Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
dropper.exe

Overview

General Information

Sample name:dropper.exe
Analysis ID:1586515
MD5:8841148d7d1186d5e5087b672de0de05
SHA1:6a41bb74c3f451c322c642f80f147ac78bf6d0cb
SHA256:a39f3ede27a0b06104e10e50b42a526b83bb7131b21ca21f799c4629caeb131c
Infos:

Detection

Score:66
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Allocates memory in foreign processes
Changes security center settings (notifications, updates, antivirus, firewall)
Creates a thread in another existing process (thread injection)
Creates an autostart registry key pointing to binary in C:\Windows
Disable Windows Defender real time protection (registry)
Disables Windows Defender (deletes autostart)
Found direct / indirect Syscall (likely to bypass EDR)
Injects code into the Windows Explorer (explorer.exe)
Tries to delay execution (extensive OutputDebugStringW loop)
Writes to foreign memory regions
AV process strings found (often used to terminate AV products)
Checks if the current process is being debugged
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Creates or modifies windows services
Detected potential crypto function
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Enables debug privileges
Enables driver privileges
Enables security privileges
Found dropped PE file which has not been started or loaded
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries disk information (often used to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Uncommon Svchost Parent Process
Uses Microsoft's Enhanced Cryptographic Provider

Classification

Process Tree

  • System is w10x64native
  • dropper.exe (PID: 8528 cmdline: "C:\Users\user\Desktop\dropper.exe" MD5: 8841148D7D1186D5E5087B672DE0DE05)
    • conhost.exe (PID: 8540 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • cmd.exe (PID: 8632 cmdline: "C:\Windows\System32\cmd.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 8644 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
      • winlogon.exe (PID: 888 cmdline: winlogon.exe MD5: A987B43E6A8E8F894B98A3DF022DB518)
      • lsass.exe (PID: 944 cmdline: C:\Windows\system32\lsass.exe MD5: 15A556DEF233F112D127025AB51AC2D3)
      • svchost.exe (PID: 568 cmdline: C:\Windows\system32\svchost.exe -k DcomLaunch -p MD5: F586835082F632DC8D9404D83BC16316)
      • fontdrvhost.exe (PID: 556 cmdline: "fontdrvhost.exe" MD5: AB7AB4CF816D091EEE234C1D9BC4FD13)
      • fontdrvhost.exe (PID: 680 cmdline: "fontdrvhost.exe" MD5: AB7AB4CF816D091EEE234C1D9BC4FD13)
      • svchost.exe (PID: 1064 cmdline: C:\Windows\system32\svchost.exe -k RPCSS -p MD5: F586835082F632DC8D9404D83BC16316)
      • svchost.exe (PID: 1112 cmdline: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM MD5: F586835082F632DC8D9404D83BC16316)
      • dwm.exe (PID: 1180 cmdline: "dwm.exe" MD5: 5C27608411832C5B39BA04E33D53536C)
      • svchost.exe (PID: 1256 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc MD5: F586835082F632DC8D9404D83BC16316)
      • svchost.exe (PID: 1300 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts MD5: F586835082F632DC8D9404D83BC16316)
      • svchost.exe (PID: 1340 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService MD5: F586835082F632DC8D9404D83BC16316)
      • svchost.exe (PID: 1348 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc MD5: F586835082F632DC8D9404D83BC16316)
      • svchost.exe (PID: 1416 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule MD5: F586835082F632DC8D9404D83BC16316)
      • IntelCpHDCPSvc.exe (PID: 1456 cmdline: C:\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_3ea756ac68d34d21\IntelCpHDCPSvc.exe MD5: B6BAD2BD8596D9101874E9042B8E2D63)
      • svchost.exe (PID: 1464 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem MD5: F586835082F632DC8D9404D83BC16316)
      • svchost.exe (PID: 1520 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc MD5: F586835082F632DC8D9404D83BC16316)
      • svchost.exe (PID: 1556 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog MD5: F586835082F632DC8D9404D83BC16316)
      • svchost.exe (PID: 1652 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS MD5: F586835082F632DC8D9404D83BC16316)
      • igfxCUIService.exe (PID: 1724 cmdline: C:\Windows\System32\DriverStore\FileRepository\cui_dch.inf_amd64_2e49f48165b8de10\igfxCUIService.exe MD5: 91038D45A86B5465E8B7E5CD63187150)
      • IntelCpHeciSvc.exe (PID: 1732 cmdline: C:\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_3ea756ac68d34d21\IntelCpHeciSvc.exe MD5: 3B0DF35583675DE5A08E8D4C1271CEC0)
      • svchost.exe (PID: 1780 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager MD5: F586835082F632DC8D9404D83BC16316)
      • svchost.exe (PID: 1856 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p MD5: F586835082F632DC8D9404D83BC16316)
      • svchost.exe (PID: 1872 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p -s nsi MD5: F586835082F632DC8D9404D83BC16316)
      • svchost.exe (PID: 1968 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp MD5: F586835082F632DC8D9404D83BC16316)
      • svchost.exe (PID: 2024 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes MD5: F586835082F632DC8D9404D83BC16316)
      • svchost.exe (PID: 2052 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder MD5: F586835082F632DC8D9404D83BC16316)
      • svchost.exe (PID: 2064 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache MD5: F586835082F632DC8D9404D83BC16316)
      • svchost.exe (PID: 2128 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc MD5: F586835082F632DC8D9404D83BC16316)
      • svchost.exe (PID: 2276 cmdline: C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm MD5: F586835082F632DC8D9404D83BC16316)
      • svchost.exe (PID: 2368 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc MD5: F586835082F632DC8D9404D83BC16316)
      • svchost.exe (PID: 2420 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc MD5: F586835082F632DC8D9404D83BC16316)
      • svchost.exe (PID: 2492 cmdline: C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache MD5: F586835082F632DC8D9404D83BC16316)
      • svchost.exe (PID: 2568 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p MD5: F586835082F632DC8D9404D83BC16316)
      • svchost.exe (PID: 2656 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p MD5: F586835082F632DC8D9404D83BC16316)
      • svchost.exe (PID: 2664 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p MD5: F586835082F632DC8D9404D83BC16316)
      • svchost.exe (PID: 2688 cmdline: C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository MD5: F586835082F632DC8D9404D83BC16316)
      • svchost.exe (PID: 2728 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection MD5: F586835082F632DC8D9404D83BC16316)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

