6647 7ff71c1ce525 22 API calls 6644->6647 6645->6644 6646 7ff71c1c8510 6645->6646 6648 7ff71c1c85da 6646->6648 6654 7ff71c084580 RtlReAllocateHeap 6646->6654 6657 7ff71c1c85aa 6646->6657 6647->6657 6649 7ff71c1ce525 22 API calls 6648->6649 6651 7ff71c1c85df 6649->6651 6650 7ff71c1ce525 22 API calls 6650->6648 6652 7ff71c1c86a0 6651->6652 6959 7ff71c089540 6651->6959 6655 7ff71c1c8795 6652->6655 6994 7ff71c1b08b0 6652->6994 6654->6657 6655->6228 6656 7ff71c1c8636 6658 7ff71c1c863f 6656->6658 6659 7ff71c1c87c0 6656->6659 6657->6650 6660 7ff71c1c85b1 6657->6660 6987 7ff71c089280 6658->6987 6663 7ff71c1ce730 22 API calls 6659->6663 6660->6228 6665 7ff71c1c8812 6663->6665 6664 7ff71c1c8669 6664->6652 6664->6665 6666 7ff71c1ce53f 22 API calls 6665->6666 6667 7ff71c1c8823 6666->6667 6667->6228 6669 7ff71c1c66ee 6668->6669 6670 7ff71c1c66d2 6668->6670 6669->6670 6686 7ff71c1ce8b8 6669->6686 6670->6274 6689 7ff71c1c3540 6684->6689 6687 7ff71c1ce730 22 API calls 6686->6687 6688 7ff71c1ce91b 6687->6688 6690 7ff71c1c356b 6689->6690 6691 7ff71c1c36dc 6690->6691 6692 7ff71c1c3661 6690->6692 6693 7ff71c1ce730 22 API calls 6690->6693 6694 7ff71c1cee10 22 API calls 6691->6694 6695 7ff71c1ce730 22 API calls 6692->6695 6696 7ff71c1c36ef 6692->6696 6693->6692 6694->6696 6695->6691 6697 7ff71c1cecb0 22 API calls 6696->6697 6700 7ff71c1c374f 6696->6700 6697->6700 6699 7ff71c1cee10 22 API calls 6699->6700 6700->6699 6701 7ff71c1c37e6 6700->6701 6704 7ff71c1ce6b0 6700->6704 6702 7ff71c1ce730 22 API calls 6701->6702 6703 7ff71c1c392f 6702->6703 6705 7ff71c1ce7d0 22 API calls 6704->6705 6706 7ff71c1ce6ce 6705->6706 6707 7ff71c1ce730 22 API calls 6706->6707 6708 7ff71c1ce72c 6707->6708 6709 7ff71c1ad140 22 API calls 6708->6709 6710 7ff71c1ce751 6709->6710 6712 7ff71c1b87a0 39 API calls 6711->6712 6718 7ff71c076926 6712->6718 6713 7ff71c076a86 6716 7ff71c1ce525 22 API calls 6713->6716 6714 7ff71c07696e memcpy 6719 7ff71c07698f 6714->6719 6717 7ff71c076a94 6716->6717 6717->6303 6718->6713 6718->6714 6719->6303 6721 7ff71c07281c 6720->6721 6722 7ff71c07220a 6720->6722 6723 7ff71c1cd8d0 3 API calls 6721->6723 6724 7ff71c07222d 6722->6724 6725 7ff71c1cdaf0 22 API calls 6722->6725 6723->6722 6726 7ff71c072884 6724->6726 6732 7ff71c07223a 6724->6732 6725->6724 6728 7ff71c1ceb00 22 API calls 6726->6728 6727 7ff71c07255b 6729 7ff71c1b85f0 22 API calls 6727->6729 6730 7ff71c0728b8 6728->6730 6731 7ff71c0725b5 memset 6729->6731 6733 7ff71c072914 6730->6733 6735 7ff71c1cdd50 25 API calls 6730->6735 6734 7ff71c0727ba OutputDebugStringW 6731->6734 6741 7ff71c0725fb 6731->6741 6732->6727 6736 7ff71c0723f9 6732->6736 6733->6310 6737 7ff71c0727d0 6734->6737 6735->6733 6738 7ff71c1b85f0 22 API calls 6736->6738 6740 7ff71c07280a 6737->6740 6743 7ff71c1cdd50 25 API calls 6737->6743 6739 7ff71c0724f0 memset 6738->6739 6742 7ff71c0726aa OutputDebugStringW 6739->6742 6746 7ff71c072536 6739->6746 6740->6310 6741->6734 6748 7ff71c0726c0 6742->6748 6743->6740 6744 7ff71c0728c7 6747 7ff71c1ce525 22 API calls 6744->6747 6745 7ff71c07270e memcpy 6745->6737 6746->6742 6747->6730 6748->6744 6748->6745 6752 7ff71c080c24 6750->6752 6754 7ff71c080c63 6750->6754 6751 7ff71c080c4f 6753 7ff71c1a0420 24 API calls 6751->6753 6752->6751 6755 7ff71c080cc8 6752->6755 6756 7ff71c080c5e 6753->6756 6757 7ff71c1ce525 22 API calls 6754->6757 6775 7ff71c080c82 6754->6775 6759 7ff71c080ce9 memcpy memcpy 6755->6759 6760 7ff71c080d16 memcpy 6756->6760 6758 7ff71c0810e6 6757->6758 6762 7ff71c1ce525 22 API calls 6758->6762 6759->6760 6760->6758 6761 7ff71c080d42 6760->6761 6761->6758 6767 7ff71c080d66 memcpy memcpy 6761->6767 6765 7ff71c0810fa 6762->6765 6764 7ff71c080db2 6832 7ff71c0862e0 6764->6832 6765->6312 6767->6764 6770 7ff71c080da8 6767->6770 6768 7ff71c1b85f0 22 API calls 6769 7ff71c080ec2 memset 6768->6769 6771 7ff71c080fba OutputDebugStringW 6769->6771 6772 7ff71c080f04 6769->6772 6770->6768 6770->6775 6773 7ff71c080fd6 6771->6773 6772->6771 6774 7ff71c1ceb00 22 API calls 6773->6774 6773->6775 6774->6765 6775->6312 6777 7ff71c077c83 6776->6777 6778 7ff71c0774d1 6776->6778 6779 7ff71c1cd8d0 3 API calls 6777->6779 6780 7ff71c1cd800 2 API calls 6778->6780 6783 7ff71c0774e7 6778->6783 6779->6778 6780->6783 6781 7ff71c077ce7 6784 7ff71c1ceb00 22 API calls 6781->6784 6782 7ff71c0777d7 6785 7ff71c1b85f0 22 API calls 6782->6785 6783->6781 6787 7ff71c07750c 6783->6787 6796 7ff71c077930 6784->6796 6786 7ff71c077831 memset 6785->6786 6788 7ff71c0779ea OutputDebugStringW 6786->6788 6793 7ff71c077877 6786->6793 6787->6782 6790 7ff71c0776d9 6787->6790 6801 7ff71c077a00 6788->6801 6792 7ff71c1b85f0 22 API calls 6790->6792 6791 7ff71c073b22 6791->6329 6791->6330 6794 7ff71c077765 memset 6792->6794 6793->6788 6795 7ff71c07791a OutputDebugStringW 6794->6795 6798 7ff71c0777b2 6794->6798 6795->6796 6796->6791 6845 7ff71c1cd8c0 WakeByAddressSingle 6796->6845 6797 7ff71c1b85f0 22 API calls 6799 7ff71c077b21 memset 6797->6799 6798->6795 6800 7ff71c077bfa OutputDebugStringW 6799->6800 6799->6801 6800->6801 6801->6796 6801->6797 6801->6800 6805 7ff71c08571c 6802->6805 6803 7ff71c085abf 6804 7ff71c1ce525 22 API calls 6803->6804 6806 7ff71c085acd 6804->6806 6805->6803 6807 7ff71c0858bc 6805->6807 6809 7ff71c085801 6805->6809 6806->6344 6808 7ff71c1c84f0 25 API calls 6807->6808 6807->6809 6808->6807 6809->6344 6811 7ff71c074e63 6810->6811 6812 7ff71c074f01 memset 6810->6812 6813 7ff71c074f4f 6811->6813 6816 7ff71c074e8f memset 6811->6816 6814 7ff71c0752fc OutputDebugStringW 6812->6814 6817 7ff71c1b85f0 22 API calls 6813->6817 6815 7ff71c07530a 6814->6815 6815->6364 6816->6814 6818 7ff71c074fdd memset 6817->6818 6819 7ff71c0750ca OutputDebugStringW 6818->6819 6820 7ff71c075015 6818->6820 6823 7ff71c0750ec 6819->6823 6820->6819 6821 7ff71c075298 memset 6821->6814 6822 7ff71c07513c strlen 6822->6823 6823->6821 6823->6822 6824 7ff71c075194 memcmp 6823->6824 6824->6823 6825 7ff71c0751a5 6824->6825 6826 7ff71c1b85f0 22 API calls 6825->6826 6827 7ff71c07523b memset 6826->6827 6828 7ff71c0753ba OutputDebugStringW 6827->6828 6829 7ff71c075273 6827->6829 6828->6815 6829->6828 6830->6345 6831->6353 6834 7ff71c086314 6832->6834 6835 7ff71c08633f 6832->6835 6833 7ff71c0863b5 6833->6770 6834->6770 6835->6833 6837 7ff71c1a0d70 6835->6837 6839 7ff71c1a0dd1 6837->6839 6838 7ff71c1a1231 6838->6835 6839->6838 6840 7ff71c1a129c 6839->6840 6843 7ff71c1a121b 6839->6843 6841 7ff71c1cecb0 22 API calls 6840->6841 6842 7ff71c1a12ab 6841->6842 6844 7ff71c1cecb0 22 API calls 6843->6844 6844->6838 6846->6434 6850 7ff71c085f6a 6847->6850 6848 7ff71c086166 6848->6509 6849 7ff71c08626f 6851 7ff71c1ce525 22 API calls 6849->6851 6850->6848 6850->6849 6854 7ff71c085fee 6850->6854 6852 7ff71c086283 6851->6852 6852->6509 6853 7ff71c1c84f0 25 API calls 6853->6854 6854->6848 6854->6853 6856 7ff71c0820ca OutputDebugStringW 6855->6856 6857 7ff71c08202a 6855->6857 6856->6569 6857->6856 6858->6472 6859->6481 6860->6493 6861->6503 6863 7ff71c08472b 6862->6863 6869 7ff71c0846a3 6862->6869 6864 7ff71c084711 6863->6864 6865 7ff71c1ce525 22 API calls 6863->6865 6868 7ff71c1ce525 22 API calls 6864->6868 6871 7ff71c084718 6864->6871 6865->6864 6866 7ff71c084741 6867 7ff71c1ce525 22 API calls 6866->6867 6872 7ff71c084746 6867->6872 6868->6866 6869->6864 6869->6866 6891 7ff71c084580 6869->6891 6871->6515 6874 7ff71c0847b4 memcpy 6872->6874 6875 7ff71c0849c1 6872->6875 6877 7ff71c0848b8 6872->6877 6895 7ff71c0845f0 6872->6895 6874->6872 6876 7ff71c1c84f0 25 API calls 6875->6876 6876->6877 6877->6515 6920 7ff71c1a4930 6878->6920 6880 7ff71c1a47fb RoOriginateErrorW 6881 7ff71c07b903 6880->6881 6882 7ff71c1a4490 GetErrorInfo 6881->6882 6882->6586 6883->6586 6885 7ff71c08503a 6884->6885 6886 7ff71c08504f 6884->6886 6887 7ff71c1a47d0 24 API calls 6885->6887 6886->6581 6888 7ff71c085041 6887->6888 6939 7ff71c1a4490 GetErrorInfo 6888->6939 6890 7ff71c085048 6890->6581 6892 7ff71c084597 6891->6892 6894 7ff71c0845b0 6891->6894 6893 7ff71c0845ae RtlReAllocateHeap 6892->6893 6892->6894 6893->6894 6894->6864 6896 7ff71c084675 6895->6896 6897 7ff71c0845ff 6895->6897 6898 7ff71c1ce525 22 API calls 6896->6898 6897->6896 6899 7ff71c084623 6897->6899 6900 7ff71c08465b 6898->6900 6902 7ff71c084580 RtlReAllocateHeap 6899->6902 6901 7ff71c1ce525 22 API calls 6900->6901 6904 7ff71c084662 6900->6904 6903 7ff71c08468b 6901->6903 6902->6900 6905 7ff71c08472b 6903->6905 6911 7ff71c0846a3 6903->6911 6904->6872 6906 7ff71c084711 6905->6906 6907 7ff71c1ce525 22 API calls 6905->6907 6910 7ff71c1ce525 22 API calls 6906->6910 6913 7ff71c084718 6906->6913 6907->6906 6908 7ff71c084741 6909 7ff71c1ce525 22 API calls 6908->6909 6914 7ff71c084746 6909->6914 6910->6908 6911->6906 6911->6908 6912 7ff71c084580 RtlReAllocateHeap 6911->6912 6912->6906 6913->6872 6915 7ff71c0845f0 25 API calls 6914->6915 6916 7ff71c0847b4 memcpy 6914->6916 6917 7ff71c0849c1 6914->6917 6919 7ff71c0848b8 6914->6919 6915->6914 6916->6914 6918 7ff71c1c84f0 25 API calls 6917->6918 6918->6919 6919->6872 6923 7ff71c1a495a 6920->6923 6921 7ff71c1a4b56 6921->6880 6922 7ff71c1a4c5f 6924 7ff71c1ce525 22 API calls 6922->6924 6923->6921 6923->6922 6925 7ff71c1a49de 6923->6925 6926 7ff71c1a4c73 6924->6926 6925->6921 6928 7ff71c1cd030 6925->6928 6926->6880 6929 7ff71c1cd0f1 6928->6929 6935 7ff71c1cd042 6928->6935 6931 7ff71c1ce525 22 API calls 6929->6931 6930 7ff71c1cd107 6932 7ff71c1ce525 22 API calls 6930->6932 6933 7ff71c1cd0d7 6931->6933 6937 7ff71c1cd10c 6932->6937 6934 7ff71c1ce525 22 API calls 6933->6934 6938 7ff71c1cd0de 6933->6938 6934->6930 6935->6930 6935->6933 6936 7ff71c084580 RtlReAllocateHeap 6935->6936 6936->6933 6937->6925 6938->6925 6939->6890 6941 7ff71c084cea 6940->6941 6944 7ff71c07703e 6940->6944 6946 7ff71c1c7530 6941->6946 6943 7ff71c084d03 6944->6606 6947 7ff71c1c7555 6946->6947 6948 7ff71c1c7549 6946->6948 6950 7ff71c1c78bf 6947->6950 6951 7ff71c1c759c 6947->6951 6953 7ff71c1c7891 6947->6953 6949 7ff71c1b8280 22 API calls 6948->6949 6958 7ff71c1c7550 6949->6958 6950->6948 6950->6953 6951->6948 6954 7ff71c1c75d3 6951->6954 6952 7ff71c1c7997 memcpy 6952->6958 6953->6952 6953->6958 6955 7ff71c1c7c7a 6954->6955 6956 7ff71c1c75f8 memset 6954->6956 6957 7ff71c1b82d0 22 API calls 6955->6957 6956->6958 6957->6958 6958->6943 6960 7ff71c089576 6959->6960 6961 7ff71c08954a 6959->6961 6960->6656 7001 7ff71c0897b0 6961->7001 6963 7ff71c089555 6963->6960 6964 7ff71c1ce53f 22 API calls 6963->6964 6965 7ff71c089598 6964->6965 6966 7ff71c1c4f56 6965->6966 6967 7ff71c0895ab 6965->6967 6968 7ff71c1cebd0 22 API calls 6965->6968 6966->6656 6969 7ff71c0895b3 6967->6969 6970 7ff71c1cebd0 22 API calls 6967->6970 6968->6967 6969->6656 6971 7ff71c1c5043 6970->6971 6972 7ff71c1c50b7 6971->6972 6973 7ff71c1cebd0 22 API calls 6971->6973 6972->6656 6974 7ff71c1c50f4 6973->6974 6975 7ff71c1c5167 6974->6975 6976 7ff71c1cebd0 22 API calls 6974->6976 6975->6656 6977 7ff71c1c51a4 6976->6977 6978 7ff71c1cebd0 22 API calls 6977->6978 6979 7ff71c1c51d5 6977->6979 6980 7ff71c1c53d2 6978->6980 6979->6656 6981 7ff71c1c5405 6980->6981 6982 7ff71c1cebd0 22 API calls 6980->6982 6981->6656 6983 7ff71c1c560d 6982->6983 6984 7ff71c1c5635 6983->6984 6985 7ff71c1cebd0 22 API calls 6983->6985 6984->6656 6986 7ff71c1c583d 6985->6986 6986->6656 6989 7ff71c089298 6987->6989 6988 7ff71c0892a5 6988->6664 6989->6988 6990 7ff71c089302 6989->6990 6991 7ff71c1cecb0 22 API calls 6989->6991 6990->6988 6992 7ff71c1cec40 22 API calls 6990->6992 6991->6990 6993 7ff71c089364 6992->6993 6995 7ff71c1b0984 6994->6995 6996 7ff71c1b08e9 6994->6996 6998 7ff71c1a9ca0 22 API calls 6995->6998 6997 7ff71c1b0940 6996->6997 7006 7ff71c1a69d0 6996->7006 6997->6655 7000 7ff71c1b09be 6998->7000 7000->6655 7002 7ff71c08981a 7001->7002 7003 7ff71c0897c3 7001->7003 7002->6963 7003->7002 7004 7ff71c0897e8 BCryptGenRandom 7003->7004 7004->7003 7005 7ff71c08980c SystemFunction036 7004->7005 7005->7002 7005->7003 7007 7ff71c1a6a73 7006->7007 7010 7ff71c1a69e9 7006->7010 7008 7ff71c1ce525 22 API calls 7007->7008 7008->7010 7009 7ff71c1a6a87 7011 7ff71c1ce525 22 API calls 7009->7011 7010->7009 7012 7ff71c1ce525 22 API calls 7010->7012 7014 7ff71c1a6a60 7010->7014 7013 7ff71c1a6a8c 7011->7013 7012->7009 7014->6997 7018 7ff71c072930 7019 7ff71c072967 7018->7019 7020 7ff71c072976 7018->7020 7021 7ff71c1cdd50 25 API calls 7020->7021 7021->7019 7022 7ff71c071230 7023 7ff71c07124e 7022->7023 7024 7ff71c1cdd67 7023->7024 7025 7ff71c1cddf9 7023->7025 7027 7ff71c1cdd8f 7024->7027 7028 7ff71c1cdd7a WakeByAddressSingle 7024->7028 7026 7ff71c1ce7d0 22 API calls 7025->7026 7030 7ff71c1cde11 7026->7030 7029 7ff71c1cdd99 7027->7029 7031 7ff71c1cddae 7027->7031 7032 7ff71c1cddc0 WakeByAddressSingle 7027->7032 7028->7027 7029->7031 7033 7ff71c1cdde4 WakeByAddressAll 7029->7033 7032->7031 7032->7033 7033->7031 7044 7ff71c077d50 7047 7ff71c071190 7044->7047 7048 7ff71c07119a 7047->7048 7049 7ff71c0711b4 7048->7049 7050 7ff71c1cd8c0 WakeByAddressSingle 7048->7050 7051 7ff71c071250 7053 7ff71c07125e 7051->7053 7052 7ff71c071287 7053->7052 7054 7ff71c1cdd67 7053->7054 7055 7ff71c1cddf9 7053->7055 7057 7ff71c1cdd7a WakeByAddressSingle 7054->7057 7058 7ff71c1cdd8f 7054->7058 7056 7ff71c1ce7d0 22 API calls 7055->7056 7060 7ff71c1cde11 7056->7060 7057->7058 7059 7ff71c1cdd99 7058->7059 7061 7ff71c1cddae 7058->7061 7062 7ff71c1cddc0 WakeByAddressSingle 7058->7062 7059->7061 7063 7ff71c1cdde4 WakeByAddressAll 7059->7063 7062->7061 7062->7063 7063->7061 7064 7ff71c0712d0 7065 7ff71c1c1d60 7064->7065 7068 7ff71c1c1e0f 7065->7068 7069 7ff71c1c2040 7065->7069 7070 7ff71c1c1f02 7065->7070 7073 7ff71c1be3d0 7065->7073 7067 7ff71c1cee10 22 API calls 7067->7069 7068->7067 7068->7069 7071 7ff71c1cee10 22 API calls 7070->7071 7072 7ff71c1c20e3 7071->7072 7074 7ff71c1be3e3 7073->7074 7076 7ff71c1be404 7074->7076 7077 7ff71c1c6540 7074->7077 7076->7065 7078 7ff71c1c669d 7077->7078 7082 7ff71c1c65eb 7077->7082 7079 7ff71c1ce8b8 22 API calls 7078->7079 7080 7ff71c1c66b1 7079->7080 7081 7ff71c1c665d 7081->7076 7082->7081 7083 7ff71c1ce8b8 22 API calls 7082->7083 7083->7078 7084 7ff71c1b9b30 7085 7ff71c1b9b66 7084->7085 7086 7ff71c1b9b7b 7084->7086 7087 7ff71c1ceb00 22 API calls 7086->7087 7088 7ff71c1b9ba3 7087->7088 7034 7ff71c072120 7035 7ff71c0850a0 25 API calls 7034->7035 7036 7ff71c07214b 7035->7036 7089 7ff71c077440 7090 7ff71c071190 WakeByAddressSingle 7089->7090 7091 7ff71c077468 7090->7091 7098 7ff71c077380 7099 7ff71c0773a6 7098->7099 7100 7ff71c0773c0 7099->7100 7102 7ff71c1cd8c0 WakeByAddressSingle 7099->7102 7103 7ff71c071000 7104 7ff71c0710a8 7103->7104 7108 7ff71c07101c 7103->7108 7105 7ff71c1ce6b0 22 API calls 7104->7105 7106 7ff71c0710b4 7105->7106 7107 7ff71c071162 7106->7107 7112 7ff71c0710dc 7106->7112 7110 7ff71c1ce6b0 22 API calls 7107->7110 7109 7ff71c07102c 7108->7109 7137 7ff71c1ac530 ProcessPrng 7108->7137 7115 7ff71c07116e 7110->7115 7113 7ff71c0710ec 7112->7113 7138 7ff71c1ac530 ProcessPrng 7112->7138 7116 7ff71c1cebd0 22 API calls 7115->7116 7117 7ff71c1c4f93 7115->7117 7122 7ff71c1c4f56 7115->7122 7116->7117 7118 7ff71c1c5006 7117->7118 7119 7ff71c1cebd0 22 API calls 7117->7119 7120 7ff71c1c5043 7119->7120 7121 7ff71c1c50b7 7120->7121 7123 7ff71c1cebd0 22 API calls 7120->7123 7124 7ff71c1c50f4 7123->7124 7125 7ff71c1c5167 7124->7125 7126 7ff71c1cebd0 22 API calls 7124->7126 7127 7ff71c1c51a4 7126->7127 7128 7ff71c1cebd0 22 API calls 7127->7128 7129 7ff71c1c51d5 7127->7129 7130 7ff71c1c53d2 7128->7130 7131 7ff71c1c5405 7130->7131 7132 7ff71c1cebd0 22 API calls 7130->7132 7133 7ff71c1c560d 7132->7133 7134 7ff71c1c5635 7133->7134 7135 7ff71c1cebd0 22 API calls 7133->7135 7136 7ff71c1c583d 7135->7136 7137->7109 7138->7113

                                              Executed Functions

                                              Function 00007FF71C077DF0 Relevance: 94.5, APIs: 49, Strings: 4, Instructions: 1711processCOMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1858140292.00007FF71C071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71C070000, based on PE: true
                                              • Associated: 00000000.00000002.1858117811.00007FF71C070000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C1CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C339000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858806603.00007FF71C377000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858833366.00007FF71C378000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff71c070000_dropper.jbxd
                                              Similarity
                                              • API ID: DebugOutputStringmemset$CreateErrorFileFirstLastModuleModule32NameSnapshotToolhelp32memcpy
                                              • String ID: C:\Windows\System32\Resolved full path for module: $kernel32.dll$kernel32.dllNtOpenProcessNtCreateSectionNtMapViewOfSectionNtOpenFileVirtualAllocExCloseHandleWriteProcessMemoryCreateToolhelp32SnapshotModule32FirstWModule32NextWResumeThreadCreateProcessWNtClosePoisonErrorpoisoned lock: another task failed inside$ntdll.dllNormalized full path for ntdll.dll:
                                              • API String ID: 2813801548-3725712533
                                              • Opcode ID: bc51da49dd5ebe1bdbac7b1e87484599ed885372a54edbe8c370cf72c3d0952a
                                              • Instruction ID: 1b08691b65e511a5903c5d8b112418c8f09810d0c0d5e0cbe43bbadab47a8107
                                              • Opcode Fuzzy Hash: bc51da49dd5ebe1bdbac7b1e87484599ed885372a54edbe8c370cf72c3d0952a
                                              • Instruction Fuzzy Hash: B703C262A18FC188EB31AF64DC057F9A3A0FB45798F905135DA8D1BB99EF3C9248C750
                                              Function 00007FF71C07A6C0 Relevance: 60.9, APIs: 27, Strings: 7, Instructions: 1423nativefileCOMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1858140292.00007FF71C071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71C070000, based on PE: true
                                              • Associated: 00000000.00000002.1858117811.00007FF71C070000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C1CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C339000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858806603.00007FF71C377000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858833366.00007FF71C378000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff71c070000_dropper.jbxd
                                              Similarity
                                              • API ID: DebugOutputStringmemset$Section$CloseCreateCurrentFileOpenProcessView
                                              • String ID: $ $KO_S$NtCreateSection failedNtOpenFile failed for $NtCreateSectionNtMapViewOfSectionNtOpenFileVirtualAllocExCloseHandleWriteProcessMemoryCreateToolhelp32SnapshotModule32FirstWModule32NextWResumeThreadCreateProcessWNtClosePoisonErrorpoisoned lock: another task failed inside$NtMapViewOfSection failedNtCreateSection failed for module: $`
                                              • API String ID: 2718610588-184564836
                                              • Opcode ID: 0076fdd761a2336a253788d27f2ab96bb376b2db0802acfe63dbc105955b691a
                                              • Instruction ID: 38ba33752efbeb2ff9dd3c34d49713e03bfb071caf6bcec29a44b0a61cc17bda
                                              • Opcode Fuzzy Hash: 0076fdd761a2336a253788d27f2ab96bb376b2db0802acfe63dbc105955b691a
                                              • Instruction Fuzzy Hash: 69F28A72A14FC189EB759FA0EC453E973A4FB49798F908135DA8D0BB89DF798248C350
                                              Function 00007FF71C072DA0 Relevance: 46.5, APIs: 30, Instructions: 1526COMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1858140292.00007FF71C071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71C070000, based on PE: true
                                              • Associated: 00000000.00000002.1858117811.00007FF71C070000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C1CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C339000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858806603.00007FF71C377000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858833366.00007FF71C378000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff71c070000_dropper.jbxd
                                              Similarity
                                              • API ID: DebugOutputStringmemset
                                              • String ID:
                                              • API String ID: 1084755268-0
                                              • Opcode ID: c5a458d34097dcc4e05b5fc4f239d8b487844a5726031d2b561af4976bc9d032
                                              • Instruction ID: 18f8460755842d1343c4468470832aabc5565222ca214bbedf30d55d50c58355
                                              • Opcode Fuzzy Hash: c5a458d34097dcc4e05b5fc4f239d8b487844a5726031d2b561af4976bc9d032
                                              • Instruction Fuzzy Hash: 83F29A72A14FC289EB769FA0DC453F96364FB45B88F904236DA4D1BB89DF799248C310
                                              Function 00007FF71C075400 Relevance: 43.0, APIs: 21, Strings: 3, Instructions: 964COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1858140292.00007FF71C071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71C070000, based on PE: true
                                              • Associated: 00000000.00000002.1858117811.00007FF71C070000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C1CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C339000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858806603.00007FF71C377000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858833366.00007FF71C378000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff71c070000_dropper.jbxd
                                              Similarity
                                              • API ID: memset$DebugOutputString$HandleModuleQueryVirtual
                                              • String ID: C:\Windows\System32\Resolved full path for module: $ntdll.dll$ntdll.dllNormalized full path for ntdll.dll:
                                              • API String ID: 3283594973-2956908514
                                              • Opcode ID: 3507e1f026d2bdbad4c318439c799bdbbbde30219bb2c4fcd8fb11c263ebd47d
                                              • Instruction ID: b3b16e89bd6d9e1ef426dba931f0395fc5e060226daa6c9d98170db238ab810f
                                              • Opcode Fuzzy Hash: 3507e1f026d2bdbad4c318439c799bdbbbde30219bb2c4fcd8fb11c263ebd47d
                                              • Instruction Fuzzy Hash: 6DA2AC72A14FC189EB359F70D8557F8A364FB45B98F944235DA8D0BB8AEF399248C310
                                              Function 00007FF71C077480 Relevance: 19.8, APIs: 6, Strings: 5, Instructions: 509COMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 1084 7ff71c077480-7ff71c0774cb 1085 7ff71c077c83-7ff71c077cc1 call 7ff71c1cd8d0 1084->1085 1086 7ff71c0774d1-7ff71c0774e1 1084->1086 1089 7ff71c077cc6-7ff71c077cce call 7ff71c1cd800 1085->1089 1088 7ff71c0774e7-7ff71c0774f7 1086->1088 1086->1089 1091 7ff71c0774fd-7ff71c077506 1088->1091 1092 7ff71c077cd3-7ff71c077ce1 call 7ff71c1cd730 1088->1092 1089->1092 1094 7ff71c07750c-7ff71c07751e 1091->1094 1095 7ff71c077ce7-7ff71c077d16 call 7ff71c1ceb00 1091->1095 1092->1094 1092->1095 1098 7ff71c0777d7-7ff71c077871 call 7ff71c1b85f0 memset 1094->1098 1099 7ff71c077524-7ff71c077669 1094->1099 1108 7ff71c077d18-7ff71c077d26 call 7ff71c1cd8c0 1095->1108 1109 7ff71c0779ea-7ff71c0779fe OutputDebugStringW 1098->1109 1110 7ff71c077877-7ff71c077889 1098->1110 1103 7ff71c07766d-7ff71c077685 1099->1103 1106 7ff71c0776ba-7ff71c0776c6 1103->1106 1107 7ff71c077687 1103->1107 1106->1098 1112 7ff71c0776cc-7ff71c0776d7 1106->1112 1111 7ff71c077690-7ff71c0776ab 1107->1111 1121 7ff71c077c65-7ff71c077c82 1108->1121 1116 7ff71c077a11-7ff71c077a32 1109->1116 1117 7ff71c077a00-7ff71c077a0c call 7ff71c086a50 1109->1117 1114 7ff71c07795e-7ff71c077981 1110->1114 1115 7ff71c07788f-7ff71c077897 1110->1115 1118 7ff71c0776ad-7ff71c0776b8 1111->1118 1119 7ff71c0776d9-7ff71c0777ac call 7ff71c1b85f0 memset 1111->1119 1112->1103 1126 7ff71c077990-7ff71c0779ba 1114->1126 1122 7ff71c0779bc-7ff71c0779cd 1115->1122 1124 7ff71c077a42-7ff71c077a46 1116->1124 1117->1116 1118->1106 1118->1111 1136 7ff71c07791a-7ff71c07792e OutputDebugStringW 1119->1136 1137 7ff71c0777b2-7ff71c0777c4 1119->1137 1127 7ff71c0779d0-7ff71c0779d7 1122->1127 1128 7ff71c077c2d-7ff71c077c40 1124->1128 1129 7ff71c077a4c-7ff71c077a4f 1124->1129 1126->1122 1126->1126 1127->1109 1131 7ff71c0779d9-7ff71c0779e8 1127->1131 1134 7ff71c077c58-7ff71c077c5f 1128->1134 1135 7ff71c077c42-7ff71c077c52 1128->1135 1132 7ff71c077a51-7ff71c077a56 1129->1132 1133 7ff71c077a60-7ff71c077a7a 1129->1133 1131->1109 1131->1127 1140 7ff71c077a89-7ff71c077b59 call 7ff71c1b85f0 memset 1132->1140 1133->1133 1141 7ff71c077a7c-7ff71c077a87 1133->1141 1134->1108 1134->1121 1135->1134 1142 7ff71c077d2b-7ff71c077d38 call 7ff71c1cd730 1135->1142 1138 7ff71c077941-7ff71c077953 1136->1138 1139 7ff71c077930-7ff71c07793c call 7ff71c086a50 1136->1139 1143 7ff71c07789c-7ff71c0778bf 1137->1143 1144 7ff71c0777ca-7ff71c0777d2 1137->1144 1138->1135 1148 7ff71c077959 1138->1148 1139->1138 1154 7ff71c077bfa-7ff71c077c11 OutputDebugStringW 1140->1154 1155 7ff71c077b5f-7ff71c077b71 1140->1155 1141->1140 1142->1134 1156 7ff71c077d3e-7ff71c077d43 1142->1156 1146 7ff71c0778c0-7ff71c0778ea 1143->1146 1150 7ff71c0778ec-7ff71c0778fd 1144->1150 1146->1146 1146->1150 1148->1134 1152 7ff71c077900-7ff71c077907 1150->1152 1152->1136 1157 7ff71c077909-7ff71c077918 1152->1157 1160 7ff71c077c17-7ff71c077c28 call 7ff71c086a50 1154->1160 1161 7ff71c077a40 1154->1161 1158 7ff71c077b73-7ff71c077b7b 1155->1158 1159 7ff71c077b80-7ff71c077b9f 1155->1159 1156->1134 1157->1136 1157->1152 1162 7ff71c077bcc-7ff71c077bdd 1158->1162 1163 7ff71c077ba0-7ff71c077bca 1159->1163 1160->1161 1161->1124 1165 7ff71c077be0-7ff71c077be7 1162->1165 1163->1162 1163->1163 1165->1154 1167 7ff71c077be9-7ff71c077bf8 1165->1167 1167->1154 1167->1165
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1858140292.00007FF71C071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71C070000, based on PE: true
                                              • Associated: 00000000.00000002.1858117811.00007FF71C070000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C1CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C339000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858806603.00007FF71C377000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858833366.00007FF71C378000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff71c070000_dropper.jbxd
                                              Similarity
                                              • API ID: DebugOutputStringmemset
                                              • String ID: arenegyl$called `Result::unwrap()` on an `Err` value$modnarod$setybdet$uespemos
                                              • API String ID: 1084755268-2410307170
                                              • Opcode ID: e22157f543b9d34401e1c6e1b49ad45fc8a942f96663ec12fb68e57e5996a59c
                                              • Instruction ID: db07d6b906e18fe25b06e54e36e88008cc5929d0e7f29f57c4617bc5cc976438
                                              • Opcode Fuzzy Hash: e22157f543b9d34401e1c6e1b49ad45fc8a942f96663ec12fb68e57e5996a59c
                                              • Instruction Fuzzy Hash: EB221262B14F8185FB21DBA4E8457F96360FB057A8F908236DE5D5BB99EF38D209C310
                                              Function 00007FF71C074E40 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 295stringCOMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 1168 7ff71c074e40-7ff71c074e5d 1169 7ff71c074e63-7ff71c074e78 1168->1169 1170 7ff71c074f01-7ff71c074f4a memset 1168->1170 1171 7ff71c074e7e-7ff71c074e89 1169->1171 1172 7ff71c074f4f 1169->1172 1173 7ff71c0752fc-7ff71c075304 OutputDebugStringW 1170->1173 1175 7ff71c074f54-7ff71c07500f call 7ff71c1b85f0 memset 1171->1175 1176 7ff71c074e8f-7ff71c074efc memset 1171->1176 1172->1175 1174 7ff71c07530a-7ff71c075323 1173->1174 1179 7ff71c0750ca-7ff71c0750ea OutputDebugStringW 1175->1179 1180 7ff71c075015-7ff71c075027 1175->1180 1176->1173 1181 7ff71c0750ec-7ff71c0750f5 call 7ff71c086a50 1179->1181 1182 7ff71c0750fa-7ff71c075101 1179->1182 1183 7ff71c075029-7ff71c075031 1180->1183 1184 7ff71c075033-7ff71c075056 1180->1184 1181->1182 1186 7ff71c075107-7ff71c075128 1182->1186 1187 7ff71c075298-7ff71c0752f3 memset 1182->1187 1188 7ff71c075092-7ff71c0750af 1183->1188 1189 7ff71c075060-7ff71c075090 1184->1189 1191 7ff71c07513c-7ff71c075192 strlen call 7ff71c1be670 1186->1191 1187->1173 1190 7ff71c0750b0-7ff71c0750b7 1188->1190 1189->1188 1189->1189 1190->1179 1192 7ff71c0750b9-7ff71c0750c8 1190->1192 1195 7ff71c075194-7ff71c0751a3 memcmp 1191->1195 1196 7ff71c075130-7ff71c075136 1191->1196 1192->1179 1192->1190 1195->1196 1197 7ff71c0751a5-7ff71c07526d call 7ff71c1b85f0 memset 1195->1197 1196->1187 1196->1191 1200 7ff71c0753ba-7ff71c0753da OutputDebugStringW 1197->1200 1201 7ff71c075273-7ff71c075285 1197->1201 1204 7ff71c0753dc-7ff71c0753e5 call 7ff71c086a50 1200->1204 1205 7ff71c0753ea-7ff71c0753f6 1200->1205 1202 7ff71c07528b-7ff71c075293 1201->1202 1203 7ff71c075324-7ff71c075347 1201->1203 1206 7ff71c075382-7ff71c07539f 1202->1206 1207 7ff71c075350-7ff71c075380 1203->1207 1204->1205 1205->1174 1209 7ff71c0753a0-7ff71c0753a7 1206->1209 1207->1206 1207->1207 1209->1200 1210 7ff71c0753a9-7ff71c0753b8 1209->1210 1210->1200 1210->1209
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1858140292.00007FF71C071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71C070000, based on PE: true
                                              • Associated: 00000000.00000002.1858117811.00007FF71C070000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C1CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C339000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858806603.00007FF71C377000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858833366.00007FF71C378000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff71c070000_dropper.jbxd
                                              Similarity
                                              • API ID: DebugOutputStringmemset$memcmpstrlen
                                              • String ID: c
                                              • API String ID: 2294051181-112844655
                                              • Opcode ID: 4a5f2d7dfcc1d3684de66f2dde6ce2d5d5f926691e0e6249c5d5fa08d6ad5891
                                              • Instruction ID: bfa2bbd5e9a355d1ffb6e8595e802658d09a786dc8525c106e7f34359bd140ac
                                              • Opcode Fuzzy Hash: 4a5f2d7dfcc1d3684de66f2dde6ce2d5d5f926691e0e6249c5d5fa08d6ad5891
                                              • Instruction Fuzzy Hash: 89E1BF62A18FC185EB219B64F4417FAE3A0FB85794FA04235EA8D03B65EF7DD149CB10
                                              Function 00007FF71C076AE0 Relevance: 18.0, APIs: 6, Strings: 4, Instructions: 480COMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 1211 7ff71c076ae0-7ff71c076b10 1212 7ff71c076d39-7ff71c076dc5 call 7ff71c1b85f0 memset 1211->1212 1213 7ff71c076b16-7ff71c076b2d 1211->1213 1222 7ff71c076dcb-7ff71c076ddd 1212->1222 1223 7ff71c076f3a-7ff71c076f55 OutputDebugStringW 1212->1223 1215 7ff71c0771fa-7ff71c077238 call 7ff71c1cd8d0 1213->1215 1216 7ff71c076b33-7ff71c076b42 1213->1216 1219 7ff71c07723d-7ff71c077245 call 7ff71c1cd800 1215->1219 1216->1219 1220 7ff71c076b48-7ff71c076b58 1216->1220 1226 7ff71c07724a-7ff71c07725d call 7ff71c1cd730 1219->1226 1225 7ff71c076b5e-7ff71c076b6e 1220->1225 1220->1226 1229 7ff71c076eae-7ff71c076edf 1222->1229 1230 7ff71c076de3-7ff71c076deb 1222->1230 1227 7ff71c076f5b-7ff71c076f69 call 7ff71c086a50 1223->1227 1228 7ff71c0771ec-7ff71c0771f9 1223->1228 1233 7ff71c077263-7ff71c077300 call 7ff71c1b85f0 call 7ff71c081ff0 1225->1233 1234 7ff71c076b74-7ff71c076b80 1225->1234 1226->1233 1226->1234 1227->1228 1241 7ff71c076ee0-7ff71c076f0a 1229->1241 1236 7ff71c076f0c-7ff71c076f1d 1230->1236 1256 7ff71c07731b-7ff71c07734d call 7ff71c1ce730 1233->1256 1257 7ff71c077302-7ff71c077316 call 7ff71c086a50 1233->1257 1238 7ff71c077028-7ff71c0770ed call 7ff71c084a90 call 7ff71c1b85f0 memset 1234->1238 1239 7ff71c076b86-7ff71c076cca 1234->1239 1246 7ff71c076f20-7ff71c076f27 1236->1246 1262 7ff71c07719a-7ff71c0771ae OutputDebugStringW 1238->1262 1263 7ff71c0770f3-7ff71c077105 1238->1263 1243 7ff71c076cce-7ff71c076ce6 1239->1243 1241->1236 1241->1241 1248 7ff71c076d1a-7ff71c076d26 1243->1248 1249 7ff71c076ce8 1243->1249 1246->1223 1247 7ff71c076f29-7ff71c076f38 1246->1247 1247->1223 1247->1246 1248->1238 1253 7ff71c076d2c-7ff71c076d37 1248->1253 1254 7ff71c076cf0-7ff71c076d07 1249->1254 1253->1243 1259 7ff71c076d0d-7ff71c076d18 1254->1259 1260 7ff71c076df0-7ff71c076e83 call 7ff71c1b85f0 memset 1254->1260 1274 7ff71c07734f-7ff71c077357 call 7ff71c1cd8c0 1256->1274 1257->1256 1259->1248 1259->1254 1275 7ff71c076e89-7ff71c076e9b 1260->1275 1276 7ff71c076ffa-7ff71c077015 OutputDebugStringW 1260->1276 1270 7ff71c0771c1-7ff71c0771cf 1262->1270 1271 7ff71c0771b0-7ff71c0771bc call 7ff71c086a50 1262->1271 1266 7ff71c077107-7ff71c07710f 1263->1266 1267 7ff71c077111-7ff71c077134 1263->1267 1272 7ff71c07716c-7ff71c07717d 1266->1272 1273 7ff71c077140-7ff71c07716a 1267->1273 1278 7ff71c0771d1-7ff71c0771da 1270->1278 1279 7ff71c0771e0-7ff71c0771e6 1270->1279 1271->1270 1281 7ff71c077180-7ff71c077187 1272->1281 1273->1272 1273->1273 1274->1228 1282 7ff71c076f6e-7ff71c076f9f 1275->1282 1283 7ff71c076ea1-7ff71c076ea9 1275->1283 1276->1238 1284 7ff71c077017-7ff71c077023 call 7ff71c086a50 1276->1284 1278->1279 1285 7ff71c07735c-7ff71c077363 call 7ff71c1cd730 1278->1285 1279->1228 1279->1274 1281->1262 1288 7ff71c077189-7ff71c077198 1281->1288 1286 7ff71c076fa0-7ff71c076fca 1282->1286 1290 7ff71c076fcc-7ff71c076fdd 1283->1290 1284->1238 1285->1279 1295 7ff71c077369-7ff71c07736d 1285->1295 1286->1286 1286->1290 1288->1262 1288->1281 1292 7ff71c076fe0-7ff71c076fe7 1290->1292 1292->1276 1294 7ff71c076fe9-7ff71c076ff8 1292->1294 1294->1276 1294->1292 1295->1279
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1858140292.00007FF71C071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71C070000, based on PE: true
                                              • Associated: 00000000.00000002.1858117811.00007FF71C070000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C1CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C339000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858806603.00007FF71C377000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858833366.00007FF71C378000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff71c070000_dropper.jbxd
                                              Similarity
                                              • API ID: DebugOutputStringmemset
                                              • String ID: arenegyl$modnarod$setybdet$uespemos
                                              • API String ID: 1084755268-66988881
                                              • Opcode ID: f0d297dbfc796e9da77eefe05c2929313f1d04e09a0514ada39c0beb4af48407
                                              • Instruction ID: b19a54ff63c4d774d5622f9f07567c22b57cd83d3a5f1487188c1bd592ae1175
                                              • Opcode Fuzzy Hash: f0d297dbfc796e9da77eefe05c2929313f1d04e09a0514ada39c0beb4af48407
                                              • Instruction Fuzzy Hash: 9822E172A15FC189FB21DFA4E8553FC6361EB05798F908236DE4D5BB4AEF289249C310
                                              Function 00007FF71C0721C0 Relevance: 17.9, APIs: 5, Strings: 5, Instructions: 433COMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 1296 7ff71c0721c0-7ff71c072204 1297 7ff71c07281c-7ff71c072869 call 7ff71c1cd8d0 1296->1297 1298 7ff71c07220a-7ff71c072219 1296->1298 1300 7ff71c07286f-7ff71c07287e call 7ff71c1cdaf0 1297->1300 1301 7ff71c07221f-7ff71c072227 1297->1301 1298->1300 1298->1301 1305 7ff71c07223a-7ff71c072246 1300->1305 1306 7ff71c072884-7ff71c0728b8 call 7ff71c1ceb00 1300->1306 1301->1300 1303 7ff71c07222d-7ff71c072234 1301->1303 1303->1305 1303->1306 1308 7ff71c07255b-7ff71c0725f5 call 7ff71c1b85f0 memset 1305->1308 1309 7ff71c07224c-7ff71c072390 1305->1309 1317 7ff71c0728d5-7ff71c072912 1306->1317 1320 7ff71c0725fb-7ff71c07260d 1308->1320 1321 7ff71c0727ba-7ff71c0727ce OutputDebugStringW 1308->1321 1312 7ff71c072394-7ff71c0723ac 1309->1312 1315 7ff71c0723ae 1312->1315 1316 7ff71c0723da-7ff71c0723e6 1312->1316 1322 7ff71c0723b0-7ff71c0723cb 1315->1322 1316->1308 1323 7ff71c0723ec-7ff71c0723f7 1316->1323 1318 7ff71c072923-7ff71c072928 call 7ff71c1cdd50 1317->1318 1319 7ff71c072914-7ff71c072922 1317->1319 1318->1319 1325 7ff71c072737-7ff71c07275a 1320->1325 1326 7ff71c072613-7ff71c07261b 1320->1326 1329 7ff71c0727e1-7ff71c0727eb 1321->1329 1330 7ff71c0727d0-7ff71c0727dc call 7ff71c086a50 1321->1330 1327 7ff71c0723cd-7ff71c0723d8 1322->1327 1328 7ff71c0723f9-7ff71c072530 call 7ff71c1b85f0 memset 1322->1328 1323->1312 1334 7ff71c072760-7ff71c07278a 1325->1334 1333 7ff71c07278c-7ff71c07279d 1326->1333 1327->1316 1327->1322 1341 7ff71c0726aa-7ff71c0726be OutputDebugStringW 1328->1341 1342 7ff71c072536-7ff71c072548 1328->1342 1331 7ff71c0727ee-7ff71c072804 1329->1331 1330->1329 1338 7ff71c0728ba-7ff71c0728c2 call 7ff71c1cdd50 1331->1338 1339 7ff71c07280a-7ff71c07281b 1331->1339 1340 7ff71c0727a0-7ff71c0727a7 1333->1340 1334->1333 1334->1334 1338->1339 1340->1321 1343 7ff71c0727a9-7ff71c0727b8 1340->1343 1347 7ff71c0726d1-7ff71c0726df 1341->1347 1348 7ff71c0726c0-7ff71c0726cc call 7ff71c086a50 1341->1348 1345 7ff71c07254e-7ff71c072556 1342->1345 1346 7ff71c072620-7ff71c072643 1342->1346 1343->1321 1343->1340 1352 7ff71c07267c-7ff71c07268d 1345->1352 1353 7ff71c072650-7ff71c07267a 1346->1353 1350 7ff71c0728c7 1347->1350 1351 7ff71c0726e5-7ff71c0726e9 1347->1351 1348->1347 1355 7ff71c0728ca-7ff71c0728d0 call 7ff71c1ce525 1350->1355 1356 7ff71c0726eb-7ff71c072708 call 7ff71c086a40 1351->1356 1357 7ff71c072713 1351->1357 1358 7ff71c072690-7ff71c072697 1352->1358 1353->1352 1353->1353 1355->1317 1356->1355 1364 7ff71c07270e-7ff71c072711 1356->1364 1361 7ff71c072719-7ff71c072732 memcpy 1357->1361 1358->1341 1362 7ff71c072699-7ff71c0726a8 1358->1362 1361->1331 1362->1341 1362->1358 1364->1361
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1858140292.00007FF71C071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71C070000, based on PE: true
                                              • Associated: 00000000.00000002.1858117811.00007FF71C070000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C1CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C339000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858806603.00007FF71C377000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858833366.00007FF71C378000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff71c070000_dropper.jbxd
                                              Similarity
                                              • API ID: DebugOutputStringmemset$memcpy
                                              • String ID: arenegyl$called `Result::unwrap()` on an `Err` value$modnarod$setybdet$uespemos
                                              • API String ID: 293864031-2410307170
                                              • Opcode ID: a4a1c5ce171b32daca0f2df972a96d958ba81183423b2dfe08f406cc63539156
                                              • Instruction ID: bdee8a36ff3c35fd5d3a81a78c0b943e0b4c6d51ba7d83b145afc47eaa52fff3
                                              • Opcode Fuzzy Hash: a4a1c5ce171b32daca0f2df972a96d958ba81183423b2dfe08f406cc63539156
                                              • Instruction Fuzzy Hash: A802F072A15F8185FB24DFA0E8557F86360FB057A8F908236DE5D5BB99EF388249C310
                                              Function 00007FF71C1C7CF0 Relevance: 15.5, APIs: 2, Strings: 8, Instructions: 516COMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 1432 7ff71c1c7cf0-7ff71c1c7d07 1433 7ff71c1c7d15-7ff71c1c7d42 1432->1433 1434 7ff71c1c7d09-7ff71c1c7d10 call 7ff71c1b8280 1432->1434 1436 7ff71c1c8063-7ff71c1c8079 1433->1436 1437 7ff71c1c7d48-7ff71c1c7d56 1433->1437 1445 7ff71c1c8464-7ff71c1c8474 1434->1445 1441 7ff71c1c807f-7ff71c1c8083 1436->1441 1442 7ff71c1c8161-7ff71c1c8165 1436->1442 1439 7ff71c1c808c-7ff71c1c8093 1437->1439 1440 7ff71c1c7d5c-7ff71c1c7d7e 1437->1440 1439->1434 1449 7ff71c1c8099-7ff71c1c80dc 1439->1449 1440->1434 1446 7ff71c1c7d80-7ff71c1c7d8d 1440->1446 1447 7ff71c1c8085-7ff71c1c8087 1441->1447 1448 7ff71c1c80ea-7ff71c1c8102 1441->1448 1443 7ff71c1c8167-7ff71c1c817f memcpy 1442->1443 1444 7ff71c1c8188-7ff71c1c818c 1442->1444 1451 7ff71c1c8191-7ff71c1c81f5 1443->1451 1452 7ff71c1c8181-7ff71c1c8183 1443->1452 1444->1451 1446->1434 1453 7ff71c1c7d93-7ff71c1c7da7 call 7ff71c086a40 1446->1453 1454 7ff71c1c8147-7ff71c1c8149 1447->1454 1450 7ff71c1c8110-7ff71c1c8145 1448->1450 1449->1434 1455 7ff71c1c80e2 1449->1455 1450->1450 1450->1454 1458 7ff71c1c8227-7ff71c1c822b 1451->1458 1457 7ff71c1c8453-7ff71c1c845a 1452->1457 1460 7ff71c1c7dac-7ff71c1c7daf 1453->1460 1454->1442 1456 7ff71c1c814b-7ff71c1c815c 1454->1456 1455->1448 1456->1442 1457->1445 1461 7ff71c1c822d-7ff71c1c8249 1458->1461 1462 7ff71c1c8217-7ff71c1c8221 1458->1462 1464 7ff71c1c7db5-7ff71c1c7ded memset 1460->1464 1465 7ff71c1c847c-7ff71c1c848b call 7ff71c1b82d0 1460->1465 1466 7ff71c1c8250-7ff71c1c8337 1461->1466 1462->1458 1463 7ff71c1c842c-7ff71c1c844f 1462->1463 1463->1457 1470 7ff71c1c7df3-7ff71c1c7e83 1464->1470 1471 7ff71c1c848d 1464->1471 1465->1445 1467 7ff71c1c8367-7ff71c1c8375 1466->1467 1468 7ff71c1c8339-7ff71c1c834f 1466->1468 1475 7ff71c1c8383-7ff71c1c8399 1467->1475 1476 7ff71c1c8377-7ff71c1c837f 1467->1476 1474 7ff71c1c8350-7ff71c1c8365 1468->1474 1472 7ff71c1c7ee2-7ff71c1c7ee5 1470->1472 1473 7ff71c1c8491-7ff71c1c84b2 1471->1473 1479 7ff71c1c7f0a-7ff71c1c8012 1472->1479 1480 7ff71c1c7ee7 1472->1480 1473->1445 1478 7ff71c1c84b4-7ff71c1c84c2 1473->1478 1474->1467 1474->1474 1481 7ff71c1c839f-7ff71c1c83c7 1475->1481 1482 7ff71c1c8200-7ff71c1c820f 1475->1482 1476->1475 1478->1445 1483 7ff71c1c84c4-7ff71c1c84e2 call 7ff71c086a50 1478->1483 1485 7ff71c1c8014-7ff71c1c8019 1479->1485 1486 7ff71c1c803a-7ff71c1c804a 1479->1486 1484 7ff71c1c7ef0-7ff71c1c7f06 1480->1484 1487 7ff71c1c8400-7ff71c1c8427 1481->1487 1488 7ff71c1c83c9-7ff71c1c83f1 1481->1488 1489 7ff71c1c8214 1482->1489 1483->1445 1484->1484 1491 7ff71c1c7f08 1484->1491 1492 7ff71c1c8020-7ff71c1c8038 1485->1492 1493 7ff71c1c7e90-7ff71c1c7edc 1486->1493 1494 7ff71c1c8050-7ff71c1c805e 1486->1494 1487->1489 1488->1466 1489->1462 1491->1479 1492->1486 1492->1492 1493->1472 1495 7ff71c1c8475-7ff71c1c847a 1493->1495 1494->1493 1495->1473
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1858140292.00007FF71C071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71C070000, based on PE: true
                                              • Associated: 00000000.00000002.1858117811.00007FF71C070000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C1CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C339000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858806603.00007FF71C377000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858833366.00007FF71C378000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff71c070000_dropper.jbxd
                                              Similarity
                                              • API ID: memset
                                              • String ID: arenegyl$arenegyl$modnarod$modnarod$setybdet$setybdet$uespemos$uespemos
                                              • API String ID: 2221118986-1116813384
                                              • Opcode ID: b35ed61f812096a3ae8165a94599fabaf60963df538cad40114b63f4de16f12d
                                              • Instruction ID: 281e4c645427ff5757a99ed0944279940d1d2238a8ab93c125afa072f311790b
                                              • Opcode Fuzzy Hash: b35ed61f812096a3ae8165a94599fabaf60963df538cad40114b63f4de16f12d
                                              • Instruction Fuzzy Hash: 850278A2B68B9186FA00AFA864016F99750BB41BF0F989730EF6D57381EF3CD655D200
                                              Function 00007FF71C071350 Relevance: 14.6, APIs: 2, Strings: 6, Instructions: 569COMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 1497 7ff71c071350-7ff71c0713b1 1498 7ff71c0713b7-7ff71c0713c9 1497->1498 1499 7ff71c071f58-7ff71c071f96 call 7ff71c1cd8d0 1497->1499 1501 7ff71c071f9b-7ff71c071fa3 call 7ff71c1cdc20 1498->1501 1502 7ff71c0713cf-7ff71c0713df 1498->1502 1499->1501 1505 7ff71c071fa8-7ff71c071fb5 call 7ff71c1cd730 1501->1505 1502->1505 1506 7ff71c0713e5-7ff71c0713ed 1502->1506 1508 7ff71c071fbb-7ff71c071fea call 7ff71c1ceb00 1505->1508 1509 7ff71c0713f3-7ff71c071419 call 7ff71c086a40 1505->1509 1506->1508 1506->1509 1516 7ff71c072066-7ff71c0720b3 call 7ff71c0850a0 1508->1516 1517 7ff71c072057-7ff71c072061 call 7ff71c1ce53f 1509->1517 1518 7ff71c07141f-7ff71c071be4 1509->1518 1517->1516 1519 7ff71c071bfb-7ff71c071c02 1518->1519 1522 7ff71c071ee9-7ff71c071f0a call 7ff71c086a50 1519->1522 1523 7ff71c071c08-7ff71c071c56 call 7ff71c080460 1519->1523 1529 7ff71c071f0c-7ff71c071f1c 1522->1529 1530 7ff71c071f22-7ff71c071f37 1522->1530 1531 7ff71c071c5c-7ff71c071c6a 1523->1531 1532 7ff71c07200f-7ff71c072055 call 7ff71c1ceb00 1523->1532 1529->1530 1533 7ff71c071ff9-7ff71c072000 call 7ff71c1cd730 1529->1533 1534 7ff71c071f3d-7ff71c071f57 1530->1534 1535 7ff71c071fec-7ff71c071ff4 call 7ff71c1cdd50 1530->1535 1536 7ff71c071d24-7ff71c071d56 call 7ff71c084d10 1531->1536 1537 7ff71c071c70-7ff71c071c77 1531->1537 1532->1516 1533->1530 1550 7ff71c072006-7ff71c07200a 1533->1550 1535->1534 1552 7ff71c071d6c-7ff71c071e12 call 7ff71c1b85f0 memset 1536->1552 1553 7ff71c071d58 1536->1553 1540 7ff71c071c7d-7ff71c071c8a 1537->1540 1541 7ff71c071cf9-7ff71c071d00 1537->1541 1546 7ff71c071c90-7ff71c071cf7 1540->1546 1541->1536 1548 7ff71c071d02-7ff71c071d05 1541->1548 1546->1541 1546->1546 1551 7ff71c071d10-7ff71c071d22 1548->1551 1550->1530 1551->1536 1551->1551 1558 7ff71c071eba-7ff71c071ecd OutputDebugStringW 1552->1558 1559 7ff71c071e18-7ff71c071e2a 1552->1559 1553->1552 1554 7ff71c071d5a-7ff71c071d67 call 7ff71c086a50 1553->1554 1554->1552 1562 7ff71c071ed3-7ff71c071ee4 call 7ff71c086a50 1558->1562 1563 7ff71c071bf0-7ff71c071bf4 1558->1563 1560 7ff71c071e2c-7ff71c071e34 1559->1560 1561 7ff71c071e40-7ff71c071e5f 1559->1561 1564 7ff71c071e8c-7ff71c071e9d 1560->1564 1565 7ff71c071e60-7ff71c071e8a 1561->1565 1562->1563 1563->1519 1567 7ff71c071ea0-7ff71c071ea7 1564->1567 1565->1564 1565->1565 1567->1558 1569 7ff71c071ea9-7ff71c071eb8 1567->1569 1569->1558 1569->1567
                                              APIs
                                              Strings
                                              • Thread32NextVirtualFreeWaitForSingleObjectTerminateThreadSuspendThreadResumeThreadIsWow64ProcessModule32FirstWModule32NextWGetCurrentProcessIdProcess32FirstWProcess32NextWZwOpenKeyZwCreateKeyZwSetValueKeyZwCloseCreateRemoteThreadNtQuerySystemInformationEnumPro, xrefs: 00007FF71C071787
                                              • RtlCaptureStackBackTraceLoadLibraryAGetProcAddressLdrGetDllHandleByMappingLdrRegisterDllNotificationVirtualAllocExVirtualFreeExNtCreateSectionFailed to encrypt function name, xrefs: 00007FF71C071B0B
                                              • FindFirstFileWFindNextFileWNtQueryDirectoryFileRegQueryValueExWNtEnumerateKeyGetAsyncKeyStateSetWindowsHookExWLogonUserWCredEnumerateWCreateProcessWNtQueryInformationProcessVirtualQueryExGetProcessIdNtOpenProcessNtWriteVirtualMemoryNtReadVirtualMemoryLoadLibra, xrefs: 00007FF71C071962
                                              • called `Result::unwrap()` on an `Err` value, xrefs: 00007FF71C071FCE
                                              • NtProtectVirtualMemoryNtAllocateVirtualMemoryNtMapViewOfSectionNtUnmapViewOfSectionNtOpenFileLdrLoadDllEtwEventWriteFullEtwEventWriteEtwEventWriteTransferWDEnableMpWDEnableMpScanStartMpSampleSubmitMpAmsiNotifyMpSampleQueryMpAmsiScanMpThreatActionNtResumeThread, xrefs: 00007FF71C071434
                                              • NtGetContextThreadNtSetContextThreadNtCloseNtCreateThreadExNtCreateProcessExNtQueryInformationThreadGetProcessIdOfThreadWriteProcessMemoryReadProcessMemoryOpenProcessVirtualProtectExCloseHandleVirtualAllocVirtualProtectOpenThreadCreateToolhelp32SnapshotThread3, xrefs: 00007FF71C0715CC
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1858140292.00007FF71C071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71C070000, based on PE: true
                                              • Associated: 00000000.00000002.1858117811.00007FF71C070000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C1CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C339000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858806603.00007FF71C377000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858833366.00007FF71C378000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff71c070000_dropper.jbxd
                                              Similarity
                                              • API ID: memcpy$memset$DebugOutputString
                                              • String ID: FindFirstFileWFindNextFileWNtQueryDirectoryFileRegQueryValueExWNtEnumerateKeyGetAsyncKeyStateSetWindowsHookExWLogonUserWCredEnumerateWCreateProcessWNtQueryInformationProcessVirtualQueryExGetProcessIdNtOpenProcessNtWriteVirtualMemoryNtReadVirtualMemoryLoadLibra$NtGetContextThreadNtSetContextThreadNtCloseNtCreateThreadExNtCreateProcessExNtQueryInformationThreadGetProcessIdOfThreadWriteProcessMemoryReadProcessMemoryOpenProcessVirtualProtectExCloseHandleVirtualAllocVirtualProtectOpenThreadCreateToolhelp32SnapshotThread3$NtProtectVirtualMemoryNtAllocateVirtualMemoryNtMapViewOfSectionNtUnmapViewOfSectionNtOpenFileLdrLoadDllEtwEventWriteFullEtwEventWriteEtwEventWriteTransferWDEnableMpWDEnableMpScanStartMpSampleSubmitMpAmsiNotifyMpSampleQueryMpAmsiScanMpThreatActionNtResumeThread$RtlCaptureStackBackTraceLoadLibraryAGetProcAddressLdrGetDllHandleByMappingLdrRegisterDllNotificationVirtualAllocExVirtualFreeExNtCreateSectionFailed to encrypt function name$Thread32NextVirtualFreeWaitForSingleObjectTerminateThreadSuspendThreadResumeThreadIsWow64ProcessModule32FirstWModule32NextWGetCurrentProcessIdProcess32FirstWProcess32NextWZwOpenKeyZwCreateKeyZwSetValueKeyZwCloseCreateRemoteThreadNtQuerySystemInformationEnumPro$called `Result::unwrap()` on an `Err` value
                                              • API String ID: 4266836622-765071994
                                              • Opcode ID: a42575152e69d51e04e4ff008b056d995d1c74d679467d2bd34058e94b2129fd
                                              • Instruction ID: d7e0a8a2fc0160f995a47dbba3e8dc3dd6530fbdbe14709f3d3e1857f0e06bac
                                              • Opcode Fuzzy Hash: a42575152e69d51e04e4ff008b056d995d1c74d679467d2bd34058e94b2129fd
                                              • Instruction Fuzzy Hash: 6C723A77615F918AE790DB90F8847E873E8FB08354FA04239DA8C437A1DF789268D356
                                              Function 00007FF71C084D10 Relevance: 5.2, Strings: 4, Instructions: 194COMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 1605 7ff71c084d10-7ff71c084d45 1606 7ff71c084d58-7ff71c084e8e 1605->1606 1607 7ff71c084d47-7ff71c084d53 call 7ff71c1c7cf0 1605->1607 1609 7ff71c084e91-7ff71c084eaa 1606->1609 1607->1606 1610 7ff71c084eac 1609->1610 1611 7ff71c084ed8-7ff71c084ee2 1609->1611 1612 7ff71c084eb0-7ff71c084ec9 1610->1612 1613 7ff71c084efe-7ff71c084f0a 1611->1613 1614 7ff71c084ee4-7ff71c084efb 1611->1614 1615 7ff71c084f1c-7ff71c084f3c 1612->1615 1616 7ff71c084ecb-7ff71c084ed6 1612->1616 1617 7ff71c084f0c-7ff71c084f17 1613->1617 1618 7ff71c084f52-7ff71c084f5a 1613->1618 1614->1613 1621 7ff71c084f40-7ff71c084f51 1615->1621 1616->1611 1616->1612 1617->1609 1619 7ff71c084f5c-7ff71c084f6a 1618->1619 1620 7ff71c084f6f-7ff71c084fda 1618->1620 1619->1620 1620->1621
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1858140292.00007FF71C071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71C070000, based on PE: true
                                              • Associated: 00000000.00000002.1858117811.00007FF71C070000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C1CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C339000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858806603.00007FF71C377000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858833366.00007FF71C378000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff71c070000_dropper.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID: arenegyl$modnarod$setybdep$uespemos
                                              • API String ID: 0-169184043
                                              • Opcode ID: 0f8630086bdaa19f6dbd244cc77421529c3fd844ef34852397b70ae4e77889aa
                                              • Instruction ID: 95bf8dbb364f389eea5bd91c4e7a5e26768b6599d7bc2a03c0a7959b6e602574
                                              • Opcode Fuzzy Hash: 0f8630086bdaa19f6dbd244cc77421529c3fd844ef34852397b70ae4e77889aa
                                              • Instruction Fuzzy Hash: B56158E2F14B9442FF01DBF568227BDA761A715BD0F91E22ADE5D27706EF3892818200
                                              Function 00007FF71C0897B0 Relevance: 3.0, APIs: 2, Instructions: 48COMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 1631 7ff71c0897b0-7ff71c0897c1 1632 7ff71c089822 1631->1632 1633 7ff71c0897c3-7ff71c0897dd 1631->1633 1634 7ff71c089824-7ff71c089834 1632->1634 1635 7ff71c0897e8-7ff71c08980a BCryptGenRandom 1633->1635 1636 7ff71c0897e0-7ff71c0897e6 1635->1636 1637 7ff71c08980c-7ff71c089818 SystemFunction036 1635->1637 1636->1632 1636->1635 1637->1636 1638 7ff71c08981a-7ff71c089820 1637->1638 1638->1634
                                              APIs
                                              • BCryptGenRandom.BCRYPT(?,?,?,00007FF71C089555,?,?,?,00007FF71C1C8636), ref: 00007FF71C089802
                                              • SystemFunction036.ADVAPI32(?,?,?,00007FF71C1C8636), ref: 00007FF71C089813
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1858140292.00007FF71C071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71C070000, based on PE: true
                                              • Associated: 00000000.00000002.1858117811.00007FF71C070000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C1CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C339000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858806603.00007FF71C377000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858833366.00007FF71C378000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff71c070000_dropper.jbxd
                                              Similarity
                                              • API ID: CryptFunction036RandomSystem
                                              • String ID:
                                              • API String ID: 1232939966-0
                                              • Opcode ID: 65f8523fcbb2458bcd751fc755406cc7c2d4a3bd098fa7d4da03422ef29cf674
                                              • Instruction ID: 34e22adf77ae70a658fa77d75fa2c5cbcd7a184962c0901633d20413604216ac
                                              • Opcode Fuzzy Hash: 65f8523fcbb2458bcd751fc755406cc7c2d4a3bd098fa7d4da03422ef29cf674
                                              • Instruction Fuzzy Hash: 50F0F462F1989644FE747AE63E054B4D1816F14BF0EB88371AC3D43BD09E28988A9210
                                              Function 00007FF71C089540 Relevance: 1.5, Strings: 1, Instructions: 265COMMON
                                              Download Yara Rule
                                              Strings
                                              • 0x000102030405060708091011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798990000000000000000000000000000000000000000000000000000000000, xrefs: 00007FF71C1C4F60, 00007FF71C1C5010
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1858140292.00007FF71C071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71C070000, based on PE: true