Sigma detected: CurrentVersion Autorun Keys Modification
Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: ....(......#........., EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\dropper.exe, ProcessId: 8528, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HADES
Sigma detected: Uncommon Svchost Parent Process
Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\svchost.exe -k DcomLaunch -p, CommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch -p, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8632, ParentProcessName: cmd.exe, ProcessCommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch -p, ProcessId: 568, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Multi AV Scanner detection for submitted file
Source: dropper.exeVirustotal: Detection: 8%Perma Link
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF66CB5B240 BCryptGenRandom,SystemFunction036,BCryptGenRandom,SystemFunction036,0_2_00007FF66CB5B240
Source: C:\Windows\System32\cmd.exeCode function: 2_2_0000018DB557E320 BCryptGenRandom,SystemFunction036,BCryptGenRandom,SystemFunction036,2_2_0000018DB557E320
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFD3580E320 BCryptGenRandom,SystemFunction036,BCryptGenRandom,SystemFunction036,2_2_00007FFD3580E320
Source: dropper.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\winload_prod.pdb source: svchost.exe, 00000016.00000000.2130671960.000001B5E3047000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3193427514.000001B5E3047000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: dropper.pdb source: dropper.exe
Source: Binary string: (@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb source: svchost.exe, 00000016.00000002.3195423744.000001B5E3056000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000000.2130746542.000001B5E3056000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: *@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\47114209A62F3B9930F6B8998DFD4A991\ntkrnlmp.pdb source: svchost.exe, 00000016.00000002.3191177052.000001B5E302A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000000.2130567601.000001B5E302A000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: WINLOA~1.PDBwinload_prod.pdb source: svchost.exe, 00000016.00000002.3195423744.000001B5E3056000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000000.2130746542.000001B5E3056000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: dll.pdb source: dropper.exe, 00000000.00000002.1884570672.000001A430E5D000.00000004.00000020.00020000.00000000.sdmp, dropper.exe, 00000000.00000003.1882615898.000001A430E0A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2212735282.0000018DB33B0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2220804385.0000018DB33AF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2070286706.0000018DB33AE000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2218806552.0000018DB33B2000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2072316368.0000018DB33B0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2216982757.0000018DB33AE000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2181564640.0000018DB33B0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2218174599.0000018DB33B2000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2149509422.0000018DB33AE000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2220430653.0000018DB33AF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2217276174.0000018DB33B0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2221279512.0000018DB33AF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2220040011.0000018DB33AF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.3190828771.0000018DB559E000.00000002.00000001.01000000.00000005.sdmp, cmd.exe, 00000002.00000003.2218012129.0000018DB33B2000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2217431398.0000018DB33B1000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2217603396.0000018DB33B1000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2078070788.0000018DB33AE000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.3181126469.0000018DB339E000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2219557674.0000018DB33B0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2217855912.0000018DB33B1000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2220970397.0000018DB33AF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2219886652.0000018DB33AF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2058219378.0000018DB33AF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2218965092.0000018DB33B0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2221125043.0000018DB33AF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2218328970.0000018DB33B2000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.3199502615.00007FFD3582E000.00000002.00000001.01000000.00000005.sdmp, cmd.exe, 00000002.00000003.2215662587.0000018DB33AE000.00000004.00
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\winload_prod.pdbTCDE&@ source: svchost.exe, 00000016.00000000.2130671960.000001B5E3047000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3193427514.000001B5E3047000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: ,@\??\C:\Users\user\AppData\Local\Temp\TCDE700.tmp.pdb source: svchost.exe, 00000016.00000002.3195423744.000001B5E3056000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000000.2130746542.000001B5E3056000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062.pdb source: svchost.exe, 00000016.00000000.2130671960.000001B5E3047000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3193427514.000001B5E3047000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: .@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdbpdb source: svchost.exe, 00000016.00000002.3195423744.000001B5E3056000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000000.2130746542.000001B5E3056000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\47114209A62F3B9930F6B8998DFD4A991 source: svchost.exe, 00000016.00000000.2130671960.000001B5E3047000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3193427514.000001B5E3047000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: .@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: svchost.exe, 00000016.00000002.3195423744.000001B5E3056000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000000.2130746542.000001B5E3056000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\download.error source: svchost.exe, 00000016.00000000.2130671960.000001B5E3047000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3193427514.000001B5E3047000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: svchost.exe, 00000016.00000002.3195423744.000001B5E3056000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000000.2130746542.000001B5E3056000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: *@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\47114209A62F3B9930F6B8998DFD4A991\download.error source: svchost.exe, 00000016.00000002.3191177052.000001B5E302A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000000.2130567601.000001B5E302A000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: *@\??\C:\Users\user\AppData\Local\Temp\TCDE6E8.tmp.pdb source: svchost.exe, 00000016.00000002.3196355914.000001B5E306C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000000.2130783393.000001B5E306C000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: dll.pdb( source: dropper.exe, 00000000.00000002.1884570672.000001A430E5D000.00000004.00000020.00020000.00000000.sdmp, dropper.exe, 00000000.00000003.1882615898.000001A430E0A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2212735282.0000018DB33B0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2220804385.0000018DB33AF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2070286706.0000018DB33AE000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2218806552.0000018DB33B2000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2072316368.0000018DB33B0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2216982757.0000018DB33AE000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2181564640.0000018DB33B0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2218174599.0000018DB33B2000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2149509422.0000018DB33AE000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2220430653.0000018DB33AF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2217276174.0000018DB33B0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2221279512.0000018DB33AF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2220040011.0000018DB33AF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.3190828771.0000018DB559E000.00000002.00000001.01000000.00000005.sdmp, cmd.exe, 00000002.00000003.2218012129.0000018DB33B2000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2217431398.0000018DB33B1000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2217603396.0000018DB33B1000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2078070788.0000018DB33AE000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.3181126469.0000018DB339E000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2219557674.0000018DB33B0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2217855912.0000018DB33B1000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2220970397.0000018DB33AF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2219886652.0000018DB33AF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2058219378.0000018DB33AF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2218965092.0000018DB33B0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2221125043.0000018DB33AF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2218328970.0000018DB33B2000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.3199502615.00007FFD3582E000.00000002.00000001.01000000.00000005.sdmp, cmd.exe, 00000002.00000003.2215662587.0000018DB33AE000.00000004.0
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\download.errork source: svchost.exe, 00000016.00000000.2130671960.000001B5E3047000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3193427514.000001B5E3047000.00000004.00000001.00020000.00000000.sdmp
Source: C:\Windows\System32\cmd.exeCode function: 2_2_0000018DB558A380 OutputDebugStringW,CloseHandle,memset,FindFirstFileExW,FindClose,2_2_0000018DB558A380
Source: Joe Sandbox ViewIP Address: 1.1.1.1 1.1.1.1
Source: Joe Sandbox ViewIP Address: 1.1.1.1 1.1.1.1
Source: svchost.exe, 00000025.00000000.2184269331.0000014606055000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000025.00000002.2296416915.0000014606055000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: @www.facebook.com equals www.facebook.com (Facebook)
Source: lsass.exe, 00000008.00000000.2059736295.000001A39071F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000003.2825024111.000001A39071F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3231758964.000001A39085C000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2060097433.000001A390800000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3220783373.000001A39071F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: lsass.exe, 00000008.00000002.3195915577.000001A38FE87000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2059008143.000001A38FE87000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2059736295.000001A39071F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000003.2825024111.000001A39071F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2060212204.000001A390893000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3231758964.000001A39085C000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3216736409.000001A39066B000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2060097433.000001A390800000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3231758964.000001A390800000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3220783373.000001A39071F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3236034431.000001A390893000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2059601768.000001A39066B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0B
Source: lsass.exe, 00000008.00000002.3216736409.000001A39066B000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2059601768.000001A39066B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG3.crt0B
Source: lsass.exe, 00000008.00000000.2059736295.000001A39071F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000003.2825024111.000001A39071F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2060097433.000001A390800000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3231758964.000001A390800000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3220783373.000001A39071F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2SecureServerCA-2.crt0
Source: lsass.exe, 00000008.00000002.3216736409.000001A39066B000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2059601768.000001A39066B000.00000004.00000001.00020000.00000000.sdmp, dwm.exe, 0000000E.00000000.2085328161.000001EEF74F8000.00000004.00000001.00020000.00000000.sdmp, dwm.exe, 0000000E.00000002.3293932255.000001EEF74F8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: lsass.exe, 00000008.00000002.3216736409.000001A39066B000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2059601768.000001A39066B000.00000004.00000001.00020000.00000000.sdmp, dwm.exe, 0000000E.00000000.2085328161.000001EEF74F8000.00000004.00000001.00020000.00000000.sdmp, dwm.exe, 0000000E.00000002.3293932255.000001EEF74F8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: lsass.exe, 00000008.00000000.2059736295.000001A39071F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000003.2825024111.000001A39071F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3231758964.000001A39085C000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2060097433.000001A390800000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3220783373.000001A39071F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: lsass.exe, 00000008.00000002.3195915577.000001A38FE87000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2059008143.000001A38FE87000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2059736295.000001A39071F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000003.2825024111.000001A39071F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2060212204.000001A390893000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3231758964.000001A39085C000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3216736409.000001A39066B000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2060097433.000001A390800000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3231758964.000001A390800000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3220783373.000001A39071F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3236034431.000001A390893000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2059601768.000001A39066B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl0
Source: lsass.exe, 00000008.00000002.3216736409.000001A39066B000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2059601768.000001A39066B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG3.crl0
Source: lsass.exe, 00000008.00000000.2059736295.000001A39071F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000003.2825024111.000001A39071F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2060097433.000001A390800000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3231758964.000001A390800000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3220783373.000001A39071F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigicertSHA2SecureServerCA-1.crl0?
Source: lsass.exe, 00000008.00000000.2059736295.000001A39071F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000003.2825024111.000001A39071F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3231758964.000001A39085C000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2060097433.000001A390800000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3220783373.000001A39071F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: lsass.exe, 00000008.00000000.2059736295.000001A39071F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000003.2825024111.000001A39071F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2060097433.000001A390800000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3231758964.000001A390800000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3220783373.000001A39071F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigicertSHA2SecureServerCA-1.crl0~
Source: svchost.exe, 00000025.00000000.2184148345.0000014606024000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000025.00000002.2296189659.0000014606024000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ctldl.windowsupdate.com/
Source: lsass.exe, 00000008.00000002.3224096873.000001A39072B000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2059841144.000001A39072B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: lsass.exe, 00000008.00000002.3209403498.000001A390600000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2059387448.000001A390600000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: lsass.exe, 00000008.00000000.2058877226.000001A38FE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3191876258.000001A38FE2F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702
Source: lsass.exe, 00000008.00000000.2058925814.000001A38FE4F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3193452173.000001A38FE4F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512
Source: lsass.exe, 00000008.00000000.2058877226.000001A38FE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3191876258.000001A38FE2F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: svchost.exe, 00000017.00000003.2304480297.000001C71D6D6000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000017.00000003.2299310316.000001C71D6D5000.00000004.00000001.00020000.00000000.sdmp, Microsoft-Windows-LiveId%4Operational.evtx.23.drString found in binary or memory: http://docs.oasis-open.org/wss/2004/XX/oasis-2004XX-wss-saml-token-profile-1.0#SAMLAssertionID
Source: dropper.exeString found in binary or memory: http://ns.adobe.
Source: lsass.exe, 00000008.00000002.3195915577.000001A38FE87000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2059008143.000001A38FE87000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2059736295.000001A39071F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000003.2825024111.000001A39071F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2060212204.000001A390893000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3231758964.000001A39085C000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3216736409.000001A39066B000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2060097433.000001A390800000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3231758964.000001A390800000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3220783373.000001A39071F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3236034431.000001A390893000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2059601768.000001A39066B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
Source: lsass.exe, 00000008.00000000.2059736295.000001A39071F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000003.2825024111.000001A39071F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2060097433.000001A390800000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3231758964.000001A390800000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3220783373.000001A39071F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0H
Source: svchost.exe, 0000001B.00000002.3214293241.000001F1A3910000.00000002.00000001.00040000.00000000.sdmpString found in binary or memory: http://schemas.micro
Source: lsass.exe, 00000008.00000000.2058877226.000001A38FE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3191876258.000001A38FE2F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policy
Source: lsass.exe, 00000008.00000000.2058877226.000001A38FE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3191876258.000001A38FE2F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: lsass.exe, 00000008.00000000.2058877226.000001A38FE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2058925814.000001A38FE4F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3191876258.000001A38FE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3193452173.000001A38FE4F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/07/securitypolicy
Source: lsass.exe, 00000008.00000000.2058877226.000001A38FE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3191876258.000001A38FE2F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: lsass.exe, 00000008.00000000.2058877226.000001A38FE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3191876258.000001A38FE2F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/wsdl/erties
Source: lsass.exe, 00000008.00000000.2058877226.000001A38FE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3191876258.000001A38FE2F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/wsdl/rameters
Source: lsass.exe, 00000008.00000000.2058877226.000001A38FE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3191876258.000001A38FE2F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/wsdl/soap12/
Source: lsass.exe, 00000008.00000000.2058877226.000001A38FE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3191876258.000001A38FE2F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/wsdl/soap12/P
Source: lsass.exe, 00000008.00000000.2059736295.000001A39071F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000003.2825024111.000001A39071F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2060097433.000001A390800000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3231758964.000001A390800000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3220783373.000001A39071F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com/CPS0
Source: svchost.exe, 00000025.00000000.2184148345.0000014606024000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000025.00000000.2184100973.0000014606013000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000025.00000003.2295274386.0000014606014000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000025.00000002.2296097609.000001460601B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.google.com/
Source: svchost.exe, 00000022.00000002.3222650236.000001E698856000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.msftconnecttest.com
Source: svchost.exe, 00000022.00000000.2176108614.000001E698856000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000022.00000002.3222650236.000001E698856000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000025.00000000.2184556095.000001460607F000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000025.00000002.2296992764.000001460607B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.msftconnecttest.com/
Source: svchost.exe, 00000022.00000000.2173616946.000001E697C51000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000022.00000002.3185069503.000001E697C51000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.msftconnecttest.com/connecttest.txt
Source: lsass.exe, 00000008.00000002.3216736409.000001A39066B000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2059601768.000001A39066B000.00000004.00000001.00020000.00000000.sdmp, dwm.exe, 0000000E.00000000.2085328161.000001EEF74F8000.00000004.00000001.00020000.00000000.sdmp, dwm.exe, 0000000E.00000002.3293932255.000001EEF74F8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.quovadis.bm0
Source: svchost.exe, 00000025.00000000.2184148345.0000014606024000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000025.00000002.2296189659.0000014606024000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://api.msn.com/
Source: svchost.exe, 00000009.00000002.3210334018.0000026FE2E00000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000009.00000000.2062798073.0000026FE2E00000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://az804205.vo.msecnd.net/
Source: svchost.exe, 00000009.00000002.3210334018.0000026FE2E00000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000009.00000000.2062798073.0000026FE2E00000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://az815563.vo.msecnd.net/
Source: svchost.exe, 00000009.00000000.2064235329.0000026FE3A63000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3255056645.0000026FE3A63000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.onenote.net/livetile/?Language=
Source: dropper.exe, tempdll.dll.0.drString found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
Source: svchost.exe, 0000002A.00000000.2200272334.000002112D213000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002A.00000000.2206188866.000002112E37F000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3196529294.000002112D213000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://excel.office.comSRD1%
Source: lsass.exe, 00000008.00000002.3216736409.000001A39066B000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2059601768.000001A39066B000.00000004.00000001.00020000.00000000.sdmp, dwm.exe, 0000000E.00000000.2085328161.000001EEF74F8000.00000004.00000001.00020000.00000000.sdmp, dwm.exe, 0000000E.00000002.3293932255.000001EEF74F8000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ocsp.quovadisoffshore.com0
Source: svchost.exe, 0000002A.00000002.3281182044.000002112E642000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://outlook.com
Source: svchost.exe, 0000002A.00000000.2203052325.000002112DCCF000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002A.00000000.2206188866.000002112E37F000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3257777182.000002112DCCF000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://outlook.comSRD1-
Source: svchost.exe, 0000002A.00000002.3281182044.000002112E642000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://outlook.comcom
Source: svchost.exe, 0000002A.00000000.2206188866.000002112E37F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://powerpoint.office.comSRD13
Source: svchost.exe, 00000009.00000000.2064235329.0000026FE3A63000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3255056645.0000026FE3A63000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://spclient.wg.spotify.com/v1/live-tile-xml?region=
Source: svchost.exe, 00000009.00000002.3251239349.0000026FE3A00000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000009.00000000.2064038066.0000026FE3A00000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://windows.msn.cn/shellRESP
Source: svchost.exe, 00000009.00000002.3251239349.0000026FE3A00000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000009.00000000.2064038066.0000026FE3A00000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://windows.msn.com/shell
Source: Microsoft-Windows-PushNotification-Platform%4Operational.evtx.23.drString found in binary or memory: https://wns2-ch1p.notify.windows.com/?token=AwYAAAAZ50ULGcXAhxlA4fj3374VoLA3vV4RBVRz1XHzN0x%2f0yimsl
Source: Microsoft-Windows-PushNotification-Platform%4Operational.evtx.23.drString found in binary or memory: https://wns2-ch1p.notify.windows.com/?token=AwYAAACoeV5AW%2fYHIYoIKM61bk4FViHsaGhVdbesI0lBnxjA4liMEd
Source: svchost.exe, 0000002A.00000000.2200442571.000002112D248000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002A.00000000.2206324463.000002112E39E000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002A.00000000.2200584743.000002112D2AD000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3257108142.000002112DCC7000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3208200155.000002112D2AD000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002A.00000000.2202948151.000002112DCC7000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.3117383882.000002112D2A1000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.3113776788.000002112D28E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://word.office.com
Source: svchost.exe, 0000002A.00000000.2200442571.000002112D248000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.3117383882.000002112D2A1000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.3113776788.000002112D28E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://word.office.com.com
Source: svchost.exe, 0000002A.00000000.2206324463.000002112E39E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://word.office.com.com-
Source: svchost.exe, 0000002A.00000000.2206324463.000002112E39E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://word.office.com.comP
Source: svchost.exe, 0000002A.00000000.2200584743.000002112D2AD000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3208200155.000002112D2AD000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://word.office.com.come.
Source: svchost.exe, 0000002A.00000002.3257108142.000002112DCC7000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002A.00000000.2202948151.000002112DCC7000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://word.office.com.comg
Source: svchost.exe, 0000002A.00000000.2203052325.000002112DCCF000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002A.00000000.2206188866.000002112E37F000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3257777182.000002112DCCF000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://word.office.comSRD1#
Source: svchost.exe, 0000002A.00000000.2202790612.000002112DC65000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3256255118.000002112DC65000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.office.com/pwaimages
Source: C:\Windows\System32\cmd.exeCode function: 2_2_0000018DB55853B0 NtReadFile,WaitForSingleObject,RtlNtStatusToDosError,2_2_0000018DB55853B0
Source: C:\Windows\System32\cmd.exeCode function: 2_2_0000018DB558A7A0 NtReadFile,WaitForSingleObject,RtlNtStatusToDosError,2_2_0000018DB558A7A0
Source: C:\Windows\System32\cmd.exeCode function: 2_2_0000018DB558A8C0 NtWriteFile,WaitForSingleObject,RtlNtStatusToDosError,GetModuleHandleW,FormatMessageW,GetLastError,2_2_0000018DB558A8C0
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFD3581A8C0 NtWriteFile,WaitForSingleObject,RtlNtStatusToDosError,GetModuleHandleW,FormatMessageW,GetLastError,2_2_00007FFD3581A8C0
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF66CB421C00_2_00007FF66CB421C0
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF66CB473400_2_00007FF66CB47340
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF66CB413500_2_00007FF66CB41350
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF66CB44D100_2_00007FF66CB44D10
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF66CC982D00_2_00007FF66CC982D0
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF66CB452D00_2_00007FF66CB452D0
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF66CB530700_2_00007FF66CB53070
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF66CC732100_2_00007FF66CC73210
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF66CC71C100_2_00007FF66CC71C10
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF66CC899D00_2_00007FF66CC899D0
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF66CC727E00_2_00007FF66CC727E0
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF66CC72F800_2_00007FF66CC72F80
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF66CC70FA00_2_00007FF66CC70FA0
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF66CC719500_2_00007FF66CC71950
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF66CC72D400_2_00007FF66CC72D40
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF66CC9E7700_2_00007FF66CC9E770
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF66CC735600_2_00007FF66CC73560
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF66CC93D100_2_00007FF66CC93D10
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF66CC701100_2_00007FF66CC70110
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF66CC71F100_2_00007FF66CC71F10
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF66CC723200_2_00007FF66CC72320
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF66CC8F2E00_2_00007FF66CC8F2E0
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF66CC716400_2_00007FF66CC71640
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF66CC72A700_2_00007FF66CC72A70
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF66CC80C700_2_00007FF66CC80C70
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF66CC70A600_2_00007FF66CC70A60
Source: C:\Windows\System32\cmd.exeCode function: 2_2_0000018DB5564D402_2_0000018DB5564D40
Source: C:\Windows\System32\cmd.exeCode function: 2_2_0000018DB557F9402_2_0000018DB557F940
Source: C:\Windows\System32\cmd.exeCode function: 2_2_0000018DB55953302_2_0000018DB5595330
Source: C:\Windows\System32\cmd.exeCode function: 2_2_0000018DB557ED602_2_0000018DB557ED60
Source: C:\Windows\System32\cmd.exeCode function: 2_2_0000018DB55613502_2_0000018DB5561350
Source: C:\Windows\System32\cmd.exeCode function: 2_2_0000018DB559AB502_2_0000018DB559AB50
Source: C:\Windows\System32\cmd.exeCode function: 2_2_0000018DB55653002_2_0000018DB5565300
Source: C:\Windows\System32\cmd.exeCode function: 2_2_0000018DB55795102_2_0000018DB5579510
Source: C:\Windows\System32\cmd.exeCode function: 2_2_0000018DB55979102_2_0000018DB5597910
Source: C:\Windows\System32\cmd.exeCode function: 2_2_0000018DB557FF102_2_0000018DB557FF10
Source: C:\Windows\System32\cmd.exeCode function: 2_2_0000018DB55815102_2_0000018DB5581510
Source: C:\Windows\System32\cmd.exeCode function: 2_2_0000018DB559AFB02_2_0000018DB559AFB0
Source: C:\Windows\System32\cmd.exeCode function: 2_2_0000018DB558B7B02_2_0000018DB558B7B0
Source: C:\Windows\System32\cmd.exeCode function: 2_2_0000018DB55799E02_2_0000018DB55799E0
Source: C:\Windows\System32\cmd.exeCode function: 2_2_0000018DB5562DE02_2_0000018DB5562DE0
Source: C:\Windows\System32\cmd.exeCode function: 2_2_0000018DB55669E02_2_0000018DB55669E0
Source: C:\Windows\System32\cmd.exeCode function: 2_2_0000018DB55739D02_2_0000018DB55739D0
Source: C:\Windows\System32\cmd.exeCode function: 2_2_0000018DB559C9802_2_0000018DB559C980
Source: C:\Windows\System32\cmd.exeCode function: 2_2_0000018DB55673702_2_0000018DB5567370
Source: C:\Windows\System32\cmd.exeCode function: 2_2_0000018DB5580D702_2_0000018DB5580D70
Source: C:\Windows\System32\cmd.exeCode function: 2_2_0000018DB5575D902_2_0000018DB5575D90
Source: C:\Windows\System32\cmd.exeCode function: 2_2_0000018DB5572E402_2_0000018DB5572E40
Source: C:\Windows\System32\cmd.exeCode function: 2_2_0000018DB55810402_2_0000018DB5581040
Source: C:\Windows\System32\cmd.exeCode function: 2_2_0000018DB55942302_2_0000018DB5594230
Source: C:\Windows\System32\cmd.exeCode function: 2_2_0000018DB55818602_2_0000018DB5581860
Source: C:\Windows\System32\cmd.exeCode function: 2_2_0000018DB55776502_2_0000018DB5577650
Source: C:\Windows\System32\cmd.exeCode function: 2_2_0000018DB557FC502_2_0000018DB557FC50
Source: C:\Windows\System32\cmd.exeCode function: 2_2_0000018DB55621F02_2_0000018DB55621F0
Source: C:\Windows\System32\cmd.exeCode function: 2_2_0000018DB5594E202_2_0000018DB5594E20
Source: C:\Windows\System32\cmd.exeCode function: 2_2_0000018DB55806202_2_0000018DB5580620
Source: C:\Windows\System32\cmd.exeCode function: 2_2_0000018DB55980102_2_0000018DB5598010
Source: C:\Windows\System32\cmd.exeCode function: 2_2_0000018DB55802102_2_0000018DB5580210
Source: C:\Windows\System32\cmd.exeCode function: 2_2_0000018DB557E4102_2_0000018DB557E410
Source: C:\Windows\System32\cmd.exeCode function: 2_2_0000018DB558A8C02_2_0000018DB558A8C0
Source: C:\Windows\System32\cmd.exeCode function: 2_2_0000018DB55716E02_2_0000018DB55716E0
Source: C:\Windows\System32\cmd.exeCode function: 2_2_0000018DB556A4E02_2_0000018DB556A4E0
Source: C:\Windows\System32\cmd.exeCode function: 2_2_0000018DB5567CE02_2_0000018DB5567CE0
Source: C:\Windows\System32\cmd.exeCode function: 2_2_0000018DB5580AE02_2_0000018DB5580AE0
Source: C:\Windows\System32\cmd.exeCode function: 2_2_0000018DB55812802_2_0000018DB5581280
Source: C:\Windows\System32\cmd.exeCode function: 2_2_0000018DB55704702_2_0000018DB5570470
Source: C:\Windows\System32\cmd.exeCode function: 2_2_0000018DB557F2A02_2_0000018DB557F2A0
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFD357F21F02_2_00007FFD357F21F0
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFD35802E402_2_00007FFD35802E40
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFD357F73702_2_00007FFD357F7370
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFD358039D02_2_00007FFD358039D0
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFD357F4D402_2_00007FFD357F4D40
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFD357F13502_2_00007FFD357F1350
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFD358099E02_2_00007FFD358099E0
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFD358102102_2_00007FFD35810210
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFD3580E4102_2_00007FFD3580E410
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFD358242302_2_00007FFD35824230
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFD35824E202_2_00007FFD35824E20
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFD358106202_2_00007FFD35810620
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFD3580FC502_2_00007FFD3580FC50
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFD358110402_2_00007FFD35811040
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFD358076502_2_00007FFD35807650
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFD35810D702_2_00007FFD35810D70
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFD3580ED602_2_00007FFD3580ED60
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFD3582C9802_2_00007FFD3582C980
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFD3582AFB02_2_00007FFD3582AFB0
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFD3581B7B02_2_00007FFD3581B7B0
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFD35810AE02_2_00007FFD35810AE0
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFD358279102_2_00007FFD35827910
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFD3580FF102_2_00007FFD3580FF10
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFD358115102_2_00007FFD35811510
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFD358253302_2_00007FFD35825330
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFD3580F9402_2_00007FFD3580F940
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFD358118602_2_00007FFD35811860
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFD358112802_2_00007FFD35811280