                                              • Associated: 00000000.00000002.1858117811.00007FF71C070000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C1CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C339000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858806603.00007FF71C377000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858833366.00007FF71C378000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff71c070000_dropper.jbxd
                                              Similarity
                                              • API ID: CryptFunction036RandomSystem
                                              • String ID: 0x000102030405060708091011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798990000000000000000000000000000000000000000000000000000000000
                                              • API String ID: 1232939966-528166994
                                              • Opcode ID: e6c5f7c104532e93a7921b5d5ec58515af85347506362396b7efc1f7b7334ce4
                                              • Instruction ID: da26f512e7e1c7498289fc9fec36a2032308a96dd89d1afd611462240eece4f0
                                              • Opcode Fuzzy Hash: e6c5f7c104532e93a7921b5d5ec58515af85347506362396b7efc1f7b7334ce4
                                              • Instruction Fuzzy Hash: 67A1AA73B68AA145F324AB68B0007F8A694EB45770FE09331EE6E47BD0DE2D9A44D354
                                              Function 00007FF71C080460 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 338COMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 1365 7ff71c080460-7ff71c0804a2 1366 7ff71c0804a4-7ff71c0804bf 1365->1366 1367 7ff71c0804e3-7ff71c0804fc call 7ff71c086a40 1365->1367 1368 7ff71c08055d-7ff71c0805a6 call 7ff71c1a3870 call 7ff71c080150 memcpy * 2 1366->1368 1369 7ff71c0804c5-7ff71c0804cd 1366->1369 1376 7ff71c080502-7ff71c080545 1367->1376 1377 7ff71c0809ff-7ff71c080a09 call 7ff71c1ce525 1367->1377 1386 7ff71c0805ab-7ff71c0805d6 memcpy 1368->1386 1371 7ff71c08054a-7ff71c080557 call 7ff71c1cd000 1369->1371 1372 7ff71c0804cf-7ff71c0804de call 7ff71c1a0420 1369->1372 1371->1368 1371->1372 1372->1386 1382 7ff71c0809e8-7ff71c0809fe 1376->1382 1385 7ff71c080a0e 1377->1385 1389 7ff71c080a10-7ff71c080a22 call 7ff71c1ce525 1385->1389 1386->1385 1388 7ff71c0805dc-7ff71c0805e3 1386->1388 1390 7ff71c0805e9-7ff71c0805fd call 7ff71c086a70 1388->1390 1391 7ff71c080a24 1388->1391 1397 7ff71c080a7b-7ff71c080aab 1389->1397 1396 7ff71c080602-7ff71c080605 1390->1396 1395 7ff71c080a2a-7ff71c080a4e call 7ff71c1cec40 1391->1395 1395->1397 1396->1389 1399 7ff71c08060b-7ff71c080615 1396->1399 1401 7ff71c080aad-7ff71c080ac1 call 7ff71c086a50 1397->1401 1402 7ff71c080ac6-7ff71c080adf 1397->1402 1399->1395 1403 7ff71c08061b-7ff71c080666 memcpy * 2 1399->1403 1401->1402 1405 7ff71c080668-7ff71c08066d 1403->1405 1406 7ff71c080672-7ff71c08076b memcpy memset call 7ff71c0863e0 call 7ff71c0864e0 1403->1406 1407 7ff71c08079f-7ff71c080855 call 7ff71c1b85f0 memset 1405->1407 1406->1407 1420 7ff71c08076d-7ff71c08079a 1406->1420 1413 7ff71c08085b-7ff71c08086d 1407->1413 1414 7ff71c08090a-7ff71c080924 OutputDebugStringW 1407->1414 1416 7ff71c080879-7ff71c08089c 1413->1416 1417 7ff71c08086f-7ff71c080877 1413->1417 1418 7ff71c080937-7ff71c0809aa call 7ff71c1a3e00 1414->1418 1419 7ff71c080926-7ff71c080932 call 7ff71c086a50 1414->1419 1422 7ff71c0808a0-7ff71c0808d0 1416->1422 1421 7ff71c0808d2-7ff71c0808e3 1417->1421 1428 7ff71c080a50-7ff71c080a76 call 7ff71c1ceb00 1418->1428 1429 7ff71c0809b0-7ff71c0809e3 call 7ff71c086a50 1418->1429 1419->1418 1420->1382 1425 7ff71c0808f0-7ff71c0808f7 1421->1425 1422->1421 1422->1422 1425->1414 1427 7ff71c0808f9-7ff71c080908 1425->1427 1427->1414 1427->1425 1428->1397 1429->1382
                                              APIs
                                              Strings
                                              • a Display implementation returned an error unexpectedly/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\alloc\src\string.rs, xrefs: 00007FF71C080A5C
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1858140292.00007FF71C071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71C070000, based on PE: true
                                              • Associated: 00000000.00000002.1858117811.00007FF71C070000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C1CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C339000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858806603.00007FF71C377000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858833366.00007FF71C378000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff71c070000_dropper.jbxd
                                              Similarity
                                              • API ID: memcpy$memset$DebugOutputString
                                              • String ID: a Display implementation returned an error unexpectedly/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\alloc\src\string.rs
                                              • API String ID: 4266836622-2804265448
                                              • Opcode ID: 4993f16b747f0d82298fc8b8c705bc9ee6e5efa5c70424381e3cc173db5c52cd
                                              • Instruction ID: b88ce96d665276df719d89aa2dc04291b00198b06ebcb13a98b9db017871d0de
                                              • Opcode Fuzzy Hash: 4993f16b747f0d82298fc8b8c705bc9ee6e5efa5c70424381e3cc173db5c52cd
                                              • Instruction Fuzzy Hash: 28F18062A14FC189F7719F61EC413E9A364FB417A8F908235DA9D0AB8ADF7CD248D350
                                              Function 00007FF71C072990 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 218COMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 1570 7ff71c072990-7ff71c0729e9 call 7ff71c080460 1573 7ff71c072cd8-7ff71c072d3e call 7ff71c1ceb00 1570->1573 1574 7ff71c0729ef-7ff71c072b1d call 7ff71c1b85f0 memset 1570->1574 1581 7ff71c072d52-7ff71c072d5b 1573->1581 1582 7ff71c072d40-7ff71c072d4d call 7ff71c086a50 1573->1582 1579 7ff71c072bca-7ff71c072bde OutputDebugStringW 1574->1579 1580 7ff71c072b23-7ff71c072b35 1574->1580 1585 7ff71c072bf1-7ff71c072c02 1579->1585 1586 7ff71c072be0-7ff71c072bec call 7ff71c086a50 1579->1586 1583 7ff71c072b37-7ff71c072b3f 1580->1583 1584 7ff71c072b41-7ff71c072b64 1580->1584 1582->1581 1588 7ff71c072b9c-7ff71c072bad 1583->1588 1589 7ff71c072b70-7ff71c072b9a 1584->1589 1591 7ff71c072c17-7ff71c072c19 1585->1591 1592 7ff71c072c04-7ff71c072c0e 1585->1592 1586->1585 1593 7ff71c072bb0-7ff71c072bb7 1588->1593 1589->1588 1589->1589 1596 7ff71c072cb3-7ff71c072cbd 1591->1596 1594 7ff71c072c1e-7ff71c072c27 1592->1594 1595 7ff71c072c10-7ff71c072c15 1592->1595 1593->1579 1600 7ff71c072bb9-7ff71c072bc8 1593->1600 1597 7ff71c072c30-7ff71c072c8f 1594->1597 1601 7ff71c072c91-7ff71c072c94 1595->1601 1598 7ff71c072cca-7ff71c072cd7 1596->1598 1599 7ff71c072cbf-7ff71c072cc5 call 7ff71c086a50 1596->1599 1597->1597 1597->1601 1599->1598 1600->1579 1600->1593 1601->1596 1602 7ff71c072c96-7ff71c072c99 1601->1602 1604 7ff71c072ca0-7ff71c072cb1 1602->1604 1604->1596 1604->1604
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1858140292.00007FF71C071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71C070000, based on PE: true
                                              • Associated: 00000000.00000002.1858117811.00007FF71C070000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C1CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C339000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858806603.00007FF71C377000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858833366.00007FF71C378000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff71c070000_dropper.jbxd
                                              Similarity
                                              • API ID: memcpy$memset$DebugOutputString
                                              • String ID: Failed to encrypt function name
                                              • API String ID: 4266836622-2980051713
                                              • Opcode ID: 274c5851c8c0481459dc76c136782ea242680e5f1735e8343850688365901373
                                              • Instruction ID: 81e7a1cfe093440c19151636a2f9977b48d4996eabc731e5d596956a3954fe5c
                                              • Opcode Fuzzy Hash: 274c5851c8c0481459dc76c136782ea242680e5f1735e8343850688365901373
                                              • Instruction Fuzzy Hash: A3A1E272E14BD188EB308FA4EC457E8A760FB15768F948239DE9C17B96DF388294C350
                                              Function 00007FF71C081FF0 Relevance: 3.1, APIs: 2, Instructions: 65COMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 1622 7ff71c081ff0-7ff71c082024 memset 1623 7ff71c0820ca-7ff71c0820e6 OutputDebugStringW 1622->1623 1624 7ff71c08202a-7ff71c08203c 1622->1624 1625 7ff71c08203e-7ff71c082046 1624->1625 1626 7ff71c082048-7ff71c08206b 1624->1626 1627 7ff71c08209c-7ff71c0820aa 1625->1627 1628 7ff71c082070-7ff71c08209a 1626->1628 1629 7ff71c0820b0-7ff71c0820b7 1627->1629 1628->1627 1628->1628 1629->1623 1630 7ff71c0820b9-7ff71c0820c8 1629->1630 1630->1623 1630->1629
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1858140292.00007FF71C071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71C070000, based on PE: true
                                              • Associated: 00000000.00000002.1858117811.00007FF71C070000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C1CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C339000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858806603.00007FF71C377000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858833366.00007FF71C378000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff71c070000_dropper.jbxd
                                              Similarity
                                              • API ID: DebugOutputStringmemset
                                              • String ID:
                                              • API String ID: 1084755268-0
                                              • Opcode ID: 5e005805314a7e973c4a02753ea2b42195f09aeaf17bcfd3b6b31f3b9658f7ea
                                              • Instruction ID: 0a085ae440bcaece6d276b2e85d3b167df95d599bb8f38ef0a87a95e4b5ef907
                                              • Opcode Fuzzy Hash: 5e005805314a7e973c4a02753ea2b42195f09aeaf17bcfd3b6b31f3b9658f7ea
                                              • Instruction Fuzzy Hash: BD216A52F28A9541EB2097A4E6157F9D221DB967D4FA0C331DA0E13F87EF1CC289C700

                                              Non-executed Functions

                                              Function 00007FF71C1AFC30 Relevance: 18.3, APIs: 7, Strings: 3, Instructions: 777COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1858140292.00007FF71C071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71C070000, based on PE: true
                                              • Associated: 00000000.00000002.1858117811.00007FF71C070000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C1CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C339000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858806603.00007FF71C377000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858833366.00007FF71C378000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff71c070000_dropper.jbxd
                                              Similarity
                                              • API ID: ErrorLast$FullNamePath
                                              • String ID: \\?\$\\?\UNC\$internal error: entered unreachable code/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\alloc\src\vec\mod.rs
                                              • API String ID: 2482867836-3388149089
                                              • Opcode ID: b199d93341afa749ec137d169cd0efeaedeb8bd2188278c4616367f00a4729b6
                                              • Instruction ID: 09e96cfd0c71c6d0e0cea5731c6eab3a0a38fb632ca60696ffd3c3a01a355629
                                              • Opcode Fuzzy Hash: b199d93341afa749ec137d169cd0efeaedeb8bd2188278c4616367f00a4729b6
                                              • Instruction Fuzzy Hash: 32623BE2E48FD284FB759AA1E4447FDA661AB01BB4FA48131DA5D076C0CF3CD689E710
                                              Function 00007FF71C1C7530 Relevance: 15.5, APIs: 2, Strings: 8, Instructions: 501COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1858140292.00007FF71C071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71C070000, based on PE: true
                                              • Associated: 00000000.00000002.1858117811.00007FF71C070000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C1CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C339000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858806603.00007FF71C377000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858833366.00007FF71C378000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff71c070000_dropper.jbxd
                                              Similarity
                                              • API ID: memset
                                              • String ID: arenegyl$arenegyl$modnarod$modnarod$setybdet$setybdet$uespemos$uespemos
                                              • API String ID: 2221118986-1116813384
                                              • Opcode ID: e91e3c1c4e9fa57c4f2b31b327df4d1bc6fcac971b8af54c333e9c5fd273e30a
                                              • Instruction ID: 416fc542e30bac7d8569378503145c7187a83a318994b206921ca4126ac8ceb4
                                              • Opcode Fuzzy Hash: e91e3c1c4e9fa57c4f2b31b327df4d1bc6fcac971b8af54c333e9c5fd273e30a
                                              • Instruction Fuzzy Hash: 7502AD52B64BA282F740AF7974122BA6A11B741BF4F94A730EE6E537C0DF78C905D344
                                              Function 00007FF71C1C6E94 Relevance: 13.6, APIs: 9, Instructions: 71COMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1858140292.00007FF71C071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71C070000, based on PE: true
                                              • Associated: 00000000.00000002.1858117811.00007FF71C070000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C1CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C339000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858806603.00007FF71C377000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858833366.00007FF71C378000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff71c070000_dropper.jbxd
                                              Similarity
                                              • API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                              • String ID:
                                              • API String ID: 313767242-0
                                              • Opcode ID: 9827864d3fefbfe535f9578bc0328e11d654a839835aa2c23d6190f9840ff760
                                              • Instruction ID: bad54d28ab3bd458e3e653da9e8c610dd7672e016b88cb3ce9356da2056bbe9f
                                              • Opcode Fuzzy Hash: 9827864d3fefbfe535f9578bc0328e11d654a839835aa2c23d6190f9840ff760
                                              • Instruction Fuzzy Hash: C7314BB6618F8186EB609FA0E8403EDB360FB84714F90443AEA4E47B98DF38D54CC724
                                              Function 00007FF71C1C6D6C Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1858140292.00007FF71C071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71C070000, based on PE: true
                                              • Associated: 00000000.00000002.1858117811.00007FF71C070000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C1CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C339000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858806603.00007FF71C377000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858833366.00007FF71C378000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff71c070000_dropper.jbxd
                                              Similarity
                                              • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                              • String ID:
                                              • API String ID: 2933794660-0
                                              • Opcode ID: c51c9d83c4ecf423997708c497593ae63bae1c7da8e2a4b3e440570c1f49921b
                                              • Instruction ID: 60f75ed42fdf2e83c876c748eabc95e3a3d159a73d980753c79bd88dbd4d5b1c
                                              • Opcode Fuzzy Hash: c51c9d83c4ecf423997708c497593ae63bae1c7da8e2a4b3e440570c1f49921b
                                              • Instruction Fuzzy Hash: 44115E26B64F0289FB00DFA0E8452F873A4FB19768F940E35EA2D427A4DF3CD1599390
                                              Function 00007FF71C1B87A0 Relevance: 5.8, APIs: 4, Instructions: 778COMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1858140292.00007FF71C071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71C070000, based on PE: true
                                              • Associated: 00000000.00000002.1858117811.00007FF71C070000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C1CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C339000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858806603.00007FF71C377000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858833366.00007FF71C378000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff71c070000_dropper.jbxd
                                              Similarity
                                              • API ID: memcpy
                                              • String ID:
                                              • API String ID: 3510742995-0
                                              • Opcode ID: e41935f5dc89d492c03508489871229254099e62dd84641783fdbe2b8ac76d7f
                                              • Instruction ID: 18a84349a5e0f579faba6102f6fcb7174a89cb5960c7181d46ec8c76f489cd4b
                                              • Opcode Fuzzy Hash: e41935f5dc89d492c03508489871229254099e62dd84641783fdbe2b8ac76d7f
                                              • Instruction Fuzzy Hash: 7F522593E58E919DFB01AEA494003FC6B30BB157A8F948535DE5E1B7C9CA38D309E760
                                              Function 00007FF71C084A90 Relevance: 5.2, Strings: 4, Instructions: 178COMMON
                                              Download Yara Rule
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1858140292.00007FF71C071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71C070000, based on PE: true
                                              • Associated: 00000000.00000002.1858117811.00007FF71C070000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C1CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C339000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858806603.00007FF71C377000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858833366.00007FF71C378000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff71c070000_dropper.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID: arenegyl$modnarod$setybdep$uespemos
                                              • API String ID: 0-169184043
                                              • Opcode ID: 6f8f06bba650ebb22b1b2bfc3a0fdb11b8ecde544a2622260dd63e56caa600fc
                                              • Instruction ID: fa61e818fcf0c2ede11c3f26d933dda5d2dd863dfda59cc3ef159c3d8824adaf
                                              • Opcode Fuzzy Hash: 6f8f06bba650ebb22b1b2bfc3a0fdb11b8ecde544a2622260dd63e56caa600fc
                                              • Instruction Fuzzy Hash: 0751DF53F2477602F2806FFA2912FD55960AB51BA0FA6D332ED2C633C1E634CE478240
                                              Function 00007FF71C1CDF10 Relevance: 4.1, Strings: 3, Instructions: 376COMMON
                                              Download Yara Rule
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1858140292.00007FF71C071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71C070000, based on PE: true
                                              • Associated: 00000000.00000002.1858117811.00007FF71C070000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C1CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C339000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858806603.00007FF71C377000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858833366.00007FF71C378000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff71c070000_dropper.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID: Authenti$GenuineI$HygonGen
                                              • API String ID: 0-696657513
                                              • Opcode ID: 3ace6ac76a10990627f1a0c2683abbc43137bb558429f15831ac77d6737df965
                                              • Instruction ID: d39eed476d8a1a9f5a6a4798ff43be313ff30bc6cfbdd38aec2a027148e826fa
                                              • Opcode Fuzzy Hash: 3ace6ac76a10990627f1a0c2683abbc43137bb558429f15831ac77d6737df965
                                              • Instruction Fuzzy Hash: DEB168A3B349A102FB198A96BD12BF949D1B358BD8F54B438ED1F97BC0C97CDA10D201
                                              Function 00007FF71C1A0420 Relevance: 3.0, APIs: 2, Instructions: 467COMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1858140292.00007FF71C071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71C070000, based on PE: true
                                              • Associated: 00000000.00000002.1858117811.00007FF71C070000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C1CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C339000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858806603.00007FF71C377000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858833366.00007FF71C378000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff71c070000_dropper.jbxd
                                              Similarity
                                              • API ID: memcpymemset
                                              • String ID:
                                              • API String ID: 1297977491-0
                                              • Opcode ID: 0fa70600c2b016857b1d59d01a32d32ffb27fe6c57eacae1322c9ed853bf39d9
                                              • Instruction ID: c567b6aa81f37eb2b2d11d6d89058839bf3e6da6448ed2b9595591cb9bbe44e2
                                              • Opcode Fuzzy Hash: 0fa70600c2b016857b1d59d01a32d32ffb27fe6c57eacae1322c9ed853bf39d9
                                              • Instruction Fuzzy Hash: 48127366C28FD941E223973978027FBAB10AFFB748E11D317EED831E45DB1CA241A654
                                              Function 00007FF71C1A2220 Relevance: 2.8, Strings: 2, Instructions: 284COMMON
                                              Download Yara Rule
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1858140292.00007FF71C071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71C070000, based on PE: true
                                              • Associated: 00000000.00000002.1858117811.00007FF71C070000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C1CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C339000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858806603.00007FF71C377000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858833366.00007FF71C378000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff71c070000_dropper.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID: 33333333$UUUUUUUU
                                              • API String ID: 0-3483174168
                                              • Opcode ID: cff9d24c3fc3692150ad18937845d9fa878edfc3b39f359c130e8016678a4c49
                                              • Instruction ID: 3a81f71bb059842e67eaceedc94535e03550869ade922beb697c2acde78d5c9a
                                              • Opcode Fuzzy Hash: cff9d24c3fc3692150ad18937845d9fa878edfc3b39f359c130e8016678a4c49
                                              • Instruction Fuzzy Hash: 0591E843B681F003F7624B7D1D66566EFA25545BD370DF152EEE423A86C038CC2AE3A5
                                              Function 00007FF71C1A2630 Relevance: 2.8, Strings: 2, Instructions: 273COMMON
                                              Download Yara Rule
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1858140292.00007FF71C071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71C070000, based on PE: true
                                              • Associated: 00000000.00000002.1858117811.00007FF71C070000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C1CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C339000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858806603.00007FF71C377000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858833366.00007FF71C378000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff71c070000_dropper.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID: 33333333$UUUUUUUU
                                              • API String ID: 0-3483174168
                                              • Opcode ID: 14b31b35ad291ddad897dd1f2a0e82a6c76d055b51b98b879fc08f69398a6c0a
                                              • Instruction ID: 0f8bec32a5713e29220c994287e2471ec9503f957c585ffdc4d845ef937708d5
                                              • Opcode Fuzzy Hash: 14b31b35ad291ddad897dd1f2a0e82a6c76d055b51b98b879fc08f69398a6c0a
                                              • Instruction Fuzzy Hash: 6691DA4375A3D48FAB52CB7E194498A6E90E12AFC835CF069CE8D27322D436D557C392
                                              Function 00007FF71C1B16F0 Relevance: 2.6, Strings: 1, Instructions: 1362COMMON
                                              Download Yara Rule
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1858140292.00007FF71C071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71C070000, based on PE: true
                                              • Associated: 00000000.00000002.1858117811.00007FF71C070000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C1CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C339000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858806603.00007FF71C377000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858833366.00007FF71C378000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff71c070000_dropper.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID: 0x000102030405060708091011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980818283848586878889909192939495969798990000000000000000000000000000000000000000000000000000000000
                                              • API String ID: 0-528166994
                                              • Opcode ID: 18b56edaf1f188816f693a5e8c7c0ec1e58247d8a8ed4df3639867427aa1d442
                                              • Instruction ID: 96d8945ea0eff97818690a8b7d20971a76a701f6de1c2b50cd2dbce30337afa4
                                              • Opcode Fuzzy Hash: 18b56edaf1f188816f693a5e8c7c0ec1e58247d8a8ed4df3639867427aa1d442
                                              • Instruction Fuzzy Hash: 8FA27973A68A9189F724DBA4E4007F8A761FB01764FE05234EA9E077E0DF3C9649E354
                                              Function 00007FF71C084750 Relevance: 1.4, APIs: 1, Instructions: 188COMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1858140292.00007FF71C071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71C070000, based on PE: true
                                              • Associated: 00000000.00000002.1858117811.00007FF71C070000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C1CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C339000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858806603.00007FF71C377000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858833366.00007FF71C378000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff71c070000_dropper.jbxd
                                              Similarity