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFD3580F2A02_2_00007FFD3580F2A0
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFD3581A8C02_2_00007FFD3581A8C0
Source: C:\Users\user\Desktop\dropper.exeProcess token adjusted: Load DriverJump to behavior
Source: C:\Users\user\Desktop\dropper.exeProcess token adjusted: SecurityJump to behavior
Source: System.evtx.23.drBinary string: \Device\HarddiskVolume4\Windows\SysWOW64\tzutil.exe
Source: Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx.23.drBinary string: 1\Device\HarddiskVolume4\Windows\SysWOW64\curl.exe?\Device\HarddiskVolume4\Program Files (x86)\AutoIt3\AutoIt3.exed
Source: System.evtx.23.drBinary string: \\?\Volume{cb7fdaf7-d8ae-4a24-98ab-ca007942ac33}\Device\HarddiskVolume1m
Source: Microsoft-Windows-Security-Mitigations%4KernelMode.evtx.23.drBinary string: 4\Device\HarddiskVolume4\Windows\System32\spoolsv.exe
Source: Microsoft-Windows-SMBServer%4Operational.evtx.23.drBinary string: computer WORKGROUP:\Device\NetBT_Tcpip_{68C65ED0-D5FC-471F-BF0F-95C04D2E3B08}
Source: Microsoft-Windows-Security-Mitigations%4KernelMode.evtx.23.drBinary string: {\Device\HarddiskVolume4\Users\user\AppData\Local\Google\Chrome\User Data\SwReporter\92.267.200\software_reporter_tool.exe=
Source: Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.23.drBinary string: \\?\Volume{cb7fdaf7-d8ae-4a24-98ab-ca007942ac33}\Device\HarddiskVolume1an
Source: Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx.23.drBinary string: 1\Device\HarddiskVolume4\Windows\System32\curl.exe?\Device\HarddiskVolume4\Program Files (x86)\AutoIt3\AutoIt3.exe
Source: System.evtx.23.drBinary string: .\Device\HarddiskVolume2\EFI\Microsoft\Boot\BCD~
Source: Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx.23.drBinary string: 1\Device\HarddiskVolume4\Windows\SysWOW64\curl.exe?\Device\HarddiskVolume4\Program Files (x86)\AutoIt3\AutoIt3.exeo
Source: Microsoft-Windows-Security-Mitigations%4KernelMode.evtx.23.drBinary string: {\Device\HarddiskVolume4\Users\user\AppData\Local\Google\Chrome\User Data\SwReporter\93.269.200\software_reporter_tool.exe2
Source: Microsoft-Windows-SmbClient%4Connectivity.evtx.23.drBinary string: :\Device\NetBT_Tcpip_{68C65ED0-D5FC-471F-BF0F-95C04D2E3B08}
Source: Microsoft-Windows-Security-Mitigations%4KernelMode.evtx.23.drBinary string: {\Device\HarddiskVolume4\Users\user\AppData\Local\Google\Chrome\User Data\SwReporter\93.269.200\software_reporter_tool.exe4
Source: Microsoft-Windows-Security-Mitigations%4KernelMode.evtx.23.drBinary string: {\Device\HarddiskVolume4\Users\user\AppData\Local\Google\Chrome\User Data\SwReporter\93.269.200\software_reporter_tool.exe3
Source: Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx.23.drBinary string: 1\Device\HarddiskVolume4\Windows\SysWOW64\curl.exe?\Device\HarddiskVolume4\Program Files (x86)\AutoIt3\AutoIt3.exeD
Source: System.evtx.23.drBinary string: C:\Device\HarddiskVolume4K
Source: Microsoft-Windows-Security-Mitigations%4KernelMode.evtx.23.drBinary string: {\Device\HarddiskVolume4\Users\user\AppData\Local\Google\Chrome\User Data\SwReporter\93.269.200\software_reporter_tool.exe<
Source: Microsoft-Windows-SMBServer%4Operational.evtx.23.drBinary string: \Device\NetbiosSmb
Source: System.evtx.23.drBinary string: \Device\HarddiskVolume4\Program Files (x86)\AutoIt3\AutoIt3.exe
Source: Microsoft-Windows-Security-Mitigations%4KernelMode.evtx.23.drBinary string: {\Device\HarddiskVolume4\Users\user\AppData\Local\Google\Chrome\User Data\SwReporter\93.269.200\software_reporter_tool.exe=
Source: Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx.23.drBinary string: 1\Device\HarddiskVolume4\Windows\SysWOW64\curl.exe?\Device\HarddiskVolume4\Program Files (x86)\AutoIt3\AutoIt3.exe
Source: Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx.23.drBinary string: 1\Device\HarddiskVolume4\Windows\System32\curl.exe?\Device\HarddiskVolume4\Program Files (x86)\AutoIt3\AutoIt3.exeo
Source: Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.23.drBinary string: C:\Device\HarddiskVolume4
Source: Microsoft-Windows-CodeIntegrity%4Operational.evtx.23.drBinary string: 0\Device\HarddiskVolume4\Windows\Temp\tempdll.dll4\Device\HarddiskVolume4\Windows\System32\dllhost.exe
Source: System.evtx.23.drBinary string: \\?\Volume{cb7fdaf7-d8ae-4a24-98ab-ca007942ac33}\Device\HarddiskVolume1iceV
Source: Microsoft-Windows-Security-Mitigations%4KernelMode.evtx.23.drBinary string: {\Device\HarddiskVolume4\Users\user\AppData\Local\Google\Chrome\User Data\SwReporter\92.267.200\software_reporter_tool.exe3
Source: Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx.23.drBinary string: 1\Device\HarddiskVolume4\Windows\SysWOW64\curl.exe?\Device\HarddiskVolume4\Program Files (x86)\AutoIt3\AutoIt3.exeT_AH**
Source: Microsoft-Windows-Security-Mitigations%4KernelMode.evtx.23.drBinary string: 4\Device\HarddiskVolume4\Windows\System32\dllhost.exeQC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}t
Source: Microsoft-Windows-Security-Mitigations%4KernelMode.evtx.23.drBinary string: _\Device\HarddiskVolume4\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\RdrCEF.exe
Source: classification engineClassification label: mal66.evad.winEXE@5/60@0/1
Source: C:\Windows\System32\cmd.exeCode function: 2_2_0000018DB558A8C0 NtWriteFile,WaitForSingleObject,RtlNtStatusToDosError,GetModuleHandleW,FormatMessageW,GetLastError,2_2_0000018DB558A8C0
Source: C:\Windows\System32\cmd.exeCode function: 2_2_0000018DB55716E0 memset,OutputDebugStringW,GetProcessId,CreateToolhelp32Snapshot,memset,OutputDebugStringW,memset,OutputDebugStringW,Module32FirstW,memset,OutputDebugStringW,memset,OutputDebugStringW,Module32NextW,memset,memset,memset,OutputDebugStringW,OutputDebugStringW,2_2_0000018DB55716E0
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8644:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8540:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8644:304:WilStaging_02
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8540:304:WilStaging_02
Source: C:\Users\user\Desktop\dropper.exeFile created: C:\Windows\Temp\tempdll.dllJump to behavior
Source: dropper.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\dropper.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: C:\Windows\System32\svchost.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Windows\System32\svchost.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: dropper.exeVirustotal: Detection: 8%
Source: unknownProcess created: C:\Users\user\Desktop\dropper.exe "C:\Users\user\Desktop\dropper.exe"
Source: C:\Users\user\Desktop\dropper.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\dropper.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\dropper.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe"Jump to behavior
Source: C:\Users\user\Desktop\dropper.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\Desktop\dropper.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Users\user\Desktop\dropper.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\Desktop\dropper.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\cmd.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Windows\System32\cmd.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\cmd.exeSection loaded: edgegdi.dllJump to behavior
Source: C:\Windows\System32\cmd.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Windows\System32\cmd.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\System32\winlogon.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Windows\System32\winlogon.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Windows\System32\lsass.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Windows\System32\lsass.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_3ea756ac68d34d21\IntelCpHDCPSvc.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_3ea756ac68d34d21\IntelCpHDCPSvc.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_3ea756ac68d34d21\IntelCpHDCPSvc.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Windows\System32\DriverStore\FileRepository\cui_dch.inf_amd64_2e49f48165b8de10\igfxCUIService.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Windows\System32\DriverStore\FileRepository\cui_dch.inf_amd64_2e49f48165b8de10\igfxCUIService.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\DriverStore\FileRepository\cui_dch.inf_amd64_2e49f48165b8de10\igfxCUIService.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_3ea756ac68d34d21\IntelCpHeciSvc.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_3ea756ac68d34d21\IntelCpHeciSvc.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_3ea756ac68d34d21\IntelCpHeciSvc.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Windows\System32\cmd.exeAutomated click: OK
Source: C:\Windows\System32\cmd.exeAutomated click: OK
Source: C:\Windows\System32\cmd.exeAutomated click: OK
Source: C:\Windows\System32\cmd.exeAutomated click: OK
Source: C:\Windows\System32\cmd.exeAutomated click: OK
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: dropper.exeStatic PE information: Virtual size of .text is bigger than: 0x100000
Source: dropper.exeStatic PE information: Image base 0x140000000 > 0x60000000
Source: dropper.exeStatic file information: File size 3272192 > 1048576
Source: dropper.exeStatic PE information: Raw size of .text is bigger than: 0x100000 < 0x15e800
Source: dropper.exeStatic PE information: Raw size of .rdata is bigger than: 0x100000 < 0x1b2a00
Source: dropper.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: dropper.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: dropper.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: dropper.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: dropper.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: dropper.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: dropper.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: dropper.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\winload_prod.pdb source: svchost.exe, 00000016.00000000.2130671960.000001B5E3047000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3193427514.000001B5E3047000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: dropper.pdb source: dropper.exe
Source: Binary string: (@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb source: svchost.exe, 00000016.00000002.3195423744.000001B5E3056000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000000.2130746542.000001B5E3056000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: *@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\47114209A62F3B9930F6B8998DFD4A991\ntkrnlmp.pdb source: svchost.exe, 00000016.00000002.3191177052.000001B5E302A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000000.2130567601.000001B5E302A000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: WINLOA~1.PDBwinload_prod.pdb source: svchost.exe, 00000016.00000002.3195423744.000001B5E3056000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000000.2130746542.000001B5E3056000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: dll.pdb source: dropper.exe, 00000000.00000002.1884570672.000001A430E5D000.00000004.00000020.00020000.00000000.sdmp, dropper.exe, 00000000.00000003.1882615898.000001A430E0A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2212735282.0000018DB33B0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2220804385.0000018DB33AF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2070286706.0000018DB33AE000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2218806552.0000018DB33B2000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2072316368.0000018DB33B0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2216982757.0000018DB33AE000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2181564640.0000018DB33B0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2218174599.0000018DB33B2000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2149509422.0000018DB33AE000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2220430653.0000018DB33AF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2217276174.0000018DB33B0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2221279512.0000018DB33AF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2220040011.0000018DB33AF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.3190828771.0000018DB559E000.00000002.00000001.01000000.00000005.sdmp, cmd.exe, 00000002.00000003.2218012129.0000018DB33B2000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2217431398.0000018DB33B1000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2217603396.0000018DB33B1000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2078070788.0000018DB33AE000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.3181126469.0000018DB339E000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2219557674.0000018DB33B0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2217855912.0000018DB33B1000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2220970397.0000018DB33AF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2219886652.0000018DB33AF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2058219378.0000018DB33AF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2218965092.0000018DB33B0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2221125043.0000018DB33AF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2218328970.0000018DB33B2000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.3199502615.00007FFD3582E000.00000002.00000001.01000000.00000005.sdmp, cmd.exe, 00000002.00000003.2215662587.0000018DB33AE000.00000004.00
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\winload_prod.pdbTCDE&@ source: svchost.exe, 00000016.00000000.2130671960.000001B5E3047000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3193427514.000001B5E3047000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: ,@\??\C:\Users\user\AppData\Local\Temp\TCDE700.tmp.pdb source: svchost.exe, 00000016.00000002.3195423744.000001B5E3056000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000000.2130746542.000001B5E3056000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062.pdb source: svchost.exe, 00000016.00000000.2130671960.000001B5E3047000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3193427514.000001B5E3047000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: .@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdbpdb source: svchost.exe, 00000016.00000002.3195423744.000001B5E3056000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000000.2130746542.000001B5E3056000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\47114209A62F3B9930F6B8998DFD4A991 source: svchost.exe, 00000016.00000000.2130671960.000001B5E3047000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3193427514.000001B5E3047000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: .@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: svchost.exe, 00000016.00000002.3195423744.000001B5E3056000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000000.2130746542.000001B5E3056000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\download.error source: svchost.exe, 00000016.00000000.2130671960.000001B5E3047000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3193427514.000001B5E3047000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: svchost.exe, 00000016.00000002.3195423744.000001B5E3056000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000000.2130746542.000001B5E3056000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: *@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\47114209A62F3B9930F6B8998DFD4A991\download.error source: svchost.exe, 00000016.00000002.3191177052.000001B5E302A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000000.2130567601.000001B5E302A000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: *@\??\C:\Users\user\AppData\Local\Temp\TCDE6E8.tmp.pdb source: svchost.exe, 00000016.00000002.3196355914.000001B5E306C000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000000.2130783393.000001B5E306C000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: dll.pdb( source: dropper.exe, 00000000.00000002.1884570672.000001A430E5D000.00000004.00000020.00020000.00000000.sdmp, dropper.exe, 00000000.00000003.1882615898.000001A430E0A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2212735282.0000018DB33B0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2220804385.0000018DB33AF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2070286706.0000018DB33AE000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2218806552.0000018DB33B2000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2072316368.0000018DB33B0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2216982757.0000018DB33AE000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2181564640.0000018DB33B0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2218174599.0000018DB33B2000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2149509422.0000018DB33AE000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2220430653.0000018DB33AF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2217276174.0000018DB33B0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2221279512.0000018DB33AF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2220040011.0000018DB33AF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.3190828771.0000018DB559E000.00000002.00000001.01000000.00000005.sdmp, cmd.exe, 00000002.00000003.2218012129.0000018DB33B2000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2217431398.0000018DB33B1000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2217603396.0000018DB33B1000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2078070788.0000018DB33AE000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.3181126469.0000018DB339E000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2219557674.0000018DB33B0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2217855912.0000018DB33B1000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2220970397.0000018DB33AF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2219886652.0000018DB33AF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2058219378.0000018DB33AF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2218965092.0000018DB33B0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2221125043.0000018DB33AF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2218328970.0000018DB33B2000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.3199502615.00007FFD3582E000.00000002.00000001.01000000.00000005.sdmp, cmd.exe, 00000002.00000003.2215662587.0000018DB33AE000.00000004.0
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\download.errork source: svchost.exe, 00000016.00000000.2130671960.000001B5E3047000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.3193427514.000001B5E3047000.00000004.00000001.00020000.00000000.sdmp
Source: dropper.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: dropper.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: dropper.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: dropper.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: dropper.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Source: C:\Users\user\Desktop\dropper.exeFile created: C:\Windows\Temp\tempdll.dllJump to dropped file
Source: C:\Users\user\Desktop\dropper.exeFile created: C:\Windows\Temp\tempdll.dllJump to dropped file