                                              • API ID: memcpy
                                              • String ID:
                                              • API String ID: 3510742995-0
                                              • Opcode ID: 52663811f58dce709f21750878c5459854adbf0e93dfc4ee6320c5fdf27e46cc
                                              • Instruction ID: e1c94e29aa6e33f6da86d802490534fdcc32de3e427da6d7c34fa575ce101cc8
                                              • Opcode Fuzzy Hash: 52663811f58dce709f21750878c5459854adbf0e93dfc4ee6320c5fdf27e46cc
                                              • Instruction Fuzzy Hash: DD61A012F0994282FB7496D5E9623BE9A41EB407A4FA5903AEECE077C1DF7CD049C320
                                              Function 00007FF71C1BE3D0 Relevance: 1.4, Strings: 1, Instructions: 134COMMON
                                              Download Yara Rule
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1858140292.00007FF71C071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71C070000, based on PE: true
                                              • Associated: 00000000.00000002.1858117811.00007FF71C070000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C1CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C339000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858806603.00007FF71C377000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858833366.00007FF71C378000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff71c070000_dropper.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID: 0123456789abcdefBorrowMutErroralready borrowed:
                                              • API String ID: 0-1320686809
                                              • Opcode ID: c9722524c4946c8e5fd1d7d2259182cc7b833465107f376a694d3e6ecbb7a7b8
                                              • Instruction ID: 8488cf75aeaa3fb45a85e9abe42e24450d1e563c51a079f00519f527592c21e2
                                              • Opcode Fuzzy Hash: c9722524c4946c8e5fd1d7d2259182cc7b833465107f376a694d3e6ecbb7a7b8
                                              • Instruction Fuzzy Hash: 0C513DA3B196F09EF32197786400EAC7FB19F15B44F554094CF981BF86C626C229E761
                                              Function 00007FF71C1A12B0 Relevance: .4, Instructions: 391COMMON
                                              Download Yara Rule
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1858140292.00007FF71C071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71C070000, based on PE: true
                                              • Associated: 00000000.00000002.1858117811.00007FF71C070000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C1CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C339000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858806603.00007FF71C377000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858833366.00007FF71C378000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff71c070000_dropper.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 2ac6b583d059193177c4dc67603224c16f14b1b95ee0b72217d2b822dc045258
                                              • Instruction ID: 28cc1b08c7b89d304eb25e5a85f593abb7b7e2bb5385e40ce878fcff41e53c84
                                              • Opcode Fuzzy Hash: 2ac6b583d059193177c4dc67603224c16f14b1b95ee0b72217d2b822dc045258
                                              • Instruction Fuzzy Hash: FEF1E262618BC481E6128B6AB4556A7E760FFDD7E4F55A212FFCC63B18DF38D2818700
                                              Function 00007FF71C1C2680 Relevance: .4, Instructions: 390COMMON
                                              Download Yara Rule
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1858140292.00007FF71C071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71C070000, based on PE: true
                                              • Associated: 00000000.00000002.1858117811.00007FF71C070000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C1CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C339000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858806603.00007FF71C377000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858833366.00007FF71C378000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff71c070000_dropper.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: ce56fb9315cdaea7b193d4740579b799f047fe6f1e1a7f37223fcddaaa4e209f
                                              • Instruction ID: e364cb6451fc5d4d52fd55a2cf2f764978c899d794b262d757089bae46314ea9
                                              • Opcode Fuzzy Hash: ce56fb9315cdaea7b193d4740579b799f047fe6f1e1a7f37223fcddaaa4e209f
                                              • Instruction Fuzzy Hash: 0AE1ABD7E39FA602F723437964022F496006FB77F4A50D336FDAD71AD1DB24A242A218
                                              Function 00007FF71C1A0D70 Relevance: .3, Instructions: 305COMMON
                                              Download Yara Rule
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1858140292.00007FF71C071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71C070000, based on PE: true
                                              • Associated: 00000000.00000002.1858117811.00007FF71C070000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C1CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C339000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858806603.00007FF71C377000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858833366.00007FF71C378000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff71c070000_dropper.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: eebfbab7b3ed996c254c43acaf36eb66bc4d7a66bc6abde1797c2194414fe1af
                                              • Instruction ID: eedfe0f6d4dcd9b33aff2b3fd10f92847eab1d0768dc2309b2f75468553105d6
                                              • Opcode Fuzzy Hash: eebfbab7b3ed996c254c43acaf36eb66bc4d7a66bc6abde1797c2194414fe1af
                                              • Instruction Fuzzy Hash: 13D1B322518AD482F2139B7DB4566EBE361FFD97A4F54A311FFC826A14EF38E1858700
                                              Function 00007FF71C0856F0 Relevance: .3, Instructions: 284COMMON
                                              Download Yara Rule
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1858140292.00007FF71C071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71C070000, based on PE: true
                                              • Associated: 00000000.00000002.1858117811.00007FF71C070000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C1CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C339000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858806603.00007FF71C377000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858833366.00007FF71C378000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff71c070000_dropper.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 0dabf93f914a508664934f82270908ed5a9c7f077b68cb68ee96b11b2cb05490
                                              • Instruction ID: 9ca01219bb3267455364a38120865f5da0b7c56a81039c6cdff87e9364165ddf
                                              • Opcode Fuzzy Hash: 0dabf93f914a508664934f82270908ed5a9c7f077b68cb68ee96b11b2cb05490
                                              • Instruction Fuzzy Hash: 7CA16473F14A6182F7149B919E427BDA6A0FB007A4FA4C136CE9903BC8DF3E9459D320
                                              Function 00007FF71C1A3870 Relevance: .2, Instructions: 249COMMON
                                              Download Yara Rule
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1858140292.00007FF71C071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71C070000, based on PE: true
                                              • Associated: 00000000.00000002.1858117811.00007FF71C070000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C1CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C339000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858806603.00007FF71C377000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858833366.00007FF71C378000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff71c070000_dropper.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 887a48b476e7e1a1dedf3e576eb7aeddfa7754fe88918e362b99fed9fec87e5f
                                              • Instruction ID: 1e6ef4fcc7a36817a885032f018c6b68dc9e68d49d0439c09f08aeff14b6d233
                                              • Opcode Fuzzy Hash: 887a48b476e7e1a1dedf3e576eb7aeddfa7754fe88918e362b99fed9fec87e5f
                                              • Instruction Fuzzy Hash: 59C14CA2D19FC542E723A738A4033E6E310FFEA394F40D312EEC47595AEB69E2459610
                                              Function 00007FF71C1A1950 Relevance: .2, Instructions: 235COMMON
                                              Download Yara Rule
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1858140292.00007FF71C071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71C070000, based on PE: true
                                              • Associated: 00000000.00000002.1858117811.00007FF71C070000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C1CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C339000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858806603.00007FF71C377000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858833366.00007FF71C378000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff71c070000_dropper.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: b20f7bc080719c1c1f3ae5b196f2442c1df25a9a2f5e432d3dc0e4515f377300
                                              • Instruction ID: 2542ae72c4ccfa20196c65beb1892f13c0bd88adc0b991ce806802190909264d
                                              • Opcode Fuzzy Hash: b20f7bc080719c1c1f3ae5b196f2442c1df25a9a2f5e432d3dc0e4515f377300
                                              • Instruction Fuzzy Hash: 6971A3A3754B64867A04CFF2A830897E7A5F359FC4B19B425AF8D27F18CA3CC552D640
                                              Function 00007FF71C1A1F20 Relevance: .2, Instructions: 216COMMON
                                              Download Yara Rule
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1858140292.00007FF71C071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71C070000, based on PE: true
                                              • Associated: 00000000.00000002.1858117811.00007FF71C070000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C1CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C339000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858806603.00007FF71C377000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858833366.00007FF71C378000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff71c070000_dropper.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 44274a9de2d5336e7d6848c18c74e22bccef06d1a72e3e06e569f83481f1efd3
                                              • Instruction ID: e6f4c0516941c6ac0632d4a235b86337f174298f226e6cbcb293f85308ddfb32
                                              • Opcode Fuzzy Hash: 44274a9de2d5336e7d6848c18c74e22bccef06d1a72e3e06e569f83481f1efd3
                                              • Instruction Fuzzy Hash: 7461D2A2FB58B653B6429EB29513DE86E10F724BD23439532DD2E23740C874DD4EE215
                                              Function 00007FF71C1A3520 Relevance: .2, Instructions: 210COMMON
                                              Download Yara Rule
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1858140292.00007FF71C071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71C070000, based on PE: true
                                              • Associated: 00000000.00000002.1858117811.00007FF71C070000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C1CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C339000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858806603.00007FF71C377000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858833366.00007FF71C378000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff71c070000_dropper.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 516913f712a79e31602e76090d16c532121ebdbc7cbb616029c414f36c94abab
                                              • Instruction ID: 457270f5b50bb61aa528683f3fab3dfe895481d90fd9d043ceb4ef80d636bc9e
                                              • Opcode Fuzzy Hash: 516913f712a79e31602e76090d16c532121ebdbc7cbb616029c414f36c94abab
                                              • Instruction Fuzzy Hash: 0C51EB63729B14456A40CFE2BD609AB6690B758BD4F49B436FE4DA7709CE3CCB829240
                                              Function 00007FF71C1A2D80 Relevance: .2, Instructions: 210COMMON
                                              Download Yara Rule
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1858140292.00007FF71C071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71C070000, based on PE: true
                                              • Associated: 00000000.00000002.1858117811.00007FF71C070000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C1CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C339000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858806603.00007FF71C377000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858833366.00007FF71C378000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff71c070000_dropper.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 63f73319fad2da576f3d5b9983d65f57c7789e905c01965cd88b4a1bca77e753
                                              • Instruction ID: ac863f4bedc9bddaddae5922fc041a548a0128ccda551c0194af9db404a13d21
                                              • Opcode Fuzzy Hash: 63f73319fad2da576f3d5b9983d65f57c7789e905c01965cd88b4a1bca77e753
                                              • Instruction Fuzzy Hash: 35511963725B24456A40DFF2BD609AB6650B76CFD4F49B422FE8CA7705CE3CCB869240
                                              Function 00007FF71C1A1C60 Relevance: .2, Instructions: 210COMMON
                                              Download Yara Rule
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1858140292.00007FF71C071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71C070000, based on PE: true
                                              • Associated: 00000000.00000002.1858117811.00007FF71C070000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C1CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C339000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858806603.00007FF71C377000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858833366.00007FF71C378000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff71c070000_dropper.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: e49d64f606b30b5e613b7687bc14d59ee01eaa8d31e2a8703c4f9323d8549704
                                              • Instruction ID: d416797be00467981505a8bf5a77a3e2a1a5905893b636c8e13afd6d057c9589
                                              • Opcode Fuzzy Hash: e49d64f606b30b5e613b7687bc14d59ee01eaa8d31e2a8703c4f9323d8549704
                                              • Instruction Fuzzy Hash: 176173A3315BA4427A04CFF2BD3199BABA5F649BD8B00F435EE8D57B1CDA3CC4518640
                                              Function 00007FF71C1A3290 Relevance: .2, Instructions: 190COMMON
                                              Download Yara Rule
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1858140292.00007FF71C071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71C070000, based on PE: true
                                              • Associated: 00000000.00000002.1858117811.00007FF71C070000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C1CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C339000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858806603.00007FF71C377000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858833366.00007FF71C378000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff71c070000_dropper.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 7bcd44aacf1be6df8b683f518df340d7f83a1aa97022882a5af4655f99829e9a
                                              • Instruction ID: 031cdd25f8197c5c57da5a8c2ab3e41862ac2129b1330e0fbd5ef58862bbe5cf
                                              • Opcode Fuzzy Hash: 7bcd44aacf1be6df8b683f518df340d7f83a1aa97022882a5af4655f99829e9a
                                              • Instruction Fuzzy Hash: 6751DAF3726A10425E45CFA2BC249B69652FA1CBD4F40D431DF1D97B09CE3CCA529340
                                              Function 00007FF71C1A2AF0 Relevance: .2, Instructions: 190COMMON
                                              Download Yara Rule
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1858140292.00007FF71C071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71C070000, based on PE: true
                                              • Associated: 00000000.00000002.1858117811.00007FF71C070000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C1CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C339000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858806603.00007FF71C377000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858833366.00007FF71C378000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff71c070000_dropper.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: 4a5052886ae8791df3e3aade1c897a77a9afdf7e8fe609916b5f9302e4dbc497
                                              • Instruction ID: c06ad373f088eac6773fd2505e3dcc1f82ea758196c565d403a05ddc2eec12b5
                                              • Opcode Fuzzy Hash: 4a5052886ae8791df3e3aade1c897a77a9afdf7e8fe609916b5f9302e4dbc497
                                              • Instruction Fuzzy Hash: 2951D6F3725A10526E45CFA3BC24AB69652BB1CFD4F40E421DE0D9BB1ACE3CCA569340
                                              Function 00007FF71C1A3050 Relevance: .2, Instructions: 170COMMON
                                              Download Yara Rule
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1858140292.00007FF71C071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71C070000, based on PE: true
                                              • Associated: 00000000.00000002.1858117811.00007FF71C070000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C1CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C339000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858806603.00007FF71C377000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858833366.00007FF71C378000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff71c070000_dropper.jbxd
                                              Similarity
                                              • API ID:
                                              • String ID:
                                              • API String ID:
                                              • Opcode ID: dbee0296d68a45a4e5011e14e78ef7d3f61107bd3d503f6abe85d47c4473e09a
                                              • Instruction ID: 483b6cafddcb58c2d63febc22e83b766fe4bb801c7eb542a8cf0cfa7ab332378
                                              • Opcode Fuzzy Hash: dbee0296d68a45a4e5011e14e78ef7d3f61107bd3d503f6abe85d47c4473e09a
                                              • Instruction Fuzzy Hash: FB41F163719A24827E58EFE2BE71877A651B75CBD0F48B436EE4E97704CE3CC5828240
                                              Function 00007FF71C080BE0 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 304COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              • a Display implementation returned an error unexpectedly/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\alloc\src\string.rs, xrefs: 00007FF71C081108
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1858140292.00007FF71C071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71C070000, based on PE: true
                                              • Associated: 00000000.00000002.1858117811.00007FF71C070000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C1CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C339000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858806603.00007FF71C377000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858833366.00007FF71C378000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff71c070000_dropper.jbxd
                                              Similarity
                                              • API ID: memcpy$memset$DebugOutputString
                                              • String ID: a Display implementation returned an error unexpectedly/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\alloc\src\string.rs
                                              • API String ID: 4266836622-2804265448
                                              • Opcode ID: 05a981d4568982c1dcd3fba42ae38f6df00daaccba554a6bba67a95afa51eca1
                                              • Instruction ID: b4cb3418ccfa327a50192d06358d54d828c72601398380c4a4e66c95cde7dacc
                                              • Opcode Fuzzy Hash: 05a981d4568982c1dcd3fba42ae38f6df00daaccba554a6bba67a95afa51eca1
                                              • Instruction Fuzzy Hash: 58D1B162A08FC185EB21AFA1ED517F9A364FB45798F908131EA4D0BB86DF7DD248C350
                                              Function 00007FF71C1A7FB0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 242COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              • internal error: entered unreachable code/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\alloc\src\vec\mod.rs, xrefs: 00007FF71C1A8340
                                              Memory Dump Source
                                              • Source File: 00000000.00000002.1858140292.00007FF71C071000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF71C070000, based on PE: true
                                              • Associated: 00000000.00000002.1858117811.00007FF71C070000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C1CF000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858428271.00007FF71C339000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858806603.00007FF71C377000.00000004.00000001.01000000.00000003.sdmpDownload File
                                              • Associated: 00000000.00000002.1858833366.00007FF71C378000.00000002.00000001.01000000.00000003.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_0_2_7ff71c070000_dropper.jbxd
                                              Similarity
                                              • API ID: ErrorLast$EnvironmentVariable
                                              • String ID: internal error: entered unreachable code/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\alloc\src\vec\mod.rs
                                              • API String ID: 2691138088-2475256114
                                              • Opcode ID: 30cbd0d6c0fac5b1b6c9e0851cd7f9d5e53f4462aa1627826fb2fe9321661c96
                                              • Instruction ID: 0847e0eed63ccb7f621d2f3ae40fb4d046b31ddd8e41c6e704591f71ed8bc596
                                              • Opcode Fuzzy Hash: 30cbd0d6c0fac5b1b6c9e0851cd7f9d5e53f4462aa1627826fb2fe9321661c96
                                              • Instruction Fuzzy Hash: 75A191A2A44FC188FB719FA1ED443E9A364FB44BA8F648135DE1D4B785DF38D2859310

                                              Execution Graph

                                              Execution Coverage:5.6%
                                              Dynamic/Decrypted Code Coverage:0%
                                              Signature Coverage:4.4%
                                              Total number of Nodes:755
                                              Total number of Limit Nodes:65
                                              execution_graph 11893 7ffbfd5b5400 11894 7ffbfd5e0bd0 40 API calls 11893->11894 11895 7ffbfd5b54eb memset 11894->11895 11896 7ffbfd5b55da OutputDebugStringW 11895->11896 11899 7ffbfd5b5526 11895->11899 11897 7ffbfd5b55fd 11896->11897 11960 7ffbfd5b21c0 11897->11960 11899->11896 11900 7ffbfd5b561d 11912 7ffbfd5b562c 11900->11912 11990 7ffbfd5c29b0 11900->11990 11902 7ffbfd5b5674 11903 7ffbfd5b5681 11902->11903 11909 7ffbfd5b575f 11902->11909 11904 7ffbfd5e0bd0 40 API calls 11903->11904 11905 7ffbfd5b56fa memset 11904->11905 11906 7ffbfd5b593a OutputDebugStringW 11905->11906 11908 7ffbfd5b573a 11905->11908 11906->11912 11907 7ffbfd5e0bd0 40 API calls 11910 7ffbfd5b5845 memset 11907->11910 11908->11906 11909->11907 11911 7ffbfd5b5a5a OutputDebugStringW 11910->11911 11915 7ffbfd5b587e 11910->11915 11913 7ffbfd5b5a76 11911->11913 11914 7ffbfd5e0bd0 40 API calls 11913->11914 11916 7ffbfd5b5b33 11914->11916 11915->11911 12038 7ffbfd5e0d80 11916->12038 11918 7ffbfd5b5b57 11919 7ffbfd5e0bd0 40 API calls 11918->11919 11920 7ffbfd5b5bc9 memset 11919->11920 11921 7ffbfd5b5c05 11920->11921 11922 7ffbfd5b5cba OutputDebugStringW 11920->11922 11921->11922 11923 7ffbfd5b5cd6 11922->11923 12058 7ffbfd5b6900 11923->12058 11925 7ffbfd5b5cfa 11926 7ffbfd5e0bd0 40 API calls 11925->11926 11927 7ffbfd5b5d73 memset 11926->11927 11928 7ffbfd5b5e5a OutputDebugStringW 11927->11928 11932 7ffbfd5b5dac 11927->11932 11929 7ffbfd5b5e76 11928->11929 12067 7ffbfd5b7480 11929->12067 11932->11928 11933 7ffbfd5b5e9c 11935 7ffbfd5e0bd0 40 API calls 11933->11935 11934 7ffbfd5b5f71 memset OutputDebugStringW GetModuleHandleA 11936 7ffbfd5b606a 11934->11936 11942 7ffbfd5b602b 11934->11942 11937 7ffbfd5b5f13 memset 11935->11937 12113 7ffbfd5c7550 GetLastError 11936->12113 11939 7ffbfd5b613a OutputDebugStringW 11937->11939 11945 7ffbfd5b5f4c 11937->11945 11939->11942 11941 7ffbfd5b6181 11943 7ffbfd5b629b 11941->11943 11944 7ffbfd5b618b 11941->11944 11942->11912 12093 7ffbfd5b4e40 11942->12093 11946 7ffbfd5e0bd0 40 API calls 11943->11946 11947 7ffbfd5b61a1 VirtualQuery 11944->11947 11945->11939 11948 7ffbfd5b62ef memset 11946->11948 11949 7ffbfd5b6354 11947->11949 11950 7ffbfd5b61c0 11947->11950 11951 7ffbfd5b654a OutputDebugStringW 11948->11951 11956 7ffbfd5b632f 11948->11956 11952 7ffbfd5e0bd0 40 API calls 11949->11952 11950->11949 11953 7ffbfd5b61cd 11950->11953 11951->11912 11954 7ffbfd5b63b6 memset 11952->11954 11955 7ffbfd5e0bd0 40 API calls 11953->11955 11954->11951 11954->11956 11957 7ffbfd5b623d memset 11955->11957 11956->11951 11958 7ffbfd5b666a OutputDebugStringW 11957->11958 11959 7ffbfd5b6276 11957->11959 11958->11912 11959->11958 11961 7ffbfd5b220a 11960->11961 11962 7ffbfd5b281c 11960->11962 11964 7ffbfd5b222d 11961->11964 11965 7ffbfd5e9af0 40 API calls 11961->11965 12114 7ffbfd5e98d0 11962->12114 11966 7ffbfd5b2884 11964->11966 11972 7ffbfd5b223a 11964->11972 11965->11964 11968 7ffbfd5ea940 40 API calls 11966->11968 11967 7ffbfd5b255b 11970 7ffbfd5e0bd0 40 API calls 11967->11970 11969 7ffbfd5b28b8 11968->11969 11973 7ffbfd5b2914 11969->11973 11977 7ffbfd5e9d50 43 API calls 11969->11977 11971 7ffbfd5b25b5 memset 11970->11971 11974 7ffbfd5b27ba OutputDebugStringW 11971->11974 11979 7ffbfd5b25fb 11971->11979 11972->11967 11975 7ffbfd5b23f9 11972->11975 11973->11900 11976 7ffbfd5b27d0 11974->11976 11978 7ffbfd5e0bd0 40 API calls 11975->11978 11981 7ffbfd5b280a 11976->11981 12121 7ffbfd5e9d50 11976->12121 11977->11973 11980 7ffbfd5b24f0 memset 11978->11980 11979->11974 11983 7ffbfd5b26aa OutputDebugStringW 11980->11983 11985 7ffbfd5b2536 11980->11985 11981->11900 11988 7ffbfd5b26c0 11983->11988 11984 7ffbfd5b28c7 11987 7ffbfd5ea525 40 API calls 11984->11987 11985->11983 11986 7ffbfd5b270e memcpy 11986->11976 11987->11969 11988->11984 11988->11986 11991 7ffbfd5e0bd0 40 API calls 11990->11991 11992 7ffbfd5c2af1 memset 11991->11992 11993 7ffbfd5c2bda OutputDebugStringW 11992->11993 11995 7ffbfd5c2b2c 11992->11995 11994 7ffbfd5c2bfd 11993->11994 11996 7ffbfd5c2c27 11994->11996 11998 7ffbfd5c2d1f 11994->11998 11995->11993 11997 7ffbfd5e0bd0 40 API calls 11996->11997 11999 7ffbfd5c2cbc memset 11997->11999 12001 7ffbfd5ea525 40 API calls 11998->12001 12036 7ffbfd5c2d3e 11998->12036 12000 7ffbfd5c2e0a OutputDebugStringW 11999->12000 12007 7ffbfd5c2cfe 11999->12007 12002 7ffbfd5c2e26 12000->12002 12003 7ffbfd5c3498 12001->12003 12002->12003 12005 7ffbfd5c2e4c 12002->12005 12143 7ffbfd5e9020 12003->12143 12006 7ffbfd5c34c8 12005->12006 12009 7ffbfd5c2e68 12005->12009 12008 7ffbfd5e9020 40 API calls 12006->12008 12007->12000 12010 7ffbfd5c34f8 12008->12010 12011 7ffbfd5c2ea4 12009->12011 12012 7ffbfd5c2e87 12009->12012 12015 7ffbfd5ea525 40 API calls 12010->12015 12018 7ffbfd5c2ec2 memcpy memcpy 12011->12018 12137 7ffbfd5cb170 memset 12012->12137 12014 7ffbfd5c2e93 12016 7ffbfd5c2eef memcpy 12014->12016 12017 7ffbfd5c350d 12015->12017 12016->12010 12023 7ffbfd5c2f21 12016->12023 12017->11902 12018->12016 12019 7ffbfd5c2f4d memcpy memcpy 12021 7ffbfd5c2f9a 12019->12021 12022 7ffbfd5c3022 12019->12022 12132 7ffbfd5c6a30 12021->12132 12025 7ffbfd5e0bd0 40 API calls 12022->12025 12023->12010 12023->12019 12026 7ffbfd5c3091 memset 12025->12026 12027 7ffbfd5c318a OutputDebugStringW 12026->12027 12030 7ffbfd5c30d3 12026->12030 12028 7ffbfd5c31a6 12027->12028 12033 7ffbfd5ea940 40 API calls 12028->12033 12028->12036 12029 7ffbfd5c2fda 12029->12022 12031 7ffbfd5c327a 12029->12031 12030->12027 12032 7ffbfd5e0bd0 40 API calls 12031->12032 12034 7ffbfd5c3344 memset 12032->12034 12033->12017 12035 7ffbfd5c343a OutputDebugStringW 12034->12035 12037 7ffbfd5c3386 12034->12037 12035->12036 12036->11902 12037->12035 12039 7ffbfd5e184f 12038->12039 12041 7ffbfd5e0daf 12038->12041 12040 7ffbfd5ea525 40 API calls 12039->12040 12042 7ffbfd5e1308 12040->12042 12041->12039 12056 7ffbfd5e0dde 12041->12056 12044 7ffbfd5eab60 40 API calls 12042->12044 12043 7ffbfd5e1807 12043->11918 12045 7ffbfd5e184d 12044->12045 12045->11918 12047 7ffbfd5e0fbd 12165 7ffbfd5eab60 12047->12165 12049 7ffbfd5e13c5 memcpy 12049->12056 12050 7ffbfd5e1614 memcpy 12050->12056 12051 7ffbfd5e0ef6 memcpy 12051->12056 12052 7ffbfd5e0b30 40 API calls 12052->12056 12053 7ffbfd5e6490 40 API calls 12053->12056 12054 7ffbfd5e14c4 memcpy 12054->12056 12055 7ffbfd5ea490 40 API calls 12055->12056 12056->12042 12056->12043 12056->12047 12056->12049 12056->12050 12056->12051 12056->12052 12056->12053 12056->12054 12056->12055 12057 7ffbfd5e6610 40 API calls 12056->12057 12158 7ffbfd5e6910 12056->12158 12057->12056 12059 7ffbfd5e0d80 53 API calls 12058->12059 12062 7ffbfd5b6926 12059->12062 12060 7ffbfd5b6a86 12064 7ffbfd5ea525 40 API calls 12060->12064 12061 7ffbfd5b696e memcpy 12066 7ffbfd5b698f 12061->12066 12062->12060 12062->12061 12065 7ffbfd5b6a94 12064->12065 12065->11925 12066->11925 12068 7ffbfd5b7c83 12067->12068 12069 7ffbfd5b74d1 12067->12069 12070 7ffbfd5e98d0 3 API calls 12068->12070 12071 7ffbfd5e9800 2 API calls 12069->12071 12075 7ffbfd5b74e7 12069->12075 12070->12069 12071->12075 12072 7ffbfd5b7ce7 12073 7ffbfd5ea940 40 API calls 12072->12073 12088 7ffbfd5b7930 12073->12088 12074 7ffbfd5b77d7 12076 7ffbfd5e0bd0 40 API calls 12074->12076 12075->12072 12078 7ffbfd5b750c 12075->12078 12077 7ffbfd5b7831 memset 12076->12077 12080 7ffbfd5b79ea OutputDebugStringW 12077->12080 12085 7ffbfd5b7877 12077->12085 12078->12074 12082 7ffbfd5b76d9 12078->12082 12092 7ffbfd5b7a00 12080->12092 12081 7ffbfd5b5e92 12081->11933 12081->11934 12083 7ffbfd5e0bd0 40 API calls 12082->12083 12084 7ffbfd5b7765 memset 12083->12084 12086 7ffbfd5b791a OutputDebugStringW 12084->12086 12090 7ffbfd5b77b2 12084->12090 12085->12080 12086->12088 12087 7ffbfd5e0bd0 40 API calls 12089 7ffbfd5b7b21 memset 12087->12089 12088->12081 12190 7ffbfd5e98c0 WakeByAddressSingle 12088->12190 12091 7ffbfd5b7bfa OutputDebugStringW 12089->12091 12089->12092 12090->12086 12091->12092 12092->12087 12092->12088 12092->12091 12094 7ffbfd5b4e63 12093->12094 12095 7ffbfd5b4f01 memset 12093->12095 12096 7ffbfd5b4f4f 12094->12096 12098 7ffbfd5b4e8f memset 12094->12098 12097 7ffbfd5b52fc OutputDebugStringW 12095->12097 12099 7ffbfd5e0bd0 40 API calls 12096->12099 12111 7ffbfd5b530a 12097->12111 12098->12097 12100 7ffbfd5b4fdd memset 12099->12100 12101 7ffbfd5b50ca OutputDebugStringW 12100->12101 12103 7ffbfd5b5015 12100->12103 12105 7ffbfd5b50ec 12101->12105 12102 7ffbfd5b5298 memset 12102->12097 12103->12101 12104 7ffbfd5b513c strlen 12104->12105 12105->12102 12105->12104 12106 7ffbfd5b5194 memcmp 12105->12106 12106->12105 12107 7ffbfd5b51a5 12106->12107 12108 7ffbfd5e0bd0 40 API calls 12107->12108 12109 7ffbfd5b523b memset 12108->12109 12110 7ffbfd5b53ba OutputDebugStringW 12109->12110 12112 7ffbfd5b5273 12109->12112 12110->12111 12111->11941 12112->12110 12113->11942 12116 7ffbfd5e9901 12114->12116 12117 7ffbfd5e9982 12114->12117 12115 7ffbfd5e9a87 12115->11961 12116->12115 12116->12117 12118 7ffbfd5e995d WaitOnAddress 12116->12118 12117->12115 12120 7ffbfd5e9a81 WakeByAddressAll 12117->12120 12118->12116 12119 7ffbfd5e9977 GetLastError 12118->12119 12119->12116 12120->12115 12122 7ffbfd5e9df9 12121->12122 12123 7ffbfd5e9d67 12121->12123 12125 7ffbfd5ea6f0 40 API calls 12122->12125 12124 7ffbfd5e9d8f 12123->12124 12127 7ffbfd5e9d7a WakeByAddressSingle 12123->12127 12128 7ffbfd5e9d99 12124->12128 12129 7ffbfd5e9dc0 WakeByAddressSingle 12124->12129 12131 7ffbfd5e9dae 12124->12131 12126 7ffbfd5e9e11 12125->12126 12130 7ffbfd5e9de4 WakeByAddressAll 12128->12130 12128->12131 12129->12130 12129->12131 12130->12131 12131->11981 12133 7ffbfd5c6a64 12132->12133 12136 7ffbfd5c6a8f 12132->12136 12133->12029 12134 7ffbfd5c6b05 12134->12029 12136->12134 12146 7ffbfd5cbac0 12136->12146 12138 7ffbfd5cb1d7 12137->12138 12139 7ffbfd5cd710 40 API calls 12138->12139 12140 7ffbfd5ccc70 40 API calls 12138->12140 12141 7ffbfd5cb2ff memcpy 12138->12141 12139->12138 12140->12138 12141->12014 12154 7ffbfd5ea7f2 12143->12154 12147 7ffbfd5cbb21 12146->12147 12148 7ffbfd5cbf81 12147->12148 12149 7ffbfd5cbfec 12147->12149 12152 7ffbfd5cbf6b 12147->12152 12148->12136 12150 7ffbfd5eaab0 40 API calls 12149->12150 12151 7ffbfd5cbffb 12150->12151 12153 7ffbfd5eaab0 40 API calls 12152->12153 12153->12148 12155 7ffbfd5ea824 12154->12155 12156 7ffbfd5ea650 40 API calls 12155->12156 12157 7ffbfd5ea93b 12156->12157 12159 7ffbfd5e693e 12158->12159 12160 7ffbfd5e6a3c 12159->12160 12167 7ffbfd5ea774 12159->12167 12160->12056 12162 7ffbfd5e6a65 12163 7ffbfd5e726c 9 API calls 12162->12163 12164 7ffbfd5e6c55 12163->12164 12170 7ffbfd5e4fc0 12165->12170 12168 7ffbfd5ea650 40 API calls 12167->12168 12169 7ffbfd5ea7d7 12168->12169 12172 7ffbfd5e4feb 12170->12172 12171 7ffbfd5e515c 12174 7ffbfd5eab60 40 API calls 12171->12174 12172->12171 12173 7ffbfd5e50e1 12172->12173 12175 7ffbfd5ea650 40 API calls 12172->12175 12176 7ffbfd5ea650 40 API calls 12173->12176 12177 7ffbfd5e516f 12173->12177 12174->12177 12175->12173 12176->12171 12178 7ffbfd5eaab0 40 API calls 12177->12178 12181 7ffbfd5e51cf 12177->12181 12178->12181 12180 7ffbfd5eab60 40 API calls 12180->12181 12181->12180 12182 7ffbfd5e5266 12181->12182 12185 7ffbfd5ea5d0 12181->12185 12183 7ffbfd5ea650 40 API calls 12182->12183 12184 7ffbfd5e53af 12183->12184 12186 7ffbfd5ea6f0 40 API calls 12185->12186 12187 7ffbfd5ea5ee 12186->12187 12188 7ffbfd5ea650 40 API calls 12187->12188 12189 7ffbfd5ea64c 12188->12189 12191 7ffbfd5b2990 12203 7ffbfd5c1e30 12191->12203 12193 7ffbfd5b29e5 12194 7ffbfd5b2cd8 12193->12194 12195 7ffbfd5b29ef 12193->12195 12197 7ffbfd5ea940 40 API calls 12194->12197 12196 7ffbfd5e0bd0 40 API calls 12195->12196 12199 7ffbfd5b2ae4 memset 12196->12199 12198 7ffbfd5b2d19 12197->12198 12200 7ffbfd5b2bca OutputDebugStringW 12199->12200 12201 7ffbfd5b2b23 12199->12201 12202 7ffbfd5b2be0 12200->12202 12201->12200 12204 7ffbfd5e0bd0 40 API calls 12203->12204 12205 7ffbfd5c1f7b memset 12204->12205 12206 7ffbfd5c206a OutputDebugStringW 12205->12206 12208 7ffbfd5c1fb6 12205->12208 12207 7ffbfd5c208d 12206->12207 12210 7ffbfd5c20ea 12207->12210 12212 7ffbfd5c20af 12207->12212 12208->12206 12209 7ffbfd5c2109 12209->12193 12210->12209 12213 7ffbfd5ea525 40 API calls 12210->12213 12211 7ffbfd5c20d9 12214 7ffbfd5cb170 42 API calls 12211->12214 12212->12211 12215 7ffbfd5c2162 12212->12215 12216 7ffbfd5c27ea 12213->12216 12217 7ffbfd5c20e5 12214->12217 12219 7ffbfd5c2180 memcpy memcpy 12215->12219 12220 7ffbfd5ea525 40 API calls 12216->12220 12218 7ffbfd5c21ad memcpy 12217->12218 12218->12216 12222 7ffbfd5c21de 12218->12222 12219->12218 12225 7ffbfd5c27fe 12220->12225 12221 7ffbfd5c2800 12223 7ffbfd5eaa40 40 API calls 12221->12223 12222->12216 12222->12221 12224 7ffbfd5c2206 12222->12224 12223->12225 12224->12221 12226 7ffbfd5c222c memcpy memcpy 12224->12226 12225->12193 12227 7ffbfd5c2273 12226->12227 12228 7ffbfd5c2282 memcpy memset 12226->12228 12229 7ffbfd5e0bd0 40 API calls 12227->12229 12230 7ffbfd5c2323 12228->12230 12231 7ffbfd5c2512 memset 12229->12231 12230->12227 12233 7ffbfd5c237e 12230->12233 12232 7ffbfd5c260a OutputDebugStringW 12231->12232 12235 7ffbfd5c2554 12231->12235 12234 7ffbfd5c2626 12232->12234 12236 7ffbfd5e0bd0 40 API calls 12233->12236 12234->12209 12238 7ffbfd5ea940 40 API calls 12234->12238 12235->12232 12237 7ffbfd5c2438 memset 12236->12237 12239 7ffbfd5c277a OutputDebugStringW 12237->12239 12240 7ffbfd5c247a 12237->12240 12238->12225 12239->12209 12240->12239 12241 7ffbfd5b1350 12242 7ffbfd5b13b7 12241->12242 12243 7ffbfd5b1f58 12241->12243 12248 7ffbfd5b13cf 12242->12248 12270 7ffbfd5e9c20 12242->12270 12244 7ffbfd5e98d0 3 API calls 12243->12244 12244->12242 12246 7ffbfd5b13f3 12251 7ffbfd5b2057 12246->12251 12265 7ffbfd5b141f 12246->12265 12247 7ffbfd5b1fbb 12249 7ffbfd5ea940 40 API calls 12247->12249 12248->12246 12248->12247 12250 7ffbfd5b1fea 12249->12250 12275 7ffbfd5c59c0 12250->12275 12252 7ffbfd5ea53f 40 API calls 12251->12252 12252->12250 12254 7ffbfd5b209e 12255 7ffbfd5c1e30 55 API calls 12255->12265 12256 7ffbfd5b1ee9 12259 7ffbfd5b1f3d 12256->12259 12261 7ffbfd5e9d50 43 API calls 12256->12261 12257 7ffbfd5b200f 12258 7ffbfd5ea940 40 API calls 12257->12258 12258->12250 12261->12259 12262 7ffbfd5e0bd0 40 API calls 12263 7ffbfd5b1dda memset 12262->12263 12264 7ffbfd5b1eba OutputDebugStringW 12263->12264 12263->12265 12264->12265 12265->12255 12265->12256 12265->12257 12265->12262 12265->12264 12266 7ffbfd5c04b0 12265->12266 12267 7ffbfd5c04f8 12266->12267 12268 7ffbfd5c04e7 12266->12268 12267->12265 12288 7ffbfd5e77e0 12268->12288 12274 7ffbfd5e9c49 12270->12274 12271 7ffbfd5e9d3d 12271->12248 12272 7ffbfd5e9cd6 WaitOnAddress 12273 7ffbfd5e9cf3 GetLastError 12272->12273 12272->12274 12273->12274 12274->12271 12274->12272 12277 7ffbfd5c59ce 12275->12277 12276 7ffbfd5c59f7 12276->12254 12277->12276 12278 7ffbfd5e9df9 12277->12278 12279 7ffbfd5e9d67 12277->12279 12281 7ffbfd5ea6f0 40 API calls 12278->12281 12280 7ffbfd5e9d8f 12279->12280 12283 7ffbfd5e9d7a WakeByAddressSingle 12279->12283 12284 7ffbfd5e9d99 12280->12284 12285 7ffbfd5e9dc0 WakeByAddressSingle 12280->12285 12287 7ffbfd5e9dae 12280->12287 12282 7ffbfd5e9e11 12281->12282 12286 7ffbfd5e9de4 WakeByAddressAll 12284->12286 12284->12287 12285->12286 12285->12287 12286->12287 12287->12254 12289 7ffbfd5e77f9 12288->12289 12290 7ffbfd5e7805 12288->12290 12301 7ffbfd5e0a30 12289->12301 12292 7ffbfd5e7b7c 12290->12292 12293 7ffbfd5e784c 12290->12293 12295 7ffbfd5e7b53 12290->12295 12292->12289 12292->12295 12293->12289 12296 7ffbfd5e7883 12293->12296 12294 7ffbfd5e7c57 memcpy 12300 7ffbfd5e7800 12294->12300 12295->12294 12295->12300 12297 7ffbfd5e78a5 memset 12296->12297 12298 7ffbfd5e7f6c 12296->12298 12297->12300 12306 7ffbfd5e0a80 12298->12306 12300->12267 12300->12300 12302 7ffbfd5e0a46 12301->12302 12303 7ffbfd5e0a3e 12301->12303 12304 7ffbfd5ea650 40 API calls 12302->12304 12303->12300 12305 7ffbfd5e0a78 12304->12305 12307 7ffbfd5e0a9a 12306->12307 12308 7ffbfd5e0a8e 12306->12308 12309 7ffbfd5ea53f 40 API calls 12307->12309 12308->12300 12310 7ffbfd5e0aa5 12309->12310 11426 7ffbfd5c3920 memset 11427 7ffbfd5c39fa OutputDebugStringW 11426->11427 11428 7ffbfd5c395a 11426->11428 11428->11427 11429 7ffbfd5c0ca0 11467 7ffbfd5c0cf0 11429->11467 11430 7ffbfd5c1938 11431 7ffbfd5c0d2b LsaOpenPolicy 11431->11467 11432 7ffbfd5c0d85 GetCurrentProcess OpenProcessToken 11432->11467 11433 7ffbfd5c7b50 41 API calls 11433->11467 11434 7ffbfd5c1953 11495 7ffbfd5ea525 11434->11495 11435 7ffbfd5c0dce GetTokenInformation 11435->11467 11437 7ffbfd5c0f2e LsaClose 11437->11467 11438 7ffbfd5e0bd0 40 API calls 11442 7ffbfd5c1059 memset 11438->11442 11446 7ffbfd5c113a OutputDebugStringW 11442->11446 11442->11467 11443 7ffbfd5c7550 GetLastError 11443->11467 11444 7ffbfd5c1219 memset 11447 7ffbfd5c12fa OutputDebugStringW 11444->11447 11461 7ffbfd5c1257 11444->11461 11445 7ffbfd5c0e4b LsaAddAccountRights LsaClose 11445->11467 11446->11467 11447->11461 11448 7ffbfd5c0f81 LsaClose 11491 7ffbfd5c7b50 11448->11491 11450 7ffbfd5c1333 GetCurrentProcess OpenProcessToken 11450->11461 11451 7ffbfd5c7810 GetErrorInfo 11451->11467 11453 7ffbfd5c1399 LookupPrivilegeValueW 11456 7ffbfd5c13c6 AdjustTokenPrivileges 11453->11456 11453->11461 11454 7ffbfd5e0bd0 40 API calls 11455 7ffbfd5c169c memset 11454->11455 11458 7ffbfd5c183a OutputDebugStringW 11455->11458 11455->11467 11457 7ffbfd5c140b GetLastError 11456->11457 11456->11461 11457->11461 11458->11467 11459 7ffbfd5c7550 GetLastError 11459->11461 11460 7ffbfd5e0bd0 40 API calls 11463 7ffbfd5c1478 memset 11460->11463 11461->11447 11461->11450 11461->11453 11461->11454 11461->11457 11461->11459 11461->11460 11462 7ffbfd5e0bd0 40 API calls 11461->11462 11464 7ffbfd5c15ba OutputDebugStringW 11461->11464 11475 7ffbfd5c6270 11461->11475 11465 7ffbfd5c1758 memset 11462->11465 11463->11461 11463->11464 11464->11461 11466 7ffbfd5c190a OutputDebugStringW 11465->11466 11465->11467 11466->11467 11467->11430 11467->11431 11467->11432 11467->11433 11467->11434 11467->11435 11467->11437 11467->11438 11467->11443 11467->11446 11467->11448 11467->11451 11467->11458 11467->11466 11468 7ffbfd5e0bd0 11467->11468 11483 7ffbfd5c5e40 11467->11483 11472 7ffbfd5e0bfa 11468->11472 11469 7ffbfd5e0ce9 11469->11444 11471 7ffbfd5e0cb9 11473 7ffbfd5ea525 40 API calls 11471->11473 11472->11469 11472->11471 11501 7ffbfd5ea940 11472->11501 11474 7ffbfd5e0d3e 11473->11474 11474->11444 11479 7ffbfd5c629c 11475->11479 11476 7ffbfd5c662f 11477 7ffbfd5ea525 40 API calls 11476->11477 11478 7ffbfd5c663a 11477->11478 11478->11461 11479->11476 11480 7ffbfd5c6439 11479->11480 11482 7ffbfd5c637c 11479->11482 11480->11482 11864 7ffbfd5e8f30 11480->11864 11482->11461 11486 7ffbfd5c5e6c 11483->11486 11484 7ffbfd5c620f 11485 7ffbfd5ea525 40 API calls 11484->11485 11487 7ffbfd5c621d 11485->11487 11486->11484 11488 7ffbfd5c600c 11486->11488 11490 7ffbfd5c5f51 11486->11490 11487->11445 11489 7ffbfd5e8f30 40 API calls 11488->11489 11488->11490 11489->11488 11490->11445 11873 7ffbfd5c7cb0 11491->11873 11493 7ffbfd5c7b7b RoOriginateErrorW 11494 7ffbfd5c7b99 11493->11494 11494->11467 11496 7ffbfd5ea539 11495->11496 11497 7ffbfd5ea534 11495->11497 11499 7ffbfd5ea53f 40 API calls 11496->11499 11890 7ffbfd5e0af0 11497->11890 11500 7ffbfd5ea53e 11499->11500 11504 7ffbfd5ea650 11501->11504 11507 7ffbfd5d5900 11504->11507 11513 7ffbfd5d4b70 11507->11513 11509 7ffbfd5d591e 11510 7ffbfd5d59e9 11509->11510 11524 7ffbfd5ea53f 11509->11524 11534 7ffbfd5d5c70 11513->11534 11515 7ffbfd5d4b7f 11517 7ffbfd5d4bc3 11515->11517 11540 7ffbfd5d2e50 11515->11540 11523 7ffbfd5d4bd4 11517->11523 11548 7ffbfd5d3c00 11517->11548 11521 7ffbfd5d4c7e 11521->11509 11523->11521 11551 7ffbfd5d4ed0 11523->11551 11525 7ffbfd5ea557 11524->11525 11854 7ffbfd5e1d30 11525->11854 11528 7ffbfd5ea650 40 API calls 11529 7ffbfd5ea5c4 11528->11529 11530 7ffbfd5ea6f0 40 API calls 11529->11530 11531 7ffbfd5ea5ee 11530->11531 11532 7ffbfd5ea650 40 API calls 11531->11532 11533 7ffbfd5ea64c 11532->11533 11536 7ffbfd5d5c93 11534->11536 11535 7ffbfd5d5ce2 11537 7ffbfd5d5de6 40 API calls 11535->11537 11536->11535 11567 7ffbfd5d5de6 11536->11567 11539 7ffbfd5d5d19 11537->11539 11539->11515 11541 7ffbfd5d2ea0 11540->11541 11544 7ffbfd5d2e79 11540->11544 11543 7ffbfd5ea525 40 API calls 11541->11543 11542 7ffbfd5d2ea5 11545 7ffbfd5d2fa4 11542->11545 11547 7ffbfd5d4db0 40 API calls 11542->11547 11546 7ffbfd5d2fd5 11543->11546 11544->11541 11544->11542 11545->11517 11546->11517 11547->11542 11727 7ffbfd5d8440 11548->11727 11550 7ffbfd5d3c21 11553 7ffbfd5d4ef6 11551->11553 11552 7ffbfd5d5015 11552->11521 11553->11552 11554 7ffbfd5d507b 11553->11554 11555 7ffbfd5d5069 11553->11555 11564 7ffbfd5d5003 11553->11564 11849 7ffbfd5eaab0 11554->11849 11557 7ffbfd5eaa40 40 API calls 11555->11557 11557->11554 11566 7ffbfd5ea9d0 40 API calls 11564->11566 11566->11552 11569 7ffbfd5d5e21 11567->11569 11568 7ffbfd5d5f0b 11570 7ffbfd5d5f95 11568->11570 11574 7ffbfd5d5f13 11568->11574 11569->11568 11573 7ffbfd5d5e4f 11569->11573 11586 7ffbfd5e9af0 11569->11586 11572 7ffbfd5d2b50 40 API calls 11570->11572 11577 7ffbfd5d5f8f 11572->11577 11578 7ffbfd5d5e93 11573->11578 11594 7ffbfd5d5434 11573->11594 11637 7ffbfd5d2b50 11574->11637 11580 7ffbfd5d2b50 40 API calls 11577->11580 11612 7ffbfd5cf560 11578->11612 11581 7ffbfd5d603d 11580->11581 11584 7ffbfd5cf560 40 API calls 11581->11584 11582 7ffbfd5d5ede 11582->11577 11625 7ffbfd5d6090 11582->11625 11585 7ffbfd5d6074 11584->11585 11585->11535 11587 7ffbfd5e9b0b 11586->11587 11588 7ffbfd5e9bdd 11587->11588 11589 7ffbfd5e9be8 11587->11589 11592 7ffbfd5e9b92 WaitOnAddress 11587->11592 11588->11573 11590 7ffbfd5ea650 38 API calls 11589->11590 11591 7ffbfd5e9c1a 11590->11591 11592->11587 11593 7ffbfd5e9bae GetLastError 11592->11593 11593->11587 11595 7ffbfd5d545e 11594->11595 11598 7ffbfd5d5458 11594->11598 11595->11598 11642 7ffbfd5d3030 11595->11642 11602 7ffbfd5d5657 11598->11602 11646 7ffbfd5d1c60 11598->11646 11599 7ffbfd5d5534 11600 7ffbfd5d5558 11599->11600 11601 7ffbfd5d55cc 11599->11601 11605 7ffbfd5d556f 11600->11605 11653 7ffbfd5e9800 11600->11653 11603 7ffbfd5d5727 2 API calls 11601->11603 11602->11578 11608 7ffbfd5d55bd 11603->11608 11650 7ffbfd5d5727 11605->11650 11608->11578 11613 7ffbfd5cf57a 11612->11613 11614 7ffbfd5cf57c 11612->11614 11613->11582 11615 7ffbfd5e9df9 11614->11615 11616 7ffbfd5e9d67 11614->11616 11683 7ffbfd5ea6f0 11615->11683 11619 7ffbfd5e9d7a WakeByAddressSingle 11616->11619 11620 7ffbfd5e9d8f 11616->11620 11621 7ffbfd5e9d99 11620->11621 11622 7ffbfd5e9dae 11620->11622 11623 7ffbfd5e9dc0 WakeByAddressSingle 11620->11623 11621->11622 11624 7ffbfd5e9de4 WakeByAddressAll 11621->11624 11622->11582 11623->11622 11623->11624 11624->11622 11686 7ffbfd5d9ea0 11625->11686 11628 7ffbfd5d2b50 40 API calls 11629 7ffbfd5d60fe 11628->11629 11631 7ffbfd5d613d 11629->11631 11633 7ffbfd5d61b2 11629->11633 11630 7ffbfd5d61b0 11630->11568 11631->11630 11719 7ffbfd5ea9d0 11631->11719 11632 7ffbfd5e08fe 11632->11568 11633->11632 11634 7ffbfd5ea940 40 API calls 11633->11634 11634->11632 11638 7ffbfd5d2b87 11637->11638 11639 7ffbfd5d2b96 11638->11639 11640 7ffbfd5ea650 40 API calls 11638->11640 11639->11577 11641 7ffbfd5d2c3a 11640->11641 11641->11577 11643 7ffbfd5d304c 11642->11643 11645 7ffbfd5d3062 11642->11645 11658 7ffbfd5d08a0 11643->11658 11645->11598 11647 7ffbfd5d1c77 11646->11647 11649 7ffbfd5d1cb4 11647->11649 11675 7ffbfd5e9e20 11647->11675 11649->11599 11679 7ffbfd5d41b0 11650->11679 11652 7ffbfd5d5750 11654 7ffbfd5e9819 11653->11654 11655 7ffbfd5e9840 11654->11655 11656 7ffbfd5e986c WaitOnAddress 11654->11656 11655->11605 11656->11654 11657 7ffbfd5e9889 GetLastError 11656->11657 11657->11654 11659 7ffbfd5d8230 35 API calls 11658->11659 11662 7ffbfd5d08d2 11659->11662 11660 7ffbfd5d0a57 SetLastError GetEnvironmentVariableW 11660->11662 11663 7ffbfd5d0a78 GetLastError 11660->11663 11661 7ffbfd5e9560 35 API calls 11661->11662 11662->11660 11662->11661 11664 7ffbfd5d0a92 GetLastError 11662->11664 11667 7ffbfd5d0ac5 11662->11667 11673 7ffbfd5d08e2 11662->11673 11663->11662 11665 7ffbfd5d0b40 GetLastError 11663->11665 11664->11662 11666 7ffbfd5d0c30 11664->11666 11665->11673 11670 7ffbfd5ea6f0 35 API calls 11666->11670 11668 7ffbfd5d0c4a 11667->11668 11669 7ffbfd5d0ace 11667->11669 11671 7ffbfd5eaa40 35 API calls 11668->11671 11672 7ffbfd5d2e50 35 API calls 11669->11672 11674 7ffbfd5d0c48 11670->11674 11671->11674 11672->11673 11673->11645 11674->11645 11676 7ffbfd5e9e37 11675->11676 11677 7ffbfd5d9050 40 API calls 11676->11677 11678 7ffbfd5e9e8e 11676->11678 11677->11678 11678->11649 11680 7ffbfd5d41ed 11679->11680 11681 7ffbfd5d41c8 11679->11681 11682 7ffbfd5e9800 WaitOnAddress GetLastError 11680->11682 11681->11652 11682->11681 11684 7ffbfd5ea650 40 API calls 11683->11684 11685 7ffbfd5ea72d 11684->11685 11687 7ffbfd5d9ead 11686->11687 11688 7ffbfd5d60a5 11687->11688 11722 7ffbfd5d53b0 11687->11722 11688->11628 11720 7ffbfd5ea650 40 API calls 11719->11720 11721 7ffbfd5eaa3e 11720->11721 11723 7ffbfd5d2b50 40 API calls 11722->11723 11724 7ffbfd5d53fc 11723->11724 11725 7ffbfd5ea7d8 40 API calls 11724->11725 11726 7ffbfd5d5433 11725->11726 11730 7ffbfd5d8456 11727->11730 11728 7ffbfd5d86d3 11729 7ffbfd5ea9d0 33 API calls 11728->11729 11735 7ffbfd5d85f6 11728->11735 11731 7ffbfd5d85db 11729->11731 11730->11728 11730->11731 11730->11735 11763 7ffbfd5eaa40 11730->11763 11733 7ffbfd5ea9d0 33 API calls 11731->11733 11731->11735 11734 7ffbfd5d88cd 11733->11734 11736 7ffbfd5d8aa2 SetLastError GetFullPathNameW 11734->11736 11740 7ffbfd5d8ae7 GetLastError 11734->11740 11742 7ffbfd5d8b1f 11734->11742 11755 7ffbfd5d8945 11734->11755 11766 7ffbfd5e9560 11734->11766 11735->11550 11736->11734 11738 7ffbfd5d8acd GetLastError 11736->11738 11738->11734 11739 7ffbfd5d8b75 GetLastError 11738->11739 11739->11755 11740->11734 11741 7ffbfd5d8f1f 11740->11741 11743 7ffbfd5ea6f0 33 API calls 11741->11743 11744 7ffbfd5d8b28 11742->11744 11745 7ffbfd5d8f39 11742->11745 11748 7ffbfd5d8f37 11743->11748 11751 7ffbfd5d8cc6 11744->11751 11758 7ffbfd5d8b4c 11744->11758 11746 7ffbfd5eaa40 33 API calls 11745->11746 11746->11748 11747 7ffbfd5d8cd3 11749 7ffbfd5d8ce5 11747->11749 11753 7ffbfd5e9560 33 API calls 11747->11753 11748->11550 11752 7ffbfd5d8dd2 memcpy 11749->11752 11750 7ffbfd5d8c7a memcpy 11750->11747 11750->11752 11751->11747 11759 7ffbfd5d8f65 11751->11759 11752->11755 11756 7ffbfd5d8dfe 11752->11756 11753->11749 11755->11550 11783 7ffbfd5d0250 11756->11783 11758->11750 11761 7ffbfd5d8f50 11758->11761 11760 7ffbfd5ea525 33 API calls 11759->11760 11760->11748 11762 7ffbfd5ea525 33 API calls 11761->11762 11762->11748 11764 7ffbfd5ea650 40 API calls 11763->11764 11765 7ffbfd5eaaae 11764->11765 11767 7ffbfd5e9578 11766->11767 11768 7ffbfd5e961d 11766->11768 11769 7ffbfd5e9631 11767->11769 11773 7ffbfd5ea525 39 API calls 11767->11773 11780 7ffbfd5e960a 11767->11780 11770 7ffbfd5ea525 39 API calls 11768->11770 11771 7ffbfd5ea525 39 API calls 11769->11771 11770->11767 11772 7ffbfd5e9636 11771->11772 11774 7ffbfd5ea650 39 API calls 11772->11774 11773->11769 11775 7ffbfd5e967c 11774->11775 11776 7ffbfd5e96ad 11775->11776 11792 7ffbfd5d1300 11775->11792 11778 7ffbfd5e96bd memcpy 11776->11778 11779 7ffbfd5e96db 11776->11779 11781 7ffbfd5e96eb 11776->11781 11778->11781 11806 7ffbfd5d2820 11779->11806 11780->11734 11781->11734 11784 7ffbfd5d02eb 11783->11784 11788 7ffbfd5d0269 11783->11788 11785 7ffbfd5ea525 40 API calls 11784->11785 11785->11788 11786 7ffbfd5d02ff 11787 7ffbfd5ea525 40 API calls 11786->11787 11790 7ffbfd5d0304 11787->11790 11788->11786 11789 7ffbfd5ea525 40 API calls 11788->11789 11791 7ffbfd5d02d8 11788->11791 11789->11786 11791->11755 11793 7ffbfd5d1370 11792->11793 11795 7ffbfd5d14be 11793->11795 11799 7ffbfd5d148b 11793->11799 11813 7ffbfd5d7ab0 11793->11813 11796 7ffbfd5d14cf 11795->11796 11797 7ffbfd5eaa40 39 API calls 11795->11797 11796->11776 11798 7ffbfd5d1506 11797->11798 11844 7ffbfd5cf590 11798->11844 11799->11796 11802 7ffbfd5d14a0 11799->11802 11803 7ffbfd5d14eb 11799->11803 11801 7ffbfd5d1536 11801->11776 11802->11796 11804 7ffbfd5d14aa memcpy 11802->11804 11805 7ffbfd5eaa40 39 API calls 11803->11805 11804->11796 11805->11795 11807 7ffbfd5d2956 11806->11807 11809 7ffbfd5d2842 11806->11809 11807->11781 11808 7ffbfd5d7ab0 40 API calls 11808->11809 11809->11807 11809->11808 11810 7ffbfd5d296d 11809->11810 11811 7ffbfd5ea9d0 40 API calls 11810->11811 11812 7ffbfd5d297f 11811->11812 11812->11781 11814 7ffbfd5d7ad2 GetStdHandle 11813->11814 11825 7ffbfd5d7b0e 11813->11825 11815 7ffbfd5d7aee 11814->11815 11814->11825 11816 7ffbfd5d7af4 GetLastError 11815->11816 11817 7ffbfd5d7b26 GetConsoleMode 11815->11817 11816->11825 11818 7ffbfd5d7b97 11817->11818 11819 7ffbfd5d7b3e 11817->11819 11821 7ffbfd5d75b0 36 API calls 11818->11821 11820 7ffbfd5d7b47 11819->11820 11827 7ffbfd5d7bb1 11819->11827 11822 7ffbfd5d7cbf 11820->11822 11823 7ffbfd5d7b50 11820->11823 11821->11825 11824 7ffbfd5ea650 36 API calls 11822->11824 11823->11825 11826 7ffbfd5d7cf1 11823->11826 11830 7ffbfd5d7c34 11823->11830 11824->11826 11825->11793 11828 7ffbfd5eaa40 36 API calls 11826->11828 11827->11825 11829 7ffbfd5d7c00 11827->11829 11831 7ffbfd5d7d08 11827->11831 11832 7ffbfd5d7bea 11827->11832 11828->11831 11833 7ffbfd5d7dc0 36 API calls 11829->11833 11830->11825 11836 7ffbfd5d7c5f 11830->11836 11837 7ffbfd5d7d4d 11830->11837 11834 7ffbfd5eaa40 36 API calls 11831->11834 11832->11829 11835 7ffbfd5d7d1d 11832->11835 11833->11825 11834->11835 11838 7ffbfd5ea940 36 API calls 11835->11838 11839 7ffbfd5d7dc0 36 API calls 11836->11839 11840 7ffbfd5e9523 36 API calls 11837->11840 11838->11837 11841 7ffbfd5d7c6a 11839->11841 11840->11841 11841->11825 11842 7ffbfd5e9523 36 API calls 11841->11842 11843 7ffbfd5d7d8d CloseHandle 11842->11843 11843->11793 11845 7ffbfd5cf5ad 11844->11845 11846 7ffbfd5cf5a1 11844->11846 11845->11801 11846->11845 11847 7ffbfd5eaa40 40 API calls 11846->11847 11848 7ffbfd5cf5ea 11847->11848 11848->11801 11850 7ffbfd5ea650 40 API calls 11849->11850 11851 7ffbfd5eab1e 11850->11851 11852 7ffbfd5ea650 40 API calls 11851->11852 11853 7ffbfd5eab58 11852->11853 11855 7ffbfd5ea650 40 API calls 11854->11855 11856 7ffbfd5e1d84 11855->11856 11859 7ffbfd5e5d00 11856->11859 11858 7ffbfd5e1da7 11858->11528 11861 7ffbfd5e5d1d 11859->11861 11860 7ffbfd5e5d25 11860->11858 11861->11860 11862 7ffbfd5ea9d0 40 API calls 11861->11862 11863 7ffbfd5e5f2d 11862->11863 11863->11858 11865 7ffbfd5e8f47 11864->11865 11866 7ffbfd5ea525 40 API calls 11865->11866 11871 7ffbfd5e8f50 11865->11871 11866->11871 11867 7ffbfd5e901a 11868 7ffbfd5ea525 40 API calls 11867->11868 11869 7ffbfd5e901f 11868->11869 11870 7ffbfd5ea525 40 API calls 11870->11867 11871->11867 11871->11870 11872 7ffbfd5e8ff1 11871->11872 11872->11480 11876 7ffbfd5c7cda 11873->11876 11874 7ffbfd5c7ed6 11874->11493 11875 7ffbfd5c7fdf 11877 7ffbfd5ea525 40 API calls 11875->11877 11876->11874 11876->11875 11879 7ffbfd5c7d5e 11876->11879 11878 7ffbfd5c7ff3 11877->11878 11878->11493 11879->11874 11881 7ffbfd5e9060 11879->11881 11882 7ffbfd5e9121 11881->11882 11888 7ffbfd5e9072 11881->11888 11884 7ffbfd5ea525 40 API calls 11882->11884 11883 7ffbfd5e9137 11885 7ffbfd5ea525 40 API calls 11883->11885 11884->11888 11886 7ffbfd5e913c 11885->11886 11887 7ffbfd5ea525 40 API calls 11887->11883 11888->11883 11888->11887 11889 7ffbfd5e910e 11888->11889 11889->11879 11891 7ffbfd5ea650 40 API calls 11890->11891 11892 7ffbfd5e0b2c 11891->11892

                                              Executed Functions

                                              Function 00007FFBFD5B5400 Relevance: 43.0, APIs: 21, Strings: 3, Instructions: 969COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000003.00000002.3729735948.00007FFBFD5B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFBFD5B0000, based on PE: true
                                              • Associated: 00000003.00000002.3728901617.00007FFBFD5B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3731019737.00007FFBFD5EB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3731947127.00007FFBFD5FF000.00000004.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3732770229.00007FFBFD600000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_3_2_7ffbfd5b0000_cmd.jbxd
                                              Similarity
                                              • API ID: memset$DebugOutputString$HandleModuleQueryVirtual
                                              • String ID: C:\Windows\System32\Resolved full path for module: $ntdll.dll$ntdll.dllNormalized full path for ntdll.dll:
                                              • API String ID: 3283594973-2956908514
                                              • Opcode ID: fa96de232a5722ec77d850d248d12f9d7c086d81a6a47ef0f31ff0e8d7221dec
                                              • Instruction ID: 44c6d3c437f18ed9580622f3a6f405d9cee35e22f2072b4310d1df65e53abfe5