Boot Survival

barindex
Creates an autostart registry key pointing to binary in C:\Windows
Source: C:\Users\user\Desktop\dropper.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run HADESJump to behavior
Source: C:\Windows\System32\cmd.exeRegistry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WdBootJump to behavior
Source: C:\Users\user\Desktop\dropper.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run HADESJump to behavior
Source: C:\Users\user\Desktop\dropper.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run HADESJump to behavior

Malware Analysis System Evasion

barindex
Tries to delay execution (extensive OutputDebugStringW loop)
Source: C:\Users\user\Desktop\dropper.exeSection loaded: OutputDebugStringW count: 1273
Source: C:\Windows\System32\cmd.exeSection loaded: OutputDebugStringW count: 1973
Source: C:\Users\user\Desktop\dropper.exeDropped PE file which has not been started: C:\Windows\Temp\tempdll.dllJump to dropped file
Source: C:\Windows\System32\svchost.exe TID: 5324Thread sleep time: -30000s >= -30000sJump to behavior
Source: C:\Windows\System32\svchost.exeFile opened: PhysicalDrive0Jump to behavior
Source: C:\Windows\System32\cmd.exeCode function: 2_2_0000018DB558A380 OutputDebugStringW,CloseHandle,memset,FindFirstFileExW,FindClose,2_2_0000018DB558A380
Source: lsass.exe, 00000008.00000000.2059099698.000001A38FEB7000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: pvmicshutdownNT SERVICE
Source: svchost.exe, 00000009.00000002.3237382606.0000026FE3235000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: (@vmicheartbeat
Source: lsass.exe, 00000008.00000000.2059099698.000001A38FEB7000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: pvmicvssNT SERVICE
Source: svchost.exe, 00000009.00000000.2064269031.0000026FE3A7E000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: vmicshutdown
Source: svchost.exe, 00000009.00000002.3237382606.0000026FE3235000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: $@vmicheartbeat
Source: svchost.exe, 00000009.00000000.2064269031.0000026FE3A7E000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: vmicvss
Source: svchost.exe, 0000000C.00000002.3193541088.000001B2A9C2A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000C.00000000.2073124907.000001B2A9C2A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000C.00000000.2073077233.000001B2A9C13000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.3192343654.000001B2A9C13000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000022.00000000.2173616946.000001E697C51000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000022.00000000.2173542693.000001E697C24000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000022.00000002.3183843063.000001E697C24000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000022.00000000.2173831320.000001E697CD6000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000022.00000002.3185069503.000001E697C51000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
Source: svchost.exe, 00000020.00000002.3187956794.0000022F44000000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcUmRdpServiceDsSvcfhsvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionsvsvcStorSvcWwanSvcvmicvssDevQueryBrokerNgcSvcsysmainNetmanTabletInputServicePcaSvcDisplayEnhancementServiceIPxlatCfgSvcDeviceAssociationServiceNcbServiceEmbeddedModeSensorServicewlansvcCscServiceWPDBusEnumMixedRealityOpenXRSvc
Source: svchost.exe, 00000017.00000000.2134366278.000001C71B240000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000017.00000002.3199213454.000001C71B240000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: @Microsoft-Windows-Hyper-V-Hypervisorr
Source: lsass.exe, 00000008.00000000.2059099698.000001A38FEB7000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: pvmicheartbeatNT SERVICE
Source: svchost.exe, 00000009.00000002.3237382606.0000026FE3235000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: (@vmicshutdown
Source: svchost.exe, 00000009.00000002.3237382606.0000026FE3235000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: @vmicshutdown
Source: lsass.exe, 00000008.00000002.3190795223.000001A38FE13000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2058833437.000001A38FE13000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000002.3193329986.0000016CBE413000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000D.00000000.2076198777.0000016CBE413000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.3185248906.000001F58F22B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000010.00000000.2111549041.000001F58F22B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000000.2113275154.0000025B92229000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.3187952872.0000025B92229000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000013.00000002.3200127239.0000014944C5B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000013.00000000.2119204896.0000014944C5B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000017.00000000.2134366278.000001C71B240000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: svchost.exe, 00000009.00000000.2064269031.0000026FE3A7E000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: vmicheartbeat
Source: svchost.exe, 00000009.00000002.3237382606.0000026FE3235000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: @vmicheartbeat
Source: C:\Windows\System32\cmd.exeProcess information queried: ProcessInformationJump to behavior
Source: C:\Windows\System32\svchost.exeProcess queried: DebugObjectHandleJump to behavior
Source: C:\Windows\System32\svchost.exeProcess queried: DebugObjectHandleJump to behavior
Source: C:\Windows\System32\svchost.exeProcess queried: DebugObjectHandleJump to behavior
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF66CC97D54 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF66CC97D54
Source: C:\Windows\System32\cmd.exeCode function: 2_2_0000018DB5570470 memset,OutputDebugStringW,OutputDebugStringW,memset,OutputDebugStringW,memset,OutputDebugStringW,memset,OutputDebugStringW,memset,memset,OutputDebugStringW,memset,memset,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,memset,OutputDebugStringW,memset,OutputDebugStringW,GetLastError,2_2_0000018DB5570470
Source: C:\Users\user\Desktop\dropper.exeProcess token adjusted: DebugJump to behavior
Source: C:\Windows\System32\cmd.exeProcess token adjusted: DebugJump to behavior
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF66CC97D54 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF66CC97D54
Source: C:\Windows\System32\cmd.exeCode function: 2_2_0000018DB559A5EC IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_0000018DB559A5EC
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFD3582A5EC IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FFD3582A5EC
Source: C:\Users\user\Desktop\dropper.exeMemory allocated: page read and write | page guardJump to behavior

HIPS / PFW / Operating System Protection Evasion

barindex
Allocates memory in foreign processes
Source: C:\Users\user\Desktop\dropper.exeMemory allocated: C:\Windows\System32\cmd.exe base: 18DB3190000 protect: page read and writeJump to behavior
Creates a thread in another existing process (thread injection)
Source: C:\Users\user\Desktop\dropper.exeThread created: C:\Windows\System32\cmd.exe EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\winlogon.exe EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\lsass.exe EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\svchost.exe EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\fontdrvhost.exe EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\fontdrvhost.exe EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\svchost.exe EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\svchost.exe EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\dwm.exe EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\svchost.exe EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\svchost.exe EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\svchost.exe EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\svchost.exe EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\svchost.exe EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_3ea756ac68d34d21\IntelCpHDCPSvc.exe EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\svchost.exe EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\svchost.exe EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\svchost.exe EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\svchost.exe EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\DriverStore\FileRepository\cui_dch.inf_amd64_2e49f48165b8de10\igfxCUIService.exe EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_3ea756ac68d34d21\IntelCpHeciSvc.exe EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\svchost.exe EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\svchost.exe EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\svchost.exe EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\svchost.exe EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\svchost.exe EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\svchost.exe EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\svchost.exe EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\svchost.exe EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\svchost.exe EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\svchost.exe EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\svchost.exe EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\svchost.exe EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\svchost.exe EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\svchost.exe EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\svchost.exe EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\svchost.exe EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\svchost.exe EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 4FE404F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 4FE404F0Jump to behavior
Disables Windows Defender (deletes autostart)
Source: C:\Windows\System32\cmd.exeRegistry value deleted: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender DisableAntiSpywareJump to behavior
Found direct / indirect Syscall (likely to bypass EDR)
Source: C:\Users\user\Desktop\dropper.exeNtSetInformationThread: Direct from: 0x7FF66CC97937Jump to behavior
Source: C:\Users\user\Desktop\dropper.exeNtAllocateVirtualMemory: Direct from: 0x7FF66CB56A2FJump to behavior
Source: C:\Users\user\Desktop\dropper.exeNtWriteFile: Direct from: 0x7FF66CC7F617Jump to behavior
Source: C:\Users\user\Desktop\dropper.exeNtProtectVirtualMemory: Direct from: 0x7FFD51D62651Jump to behavior
Source: C:\Users\user\Desktop\dropper.exeNtQueryInformationProcess: Direct from: 0x7FF66CB4F67FJump to behavior
Source: C:\Users\user\Desktop\dropper.exeNtClose: Direct from: 0x7FF66CB4BF83
Source: C:\Users\user\Desktop\dropper.exeNtUnmapViewOfSection: Direct from: 0x7FF66CB4F7E5Jump to behavior
Source: C:\Users\user\Desktop\dropper.exeNtCreateThreadEx: Direct from: 0x7FF66CB4D30AJump to behavior
Source: C:\Users\user\Desktop\dropper.exeNtProtectVirtualMemory: Direct from: 0x7FF66CB4DBFBJump to behavior
Source: C:\Users\user\Desktop\dropper.exeNtMapViewOfSection: Direct from: 0x7FF66CB4FAF4Jump to behavior
Source: C:\Users\user\Desktop\dropper.exeNtClose: Direct from: 0x7FF66CC79691
Source: C:\Users\user\Desktop\dropper.exeNtSetValueKey: Indirect: 0x7FF66CB53B0CJump to behavior
Source: C:\Users\user\Desktop\dropper.exeNtAllocateVirtualMemory: Direct from: 0x7FF66CB4F694Jump to behavior
Source: C:\Users\user\Desktop\dropper.exeNtUnmapViewOfSection: Direct from: 0x7FF66CB49D14Jump to behavior
Source: C:\Users\user\Desktop\dropper.exeNtWriteVirtualMemory: Direct from: 0x7FF66CB4D0BAJump to behavior
Source: C:\Users\user\Desktop\dropper.exeNtAllocateVirtualMemory: Direct from: 0x7FF66CB4D076Jump to behavior
Source: C:\Users\user\Desktop\dropper.exeNtCreateFile: Direct from: 0x7FF66CC7F485Jump to behavior
Source: C:\Users\user\Desktop\dropper.exeNtClose: Direct from: 0x7FF66CB49E04
Injects code into the Windows Explorer (explorer.exe)
Source: C:\Windows\System32\cmd.exeMemory written: PID: 4964 base: F10000 value: 43Jump to behavior
Writes to foreign memory regions
Source: C:\Users\user\Desktop\dropper.exeMemory written: C:\Windows\System32\cmd.exe base: 18DB3190000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\winlogon.exe base: 2762E6B0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\lsass.exe base: 1A390470000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 26FE39A0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\fontdrvhost.exe base: 26A6BB30000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\fontdrvhost.exe base: 29B91070000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 1B2A9FA0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 16CBF100000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\dwm.exe base: 1EE81FE0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 197E1D40000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 1F58F1F0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 25B92AA0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 23DE7CD0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 149459C0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_3ea756ac68d34d21\IntelCpHDCPSvc.exe base: 2ED65B60000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 2CB1E680000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 1B5E37D0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 1C71B9F0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 1D397950000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\DriverStore\FileRepository\cui_dch.inf_amd64_2e49f48165b8de10\igfxCUIService.exe base: 2C598060000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_3ea756ac68d34d21\IntelCpHeciSvc.exe base: 25556220000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 1F1A39C0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 1EC87870000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 29C5AEC0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 1FD305F0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 213A95A0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 22F44D60000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 2341B5E0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 1E698540000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 209C0F50000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 2CDEBBD0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 14605FD0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 256FE5E0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 2026C590000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 128F07E0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 17DDBDF0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 2112D1D0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 22F53F40000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 1DA07B80000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\spoolsv.exe base: 950000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 1B63E7C0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 295395A0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 2E2F8740000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 1EE9B940000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 246B4DD0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 22AE6FE0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 21280190000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\DriverStore\FileRepository\igcc_dch.inf_amd64_78ff17a5ea060c5f\OneApp.IGCC.WinService.exe base: 2037CEE0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 2431A2D0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 21717590000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 27D17F40000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 286958F0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 26DF0140000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\DriverStore\FileRepository\dal.inf_amd64_ffc75848a6342fdf\jhi_service.exe base: 29411300000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 186D1D30000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 215F64B0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\sihost.exe base: 1A9DAE80000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 1FE4A430000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe base: C00000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 238922D0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 21479B10000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 1F6319F0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\ctfmon.exe base: 205A8DE0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 261DD8E0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\explorer.exe base: F10000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\DriverStore\FileRepository\cui_dch.inf_amd64_2e49f48165b8de10\igfxEM.exe base: 12899560000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 1CEDB3A0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: 18B9E5F0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 17ABD5D0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: 266AEFB0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 27C9A270000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 2A9D75B0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 20BCE060000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe base: 213E39E0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\SettingSyncHost.exe base: 1DCF8AC0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: 162E18B0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 16A41B90000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\audiodg.exe base: 1EC1D6E0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\dllhost.exe base: 24A4FDB0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 230AF060000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\smartscreen.exe base: 1D95EE70000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe base: 4D0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 2C108CF0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 244269E0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: 21233780000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\ApplicationFrameHost.exe base: 1B96B8B0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\oobe\UserOOBEBroker.exe base: 236447E0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 2CD2E650000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 1FA83720000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 4330000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 4340000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 4350000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 4360000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 4370000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 4380000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 4390000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 43A0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 44B0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 4640000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 46D0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 46E0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\conhost.exe base: 28ED8280000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\dllhost.exe base: 1221EC50000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 16D911C0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 1BA4B2F0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: 1490000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: D00000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: 9B0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: A00000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: 9E0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: A20000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: 1300000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: 13F0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: AD0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: 680000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: 590000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: 9C0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: 1410000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: 3C0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: D80000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: 930000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: 820000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: 5A0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: 13D0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: C00000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: CF0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: 550000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: CE0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: 530000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: D80000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: F90000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: FA0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: 770000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: 7A0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: 920000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: 1400000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: CF0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: 960000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: D80000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: C20000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: 6E0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: 500000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: 400000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: 13D0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: 570000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: C20000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: 1400000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: D80000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: 900000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: 190000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: 930000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: 1220000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: 980000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: 420000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: 550000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: 550000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: 780000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: C80000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: 1350000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: 720000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: D10000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: CF0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: 9D0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: 150000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: 9C0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: C60000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: 12D0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: C40000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: 840000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: FA0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: D80000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: AA0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: D80000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: F80000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: 9D0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: 5C0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: CD0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: 890000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: D80000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: CB0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: 500000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: 700000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: D10000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: 510000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: CE0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: 1100000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: CA0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: AA0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: 370000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: 8C0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: BD0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: 800000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: 1360000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: 13B0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: DC0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: CE0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\zcrBPfwpvXXlXVchuzoqddqkjjCMVllWdcqvnupsxpuvBsawHArAwDxSNDpGxMfcg\VvPEZLBBqlFoYSKVXxZ.exe base: 13D0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 156F8390000Jump to behavior
Source: C:\Windows\System32\lsass.exeMemory written: C:\Windows\System32\svchost.exe base: 1B2A9FE0000Jump to behavior
Source: C:\Windows\System32\lsass.exeMemory written: C:\Windows\System32\svchost.exe base: 1B2A9FB0000Jump to behavior
Source: winlogon.exe, 00000007.00000000.2057164273.000002762F100000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000007.00000002.3221346358.000002762F100000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 0000000E.00000002.3314634057.000001EEFBDAC000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Program Manager
Source: winlogon.exe, 00000007.00000000.2057164273.000002762F100000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000007.00000002.3221346358.000002762F100000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 0000000E.00000000.2084298746.000001EEF54B0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Shell_TrayWnd
Source: winlogon.exe, 00000007.00000000.2057164273.000002762F100000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000007.00000002.3221346358.000002762F100000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 0000000E.00000000.2084298746.000001EEF54B0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
Source: winlogon.exe, 00000007.00000000.2057164273.000002762F100000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000007.00000002.3221346358.000002762F100000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 0000000E.00000000.2084298746.000001EEF54B0000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF66CC97C2C GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,0_2_00007FF66CC97C2C

Lowering of HIPS / PFW / Operating System Security Settings

barindex
Changes security center settings (notifications, updates, antivirus, firewall)
Source: C:\Windows\System32\cmd.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center FirewallOverrideJump to behavior
Disable Windows Defender real time protection (registry)
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows DefenderRegistry value created: DisableAntiSpyware 1Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows DefenderRegistry value created: DisableAntiVirus 1Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngineRegistry value created: MpEnablePus 1Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time ProtectionRegistry value created: DisableBehaviorMonitoring 1Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time ProtectionRegistry value created: DisableIOAVProtection 1Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time ProtectionRegistry value created: DisableOnAccessProtection 1Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time ProtectionRegistry value created: DisableRealtimeMonitoring 1Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time ProtectionRegistry value created: DisableScanOnRealtimeEnable 1Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\ReportingRegistry value created: DisableEnhancedNotifications 1Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNetRegistry value created: DisableBlockAtFirstSeen 1Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNetRegistry value created: SpynetReporting 1Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNetRegistry value created: SubmitSamplesConsent 1Jump to behavior
Source: Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.23.drBinary or memory string: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2108.7-0\MsMpEng.exe

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation1
Windows Service		1
Windows Service		1
Masquerading		OS Credential Dumping1
System Time Discovery		Remote Services1
Archive Collected Data		2
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/Job11
Registry Run Keys / Startup Folder		42
Process Injection		13
Virtualization/Sandbox Evasion		LSASS Memory51
Security Software Discovery		Remote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAt1
LSASS Driver		1
Abuse Elevation Control Mechanism		31
Disable or Modify Tools		Security Account Manager13
Virtualization/Sandbox Evasion		SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCron1
DLL Side-Loading		11
Registry Run Keys / Startup Folder		42
Process Injection		NTDS3
Process Discovery		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script1
LSASS Driver		1
Abuse Elevation Control Mechanism		LSA Secrets1
Remote System Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts1
DLL Side-Loading		1
DLL Side-Loading		Cached Domain Credentials1
File and Directory Discovery		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup Items1
Bypass User Account Control		1
Bypass User Account Control		DCSync22
System Information Discovery		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
dropper.exe8%VirustotalBrowse

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://outlook.comcom0%Avira URL Cloudsafe
https://word.office.com.com-0%Avira URL Cloudsafe
https://excel.office.comSRD1%0%Avira URL Cloudsafe
https://word.office.com.com0%Avira URL Cloudsafe
https://word.office.com.comP0%Avira URL Cloudsafe
https://word.office.com.come.0%Avira URL Cloudsafe
https://powerpoint.office.comSRD130%Avira URL Cloudsafe
https://word.office.com.comg0%Avira URL Cloudsafe
https://outlook.comSRD1-0%Avira URL Cloudsafe
https://word.office.comSRD1#0%Avira URL Cloudsafe
http://ns.adobe.0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
https://word.office.comsvchost.exe, 0000002A.00000000.2200442571.000002112D248000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002A.00000000.2206324463.000002112E39E000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002A.00000000.2200584743.000002112D2AD000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3257108142.000002112DCC7000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3208200155.000002112D2AD000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002A.00000000.2202948151.000002112DCC7000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.3117383882.000002112D2A1000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.3113776788.000002112D28E000.00000004.00000001.00020000.00000000.sdmpfalse
    		high
    http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702lsass.exe, 00000008.00000000.2058877226.000001A38FE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3191876258.000001A38FE2F000.00000004.00000001.00020000.00000000.sdmpfalse
      		high
      https://windows.msn.com/shellsvchost.exe, 00000009.00000002.3251239349.0000026FE3A00000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000009.00000000.2064038066.0000026FE3A00000.00000004.00000001.00020000.00000000.sdmpfalse
        		high
        https://word.office.com.comPsvchost.exe, 0000002A.00000000.2206324463.000002112E39E000.00000004.00000001.00020000.00000000.sdmpfalse
        • Avira URL Cloud: safe
        		unknown
        http://schemas.xmlsoap.org/ws/2004/09/policylsass.exe, 00000008.00000000.2058877226.000001A38FE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3191876258.000001A38FE2F000.00000004.00000001.00020000.00000000.sdmpfalse
          		high
          http://schemas.xmlsoap.org/wsdl/ertieslsass.exe, 00000008.00000000.2058877226.000001A38FE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3191876258.000001A38FE2F000.00000004.00000001.00020000.00000000.sdmpfalse
            		high
            https://word.office.com.come.svchost.exe, 0000002A.00000000.2200584743.000002112D2AD000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3208200155.000002112D2AD000.00000004.00000001.00020000.00000000.sdmpfalse
            • Avira URL Cloud: safe
            		unknown
            https://wns2-ch1p.notify.windows.com/?token=AwYAAACoeV5AW%2fYHIYoIKM61bk4FViHsaGhVdbesI0lBnxjA4liMEdMicrosoft-Windows-PushNotification-Platform%4Operational.evtx.23.drfalse
              		high
              https://outlook.comcomsvchost.exe, 0000002A.00000002.3281182044.000002112E642000.00000004.00000001.00020000.00000000.sdmpfalse
              • Avira URL Cloud: safe
              		unknown
              https://docs.rs/getrandom#nodejs-es-module-supportdropper.exe, tempdll.dll.0.drfalse
                		high
                https://wns2-ch1p.notify.windows.com/?token=AwYAAAAZ50ULGcXAhxlA4fj3374VoLA3vV4RBVRz1XHzN0x%2f0yimslMicrosoft-Windows-PushNotification-Platform%4Operational.evtx.23.drfalse
                  		high
                  https://www.office.com/pwaimagessvchost.exe, 0000002A.00000000.2202790612.000002112DC65000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3256255118.000002112DC65000.00000004.00000001.00020000.00000000.sdmpfalse
                    		high
                    http://schemas.xmlsoap.org/ws/2005/02/trustlsass.exe, 00000008.00000000.2058877226.000001A38FE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3191876258.000001A38FE2F000.00000004.00000001.00020000.00000000.sdmpfalse
                      		high
                      http://schemas.microsvchost.exe, 0000001B.00000002.3214293241.000001F1A3910000.00000002.00000001.00040000.00000000.sdmpfalse
                        		high
                        https://outlook.comsvchost.exe, 0000002A.00000002.3281182044.000002112E642000.00000004.00000001.00020000.00000000.sdmpfalse
                          		high
                          http://docs.oasis-open.org/wss/2004/XX/oasis-2004XX-wss-saml-token-profile-1.0#SAMLAssertionIDsvchost.exe, 00000017.00000003.2304480297.000001C71D6D6000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000017.00000003.2299310316.000001C71D6D5000.00000004.00000001.00020000.00000000.sdmp, Microsoft-Windows-LiveId%4Operational.evtx.23.drfalse
                            		high
                            http://schemas.xmlsoap.org/ws/2005/07/securitypolicylsass.exe, 00000008.00000000.2058877226.000001A38FE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2058925814.000001A38FE4F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3191876258.000001A38FE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3193452173.000001A38FE4F000.00000004.00000001.00020000.00000000.sdmpfalse
                              		high
                              https://word.office.com.comsvchost.exe, 0000002A.00000000.2200442571.000002112D248000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.3117383882.000002112D2A1000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002A.00000003.3113776788.000002112D28E000.00000004.00000001.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              https://excel.office.comSRD1%svchost.exe, 0000002A.00000000.2200272334.000002112D213000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002A.00000000.2206188866.000002112E37F000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3196529294.000002112D213000.00000004.00000001.00020000.00000000.sdmpfalse
                              • Avira URL Cloud: safe
                              		unknown
                              http://schemas.xmlsoap.org/wsdl/soap12/lsass.exe, 00000008.00000000.2058877226.000001A38FE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3191876258.000001A38FE2F000.00000004.00000001.00020000.00000000.sdmpfalse
                                		high
                                https://word.office.com.com-svchost.exe, 0000002A.00000000.2206324463.000002112E39E000.00000004.00000001.00020000.00000000.sdmpfalse
                                • Avira URL Cloud: safe
                                		unknown
                                https://spclient.wg.spotify.com/v1/live-tile-xml?region=svchost.exe, 00000009.00000000.2064235329.0000026FE3A63000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3255056645.0000026FE3A63000.00000004.00000001.00020000.00000000.sdmpfalse
                                  		high
                                  http://schemas.xmlsoap.org/wsdl/lsass.exe, 00000008.00000000.2058877226.000001A38FE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3191876258.000001A38FE2F000.00000004.00000001.00020000.00000000.sdmpfalse
                                    		high
                                    https://powerpoint.office.comSRD13svchost.exe, 0000002A.00000000.2206188866.000002112E37F000.00000004.00000001.00020000.00000000.sdmpfalse
                                    • Avira URL Cloud: safe
                                    		unknown
                                    https://word.office.com.comgsvchost.exe, 0000002A.00000002.3257108142.000002112DCC7000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002A.00000000.2202948151.000002112DCC7000.00000004.00000001.00020000.00000000.sdmpfalse
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://schemas.xmlsoap.org/wsdl/soap12/Plsass.exe, 00000008.00000000.2058877226.000001A38FE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3191876258.000001A38FE2F000.00000004.00000001.00020000.00000000.sdmpfalse
                                      		high
                                      https://outlook.comSRD1-svchost.exe, 0000002A.00000000.2203052325.000002112DCCF000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002A.00000000.2206188866.000002112E37F000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3257777182.000002112DCCF000.00000004.00000001.00020000.00000000.sdmpfalse
                                      • Avira URL Cloud: safe
                                      		unknown
                                      https://windows.msn.cn/shellRESPsvchost.exe, 00000009.00000002.3251239349.0000026FE3A00000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000009.00000000.2064038066.0000026FE3A00000.00000004.00000001.00020000.00000000.sdmpfalse
                                        		high
                                        http://www.quovadis.bm0lsass.exe, 00000008.00000002.3216736409.000001A39066B000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2059601768.000001A39066B000.00000004.00000001.00020000.00000000.sdmp, dwm.exe, 0000000E.00000000.2085328161.000001EEF74F8000.00000004.00000001.00020000.00000000.sdmp, dwm.exe, 0000000E.00000002.3293932255.000001EEF74F8000.00000004.00000001.00020000.00000000.sdmpfalse
                                          		high
                                          https://word.office.comSRD1#svchost.exe, 0000002A.00000000.2203052325.000002112DCCF000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002A.00000000.2206188866.000002112E37F000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000002A.00000002.3257777182.000002112DCCF000.00000004.00000001.00020000.00000000.sdmpfalse
                                          • Avira URL Cloud: safe
                                          		unknown
                                          https://api.msn.com/svchost.exe, 00000025.00000000.2184148345.0000014606024000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000025.00000002.2296189659.0000014606024000.00000004.00000001.00020000.00000000.sdmpfalse
                                            		high
                                            http://docs.oasis-open.org/ws-sx/ws-trust/200512lsass.exe, 00000008.00000000.2058925814.000001A38FE4F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3193452173.000001A38FE4F000.00000004.00000001.00020000.00000000.sdmpfalse
                                              		high
                                              http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdlsass.exe, 00000008.00000000.2058877226.000001A38FE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3191876258.000001A38FE2F000.00000004.00000001.00020000.00000000.sdmpfalse
                                                		high
                                                http://schemas.xmlsoap.org/wsdl/rameterslsass.exe, 00000008.00000000.2058877226.000001A38FE2F000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000002.3191876258.000001A38FE2F000.00000004.00000001.00020000.00000000.sdmpfalse
                                                  		high
                                                  http://ns.adobe.dropper.exefalse
                                                  • Avira URL Cloud: safe
                                                  		unknown
                                                  https://ocsp.quovadisoffshore.com0lsass.exe, 00000008.00000002.3216736409.000001A39066B000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000008.00000000.2059601768.000001A39066B000.00000004.00000001.00020000.00000000.sdmp, dwm.exe, 0000000E.00000000.2085328161.000001EEF74F8000.00000004.00000001.00020000.00000000.sdmp, dwm.exe, 0000000E.00000002.3293932255.000001EEF74F8000.00000004.00000001.00020000.00000000.sdmpfalse
                                                    		high
                                                    http://www.google.com/svchost.exe, 00000025.00000000.2184148345.0000014606024000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000025.00000000.2184100973.0000014606013000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000025.00000003.2295274386.0000014606014000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000025.00000002.2296097609.000001460601B000.00000004.00000001.00020000.00000000.sdmpfalse
                                                      		high