                                              • Opcode Fuzzy Hash: fa96de232a5722ec77d850d248d12f9d7c086d81a6a47ef0f31ff0e8d7221dec
                                              • Instruction Fuzzy Hash: 1FA2BEB2A14BC689EB358F70D8547E83365FB49B88F404235DE5D1BB9AEF399244C380
                                              Function 00007FFBFD5C0CA0 Relevance: 42.7, APIs: 23, Strings: 1, Instructions: 711COMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 194 7ffbfd5c0ca0-7ffbfd5c0cdf 195 7ffbfd5c0cf3-7ffbfd5c0cf9 194->195 196 7ffbfd5c1938-7ffbfd5c1952 195->196 197 7ffbfd5c0cff-7ffbfd5c0d48 call 7ffbfd5c7250 call 7ffbfd5c7230 LsaOpenPolicy 195->197 202 7ffbfd5c0d4a-7ffbfd5c0d52 197->202 203 7ffbfd5c0d80-7ffbfd5c0da9 call 7ffbfd5c7230 GetCurrentProcess OpenProcessToken 197->203 205 7ffbfd5c0d59-7ffbfd5c0d67 call 7ffbfd5c7b50 call 7ffbfd5c7810 202->205 209 7ffbfd5c0f03-7ffbfd5c0f17 call 7ffbfd5c7550 203->209 210 7ffbfd5c0daf-7ffbfd5c0dc8 call 7ffbfd5c71c0 203->210 217 7ffbfd5c0fd7-7ffbfd5c1091 call 7ffbfd5e0bd0 memset 205->217 218 7ffbfd5c0d6d 205->218 209->210 219 7ffbfd5c0f1d-7ffbfd5c0f20 209->219 220 7ffbfd5c1953-7ffbfd5c19be call 7ffbfd5ea525 call 7ffbfd5c71a0 210->220 221 7ffbfd5c0dce-7ffbfd5c0e0b GetTokenInformation 210->221 238 7ffbfd5c113a-7ffbfd5c114d OutputDebugStringW 217->238 239 7ffbfd5c1097-7ffbfd5c10a9 217->239 223 7ffbfd5c11c0-7ffbfd5c1251 call 7ffbfd5e0bd0 memset 218->223 224 7ffbfd5c0f2e-7ffbfd5c0f4a LsaClose 219->224 225 7ffbfd5c0f22-7ffbfd5c0f29 call 7ffbfd5c8050 219->225 226 7ffbfd5c0e11-7ffbfd5c0ea4 call 7ffbfd5c5e40 LsaAddAccountRights LsaClose 221->226 227 7ffbfd5c0f4f-7ffbfd5c0f6a call 7ffbfd5c7550 221->227 243 7ffbfd5c12fa-7ffbfd5c130d OutputDebugStringW 223->243 244 7ffbfd5c1257-7ffbfd5c1269 223->244 224->205 225->224 247 7ffbfd5c0eaa-7ffbfd5c0ee3 call 7ffbfd5c7b50 call 7ffbfd5c7810 226->247 248 7ffbfd5c117f-7ffbfd5c1189 226->248 227->226 241 7ffbfd5c0f70-7ffbfd5c0f73 227->241 245 7ffbfd5c1160-7ffbfd5c1168 238->245 246 7ffbfd5c114f-7ffbfd5c115b call 7ffbfd5c71a0 238->246 249 7ffbfd5c10b5-7ffbfd5c10d4 239->249 250 7ffbfd5c10ab-7ffbfd5c10b3 239->250 252 7ffbfd5c0f75-7ffbfd5c0f7c call 7ffbfd5c8050 241->252 253 7ffbfd5c0f81-7ffbfd5c0faf LsaClose call 7ffbfd5c7b50 call 7ffbfd5c7810 241->253 260 7ffbfd5c1320-7ffbfd5c1357 call 7ffbfd5c7230 GetCurrentProcess OpenProcessToken 243->260 261 7ffbfd5c130f-7ffbfd5c131b call 7ffbfd5c71a0 243->261 255 7ffbfd5c1275-7ffbfd5c1294 244->255 256 7ffbfd5c126b-7ffbfd5c1273 244->256 258 7ffbfd5c116e-7ffbfd5c117a call 7ffbfd5c8050 245->258 259 7ffbfd5c0cf0 245->259 246->245 289 7ffbfd5c0fb6-7ffbfd5c0fd1 call 7ffbfd5c71a0 247->289 290 7ffbfd5c0ee9-7ffbfd5c0efe call 7ffbfd5c71a0 247->290 262 7ffbfd5c119c-7ffbfd5c11b3 call 7ffbfd5c71a0 248->262 263 7ffbfd5c118b-7ffbfd5c1197 call 7ffbfd5c71a0 248->263 254 7ffbfd5c10e0-7ffbfd5c110a 249->254 251 7ffbfd5c110c-7ffbfd5c111d 250->251 267 7ffbfd5c1120-7ffbfd5c1127 251->267 252->253 253->289 254->251 254->254 274 7ffbfd5c12a0-7ffbfd5c12ca 255->274 273 7ffbfd5c12cc-7ffbfd5c12dd 256->273 258->259 259->195 283 7ffbfd5c14da-7ffbfd5c14e1 call 7ffbfd5c7550 260->283 284 7ffbfd5c135d-7ffbfd5c13c0 call 7ffbfd5c6270 call 7ffbfd5c7240 LookupPrivilegeValueW 260->284 261->260 262->223 263->262 267->238 279 7ffbfd5c1129-7ffbfd5c1138 267->279 281 7ffbfd5c12e0-7ffbfd5c12e7 273->281 274->273 274->274 279->238 279->267 281->243 287 7ffbfd5c12e9-7ffbfd5c12f8 281->287 297 7ffbfd5c161a-7ffbfd5c16d4 call 7ffbfd5e0bd0 memset 283->297 298 7ffbfd5c14e7 283->298 305 7ffbfd5c13c6-7ffbfd5c1405 AdjustTokenPrivileges 284->305 306 7ffbfd5c14ec-7ffbfd5c14f3 call 7ffbfd5c7550 284->306 287->243 287->281 289->217 289->223 290->289 309 7ffbfd5c183a-7ffbfd5c184d OutputDebugStringW 297->309 310 7ffbfd5c16da-7ffbfd5c16ec 297->310 298->284 307 7ffbfd5c14fe-7ffbfd5c1505 call 7ffbfd5c7550 305->307 308 7ffbfd5c140b-7ffbfd5c1419 GetLastError 305->308 325 7ffbfd5c14f9 306->325 326 7ffbfd5c15e8-7ffbfd5c15f2 306->326 307->326 333 7ffbfd5c150b 307->333 316 7ffbfd5c1510-7ffbfd5c151a 308->316 317 7ffbfd5c141f-7ffbfd5c14b3 call 7ffbfd5e0bd0 memset 308->317 318 7ffbfd5c1860-7ffbfd5c1868 309->318 319 7ffbfd5c184f-7ffbfd5c185b call 7ffbfd5c71a0 309->319 312 7ffbfd5c17bb-7ffbfd5c17da 310->312 313 7ffbfd5c16f2-7ffbfd5c16fa 310->313 328 7ffbfd5c17e0-7ffbfd5c180a 312->328 324 7ffbfd5c180c-7ffbfd5c181d 313->324 329 7ffbfd5c1520-7ffbfd5c1531 call 7ffbfd5c71a0 316->329 330 7ffbfd5c16ff-7ffbfd5c1790 call 7ffbfd5e0bd0 memset 316->330 340 7ffbfd5c15ba-7ffbfd5c15cd OutputDebugStringW 317->340 341 7ffbfd5c14b9-7ffbfd5c14cb 317->341 321 7ffbfd5c186e-7ffbfd5c187d call 7ffbfd5c8050 318->321 322 7ffbfd5c1930-7ffbfd5c1933 318->322 319->318 321->195 322->195 337 7ffbfd5c1820-7ffbfd5c1827 324->337 325->307 335 7ffbfd5c15f4-7ffbfd5c160f call 7ffbfd5c71a0 326->335 336 7ffbfd5c1612-7ffbfd5c1614 326->336 328->324 328->328 329->330 348 7ffbfd5c1796-7ffbfd5c17a8 330->348 349 7ffbfd5c190a-7ffbfd5c191d OutputDebugStringW 330->349 333->308 335->336 336->297 336->330 337->309 344 7ffbfd5c1829-7ffbfd5c1838 337->344 346 7ffbfd5c15e0-7ffbfd5c15e5 call 7ffbfd5c7550 340->346 347 7ffbfd5c15cf-7ffbfd5c15db call 7ffbfd5c71a0 340->347 350 7ffbfd5c1536-7ffbfd5c1555 341->350 351 7ffbfd5c14cd-7ffbfd5c14d5 341->351 344->309 344->337 346->326 347->346 358 7ffbfd5c17ae-7ffbfd5c17b6 348->358 359 7ffbfd5c1882-7ffbfd5c18a1 348->359 349->322 356 7ffbfd5c191f-7ffbfd5c192b call 7ffbfd5c71a0 349->356 353 7ffbfd5c1560-7ffbfd5c158a 350->353 357 7ffbfd5c158c-7ffbfd5c159d 351->357 353->353 353->357 356->322 360 7ffbfd5c15a0-7ffbfd5c15a7 357->360 363 7ffbfd5c18dc-7ffbfd5c18ed 358->363 361 7ffbfd5c18b0-7ffbfd5c18da 359->361 360->340 365 7ffbfd5c15a9-7ffbfd5c15b8 360->365 361->361 361->363 366 7ffbfd5c18f0-7ffbfd5c18f7 363->366 365->340 365->360 366->349 367 7ffbfd5c18f9-7ffbfd5c1908 366->367 367->349 367->366
                                              APIs
                                              Strings
                                              • Failed to add privilegeFailed to get token informationFailed to open process tokenFailed to open LSA policyAdjustTokenPrivileges failed with error: , xrefs: 00007FFBFD5C0EB9
                                              Memory Dump Source
                                              • Source File: 00000003.00000002.3729735948.00007FFBFD5B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFBFD5B0000, based on PE: true
                                              • Associated: 00000003.00000002.3728901617.00007FFBFD5B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3731019737.00007FFBFD5EB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3731947127.00007FFBFD5FF000.00000004.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3732770229.00007FFBFD600000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_3_2_7ffbfd5b0000_cmd.jbxd
                                              Similarity
                                              • API ID: ErrorOpenProcessTokenmemset$AccountCloseCurrentDebugInfoInformationOriginateOutputPolicyRightsString
                                              • String ID: Failed to add privilegeFailed to get token informationFailed to open process tokenFailed to open LSA policyAdjustTokenPrivileges failed with error:
                                              • API String ID: 4216219486-1190080770
                                              • Opcode ID: 9150818ab04af775a252cb06e1d98789d450071cd3d9c2038690949e2f7dda96
                                              • Instruction ID: 1af5e6e8709c1a4d3bdb3687522f2a6da0a397ca6222f7271bc62b2a47945788
                                              • Opcode Fuzzy Hash: 9150818ab04af775a252cb06e1d98789d450071cd3d9c2038690949e2f7dda96
                                              • Instruction Fuzzy Hash: FC627EB2B14B8189EB609FB5D8447E96361FB49788F844239DE1D4BBD9EF3C9245C380
                                              Function 00007FFBFD5C29B0 Relevance: 26.9, APIs: 13, Strings: 2, Instructions: 601COMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 368 7ffbfd5c29b0-7ffbfd5c2b26 call 7ffbfd5e0bd0 memset 371 7ffbfd5c2bda-7ffbfd5c2bfb OutputDebugStringW 368->371 372 7ffbfd5c2b2c-7ffbfd5c2b3e 368->372 373 7ffbfd5c2bfd-7ffbfd5c2c06 call 7ffbfd5c71a0 371->373 374 7ffbfd5c2c0b-7ffbfd5c2c13 371->374 375 7ffbfd5c2b4a-7ffbfd5c2b6d 372->375 376 7ffbfd5c2b40-7ffbfd5c2b48 372->376 373->374 380 7ffbfd5c2c19-7ffbfd5c2c21 374->380 381 7ffbfd5c2d1f-7ffbfd5c2d38 call 7ffbfd5c7190 374->381 378 7ffbfd5c2b70-7ffbfd5c2ba0 375->378 377 7ffbfd5c2ba2-7ffbfd5c2bbf 376->377 383 7ffbfd5c2bc0-7ffbfd5c2bc7 377->383 378->377 378->378 380->381 384 7ffbfd5c2c27-7ffbfd5c2cf8 call 7ffbfd5e0bd0 memset 380->384 388 7ffbfd5c3489-7ffbfd5c3493 call 7ffbfd5ea525 381->388 389 7ffbfd5c2d3e-7ffbfd5c2d6e 381->389 383->371 386 7ffbfd5c2bc9-7ffbfd5c2bd8 383->386 392 7ffbfd5c2e0a-7ffbfd5c2e24 OutputDebugStringW 384->392 393 7ffbfd5c2cfe-7ffbfd5c2d10 384->393 386->371 386->383 399 7ffbfd5c3498-7ffbfd5c34c3 call 7ffbfd5e9020 388->399 391 7ffbfd5c3263-7ffbfd5c3279 389->391 395 7ffbfd5c2e26-7ffbfd5c2e32 call 7ffbfd5c71a0 392->395 396 7ffbfd5c2e37-7ffbfd5c2e46 392->396 397 7ffbfd5c2d73-7ffbfd5c2d96 393->397 398 7ffbfd5c2d12-7ffbfd5c2d1a 393->398 395->396 396->399 403 7ffbfd5c2e4c-7ffbfd5c2e62 396->403 401 7ffbfd5c2da0-7ffbfd5c2dd0 397->401 404 7ffbfd5c2dd2-7ffbfd5c2def 398->404 405 7ffbfd5c34c8-7ffbfd5c34f3 call 7ffbfd5e9020 399->405 401->401 401->404 403->405 407 7ffbfd5c2e68-7ffbfd5c2e7b 403->407 406 7ffbfd5c2df0-7ffbfd5c2df7 404->406 412 7ffbfd5c34f8 405->412 406->392 409 7ffbfd5c2df9-7ffbfd5c2e08 406->409 410 7ffbfd5c2ea4-7ffbfd5c2eea call 7ffbfd5ce5c0 call 7ffbfd5c1b20 memcpy * 2 407->410 411 7ffbfd5c2e7d-7ffbfd5c2e85 407->411 409->392 409->406 424 7ffbfd5c2eef-7ffbfd5c2f1b memcpy 410->424 414 7ffbfd5c2e95-7ffbfd5c2ea2 call 7ffbfd5e93e0 411->414 415 7ffbfd5c2e87-7ffbfd5c2e93 call 7ffbfd5cb170 411->415 418 7ffbfd5c34fb-7ffbfd5c350d call 7ffbfd5ea525 412->418 414->410 414->415 415->424 427 7ffbfd5c353a-7ffbfd5c3576 418->427 424->412 428 7ffbfd5c2f21-7ffbfd5c2f28 424->428 429 7ffbfd5c2f2a-7ffbfd5c2f47 call 7ffbfd5c7190 428->429 430 7ffbfd5c2f52 428->430 429->418 438 7ffbfd5c2f4d-7ffbfd5c2f50 429->438 431 7ffbfd5c2f58-7ffbfd5c2f94 memcpy * 2 430->431 433 7ffbfd5c2f9a-7ffbfd5c2fde call 7ffbfd5c6a30 431->433 434 7ffbfd5c3022-7ffbfd5c30cd call 7ffbfd5e0bd0 memset 431->434 433->434 441 7ffbfd5c2fe0-7ffbfd5c2ff4 433->441 442 7ffbfd5c30d3-7ffbfd5c30e5 434->442 443 7ffbfd5c318a-7ffbfd5c31a4 OutputDebugStringW 434->443 438->431 441->434 446 7ffbfd5c2ff6-7ffbfd5c300f 441->446 447 7ffbfd5c30e7-7ffbfd5c30ef 442->447 448 7ffbfd5c30f1-7ffbfd5c3114 442->448 444 7ffbfd5c31a6-7ffbfd5c31b2 call 7ffbfd5c71a0 443->444 445 7ffbfd5c31b7-7ffbfd5c322a call 7ffbfd5ceb70 443->445 444->445 459 7ffbfd5c3230-7ffbfd5c3250 445->459 460 7ffbfd5c350f-7ffbfd5c3535 call 7ffbfd5ea940 445->460 451 7ffbfd5c3010-7ffbfd5c3013 446->451 452 7ffbfd5c3152-7ffbfd5c316f 447->452 453 7ffbfd5c3120-7ffbfd5c3150 448->453 456 7ffbfd5c327a-7ffbfd5c328a 451->456 457 7ffbfd5c3019-7ffbfd5c3020 451->457 454 7ffbfd5c3170-7ffbfd5c3177 452->454 453->452 453->453 454->443 458 7ffbfd5c3179-7ffbfd5c3188 454->458 461 7ffbfd5c3293-7ffbfd5c3380 call 7ffbfd5e0bd0 memset 456->461 462 7ffbfd5c328c 456->462 457->434 457->451 458->443 458->454 459->391 465 7ffbfd5c3252-7ffbfd5c325e call 7ffbfd5c71a0 459->465 460->427 468 7ffbfd5c3386-7ffbfd5c3398 461->468 469 7ffbfd5c343a-7ffbfd5c3454 OutputDebugStringW 461->469 462->461 465->391 470 7ffbfd5c33a4-7ffbfd5c33c7 468->470 471 7ffbfd5c339a-7ffbfd5c33a2 468->471 472 7ffbfd5c3456-7ffbfd5c3462 call 7ffbfd5c71a0 469->472 473 7ffbfd5c3467-7ffbfd5c3484 469->473 475 7ffbfd5c33d0-7ffbfd5c3400 470->475 474 7ffbfd5c3402-7ffbfd5c341f 471->474 472->473 473->391 477 7ffbfd5c3420-7ffbfd5c3427 474->477 475->474 475->475 477->469 478 7ffbfd5c3429-7ffbfd5c3438 477->478 478->469 478->477
                                              APIs
                                              Strings
                                              • , xrefs: 00007FFBFD5C2A5E
                                              • a Display implementation returned an error unexpectedly/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\alloc\src\string.rs, xrefs: 00007FFBFD5C351B
                                              Memory Dump Source
                                              • Source File: 00000003.00000002.3729735948.00007FFBFD5B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFBFD5B0000, based on PE: true
                                              • Associated: 00000003.00000002.3728901617.00007FFBFD5B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3731019737.00007FFBFD5EB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3731947127.00007FFBFD5FF000.00000004.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3732770229.00007FFBFD600000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_3_2_7ffbfd5b0000_cmd.jbxd
                                              Similarity
                                              • API ID: memcpy$DebugOutputStringmemset
                                              • String ID: $a Display implementation returned an error unexpectedly/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\alloc\src\string.rs
                                              • API String ID: 4201822616-2898851051
                                              • Opcode ID: 3f1b29377df0228047eaae6ea7b2af8af4d9fff8547539b7815188e41c1e116a
                                              • Instruction ID: c9d835fd9cdaa81b3dbb49eab99b5a38c9c1a71473bde45a6fc8d3c1621a5963
                                              • Opcode Fuzzy Hash: 3f1b29377df0228047eaae6ea7b2af8af4d9fff8547539b7815188e41c1e116a
                                              • Instruction Fuzzy Hash: 3E528D62A15BC688EB319F70E8407EA3364FB49788F805135DE5D5BBCAEF799245C380
                                              Function 00007FFBFD5C1E30 Relevance: 25.0, APIs: 13, Strings: 1, Instructions: 525COMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 479 7ffbfd5c1e30-7ffbfd5c1fb0 call 7ffbfd5e0bd0 memset 482 7ffbfd5c1fb6-7ffbfd5c1fc8 479->482 483 7ffbfd5c206a-7ffbfd5c208b OutputDebugStringW 479->483 484 7ffbfd5c1fd4-7ffbfd5c1ff7 482->484 485 7ffbfd5c1fca-7ffbfd5c1fd2 482->485 486 7ffbfd5c208d-7ffbfd5c2096 call 7ffbfd5c71a0 483->486 487 7ffbfd5c209b-7ffbfd5c20a3 483->487 489 7ffbfd5c2000-7ffbfd5c2030 484->489 488 7ffbfd5c2032-7ffbfd5c204f 485->488 486->487 491 7ffbfd5c20a5-7ffbfd5c20ad 487->491 492 7ffbfd5c20ea-7ffbfd5c2103 call 7ffbfd5c7190 487->492 494 7ffbfd5c2050-7ffbfd5c2057 488->494 489->488 489->489 491->492 495 7ffbfd5c20af-7ffbfd5c20c9 491->495 500 7ffbfd5c2109-7ffbfd5c214a 492->500 501 7ffbfd5c27db-7ffbfd5c27e5 call 7ffbfd5ea525 492->501 494->483 497 7ffbfd5c2059-7ffbfd5c2068 494->497 498 7ffbfd5c2162-7ffbfd5c21a8 call 7ffbfd5ce5c0 call 7ffbfd5c1b20 memcpy * 2 495->498 499 7ffbfd5c20cf-7ffbfd5c20d7 495->499 497->483 497->494 515 7ffbfd5c21ad-7ffbfd5c21d8 memcpy 498->515 503 7ffbfd5c20d9-7ffbfd5c20e5 call 7ffbfd5cb170 499->503 504 7ffbfd5c214f-7ffbfd5c215c call 7ffbfd5e93e0 499->504 505 7ffbfd5c27c4-7ffbfd5c27da 500->505 512 7ffbfd5c27ea 501->512 503->515 504->498 504->503 514 7ffbfd5c27ec-7ffbfd5c27fe call 7ffbfd5ea525 512->514 522 7ffbfd5c2863-7ffbfd5c289d 514->522 515->512 518 7ffbfd5c21de 515->518 520 7ffbfd5c21e4-7ffbfd5c2200 call 7ffbfd5c71c0 518->520 521 7ffbfd5c2800-7ffbfd5c2816 518->521 520->514 529 7ffbfd5c2206-7ffbfd5c2226 520->529 523 7ffbfd5c281d-7ffbfd5c2836 call 7ffbfd5eaa40 521->523 527 7ffbfd5c28b1-7ffbfd5c28ca 522->527 528 7ffbfd5c289f-7ffbfd5c28ac call 7ffbfd5c71a0 522->528 523->522 528->527 529->523 532 7ffbfd5c222c-7ffbfd5c2271 memcpy * 2 529->532 533 7ffbfd5c2273-7ffbfd5c227d 532->533 534 7ffbfd5c2282-7ffbfd5c2378 memcpy memset call 7ffbfd5c6b30 call 7ffbfd5c6c30 532->534 535 7ffbfd5c249f-7ffbfd5c254e call 7ffbfd5e0bd0 memset 533->535 534->535 546 7ffbfd5c237e-7ffbfd5c238d 534->546 541 7ffbfd5c2554-7ffbfd5c2566 535->541 542 7ffbfd5c260a-7ffbfd5c2624 OutputDebugStringW 535->542 544 7ffbfd5c2568-7ffbfd5c2570 541->544 545 7ffbfd5c2572-7ffbfd5c2595 541->545 547 7ffbfd5c2626-7ffbfd5c2632 call 7ffbfd5c71a0 542->547 548 7ffbfd5c2637-7ffbfd5c26aa call 7ffbfd5ceb50 542->548 549 7ffbfd5c25d2-7ffbfd5c25e3 544->549 550 7ffbfd5c25a0-7ffbfd5c25d0 545->550 551 7ffbfd5c2396-7ffbfd5c2474 call 7ffbfd5e0bd0 memset 546->551 552 7ffbfd5c238f 546->552 547->548 558 7ffbfd5c2838-7ffbfd5c285e call 7ffbfd5ea940 548->558 559 7ffbfd5c26b0-7ffbfd5c26de call 7ffbfd5c71a0 548->559 555 7ffbfd5c25f0-7ffbfd5c25f7 549->555 550->549 550->550 564 7ffbfd5c277a-7ffbfd5c2794 OutputDebugStringW 551->564 565 7ffbfd5c247a-7ffbfd5c248c 551->565 552->551 555->542 560 7ffbfd5c25f9-7ffbfd5c2608 555->560 558->522 559->505 560->542 560->555 567 7ffbfd5c2796-7ffbfd5c27a2 call 7ffbfd5c71a0 564->567 568 7ffbfd5c27a7-7ffbfd5c27bd 564->568 569 7ffbfd5c26e3-7ffbfd5c2706 565->569 570 7ffbfd5c2492-7ffbfd5c249a 565->570 567->568 568->505 572 7ffbfd5c2710-7ffbfd5c2740 569->572 571 7ffbfd5c2742-7ffbfd5c275f 570->571 574 7ffbfd5c2760-7ffbfd5c2767 571->574 572->571 572->572 574->564 575 7ffbfd5c2769-7ffbfd5c2778 574->575 575->564 575->574
                                              APIs
                                              Strings
                                              • a Display implementation returned an error unexpectedly/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\alloc\src\string.rs, xrefs: 00007FFBFD5C2844
                                              Memory Dump Source
                                              • Source File: 00000003.00000002.3729735948.00007FFBFD5B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFBFD5B0000, based on PE: true
                                              • Associated: 00000003.00000002.3728901617.00007FFBFD5B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3731019737.00007FFBFD5EB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3731947127.00007FFBFD5FF000.00000004.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3732770229.00007FFBFD600000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_3_2_7ffbfd5b0000_cmd.jbxd
                                              Similarity
                                              • API ID: memcpy$memset$DebugOutputString
                                              • String ID: a Display implementation returned an error unexpectedly/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\alloc\src\string.rs
                                              • API String ID: 4266836622-2804265448
                                              • Opcode ID: 59533ceab819cd49980441fe64c45bad8d5f07d82b8996023592119642a4b9a8
                                              • Instruction ID: 98fbafba821f58be3607c08966d444b8976f751f13eb8ba9f86e721d1c198127
                                              • Opcode Fuzzy Hash: 59533ceab819cd49980441fe64c45bad8d5f07d82b8996023592119642a4b9a8
                                              • Instruction Fuzzy Hash: 13426062A19BC189EB718F70D8507E93364FB59788F804235DE9D0BB8AEF799344C381
                                              Function 00007FFBFD5B7480 Relevance: 19.8, APIs: 6, Strings: 5, Instructions: 512COMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 576 7ffbfd5b7480-7ffbfd5b74cb 577 7ffbfd5b7c83-7ffbfd5b7cc1 call 7ffbfd5e98d0 576->577 578 7ffbfd5b74d1-7ffbfd5b74e1 576->578 580 7ffbfd5b7cc6-7ffbfd5b7cce call 7ffbfd5e9800 577->580 578->580 581 7ffbfd5b74e7-7ffbfd5b74f7 578->581 583 7ffbfd5b7cd3-7ffbfd5b7ce1 call 7ffbfd5e9780 580->583 581->583 584 7ffbfd5b74fd-7ffbfd5b7506 581->584 586 7ffbfd5b7ce7-7ffbfd5b7d16 call 7ffbfd5ea940 583->586 587 7ffbfd5b750c-7ffbfd5b751e 583->587 584->586 584->587 597 7ffbfd5b7d18-7ffbfd5b7d26 call 7ffbfd5e98c0 586->597 591 7ffbfd5b7524-7ffbfd5b7669 587->591 592 7ffbfd5b77d7-7ffbfd5b7871 call 7ffbfd5e0bd0 memset 587->592 596 7ffbfd5b766d-7ffbfd5b7685 591->596 602 7ffbfd5b79ea-7ffbfd5b79fe OutputDebugStringW 592->602 603 7ffbfd5b7877-7ffbfd5b7889 592->603 599 7ffbfd5b76ba-7ffbfd5b76c6 596->599 600 7ffbfd5b7687 596->600 615 7ffbfd5b7c65-7ffbfd5b7c82 597->615 599->592 605 7ffbfd5b76cc-7ffbfd5b76d7 599->605 604 7ffbfd5b7690-7ffbfd5b76ab 600->604 609 7ffbfd5b7a11-7ffbfd5b7a32 602->609 610 7ffbfd5b7a00-7ffbfd5b7a0c call 7ffbfd5c71a0 602->610 607 7ffbfd5b795e-7ffbfd5b798f 603->607 608 7ffbfd5b788f-7ffbfd5b7897 603->608 611 7ffbfd5b76d9-7ffbfd5b77ac call 7ffbfd5e0bd0 memset 604->611 612 7ffbfd5b76ad-7ffbfd5b76b8 604->612 605->596 614 7ffbfd5b7990-7ffbfd5b79ba 607->614 616 7ffbfd5b79bc-7ffbfd5b79cd 608->616 618 7ffbfd5b7a42-7ffbfd5b7a46 609->618 610->609 625 7ffbfd5b791a-7ffbfd5b792e OutputDebugStringW 611->625 626 7ffbfd5b77b2-7ffbfd5b77c4 611->626 612->599 612->604 614->614 614->616 620 7ffbfd5b79d0-7ffbfd5b79d7 616->620 621 7ffbfd5b7c2d-7ffbfd5b7c40 618->621 622 7ffbfd5b7a4c-7ffbfd5b7a4f 618->622 620->602 627 7ffbfd5b79d9-7ffbfd5b79e8 620->627 623 7ffbfd5b7c58-7ffbfd5b7c5f 621->623 624 7ffbfd5b7c42-7ffbfd5b7c52 621->624 628 7ffbfd5b7a51-7ffbfd5b7a56 622->628 629 7ffbfd5b7a60-7ffbfd5b7a7a 622->629 623->597 623->615 624->623 632 7ffbfd5b7d2b-7ffbfd5b7d38 call 7ffbfd5e9780 624->632 635 7ffbfd5b7941-7ffbfd5b7953 625->635 636 7ffbfd5b7930-7ffbfd5b793c call 7ffbfd5c71a0 625->636 633 7ffbfd5b77ca-7ffbfd5b77d2 626->633 634 7ffbfd5b789c-7ffbfd5b78bf 626->634 627->602 627->620 630 7ffbfd5b7a89-7ffbfd5b7b59 call 7ffbfd5e0bd0 memset 628->630 629->629 631 7ffbfd5b7a7c-7ffbfd5b7a87 629->631 646 7ffbfd5b7bfa-7ffbfd5b7c11 OutputDebugStringW 630->646 647 7ffbfd5b7b5f-7ffbfd5b7b71 630->647 631->630 632->623 648 7ffbfd5b7d3e-7ffbfd5b7d43 632->648 640 7ffbfd5b78ec-7ffbfd5b78fd 633->640 642 7ffbfd5b78c0-7ffbfd5b78ea 634->642 635->624 638 7ffbfd5b7959 635->638 636->635 638->623 645 7ffbfd5b7900-7ffbfd5b7907 640->645 642->640 642->642 645->625 649 7ffbfd5b7909-7ffbfd5b7918 645->649 652 7ffbfd5b7c17-7ffbfd5b7c28 call 7ffbfd5c71a0 646->652 653 7ffbfd5b7a40 646->653 650 7ffbfd5b7b73-7ffbfd5b7b7b 647->650 651 7ffbfd5b7b80-7ffbfd5b7b9f 647->651 648->623 649->625 649->645 654 7ffbfd5b7bcc-7ffbfd5b7bdd 650->654 655 7ffbfd5b7ba0-7ffbfd5b7bca 651->655 652->653 653->618 657 7ffbfd5b7be0-7ffbfd5b7be7 654->657 655->654 655->655 657->646 659 7ffbfd5b7be9-7ffbfd5b7bf8 657->659 659->646 659->657
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000003.00000002.3729735948.00007FFBFD5B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFBFD5B0000, based on PE: true
                                              • Associated: 00000003.00000002.3728901617.00007FFBFD5B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3731019737.00007FFBFD5EB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3731947127.00007FFBFD5FF000.00000004.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3732770229.00007FFBFD600000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_3_2_7ffbfd5b0000_cmd.jbxd
                                              Similarity
                                              • API ID: DebugOutputStringmemset
                                              • String ID: arenegyl$called `Result::unwrap()` on an `Err` value$modnarod$setybdet$uespemos
                                              • API String ID: 1084755268-2410307170
                                              • Opcode ID: 47b1002425d6aa6c5ac160118d23398c3d78d00c4aac2b45fc09c008eaf78720
                                              • Instruction ID: 58738387b4129f6d587df49d419bac8b00f339ccb4cbd91ef8699e59d6655683
                                              • Opcode Fuzzy Hash: 47b1002425d6aa6c5ac160118d23398c3d78d00c4aac2b45fc09c008eaf78720
                                              • Instruction Fuzzy Hash: FE22B1A2A14B9145EB218FB4D8547E93361FB19798F808336DE2D5BBE5EF38D245C380
                                              Function 00007FFBFD5B4E40 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 295stringCOMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 660 7ffbfd5b4e40-7ffbfd5b4e5d 661 7ffbfd5b4e63-7ffbfd5b4e78 660->661 662 7ffbfd5b4f01-7ffbfd5b4f4a memset 660->662 663 7ffbfd5b4e7e-7ffbfd5b4e89 661->663 664 7ffbfd5b4f4f 661->664 665 7ffbfd5b52fc-7ffbfd5b5304 OutputDebugStringW 662->665 667 7ffbfd5b4f54-7ffbfd5b500f call 7ffbfd5e0bd0 memset 663->667 668 7ffbfd5b4e8f-7ffbfd5b4efc memset 663->668 664->667 666 7ffbfd5b530a-7ffbfd5b5323 665->666 671 7ffbfd5b5015-7ffbfd5b5027 667->671 672 7ffbfd5b50ca-7ffbfd5b50ea OutputDebugStringW 667->672 668->665 673 7ffbfd5b5033-7ffbfd5b5056 671->673 674 7ffbfd5b5029-7ffbfd5b5031 671->674 675 7ffbfd5b50fa-7ffbfd5b5101 672->675 676 7ffbfd5b50ec-7ffbfd5b50f5 call 7ffbfd5c71a0 672->676 678 7ffbfd5b5060-7ffbfd5b5090 673->678 677 7ffbfd5b5092-7ffbfd5b50af 674->677 680 7ffbfd5b5107-7ffbfd5b5128 675->680 681 7ffbfd5b5298-7ffbfd5b52f3 memset 675->681 676->675 682 7ffbfd5b50b0-7ffbfd5b50b7 677->682 678->677 678->678 683 7ffbfd5b513c-7ffbfd5b5192 strlen call 7ffbfd5e2070 680->683 681->665 682->672 684 7ffbfd5b50b9-7ffbfd5b50c8 682->684 687 7ffbfd5b5194-7ffbfd5b51a3 memcmp 683->687 688 7ffbfd5b5130-7ffbfd5b5136 683->688 684->672 684->682 687->688 689 7ffbfd5b51a5-7ffbfd5b526d call 7ffbfd5e0bd0 memset 687->689 688->681 688->683 692 7ffbfd5b5273-7ffbfd5b5285 689->692 693 7ffbfd5b53ba-7ffbfd5b53da OutputDebugStringW 689->693 694 7ffbfd5b5324-7ffbfd5b5347 692->694 695 7ffbfd5b528b-7ffbfd5b5293 692->695 696 7ffbfd5b53ea-7ffbfd5b53f6 693->696 697 7ffbfd5b53dc-7ffbfd5b53e5 call 7ffbfd5c71a0 693->697 700 7ffbfd5b5350-7ffbfd5b5380 694->700 699 7ffbfd5b5382-7ffbfd5b539f 695->699 696->666 697->696 701 7ffbfd5b53a0-7ffbfd5b53a7 699->701 700->699 700->700 701->693 702 7ffbfd5b53a9-7ffbfd5b53b8 701->702 702->693 702->701
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000003.00000002.3729735948.00007FFBFD5B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFBFD5B0000, based on PE: true
                                              • Associated: 00000003.00000002.3728901617.00007FFBFD5B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3731019737.00007FFBFD5EB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3731947127.00007FFBFD5FF000.00000004.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3732770229.00007FFBFD600000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_3_2_7ffbfd5b0000_cmd.jbxd
                                              Similarity
                                              • API ID: DebugOutputStringmemset$memcmpstrlen
                                              • String ID: c
                                              • API String ID: 2294051181-112844655
                                              • Opcode ID: 9670e1c11f532cf529f2240a26eed1613fd94ce408e5a2dbbda432817b9d7a2d
                                              • Instruction ID: 2c653851f9d7ec016681e915e5c9abd7bb70b82c38e62c7d32c646c1814496f3
                                              • Opcode Fuzzy Hash: 9670e1c11f532cf529f2240a26eed1613fd94ce408e5a2dbbda432817b9d7a2d
                                              • Instruction Fuzzy Hash: 3AE1A162A18BC585EB218B64E4417FAB3A1FB89784F444235DE9D03B96FF7CD185CB80
                                              Function 00007FFBFD5B21C0 Relevance: 17.9, APIs: 5, Strings: 5, Instructions: 433COMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 703 7ffbfd5b21c0-7ffbfd5b2204 704 7ffbfd5b220a-7ffbfd5b2219 703->704 705 7ffbfd5b281c-7ffbfd5b2869 call 7ffbfd5e98d0 703->705 706 7ffbfd5b286f-7ffbfd5b287e call 7ffbfd5e9af0 704->706 707 7ffbfd5b221f-7ffbfd5b2227 704->707 705->706 705->707 712 7ffbfd5b2884-7ffbfd5b28b8 call 7ffbfd5ea940 706->712 713 7ffbfd5b223a-7ffbfd5b2246 706->713 707->706 709 7ffbfd5b222d-7ffbfd5b2234 707->709 709->712 709->713 721 7ffbfd5b28d5-7ffbfd5b2912 712->721 715 7ffbfd5b255b-7ffbfd5b25f5 call 7ffbfd5e0bd0 memset 713->715 716 7ffbfd5b224c-7ffbfd5b2390 713->716 728 7ffbfd5b27ba-7ffbfd5b27ce OutputDebugStringW 715->728 729 7ffbfd5b25fb-7ffbfd5b260d 715->729 720 7ffbfd5b2394-7ffbfd5b23ac 716->720 723 7ffbfd5b23da-7ffbfd5b23e6 720->723 724 7ffbfd5b23ae 720->724 726 7ffbfd5b2923-7ffbfd5b2928 call 7ffbfd5e9d50 721->726 727 7ffbfd5b2914-7ffbfd5b2922 721->727 723->715 725 7ffbfd5b23ec-7ffbfd5b23f7 723->725 730 7ffbfd5b23b0-7ffbfd5b23cb 724->730 725->720 726->727 733 7ffbfd5b27e1-7ffbfd5b27eb 728->733 734 7ffbfd5b27d0-7ffbfd5b27dc call 7ffbfd5c71a0 728->734 736 7ffbfd5b2613-7ffbfd5b261b 729->736 737 7ffbfd5b2737-7ffbfd5b275a 729->737 731 7ffbfd5b23f9-7ffbfd5b2530 call 7ffbfd5e0bd0 memset 730->731 732 7ffbfd5b23cd-7ffbfd5b23d8 730->732 750 7ffbfd5b2536-7ffbfd5b2548 731->750 751 7ffbfd5b26aa-7ffbfd5b26be OutputDebugStringW 731->751 732->723 732->730 740 7ffbfd5b27ee-7ffbfd5b2804 733->740 734->733 742 7ffbfd5b278c-7ffbfd5b279d 736->742 743 7ffbfd5b2760-7ffbfd5b278a 737->743 746 7ffbfd5b28ba-7ffbfd5b28c2 call 7ffbfd5e9d50 740->746 747 7ffbfd5b280a-7ffbfd5b281b 740->747 744 7ffbfd5b27a0-7ffbfd5b27a7 742->744 743->742 743->743 744->728 748 7ffbfd5b27a9-7ffbfd5b27b8 744->748 746->747 748->728 748->744 755 7ffbfd5b254e-7ffbfd5b2556 750->755 756 7ffbfd5b2620-7ffbfd5b2643 750->756 753 7ffbfd5b26d1-7ffbfd5b26df 751->753 754 7ffbfd5b26c0-7ffbfd5b26cc call 7ffbfd5c71a0 751->754 758 7ffbfd5b26e5-7ffbfd5b26e9 753->758 759 7ffbfd5b28c7 753->759 754->753 760 7ffbfd5b267c-7ffbfd5b268d 755->760 761 7ffbfd5b2650-7ffbfd5b267a 756->761 764 7ffbfd5b2713 758->764 765 7ffbfd5b26eb-7ffbfd5b2708 call 7ffbfd5c7190 758->765 763 7ffbfd5b28ca-7ffbfd5b28d0 call 7ffbfd5ea525 759->763 762 7ffbfd5b2690-7ffbfd5b2697 760->762 761->760 761->761 762->751 766 7ffbfd5b2699-7ffbfd5b26a8 762->766 763->721 769 7ffbfd5b2719-7ffbfd5b2732 memcpy 764->769 765->763 771 7ffbfd5b270e-7ffbfd5b2711 765->771 766->751 766->762 769->740 771->769