                                                      World Map of Contacted IPs

                                                      • No. of IPs < 25%
                                                      • 25% < No. of IPs < 50%
                                                      • 50% < No. of IPs < 75%
                                                      • 75% < No. of IPs

                                                      Public IPs

                                                      IPDomainCountryFlagASNASN NameMalicious
                                                      1.1.1.1
                                                      		unknownAustralia
                                                      		13335CLOUDFLARENETUSfalse

                                                      General Information

                                                      Joe Sandbox version:41.0.0 Charoite
                                                      Analysis ID:1586515
                                                      Start date and time:2025-01-09 08:44:45 +01:00
                                                      Joe Sandbox product:CloudBasic
                                                      Overall analysis duration:0h 11m 7s
                                                      Hypervisor based Inspection enabled:false
                                                      Report type:full
                                                      Cookbook file name:default.jbs
                                                      Analysis system description:Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 128, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
                                                      Number of analysed new started processes analysed:7
                                                      Number of new started drivers analysed:0
                                                      Number of existing processes analysed:0
                                                      Number of existing drivers analysed:0
                                                      Number of injected processes analysed:37
                                                      Technologies:
                                                      • HCA enabled
                                                      • EGA enabled
                                                      • AMSI enabled
                                                      Analysis Mode:default
                                                      Analysis stop reason:Timeout
                                                      Sample name:dropper.exe
                                                      Detection:MAL
                                                      Classification:mal66.evad.winEXE@5/60@0/1
                                                      EGA Information:
                                                      • Successful, ratio: 100%
                                                      HCA Information:Failed
                                                      Cookbook Comments:
                                                      • Found application associated with file extension: .exe

                                                      Warnings

                                                      • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, conhost.exe
                                                      • Excluded domains from analysis (whitelisted): ctldl.windowsupdate.com
                                                      • Not all processes where analyzed, report is missing behavior information
                                                      • Report size exceeded maximum capacity and may have missing behavior information.

                                                      Simulations

                                                      Behavior and APIs

                                                      TimeTypeDescription
                                                      02:47:31API Interceptor1x Sleep call for process: svchost.exe modified

                                                      Joe Sandbox View / Context

                                                      IPs

                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                      1.1.1.1watchdog.elfGet hashmaliciousXmrigBrowse
                                                      • 1.1.1.1:8080/
                                                      6fW0GedR6j.xlsGet hashmaliciousUnknownBrowse
                                                      • 1.1.1.1/ctrl/playback.php
                                                      PO-230821_pdf.exeGet hashmaliciousFormBook, NSISDropperBrowse
                                                      • www.974dp.com/sn26/?kJBLpb8=qaEGeuQorcUQurUZCuE8d9pas+Z0M0brqtX248JBolEfq8j8F1R9i1jKZexhxY54UlRG&ML0tl=NZlpi
                                                      AFfv8HpACF.exeGet hashmaliciousUnknownBrowse
                                                      • 1.1.1.1/
                                                      INVOICE_90990_PDF.exeGet hashmaliciousFormBookBrowse
                                                      • www.quranvisor.com/usvr/?mN9d3vF=HHrW7cA9N4YJlebHFvlsdlDciSnnaQItEG8Ccfxp291VjnjcuwoPACt7EOqEq4SWjIf8&Pjf81=-Zdd-V5hqhM4p2S
                                                      Go.exeGet hashmaliciousUnknownBrowse
                                                      • 1.1.1.1/

                                                      Domains

                                                      ⊘No context

                                                      ASNs

                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                      CLOUDFLARENETUSchrtrome22.exeGet hashmaliciousXmrigBrowse
                                                      • 172.67.144.26
                                                      uU6IvUPN39.exeGet hashmaliciousLummaCBrowse
                                                      • 104.21.96.1
                                                      QUOTATION#050125.exeGet hashmaliciousFormBookBrowse
                                                      • 104.21.64.1
                                                      xCnwCctDWC.exeGet hashmaliciousLummaCBrowse
                                                      • 104.21.56.70
                                                      DLKs2Qeljg.exeGet hashmaliciousLummaCBrowse
                                                      • 104.21.56.70
                                                      fuk7RfLrD3.exeGet hashmaliciousLummaCBrowse
                                                      • 104.21.80.1
                                                      Ljrprfl3BH.exeGet hashmaliciousLummaCBrowse
                                                      • 104.21.64.1
                                                      PO1178236.scr.exeGet hashmaliciousUnknownBrowse
                                                      • 188.114.96.3
                                                      Subscription_Renewal_Invoice_2025_FGHDCS.htmlGet hashmaliciousHTMLPhisherBrowse
                                                      • 188.114.96.3
                                                      PO1178236.scr.exeGet hashmaliciousUnknownBrowse
                                                      • 188.114.96.3

                                                      JA3 Fingerprints

                                                      ⊘No context

                                                      Dropped Files

                                                      ⊘No context

                                                      Created / dropped Files

                                                      C:\Windows\System32\winevt\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx

                                                      Download File
                                                      Process:C:\Windows\System32\svchost.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):65536
                                                      Entropy (8bit):4.318930277753555
                                                      Encrypted:false
                                                      SSDEEP:192:Y8V7IF0RuqHQOnbgpib8AtYl+HDJ86PL+2SSD2Czp0gy16ZcC0/oUhQXzgwPtFqy:jhkyHQOLt5jR7zpkYQ9EM/TG6OtiY
                                                      MD5:F9EC05B1768AF883353DA3993F200C7E
                                                      SHA1:05DDCE9F6DAD491408B135CB8C07867E521361B1
                                                      SHA-256:B3D63F6A3C01023709938CAEEAA0CEA0CF71CAB3FC91AD19C98762D40746D7E9
                                                      SHA-512:098E439C8B03E83A21F1A27068E43310720EE38B2F215A1939A9C4CC86EDC5A90D7A12178FD2CCDDC4C5891A7620A884B6B730D9604553153D333C29EF5A128F
                                                      Malicious:false
                                                      Preview:ElfChnk.u...............u............................z.g....................................................................G.I.................0.......................X...=...........................................................................................................................f...............?...........................m...................M...F...............................................................&...............................9...........................).......................**......u.........K.i........./X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                      C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx

                                                      Download File
                                                      Process:C:\Windows\System32\svchost.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):65536
                                                      Entropy (8bit):1.4706338124119585
                                                      Encrypted:false
                                                      SSDEEP:384:RAhBNimLN3UN3pNINcN3uN36ZN3fcN3dN3xzN3lN3RN3sN3YN3zN3TN3JN3xN3ks:OAaC30SyTx57f6u5Z3/y2Fpwsfv
                                                      MD5:9EBB1C7AC39375B2EA84CFA8E50E00CB
                                                      SHA1:20A6044DCB8584AAE46DF2D229040052A810206E
                                                      SHA-256:161949189705623278225571E09B6808271B9B71F951E29B2DFABFB11848AC76
                                                      SHA-512:08BDADE8C38CFE2CF608AE9E352D9AA6A92D12731ECAA68ABB4C919B5009528268A910963270C30EC68F8D6CEA2C788CFE02822F10277BE096A0FE527813DD0F
                                                      Malicious:false
                                                      Preview:ElfChnk._.......y......._.......y............G..xI...h........................................................................<................,.......................T...=...........................................................................................................................f...............?...........................m...................M...F...............................................................&...................................................................................**......_..........f,........./X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                      C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx

                                                      Download File
                                                      Process:C:\Windows\System32\svchost.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):66960
                                                      Entropy (8bit):4.313849716381436
                                                      Encrypted:false
                                                      SSDEEP:384:LrVnV9hKVQV7VdVdEV/jVAVjVKV+VsV6VxVpV5mVmVoVJVsVuVSVRVLViVfV3VFI:LpfA2tRq6
                                                      MD5:BB3BDDA3E93F0CD0ADD00D2B1CF4B62D
                                                      SHA1:BFF16C4EF7966302C9C718B2C31147B57104FAF1
                                                      SHA-256:8A22422885B24E2D9B01351219F6334D0E3AD8330D13862B335F6ECF863B77B5
                                                      SHA-512:0049F2EB1D6F08E0A074AE28864923EC969B6D6FC1F912F5C48C7648DCFF04C85749A7B8E08FCC04E950ED0CC67DA0B593369E50732C4A2B086765290DCFF431
                                                      Malicious:false
                                                      Preview:ElfChnk.|(.......(......|(.......(..........hj..0l....gl.....................................................................XRt................0.......................X...=...........................................................................................................................f...............?...........................m...................M...F...............................................................&............................................&...............................#......**.......(.......j].jb......../X.P&...............................................................@.......X...a.!.....E..........@.j].jb...._.7b..#._.7b..8...<....(...................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.A.p.p.X.D.e.p.l.o.y.m.e.n.t...'..Y.J.R>:..=_M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.A.p.p.X.D.e.p.l.o.y.m.e.n.t./.O.p.e.r.a.t.i.o.n.a.l...f.d.........N...M.i.c.r.o.s.o.f.t...W.i.n.d.o.w.s...S.e.a.r.c.h._.c.w.5.n.1.h.2.t.x.y.e.w.y............**.......(........^.jb......../X