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000003.00000002.3729735948.00007FFBFD5B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFBFD5B0000, based on PE: true
                                              • Associated: 00000003.00000002.3728901617.00007FFBFD5B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3731019737.00007FFBFD5EB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3731947127.00007FFBFD5FF000.00000004.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3732770229.00007FFBFD600000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_3_2_7ffbfd5b0000_cmd.jbxd
                                              Similarity
                                              • API ID: DebugOutputStringmemset$memcpy
                                              • String ID: arenegyl$called `Result::unwrap()` on an `Err` value$modnarod$setybdet$uespemos
                                              • API String ID: 293864031-2410307170
                                              • Opcode ID: 7045e56c2492ea5ea10e38f19944d04163f1eadbf4809d59d1580a441f1ae846
                                              • Instruction ID: 69c2ba38c1d0d196d716df3034328e9c9b5870b17bae5008e8e998bebb7f8ae8
                                              • Opcode Fuzzy Hash: 7045e56c2492ea5ea10e38f19944d04163f1eadbf4809d59d1580a441f1ae846
                                              • Instruction Fuzzy Hash: 4102C4B2A15B8149EB21DFB1D8547ED2361FB09798F408236DE2D5BBD9EF389245C380
                                              Function 00007FFBFD5B1350 Relevance: 14.6, APIs: 2, Strings: 6, Instructions: 569COMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 772 7ffbfd5b1350-7ffbfd5b13b1 773 7ffbfd5b13b7-7ffbfd5b13c9 772->773 774 7ffbfd5b1f58-7ffbfd5b1f96 call 7ffbfd5e98d0 772->774 775 7ffbfd5b1f9b-7ffbfd5b1fa3 call 7ffbfd5e9c20 773->775 776 7ffbfd5b13cf-7ffbfd5b13df 773->776 774->775 780 7ffbfd5b1fa8-7ffbfd5b1fb5 call 7ffbfd5e9780 775->780 779 7ffbfd5b13e5-7ffbfd5b13ed 776->779 776->780 783 7ffbfd5b13f3-7ffbfd5b1419 call 7ffbfd5c7190 779->783 784 7ffbfd5b1fbb-7ffbfd5b1fea call 7ffbfd5ea940 779->784 780->783 780->784 791 7ffbfd5b2057-7ffbfd5b2061 call 7ffbfd5ea53f 783->791 792 7ffbfd5b141f-7ffbfd5b1be4 783->792 793 7ffbfd5b2066-7ffbfd5b20b3 call 7ffbfd5c59c0 784->793 791->793 795 7ffbfd5b1bfb-7ffbfd5b1c02 792->795 797 7ffbfd5b1ee9-7ffbfd5b1f0a call 7ffbfd5c71a0 795->797 798 7ffbfd5b1c08-7ffbfd5b1c56 call 7ffbfd5c1e30 795->798 804 7ffbfd5b1f0c-7ffbfd5b1f1c 797->804 805 7ffbfd5b1f22-7ffbfd5b1f37 797->805 806 7ffbfd5b1c5c-7ffbfd5b1c6a 798->806 807 7ffbfd5b200f-7ffbfd5b2055 call 7ffbfd5ea940 798->807 804->805 809 7ffbfd5b1ff9-7ffbfd5b2000 call 7ffbfd5e9780 804->809 810 7ffbfd5b1f3d-7ffbfd5b1f57 805->810 811 7ffbfd5b1fec-7ffbfd5b1ff4 call 7ffbfd5e9d50 805->811 812 7ffbfd5b1d24-7ffbfd5b1d56 call 7ffbfd5c04b0 806->812 813 7ffbfd5b1c70-7ffbfd5b1c77 806->813 807->793 809->805 825 7ffbfd5b2006-7ffbfd5b200a 809->825 811->810 827 7ffbfd5b1d58 812->827 828 7ffbfd5b1d6c-7ffbfd5b1e12 call 7ffbfd5e0bd0 memset 812->828 817 7ffbfd5b1cf9-7ffbfd5b1d00 813->817 818 7ffbfd5b1c7d-7ffbfd5b1c8a 813->818 817->812 820 7ffbfd5b1d02-7ffbfd5b1d05 817->820 823 7ffbfd5b1c90-7ffbfd5b1cf7 818->823 826 7ffbfd5b1d10-7ffbfd5b1d22 820->826 823->817 823->823 825->805 826->812 826->826 827->828 829 7ffbfd5b1d5a-7ffbfd5b1d67 call 7ffbfd5c71a0 827->829 833 7ffbfd5b1eba-7ffbfd5b1ecd OutputDebugStringW 828->833 834 7ffbfd5b1e18-7ffbfd5b1e2a 828->834 829->828 835 7ffbfd5b1ed3-7ffbfd5b1ee4 call 7ffbfd5c71a0 833->835 836 7ffbfd5b1bf0-7ffbfd5b1bf4 833->836 837 7ffbfd5b1e2c-7ffbfd5b1e34 834->837 838 7ffbfd5b1e40-7ffbfd5b1e5f 834->838 835->836 836->795 840 7ffbfd5b1e8c-7ffbfd5b1e9d 837->840 841 7ffbfd5b1e60-7ffbfd5b1e8a 838->841 842 7ffbfd5b1ea0-7ffbfd5b1ea7 840->842 841->840 841->841 842->833 844 7ffbfd5b1ea9-7ffbfd5b1eb8 842->844 844->833 844->842
                                              APIs
                                              Strings
                                              • RtlCaptureStackBackTraceLoadLibraryAGetProcAddressLdrGetDllHandleByMappingLdrRegisterDllNotificationVirtualAllocExVirtualFreeExNtCreateSectionFailed to encrypt function name, xrefs: 00007FFBFD5B1B0B
                                              • called `Result::unwrap()` on an `Err` value, xrefs: 00007FFBFD5B1FCE
                                              • FindFirstFileWFindNextFileWNtQueryDirectoryFileRegQueryValueExWNtEnumerateKeyGetAsyncKeyStateSetWindowsHookExWLogonUserWCredEnumerateWCreateProcessWNtQueryInformationProcessVirtualQueryExGetProcessIdNtOpenProcessNtWriteVirtualMemoryNtReadVirtualMemoryLoadLibra, xrefs: 00007FFBFD5B1962
                                              • NtProtectVirtualMemoryNtAllocateVirtualMemoryNtMapViewOfSectionNtUnmapViewOfSectionNtOpenFileLdrLoadDllEtwEventWriteFullEtwEventWriteEtwEventWriteTransferWDEnableMpWDEnableMpScanStartMpSampleSubmitMpAmsiNotifyMpSampleQueryMpAmsiScanMpThreatActionNtResumeThread, xrefs: 00007FFBFD5B1434
                                              • Thread32NextVirtualFreeWaitForSingleObjectTerminateThreadSuspendThreadResumeThreadIsWow64ProcessModule32FirstWModule32NextWGetCurrentProcessIdProcess32FirstWProcess32NextWZwOpenKeyZwCreateKeyZwSetValueKeyZwCloseCreateRemoteThreadNtQuerySystemInformationEnumPro, xrefs: 00007FFBFD5B1787
                                              • NtGetContextThreadNtSetContextThreadNtCloseNtCreateThreadExNtCreateProcessExNtQueryInformationThreadGetProcessIdOfThreadWriteProcessMemoryReadProcessMemoryOpenProcessVirtualProtectExCloseHandleVirtualAllocVirtualProtectOpenThreadCreateToolhelp32SnapshotThread3, xrefs: 00007FFBFD5B15CC
                                              Memory Dump Source
                                              • Source File: 00000003.00000002.3729735948.00007FFBFD5B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFBFD5B0000, based on PE: true
                                              • Associated: 00000003.00000002.3728901617.00007FFBFD5B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3731019737.00007FFBFD5EB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3731947127.00007FFBFD5FF000.00000004.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3732770229.00007FFBFD600000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_3_2_7ffbfd5b0000_cmd.jbxd
                                              Similarity
                                              • API ID: DebugOutputStringmemset
                                              • String ID: FindFirstFileWFindNextFileWNtQueryDirectoryFileRegQueryValueExWNtEnumerateKeyGetAsyncKeyStateSetWindowsHookExWLogonUserWCredEnumerateWCreateProcessWNtQueryInformationProcessVirtualQueryExGetProcessIdNtOpenProcessNtWriteVirtualMemoryNtReadVirtualMemoryLoadLibra$NtGetContextThreadNtSetContextThreadNtCloseNtCreateThreadExNtCreateProcessExNtQueryInformationThreadGetProcessIdOfThreadWriteProcessMemoryReadProcessMemoryOpenProcessVirtualProtectExCloseHandleVirtualAllocVirtualProtectOpenThreadCreateToolhelp32SnapshotThread3$NtProtectVirtualMemoryNtAllocateVirtualMemoryNtMapViewOfSectionNtUnmapViewOfSectionNtOpenFileLdrLoadDllEtwEventWriteFullEtwEventWriteEtwEventWriteTransferWDEnableMpWDEnableMpScanStartMpSampleSubmitMpAmsiNotifyMpSampleQueryMpAmsiScanMpThreatActionNtResumeThread$RtlCaptureStackBackTraceLoadLibraryAGetProcAddressLdrGetDllHandleByMappingLdrRegisterDllNotificationVirtualAllocExVirtualFreeExNtCreateSectionFailed to encrypt function name$Thread32NextVirtualFreeWaitForSingleObjectTerminateThreadSuspendThreadResumeThreadIsWow64ProcessModule32FirstWModule32NextWGetCurrentProcessIdProcess32FirstWProcess32NextWZwOpenKeyZwCreateKeyZwSetValueKeyZwCloseCreateRemoteThreadNtQuerySystemInformationEnumPro$called `Result::unwrap()` on an `Err` value
                                              • API String ID: 1084755268-765071994
                                              • Opcode ID: 81d56a0d810f2922b958ef61a649dc97d2d0553e2a685df67d55acace2363f78
                                              • Instruction ID: 3121d419b2b5aafa0ec364c27ef2a2e99117af4e468792b92b251a51c0fd7ed0
                                              • Opcode Fuzzy Hash: 81d56a0d810f2922b958ef61a649dc97d2d0553e2a685df67d55acace2363f78
                                              • Instruction Fuzzy Hash: A4720D77505F919AE791DB60E8847E933E8F708349F904239CE9C477A5EF789268C382
                                              Function 00007FFBFD5B2990 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 218COMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000003.00000002.3729735948.00007FFBFD5B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFBFD5B0000, based on PE: true
                                              • Associated: 00000003.00000002.3728901617.00007FFBFD5B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3731019737.00007FFBFD5EB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3731947127.00007FFBFD5FF000.00000004.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3732770229.00007FFBFD600000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_3_2_7ffbfd5b0000_cmd.jbxd
                                              Similarity
                                              • API ID: DebugOutputStringmemset
                                              • String ID: Failed to encrypt function name
                                              • API String ID: 1084755268-2980051713
                                              • Opcode ID: 621937c177565e70e3370e9c94ad4b3e69633e88e3bf2871e650a3a5fe73ae47
                                              • Instruction ID: 356e8cfb9330d7177ce8626c797c7c765c8616fd67bddd81ef9e2982e385efa3
                                              • Opcode Fuzzy Hash: 621937c177565e70e3370e9c94ad4b3e69633e88e3bf2871e650a3a5fe73ae47
                                              • Instruction Fuzzy Hash: 3CA190B2A14BD588EB318FB4E8457E86760FB59758F444239CE6C17BD6EF788294C380
                                              Function 00007FFBFD5C3920 Relevance: 3.1, APIs: 2, Instructions: 65COMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 880 7ffbfd5c3920-7ffbfd5c3954 memset 881 7ffbfd5c39fa-7ffbfd5c3a16 OutputDebugStringW 880->881 882 7ffbfd5c395a-7ffbfd5c396c 880->882 883 7ffbfd5c3978-7ffbfd5c399b 882->883 884 7ffbfd5c396e-7ffbfd5c3976 882->884 886 7ffbfd5c39a0-7ffbfd5c39ca 883->886 885 7ffbfd5c39cc-7ffbfd5c39da 884->885 887 7ffbfd5c39e0-7ffbfd5c39e7 885->887 886->885 886->886 887->881 888 7ffbfd5c39e9-7ffbfd5c39f8 887->888 888->881 888->887
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000003.00000002.3729735948.00007FFBFD5B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFBFD5B0000, based on PE: true
                                              • Associated: 00000003.00000002.3728901617.00007FFBFD5B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3731019737.00007FFBFD5EB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3731947127.00007FFBFD5FF000.00000004.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3732770229.00007FFBFD600000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_3_2_7ffbfd5b0000_cmd.jbxd
                                              Similarity
                                              • API ID: DebugOutputStringmemset
                                              • String ID:
                                              • API String ID: 1084755268-0
                                              • Opcode ID: 59dad3f4ad8b939d3a9dede857d016f1f650e7aafe7098f9e5917a612a7466d8
                                              • Instruction ID: f37f20c8b0ae7feff806c92b8a44d45e2783af01341639eeb84e8c30ee30c439
                                              • Opcode Fuzzy Hash: 59dad3f4ad8b939d3a9dede857d016f1f650e7aafe7098f9e5917a612a7466d8
                                              • Instruction Fuzzy Hash: 8B216A52F2869941FB209B74E100BB99220DB9A7C4F909331DE5E13FC6FE2CC2818700

                                              Non-executed Functions

                                              Function 0000018B3C400CA0 Relevance: 42.7, APIs: 23, Strings: 1, Instructions: 711COMMON
                                              Download Yara Rule

                                              Control-flow Graph

                                              • Executed
                                              • Not Executed
                                              control_flow_graph 2320 18b3c400ca0-18b3c400cdf 2321 18b3c400cf3-18b3c400cf9 2320->2321 2322 18b3c400cff-18b3c400d48 call 18b3c407250 call 18b3c407230 LsaOpenPolicy 2321->2322 2323 18b3c401938-18b3c401952 2321->2323 2328 18b3c400d80-18b3c400da9 call 18b3c407230 GetCurrentProcess OpenProcessToken 2322->2328 2329 18b3c400d4a-18b3c400d52 2322->2329 2335 18b3c400daf-18b3c400dc8 call 18b3c4071c0 2328->2335 2336 18b3c400f03-18b3c400f17 call 18b3c407550 2328->2336 2330 18b3c400d59-18b3c400d67 call 18b3c407b50 call 18b3c407810 2329->2330 2343 18b3c400d6d 2330->2343 2344 18b3c400fd7-18b3c401091 call 18b3c420bd0 memset 2330->2344 2346 18b3c400dce-18b3c400e0b GetTokenInformation 2335->2346 2347 18b3c401953-18b3c4019be call 18b3c42a525 call 18b3c4071a0 2335->2347 2336->2335 2345 18b3c400f1d-18b3c400f20 2336->2345 2349 18b3c4011c0-18b3c401251 call 18b3c420bd0 memset 2343->2349 2361 18b3c401097-18b3c4010a9 2344->2361 2362 18b3c40113a-18b3c40114d OutputDebugStringW 2344->2362 2350 18b3c400f2e-18b3c400f4a LsaClose 2345->2350 2351 18b3c400f22-18b3c400f29 call 18b3c408050 2345->2351 2352 18b3c400f4f-18b3c400f6a call 18b3c407550 2346->2352 2353 18b3c400e11-18b3c400ea4 call 18b3c405e40 LsaAddAccountRights LsaClose 2346->2353 2373 18b3c401257-18b3c401269 2349->2373 2374 18b3c4012fa-18b3c40130d OutputDebugStringW 2349->2374 2350->2330 2351->2350 2352->2353 2371 18b3c400f70-18b3c400f73 2352->2371 2367 18b3c40117f-18b3c401189 2353->2367 2368 18b3c400eaa-18b3c400ee3 call 18b3c407b50 call 18b3c407810 2353->2368 2369 18b3c4010ab-18b3c4010b3 2361->2369 2370 18b3c4010b5-18b3c4010d4 2361->2370 2375 18b3c40114f-18b3c40115b call 18b3c4071a0 2362->2375 2376 18b3c401160-18b3c401168 2362->2376 2387 18b3c40118b-18b3c401197 call 18b3c4071a0 2367->2387 2388 18b3c40119c-18b3c4011b3 call 18b3c4071a0 2367->2388 2415 18b3c400fb6-18b3c400fd1 call 18b3c4071a0 2368->2415 2416 18b3c400ee9-18b3c400efe call 18b3c4071a0 2368->2416 2378 18b3c40110c-18b3c40111d 2369->2378 2379 18b3c4010e0-18b3c40110a 2370->2379 2380 18b3c400f81-18b3c400faf LsaClose call 18b3c407b50 call 18b3c407810 2371->2380 2381 18b3c400f75-18b3c400f7c call 18b3c408050 2371->2381 2382 18b3c40126b-18b3c401273 2373->2382 2383 18b3c401275-18b3c401294 2373->2383 2389 18b3c40130f-18b3c40131b call 18b3c4071a0 2374->2389 2390 18b3c401320-18b3c401357 call 18b3c407230 GetCurrentProcess OpenProcessToken 2374->2390 2375->2376 2385 18b3c40116e-18b3c40117a call 18b3c408050 2376->2385 2386 18b3c400cf0 2376->2386 2400 18b3c401120-18b3c401127 2378->2400 2379->2378 2379->2379 2380->2415 2381->2380 2395 18b3c4012cc-18b3c4012dd 2382->2395 2396 18b3c4012a0-18b3c4012ca 2383->2396 2385->2386 2386->2321 2387->2388 2388->2349 2389->2390 2412 18b3c40135d-18b3c4013c0 call 18b3c406270 call 18b3c407240 LookupPrivilegeValueW 2390->2412 2413 18b3c4014da-18b3c4014e1 call 18b3c407550 2390->2413 2407 18b3c4012e0-18b3c4012e7 2395->2407 2396->2395 2396->2396 2400->2362 2405 18b3c401129-18b3c401138 2400->2405 2405->2362 2405->2400 2407->2374 2410 18b3c4012e9-18b3c4012f8 2407->2410 2410->2374 2410->2407 2431 18b3c4014ec-18b3c4014f3 call 18b3c407550 2412->2431 2432 18b3c4013c6-18b3c401405 AdjustTokenPrivileges 2412->2432 2423 18b3c4014e7 2413->2423 2424 18b3c40161a-18b3c4016d4 call 18b3c420bd0 memset 2413->2424 2415->2344 2415->2349 2416->2415 2423->2412 2433 18b3c40183a-18b3c40184d OutputDebugStringW 2424->2433 2434 18b3c4016da-18b3c4016ec 2424->2434 2447 18b3c4015e8-18b3c4015f2 2431->2447 2448 18b3c4014f9 2431->2448 2436 18b3c40140b-18b3c401419 GetLastError 2432->2436 2437 18b3c4014fe-18b3c401505 call 18b3c407550 2432->2437 2438 18b3c40184f-18b3c40185b call 18b3c4071a0 2433->2438 2439 18b3c401860-18b3c401868 2433->2439 2440 18b3c4017bb-18b3c4017da 2434->2440 2441 18b3c4016f2-18b3c4016fa 2434->2441 2444 18b3c40141f-18b3c4014b3 call 18b3c420bd0 memset 2436->2444 2445 18b3c401510-18b3c40151a 2436->2445 2437->2447 2459 18b3c40150b 2437->2459 2438->2439 2454 18b3c40186e-18b3c40187d call 18b3c408050 2439->2454 2455 18b3c401930-18b3c401933 2439->2455 2450 18b3c4017e0-18b3c40180a 2440->2450 2446 18b3c40180c-18b3c40181d 2441->2446 2470 18b3c4014b9-18b3c4014cb 2444->2470 2471 18b3c4015ba-18b3c4015cd OutputDebugStringW 2444->2471 2451 18b3c4016ff-18b3c401790 call 18b3c420bd0 memset 2445->2451 2452 18b3c401520-18b3c401531 call 18b3c4071a0 2445->2452 2463 18b3c401820-18b3c401827 2446->2463 2460 18b3c401612-18b3c401614 2447->2460 2461 18b3c4015f4-18b3c40160f call 18b3c4071a0 2447->2461 2448->2437 2450->2446 2450->2450 2474 18b3c401796-18b3c4017a8 2451->2474 2475 18b3c40190a-18b3c40191d OutputDebugStringW 2451->2475 2452->2451 2454->2321 2455->2321 2459->2436 2460->2424 2460->2451 2461->2460 2463->2433 2466 18b3c401829-18b3c401838 2463->2466 2466->2433 2466->2463 2477 18b3c4014cd-18b3c4014d5 2470->2477 2478 18b3c401536-18b3c401555 2470->2478 2472 18b3c4015cf-18b3c4015db call 18b3c4071a0 2471->2472 2473 18b3c4015e0-18b3c4015e5 call 18b3c407550 2471->2473 2472->2473 2473->2447 2480 18b3c4017ae-18b3c4017b6 2474->2480 2481 18b3c401882-18b3c4018a1 2474->2481 2475->2455 2485 18b3c40191f-18b3c40192b call 18b3c4071a0 2475->2485 2479 18b3c40158c-18b3c40159d 2477->2479 2482 18b3c401560-18b3c40158a 2478->2482 2486 18b3c4015a0-18b3c4015a7 2479->2486 2488 18b3c4018dc-18b3c4018ed 2480->2488 2487 18b3c4018b0-18b3c4018da 2481->2487 2482->2479 2482->2482 2485->2455 2486->2471 2491 18b3c4015a9-18b3c4015b8 2486->2491 2487->2487 2487->2488 2492 18b3c4018f0-18b3c4018f7 2488->2492 2491->2471 2491->2486 2492->2475 2493 18b3c4018f9-18b3c401908 2492->2493 2493->2475 2493->2492
                                              APIs
                                              Strings
                                              • Failed to add privilegeFailed to get token informationFailed to open process tokenFailed to open LSA policyAdjustTokenPrivileges failed with error: , xrefs: 0000018B3C400EB9
                                              Memory Dump Source
                                              • Source File: 00000003.00000002.3722700220.0000018B3C3F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 0000018B3C3F0000, based on PE: true
                                              • Associated: 00000003.00000002.3721928851.0000018B3C3F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3723910614.0000018B3C42B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3724892406.0000018B3C43F000.00000008.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3725717232.0000018B3C440000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_3_2_18b3c3f0000_cmd.jbxd
                                              Similarity
                                              • API ID: ErrorOpenProcessTokenmemset$AccountCloseCurrentDebugInfoInformationOriginateOutputPolicyRightsString
                                              • String ID: Failed to add privilegeFailed to get token informationFailed to open process tokenFailed to open LSA policyAdjustTokenPrivileges failed with error:
                                              • API String ID: 4216219486-1190080770
                                              • Opcode ID: 2114a1c7ab37438428a54ddf038fbf44027d721bc1e45900630ad34cb01b1988
                                              • Instruction ID: 9f0225a16d4f38b5ae0730e480aee290f8c6b8cc89b095c7af63034b946b5d01
                                              • Opcode Fuzzy Hash: 2114a1c7ab37438428a54ddf038fbf44027d721bc1e45900630ad34cb01b1988
                                              • Instruction Fuzzy Hash: F962C272714BD189EBB09FA2D8E87DDA3A1F745788F448225DE494BB99EF398345C300
                                              Function 0000018B3C3F4E40 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 295stringCOMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000003.00000002.3722700220.0000018B3C3F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 0000018B3C3F0000, based on PE: true
                                              • Associated: 00000003.00000002.3721928851.0000018B3C3F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3723910614.0000018B3C42B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3724892406.0000018B3C43F000.00000008.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3725717232.0000018B3C440000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_3_2_18b3c3f0000_cmd.jbxd
                                              Similarity
                                              • API ID: DebugOutputStringmemset$memcmpstrlen
                                              • String ID: c
                                              • API String ID: 2294051181-112844655
                                              • Opcode ID: 2f1a741cf87aad0d844a3b6cf1fca357bc0d6db4b12a2b48cca98936c4486f3f
                                              • Instruction ID: 90c2a8642a6126558cc796b4d977ed76cdc0645bc7cb4430d9662bbabbcc1e9e
                                              • Opcode Fuzzy Hash: 2f1a741cf87aad0d844a3b6cf1fca357bc0d6db4b12a2b48cca98936c4486f3f
                                              • Instruction Fuzzy Hash: 5AE1B33261CBC581EB218F66E4A17EAB7A1FBD5784F448215DE8A03B95EF7CC285C700
                                              Function 0000018B3C3F6AE0 Relevance: 18.0, APIs: 6, Strings: 4, Instructions: 480COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000003.00000002.3722700220.0000018B3C3F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 0000018B3C3F0000, based on PE: true
                                              • Associated: 00000003.00000002.3721928851.0000018B3C3F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3723910614.0000018B3C42B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3724892406.0000018B3C43F000.00000008.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3725717232.0000018B3C440000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_3_2_18b3c3f0000_cmd.jbxd
                                              Similarity
                                              • API ID: DebugOutputStringmemset
                                              • String ID: arenegyl$modnarod$setybdet$uespemos
                                              • API String ID: 1084755268-66988881
                                              • Opcode ID: dcb70d738a9cb88ae951c61cd9fdedf12c350a19f8f16ff82dd162dc9184d4d2
                                              • Instruction ID: 729a8e008203650fe4389d600a7195268d70cca8467cbf312185a79604a38a1c
                                              • Opcode Fuzzy Hash: dcb70d738a9cb88ae951c61cd9fdedf12c350a19f8f16ff82dd162dc9184d4d2
                                              • Instruction Fuzzy Hash: 6A22BF72A55BC189FB20CFA1E8A57DD2371F756788F408226DE495BB9AEF388345C340
                                              Function 0000018B3C3F21C0 Relevance: 17.9, APIs: 5, Strings: 5, Instructions: 433COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000003.00000002.3722700220.0000018B3C3F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 0000018B3C3F0000, based on PE: true
                                              • Associated: 00000003.00000002.3721928851.0000018B3C3F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3723910614.0000018B3C42B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3724892406.0000018B3C43F000.00000008.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3725717232.0000018B3C440000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_3_2_18b3c3f0000_cmd.jbxd
                                              Similarity
                                              • API ID: DebugOutputStringmemset$memcpy
                                              • String ID: arenegyl$called `Result::unwrap()` on an `Err` value$modnarod$setybdet$uespemos
                                              • API String ID: 293864031-2410307170
                                              • Opcode ID: 6215c194bb74bdfb36e14a4eae83411810ab413d22abe143d9f6bd1c1ff5a190
                                              • Instruction ID: 881dbc74c2a15725cc13da4c1e6bc166b6a9b91f07b09aaa7a6b40976af3a690
                                              • Opcode Fuzzy Hash: 6215c194bb74bdfb36e14a4eae83411810ab413d22abe143d9f6bd1c1ff5a190
                                              • Instruction Fuzzy Hash: C702F372619B8185EB20CFA2E8A57DD2361F705798F408626DE195BB9AEF79C345C300
                                              Function 0000018B3C427FE0 Relevance: 15.5, APIs: 2, Strings: 8, Instructions: 490COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000003.00000002.3722700220.0000018B3C3F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 0000018B3C3F0000, based on PE: true
                                              • Associated: 00000003.00000002.3721928851.0000018B3C3F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3723910614.0000018B3C42B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3724892406.0000018B3C43F000.00000008.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3725717232.0000018B3C440000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_3_2_18b3c3f0000_cmd.jbxd
                                              Similarity
                                              • API ID: memset
                                              • String ID: arenegyl$arenegyl$modnarod$modnarod$setybdet$setybdet$uespemos$uespemos
                                              • API String ID: 2221118986-1116813384
                                              • Opcode ID: dc6041d8019bd6a4ab417513f7d1d9fb842234f189d71b93f1b027619d78a870
                                              • Instruction ID: b4862580cabcdd8489fe0c0e32b8ded768f32133283244a707dfea35a682b3fa
                                              • Opcode Fuzzy Hash: dc6041d8019bd6a4ab417513f7d1d9fb842234f189d71b93f1b027619d78a870
                                              • Instruction Fuzzy Hash: 7302AB33B186A682FB51DFBAA562BAA6B10B711BE4F449711EE6A537C4DF34C711C300
                                              Function 0000018B3C4175B0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 301filenativesynchronizationCOMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              • assertion failed: self.is_char_boundary(new_len)/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\alloc\src\string.rs, xrefs: 0000018B3C417A0C
                                              • NTDLL.DLL, xrefs: 0000018B3C417725
                                              Memory Dump Source
                                              • Source File: 00000003.00000002.3722700220.0000018B3C3F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 0000018B3C3F0000, based on PE: true
                                              • Associated: 00000003.00000002.3721928851.0000018B3C3F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3723910614.0000018B3C42B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3724892406.0000018B3C43F000.00000008.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3725717232.0000018B3C440000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_3_2_18b3c3f0000_cmd.jbxd
                                              Similarity
                                              • API ID: Error$FileFormatHandleLastMessageModuleObjectSingleStatusWaitWrite
                                              • String ID: NTDLL.DLL$assertion failed: self.is_char_boundary(new_len)/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\alloc\src\string.rs
                                              • API String ID: 415079386-1565840215
                                              • Opcode ID: b77ccb578e916ab17dccf7c991ae8e1b7d048442448e2d063ea1c8865c960b6c
                                              • Instruction ID: 676e388e4f4df0247c559ddffa283cf334fe4ec134285165ff35a96c2ee12fed
                                              • Opcode Fuzzy Hash: b77ccb578e916ab17dccf7c991ae8e1b7d048442448e2d063ea1c8865c960b6c
                                              • Instruction Fuzzy Hash: 49D1C032619BC289F7318FA2E9A17EC37A0F744394F549225DE9A46BD4DF788795C300
                                              Function 00007FFBFD5D75B0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 301filenativesynchronizationCOMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              • assertion failed: self.is_char_boundary(new_len)/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\alloc\src\string.rs, xrefs: 00007FFBFD5D7A0C
                                              • NTDLL.DLL, xrefs: 00007FFBFD5D7725
                                              Memory Dump Source
                                              • Source File: 00000003.00000002.3729735948.00007FFBFD5B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFBFD5B0000, based on PE: true
                                              • Associated: 00000003.00000002.3728901617.00007FFBFD5B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3731019737.00007FFBFD5EB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3731947127.00007FFBFD5FF000.00000004.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3732770229.00007FFBFD600000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_3_2_7ffbfd5b0000_cmd.jbxd
                                              Similarity
                                              • API ID: Error$FileFormatHandleLastMessageModuleObjectSingleStatusWaitWrite
                                              • String ID: NTDLL.DLL$assertion failed: self.is_char_boundary(new_len)/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\alloc\src\string.rs
                                              • API String ID: 415079386-1565840215
                                              • Opcode ID: 809c114975c795f9a7b7628066d58efe2ed73c5380dc3917d9a03277512e7401
                                              • Instruction ID: 937e7b300c31f8139569c31cb20393a9c9e03307956deebe9968873b3b18e715
                                              • Opcode Fuzzy Hash: 809c114975c795f9a7b7628066d58efe2ed73c5380dc3917d9a03277512e7401
                                              • Instruction Fuzzy Hash: BED180B2A19BC289E7318FB4E8407E837A4FB48394F544135DE6E46BD4EF789685C390
                                              Function 0000018B3C42726C Relevance: 13.6, APIs: 9, Instructions: 71COMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000003.00000002.3722700220.0000018B3C3F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 0000018B3C3F0000, based on PE: true
                                              • Associated: 00000003.00000002.3721928851.0000018B3C3F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3723910614.0000018B3C42B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3724892406.0000018B3C43F000.00000008.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3725717232.0000018B3C440000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_3_2_18b3c3f0000_cmd.jbxd
                                              Similarity
                                              • API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                              • String ID:
                                              • API String ID: 313767242-0
                                              • Opcode ID: eba220e78b844b365566259a7463a469e1534874e1147a5bedb48010a45282e8
                                              • Instruction ID: 0e8c1f7b7babec869aa3671662b2737f7e0061c415899bb1f8c6b77d3427dabb
                                              • Opcode Fuzzy Hash: eba220e78b844b365566259a7463a469e1534874e1147a5bedb48010a45282e8
                                              • Instruction Fuzzy Hash: 10311E72209B8186EB609FA1E8A57ED7374F784744F44842ADE4E47B99EF78C648C710
                                              Function 00007FFBFD5E726C Relevance: 13.6, APIs: 9, Instructions: 71COMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000003.00000002.3729735948.00007FFBFD5B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFBFD5B0000, based on PE: true
                                              • Associated: 00000003.00000002.3728901617.00007FFBFD5B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3731019737.00007FFBFD5EB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3731947127.00007FFBFD5FF000.00000004.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3732770229.00007FFBFD600000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_3_2_7ffbfd5b0000_cmd.jbxd
                                              Similarity
                                              • API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                              • String ID:
                                              • API String ID: 313767242-0
                                              • Opcode ID: eba220e78b844b365566259a7463a469e1534874e1147a5bedb48010a45282e8
                                              • Instruction ID: dace409043098891e1f97c01fb39bec9b9c9b369d3acfb4f9d0313e15314e1c3
                                              • Opcode Fuzzy Hash: eba220e78b844b365566259a7463a469e1534874e1147a5bedb48010a45282e8
                                              • Instruction Fuzzy Hash: 7E313CB2608B8186EB64AFB0E8407E97364FB88754F44403EDE5D47B99EF38D648C700
                                              Function 0000018B3C417090 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 134fileCOMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              • C:\Windows\Temp\tempdll.dllReading DLL from disk at path: , xrefs: 0000018B3C417099
                                              Memory Dump Source
                                              • Source File: 00000003.00000002.3722700220.0000018B3C3F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 0000018B3C3F0000, based on PE: true
                                              • Associated: 00000003.00000002.3721928851.0000018B3C3F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3723910614.0000018B3C42B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3724892406.0000018B3C43F000.00000008.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3725717232.0000018B3C440000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_3_2_18b3c3f0000_cmd.jbxd
                                              Similarity
                                              • API ID: CloseFind$FileFirstHandlememset
                                              • String ID: C:\Windows\Temp\tempdll.dllReading DLL from disk at path:
                                              • API String ID: 4181070385-2284096931
                                              • Opcode ID: 058249c3dc6c70ad6a4ce6f20f735d50d38880fea3824faaac27def2eab10332
                                              • Instruction ID: 0cfb751aed3a8ef96b06851f927fa4798145197c11e65a74519c27077c36852d
                                              • Opcode Fuzzy Hash: 058249c3dc6c70ad6a4ce6f20f735d50d38880fea3824faaac27def2eab10332
                                              • Instruction Fuzzy Hash: EB519032604B8286E734CFA2E9E93ED73A1F7457E4F109205DEA90BBD5DF7882858300
                                              Function 0000018B3C4188D0 Relevance: 17.9, APIs: 7, Strings: 3, Instructions: 426COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000003.00000002.3722700220.0000018B3C3F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 0000018B3C3F0000, based on PE: true
                                              • Associated: 00000003.00000002.3721928851.0000018B3C3F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3723910614.0000018B3C42B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3724892406.0000018B3C43F000.00000008.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3725717232.0000018B3C440000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_3_2_18b3c3f0000_cmd.jbxd
                                              Similarity
                                              • API ID: ErrorLast$FullNamePath
                                              • String ID: \\?\$\\?\UNC\$internal error: entered unreachable code/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\alloc\src\vec\mod.rs
                                              • API String ID: 2482867836-3388149089
                                              • Opcode ID: 2314d7fb14eb79405d6c124e2ec9673b197f554c4fe9eadf2f5b799e83effc15
                                              • Instruction ID: d76d7bfc9cb422cf79ebf89d609cded8bd5d7d3e65336403bcb10acd51c481c2
                                              • Opcode Fuzzy Hash: 2314d7fb14eb79405d6c124e2ec9673b197f554c4fe9eadf2f5b799e83effc15
                                              • Instruction Fuzzy Hash: 59029C7360879285EB748FA6D8AA3E923A5F304B98F41D116DE995B7C8DF38C781C301
                                              Function 0000018B3C4108A0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 242COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              • internal error: entered unreachable code/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\alloc\src\vec\mod.rs, xrefs: 0000018B3C410C30
                                              Memory Dump Source
                                              • Source File: 00000003.00000002.3722700220.0000018B3C3F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 0000018B3C3F0000, based on PE: true
                                              • Associated: 00000003.00000002.3721928851.0000018B3C3F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3723910614.0000018B3C42B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3724892406.0000018B3C43F000.00000008.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3725717232.0000018B3C440000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_3_2_18b3c3f0000_cmd.jbxd
                                              Similarity
                                              • API ID: ErrorLast$EnvironmentVariable
                                              • String ID: internal error: entered unreachable code/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\alloc\src\vec\mod.rs
                                              • API String ID: 2691138088-2475256114
                                              • Opcode ID: 30fe457091c71bd055e5b757d35bd8d4fb51284dc4ab386c042eba95eb2abf8a
                                              • Instruction ID: fedbe24cc137ed96f3556f1cc067e93103d98bbdfa7067f25b8f7cd6f900ed0b
                                              • Opcode Fuzzy Hash: 30fe457091c71bd055e5b757d35bd8d4fb51284dc4ab386c042eba95eb2abf8a
                                              • Instruction Fuzzy Hash: 99A19B72314BC689EB758FA3D8A53D96364F788B98F048126DE9D5B789DF38C3818300
                                              Function 00007FFBFD5D08A0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 242COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              • internal error: entered unreachable code/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\alloc\src\vec\mod.rs, xrefs: 00007FFBFD5D0C30
                                              Memory Dump Source
                                              • Source File: 00000003.00000002.3729735948.00007FFBFD5B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFBFD5B0000, based on PE: true
                                              • Associated: 00000003.00000002.3728901617.00007FFBFD5B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3731019737.00007FFBFD5EB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3731947127.00007FFBFD5FF000.00000004.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3732770229.00007FFBFD600000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_3_2_7ffbfd5b0000_cmd.jbxd
                                              Similarity
                                              • API ID: ErrorLast$EnvironmentVariable
                                              • String ID: internal error: entered unreachable code/rustc/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf\library\alloc\src\vec\mod.rs
                                              • API String ID: 2691138088-2475256114
                                              • Opcode ID: 1dad040292b619b6ab3b5cf5ba56b2b19ab9bc8c350b82c2041703b18e629291
                                              • Instruction ID: b06454cca06a6e0dfe82db7364c432c4ca3e0d7260e5a7de5ae47e59c845a127
                                              • Opcode Fuzzy Hash: 1dad040292b619b6ab3b5cf5ba56b2b19ab9bc8c350b82c2041703b18e629291
                                              • Instruction Fuzzy Hash: C5A192A2B08BC589EB718FB5D8443ED6364FB48B98F444135CE6C5B7D5EE38D2858390
                                              Function 0000018B3C416AD0 Relevance: 9.2, APIs: 6, Instructions: 180COMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000003.00000002.3722700220.0000018B3C3F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 0000018B3C3F0000, based on PE: true
                                              • Associated: 00000003.00000002.3721928851.0000018B3C3F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3723910614.0000018B3C42B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3724892406.0000018B3C43F000.00000008.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3725717232.0000018B3C440000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_3_2_18b3c3f0000_cmd.jbxd
                                              Similarity
                                              • API ID: ErrorLast$CloseHandle
                                              • String ID:
                                              • API String ID: 3463825546-0
                                              • Opcode ID: 2aaf3b666e5c80c828f3449ae25cff009d329a38228fa87083c8bbeeab0e8767
                                              • Instruction ID: aaaadc36007c18e051007e8481b5416aa5c1107b105cc1c48377a049b7f90c35
                                              • Opcode Fuzzy Hash: 2aaf3b666e5c80c828f3449ae25cff009d329a38228fa87083c8bbeeab0e8767
                                              • Instruction Fuzzy Hash: F471CDB170866286FB258BA395A63ED2AA0F745BD8F14E115CDC907BC9EF39CB45C310
                                              Function 0000018B3C417AB0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 198COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000003.00000002.3722700220.0000018B3C3F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 0000018B3C3F0000, based on PE: true
                                              • Associated: 00000003.00000002.3721928851.0000018B3C3F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3723910614.0000018B3C42B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3724892406.0000018B3C43F000.00000008.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3725717232.0000018B3C440000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_3_2_18b3c3f0000_cmd.jbxd
                                              Similarity
                                              • API ID: Handle$CloseConsoleErrorLastMode
                                              • String ID: called `Result::unwrap()` on an `Err` value
                                              • API String ID: 1170577072-2333694755
                                              • Opcode ID: f8f94a4482a42e753592072760699fa641ddedbd010ff4989c4a7f9634d4fb86
                                              • Instruction ID: 0c6190d274f6e521a3bc6fd867997af4777ed3bd354376785909abf5d3028d94
                                              • Opcode Fuzzy Hash: f8f94a4482a42e753592072760699fa641ddedbd010ff4989c4a7f9634d4fb86
                                              • Instruction Fuzzy Hash: E081C27260879289FB118FE2EAA23ED2760B7557D8F44D111DE9913AD9EF38C385C350
                                              Function 00007FFBFD5D7AB0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 198COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000003.00000002.3729735948.00007FFBFD5B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFBFD5B0000, based on PE: true
                                              • Associated: 00000003.00000002.3728901617.00007FFBFD5B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3731019737.00007FFBFD5EB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3731947127.00007FFBFD5FF000.00000004.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3732770229.00007FFBFD600000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_3_2_7ffbfd5b0000_cmd.jbxd
                                              Similarity
                                              • API ID: Handle$CloseConsoleErrorLastMode
                                              • String ID: called `Result::unwrap()` on an `Err` value
                                              • API String ID: 1170577072-2333694755
                                              • Opcode ID: 79e21faca9b508452aa96316488c7a9caf30f83d019d517c18fed7057e479e5a
                                              • Instruction ID: 17c4e81e648a911213971e4e8b7c8f24938c48bc4fd3729f0848d1e9eab1968d
                                              • Opcode Fuzzy Hash: 79e21faca9b508452aa96316488c7a9caf30f83d019d517c18fed7057e479e5a
                                              • Instruction Fuzzy Hash: CE81A0A2E0C69299FB119BB1E8003FD3760AB19798F444535DE6E16AD9FF3CD185C3A0
                                              Function 00007FFBFD5D7DC0 Relevance: 7.7, APIs: 5, Instructions: 249COMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000003.00000002.3729735948.00007FFBFD5B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFBFD5B0000, based on PE: true
                                              • Associated: 00000003.00000002.3728901617.00007FFBFD5B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3731019737.00007FFBFD5EB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3731947127.00007FFBFD5FF000.00000004.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3732770229.00007FFBFD600000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_3_2_7ffbfd5b0000_cmd.jbxd
                                              Similarity
                                              • API ID: ConsoleErrorLastWrite$ByteCharMultiWide
                                              • String ID:
                                              • API String ID: 1956605914-0
                                              • Opcode ID: fa0be04b3a924d1f5884fd7eb2462f8ab4ce4a64ea325d122178635e6aa3db52
                                              • Instruction ID: bfb36945f7f0891aec354defd082a5f180072ae525fb5f0266f7b3121dea85ce
                                              • Opcode Fuzzy Hash: fa0be04b3a924d1f5884fd7eb2462f8ab4ce4a64ea325d122178635e6aa3db52
                                              • Instruction Fuzzy Hash: F491EFE290C54245FB388BF4D8583BD2651EF49391F58413ADE3E4ABD4FF2CA589C2A1
                                              Function 0000018B3C417DC0 Relevance: 7.6, APIs: 5, Instructions: 141COMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000003.00000002.3722700220.0000018B3C3F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 0000018B3C3F0000, based on PE: true
                                              • Associated: 00000003.00000002.3721928851.0000018B3C3F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3723910614.0000018B3C42B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3724892406.0000018B3C43F000.00000008.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3725717232.0000018B3C440000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_3_2_18b3c3f0000_cmd.jbxd
                                              Similarity
                                              • API ID: ConsoleErrorLastWrite$ByteCharMultiWide
                                              • String ID:
                                              • API String ID: 1956605914-0
                                              • Opcode ID: da75447ee83443e1306168355bc515b96579987107d95d382e9d702c242ca6d9
                                              • Instruction ID: 2ee83a5b8d63727b6f6df062b0ac8d1f732992794fbeae05ad036f1b73bd9c69
                                              • Opcode Fuzzy Hash: da75447ee83443e1306168355bc515b96579987107d95d382e9d702c242ca6d9
                                              • Instruction Fuzzy Hash: 3A51B27260869245F7308FA2D9AA3EE6361F744794F54D121EE8947AD9DF3CC789C340
                                              Function 0000018B3C426E4C Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000003.00000002.3722700220.0000018B3C3F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 0000018B3C3F0000, based on PE: true
                                              • Associated: 00000003.00000002.3721928851.0000018B3C3F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3723910614.0000018B3C42B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3724892406.0000018B3C43F000.00000008.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3725717232.0000018B3C440000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_3_2_18b3c3f0000_cmd.jbxd
                                              Similarity
                                              • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                              • String ID:
                                              • API String ID: 2933794660-0
                                              • Opcode ID: 3a258a47e5b426f00e72d33cd1cfbbd90f495a388b7ced27f5f149e6da52107e
                                              • Instruction ID: 4e34a9daddefdf987113f00f3c00c16209dcc5f8d00ee4e19ff2f844812c7688
                                              • Opcode Fuzzy Hash: 3a258a47e5b426f00e72d33cd1cfbbd90f495a388b7ced27f5f149e6da52107e
                                              • Instruction Fuzzy Hash: 52111832714B068AEB00CFA1E8A53A833B4F759798F444A21DE6D867A4DF78D268C340
                                              Function 00007FFBFD5E6E4C Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON
                                              Download Yara Rule
                                              APIs
                                              Memory Dump Source
                                              • Source File: 00000003.00000002.3729735948.00007FFBFD5B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFBFD5B0000, based on PE: true
                                              • Associated: 00000003.00000002.3728901617.00007FFBFD5B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3731019737.00007FFBFD5EB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3731947127.00007FFBFD5FF000.00000004.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3732770229.00007FFBFD600000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_3_2_7ffbfd5b0000_cmd.jbxd
                                              Similarity
                                              • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                              • String ID:
                                              • API String ID: 2933794660-0
                                              • Opcode ID: 3a258a47e5b426f00e72d33cd1cfbbd90f495a388b7ced27f5f149e6da52107e
                                              • Instruction ID: ffc00277663255614b636ec5631196fe97583189a59fb4dc1a2322bdd46c2dfe
                                              • Opcode Fuzzy Hash: 3a258a47e5b426f00e72d33cd1cfbbd90f495a388b7ced27f5f149e6da52107e
                                              • Instruction Fuzzy Hash: 2D111C62B14B0689EB00DFB0E8542B833A4FB1D769F440E35DE6D86BA4EF78D1588380
                                              Function 0000018B3C3F2990 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 218COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000003.00000002.3722700220.0000018B3C3F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 0000018B3C3F0000, based on PE: true
                                              • Associated: 00000003.00000002.3721928851.0000018B3C3F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3723910614.0000018B3C42B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3724892406.0000018B3C43F000.00000008.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3725717232.0000018B3C440000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_3_2_18b3c3f0000_cmd.jbxd
                                              Similarity
                                              • API ID: DebugOutputStringmemset
                                              • String ID: Failed to encrypt function name
                                              • API String ID: 1084755268-2980051713
                                              • Opcode ID: 959a784379181f2edefa2f953fa415212389e06563d4c0988bc4f2e8b6188a7f
                                              • Instruction ID: 5df3c99f129df1b5501ef262a7998229760bd292bdb031643cc42ca96a390fb2
                                              • Opcode Fuzzy Hash: 959a784379181f2edefa2f953fa415212389e06563d4c0988bc4f2e8b6188a7f
                                              • Instruction Fuzzy Hash: C7A10373A18BD088EB308FA5E8A97DC7760F749758F448619CE985BB96DF398790C340
                                              Function 0000018B3C3FC920 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 169COMMON
                                              Download Yara Rule
                                              APIs
                                              Strings
                                              Memory Dump Source
                                              • Source File: 00000003.00000002.3722700220.0000018B3C3F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 0000018B3C3F0000, based on PE: true
                                              • Associated: 00000003.00000002.3721928851.0000018B3C3F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3723910614.0000018B3C42B000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3724892406.0000018B3C43F000.00000008.00000001.01000000.00000005.sdmpDownload File
                                              • Associated: 00000003.00000002.3725717232.0000018B3C440000.00000002.00000001.01000000.00000005.sdmpDownload File
                                              Joe Sandbox IDA Plugin
                                              • Snapshot File: hcaresult_3_2_18b3c3f0000_cmd.jbxd
                                              Similarity
                                              • API ID: DebugOutputStringmemset
                                              • String ID: LL file.
                                              • API String ID: 1084755268-1255835901
                                              • Opcode ID: 2eb753c13cd71a1d6f01caf7847ed591264962dad786f19f2415057806ab18c5
                                              • Instruction ID: 6fb66d1b6b69ab604faacf6511713e761b10383189caec661d5d66555edc2554
                                              • Opcode Fuzzy Hash: 2eb753c13cd71a1d6f01caf7847ed591264962dad786f19f2415057806ab18c5
                                              • Instruction Fuzzy Hash: B8718232755B8488EB718F62E8A03EC7760F789798F448226CE4D5BB99DF35C685C340