                                                      C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx

                                                      Download File
                                                      Process:C:\Windows\System32\svchost.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):65536
                                                      Entropy (8bit):4.391844289862266
                                                      Encrypted:false
                                                      SSDEEP:1536:JF1fni2TDyiWAZfBzB6BbB2e7GBc423KDi/OyazwNJCmikDw:VfjDyZA
                                                      MD5:B4EE21F55D004E293A6BB74AC3D2C249
                                                      SHA1:7C324D11AD2C1D1AA106AF91313C54E229AEFB35
                                                      SHA-256:666A6EC29D67886EDA190C709145EBE55D2CD91FC50A275A87E44D0692D97486
                                                      SHA-512:A2A433518281B20132AF13A10134B2691EA757C4859F0DB861E2FA7624CE6C11F38D276B1867040BC4728FD68BD92CD9167D017716210ECAA6D3BA679F0062F1
                                                      Malicious:false
                                                      Preview:ElfChnk..'.......'.......'.......(................r.........................................................................G................J.......................r...=...........................................................................................................................f...............?...........................m...................M...F...............................3W..#>.......................N..&........................................8...;.......@......;5...........`..........**.......'........~........./X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                      C:\Windows\System32\winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx

                                                      Download File
                                                      Process:C:\Windows\System32\svchost.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):65536
                                                      Entropy (8bit):2.3391301654396366
                                                      Encrypted:false
                                                      SSDEEP:384:Phm+iMNEi1itiXiYiAiQiCiYiXiviCiriMiKiYili+iciSiVciji/DiQisiKi7iM:P8
                                                      MD5:DEBDC0C72E9EA725D563FA651BB279F5
                                                      SHA1:46981213FC3464FF24B8BBDD02F8FD049EFE6FD6
                                                      SHA-256:1FB6DB92B3C51647BA0AF9F1C263BD857C3D4C060711C1789B2613893EF1EDED
                                                      SHA-512:C73C993ADE513860837F5F85428D9FBC7CBFE33C8E5616AED75E9486655EA2479D6B8766E179ED456A6666E28C596F7BD18FFC8B95983AA720F320EF135B6CCF
                                                      Malicious:false
                                                      Preview:ElfChnk.........3...............3........... z..h|....#u....................................................................$.].............................................=...........................................................................................................................f...............?...................................b...........M...F...........................................................&.......................................................................................**..X..............w............>.&.........>..'.W.U2..9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                      C:\Windows\System32\winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Telemetry.evtx

                                                      Download File
                                                      Process:C:\Windows\System32\svchost.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):65536
                                                      Entropy (8bit):4.449671342929986
                                                      Encrypted:false
                                                      SSDEEP:384:DhI3c6dh3O3Km30v3635B33H353X3g3J3N33Lv3j3j3A3730j3ue3H3T39z3IM3g:DkqL+Tl5qhdWFgwc4MElvawvMLwk
                                                      MD5:4760A70F75BE731B95E52BB164B22A49
                                                      SHA1:D20B570C71034636276868FF263E067EE2BD2210
                                                      SHA-256:3C664D51CBE406710CE779EE7B0A0849D853362F55EC3EE94AE2C4E4EA1C3126
                                                      SHA-512:CA5CDB03173B24827CA8FDFD60D0E0E670AFE7C9D05DE1D18C5B84826A8D185E69C95E0EF28FA45BA1AA917F68B135E5F2817D09C6F620CF5EC707FDD673851A
                                                      Malicious:false
                                                      Preview:ElfChnk.........^...............^...........`........)...................................................................... .R.............................................=...............u...........................................................................................................H...............?...............................................M...F...........................................&................9......................................................................j...............**.................*T.........B...&.......B...._.X.$.]...+........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                      C:\Windows\System32\winevt\Logs\Microsoft-Windows-Audio%4Operational.evtx

                                                      Download File
                                                      Process:C:\Windows\System32\svchost.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):65536
                                                      Entropy (8bit):4.225930179138989
                                                      Encrypted:false
                                                      SSDEEP:768:APcpk0+dN1RzsZrczv9ezTjlRLD1xzzmfgO5WJ:I4PTjX
                                                      MD5:0241AE8604B37FC414D6B44A74DF0BE5
                                                      SHA1:ECEC080B827CC1ED72D18597354E871AE65D7546
                                                      SHA-256:92B23B21E1223AA060444C5EF3E75788F504E05A44284F11AE8669CEFB959369
                                                      SHA-512:C7A45C8B4A2C7A265D0E6EE8EC6D70FE56FC0122AA3E3F16155DF449C25CF805082305CE2B66C6B2C8432B89F40EA4C8FE301D076329CECB84FE27328F201609
                                                      Malicious:false
                                                      Preview:ElfChnk......................................&...(...1.........................................................................<........................................4...=...........................................................................................................................f...............?...........................m...................M...F...............................................................&...................................................................................**...............q..f........./X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                      C:\Windows\System32\winevt\Logs\Microsoft-Windows-CloudStore%4Operational.evtx

                                                      Download File
                                                      Process:C:\Windows\System32\svchost.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):65536
                                                      Entropy (8bit):2.954950121496903
                                                      Encrypted:false
                                                      SSDEEP:768:ql/LLKiILbXvvvD7rrXuXtPPrzbvjPH7btz:RiZX
                                                      MD5:C8941DD3FD74AB9F76A08A0FCB5AA990
                                                      SHA1:336094A88ADF968D18F8BF290090DDCB19F86D51
                                                      SHA-256:8F2CED9BA1F029FB496DCE6FDE143DAAFFBEA70B86DAAC0670CBA58486F6F28E
                                                      SHA-512:8CE99D3852F718054816B669A48CBFEA3883052237B9302D73504C088C1DDCDD16BDA228CD913F4230BC53FE213D6CD40127327D5DF9D707F5DB2F3A80FE6CA5
                                                      Malicious:false
                                                      Preview:ElfChnk.........................................p...d.g.......................................................................K.................0.......................X...=...........................................................................................................................f...............?...........................m...................M...F...............................................................&...................................................................................**.................g,........./X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                      C:\Windows\System32\winevt\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx

                                                      Download File
                                                      Process:C:\Windows\System32\svchost.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):4520
                                                      Entropy (8bit):4.063354718621003
                                                      Encrypted:false
                                                      SSDEEP:48:MQzpWSnDSZDSnkvcgrzeNp/TuHSZDSrCAAlxXWzOXWV53ayovfUSZDSKLeLDbSZA:N9DoGkvcgrSvTooF0+NyokopKvboMyo9
                                                      MD5:59CCA1F36936F2B2836DFD8CF03BC06E
                                                      SHA1:9D9071E2192F351F9FF0D96AF4EA77859C4688B7
                                                      SHA-256:2C2A2F91D3E53BEBFBB6E1811AF613A6598D5C844518A0A49FD1D18B546AA3F2
                                                      SHA-512:8F1F7CFE0C0F0679BE01F2405E3542D9DA619B153FB2FE1E843644F14BC3D414F60451DC56EBA3C66D2CDABF51120FD6AFEF9A513B33D9665E01989751B4CB4B
                                                      Malicious:false
                                                      Preview:ElfChnk.........Q...............Q...........@...p.....`.......................................................................................:.......................b...=...........................................................................................................................f...............?...........................m...................M...F...............................................................M...................................-...............E{..............................**.. ...N.......y.B.jb......../X.P................................................................>.......V.....!..o..............y.B.jb...._.7b...._.7b..t.......N....................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.C.o.d.e.I.n.t.e.g.r.i.t.y..k.N.<.D..97d>7.M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.C.o.d.e.I.n.t.e.g.r.i.t.y./.O.p.e.r.a.t.i.o.n.a.l...be.`-.......be.`g..^...:@.p...............:....A..3...b...%....=.......F.i.l.e.N.a.m.e.L.e.n.g.t.h.......A..3...b...%....=.......F.i.l.e.N

                                                      C:\Windows\System32\winevt\Logs\Microsoft-Windows-Containers-BindFlt%4Operational.evtx

                                                      Download File
                                                      Process:C:\Windows\System32\svchost.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):65536
                                                      Entropy (8bit):2.204276689314362
                                                      Encrypted:false
                                                      SSDEEP:384:ChNPmP1PKPvPZl5P8P7PAPt/PU+PKP1PEPNPaPQPiPqPFDPhP6PwPXPaPZ8PWPCt:CDlvUGLpFS
                                                      MD5:6043936AA534298520657F7A2969F04C
                                                      SHA1:41BD5A6633825B840E740BDBFF4C16A2114E5711
                                                      SHA-256:2D140459A23587982CB8EA5410D678FDD355D303F154A5BDDDF068DF396FA2D8
                                                      SHA-512:C8BE0B62D402D101CC8B6D5DA929DDEFA3855B8582E3A72A462743B71B3574832D847C2174C86862D9979BD61951320F74ECA6D96F2AD238410F74B1C4042790
                                                      Malicious:false
                                                      Preview:ElfChnk.........G...............G........... t...u.._H&......................................................................)..................N...........................=...........................................................................................................................f...............?...........................m...................M...F.......................&...................................................................................................'.......................**..x...........B...S...........w.&.........w..._.|.1+O.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                      C:\Windows\System32\winevt\Logs\Microsoft-Windows-Containers-Wcifs%4Operational.evtx

                                                      Download File
                                                      Process:C:\Windows\System32\svchost.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):65536
                                                      Entropy (8bit):2.177714243161536
                                                      Encrypted:false
                                                      SSDEEP:768:QDbHtuYYZAqRidVY4HdYWgML/chv4PzSw05Wt19M6vz73mA4+9AxNAVBBBxZvaVZ:H27
                                                      MD5:8E2EF4A63A3CB2346A0614F0B5759F98
                                                      SHA1:E40D19780188006FD33429A48D1A43B75B8E6B75
                                                      SHA-256:4D2083A4E3CD1FE0B735018CFD55A6CC4257A32DA1AF0DC67CCE4747CB2C1182
                                                      SHA-512:9B747C295AC278AE955EB2B4B6458FC6CB4310179EBA34F0A612E9F42E6DFC3B4A0BC41E8D4DD42FDF278B820A0E94579674464D7482665456A30C293B4E1280
                                                      Malicious:false
                                                      Preview:ElfChnk.........G...............G............q..ps.........................................................................>..1................F...........................=...........................................................................................................................f...............?...........................m...................M...F.......................&...........................................................................................................................**..p...........!|..S...........w.&.........w..._.|.1+O.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                      C:\Windows\System32\winevt\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx

                                                      Download File
                                                      Process:C:\Windows\System32\svchost.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):65536
                                                      Entropy (8bit):4.727048265141735
                                                      Encrypted:false
                                                      SSDEEP:384:yhch15hHh0hUh4hlhhhFhhNhPhLh1hthlh6hah+hFh1hVhEhUhMhFhJhKhthPFhA:yyyIK
                                                      MD5:BA7A9ADF48E403EDE23439184EB9CC9B
                                                      SHA1:76CCFA353E537694CFFEE56D4B04D55CBC02C56B
                                                      SHA-256:1807F6A98C01E0DA3049A3708FC523BF0F7D61FF526C23055C6A80AE10B46FC3
                                                      SHA-512:D4160FA0166475925C453DE00C7F0628297C19A70B06AB7070C3EFFF6D09D96CE1CE87D7822F3D532764A5DF8EC9E02284DF291286D6B9B8C3D184892EE9A65C
                                                      Malicious:false
                                                      Preview:ElfChnk.....................................h...X...............................................................................................(.......................P...=...........................................................................................................................f...............?...........................m...................M...F...................................................!i..........&...................................................................................**..X........................./X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                      C:\Windows\System32\winevt\Logs\Microsoft-Windows-Crypto-NCrypt%4Operational.evtx

                                                      Download File
                                                      Process:C:\Windows\System32\svchost.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):65536
                                                      Entropy (8bit):0.7996817878826623
                                                      Encrypted:false
                                                      SSDEEP:384:AKh7YJVYV4YcYIjYkYVpYsqYVyYV3YVfYVRYVdY:ffvzDWeM
                                                      MD5:BBF132EAD9833C1378E6CC4C0E50901B
                                                      SHA1:F61AC3AF9E8C14EA2BA78B461E2D263F62B55F7E
                                                      SHA-256:2404B56F849F2182CCBFB1F0F6591E80FE94E070307DDD83B67781A2161D534B
                                                      SHA-512:547EDE96B9B0522470A2824F35A70DD6E674DF26FBE600D75FA8C07A3ECCDF75416F177CE90C8434B6F8FE7D2C174D778F1CE99E6EF259E7293B1BAF886B739F
                                                      Malicious:false
                                                      Preview:ElfChnk.z...............z...................@!.. #..{.nl.......................................................................4................,.......................T...=...........................................................................................................................f...............?...........................m...................M...F...............................................................&...................................................................................**..h...z.........i._........./X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                      C:\Windows\System32\winevt\Logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx

                                                      Download File
                                                      Process:C:\Windows\System32\svchost.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):65536
                                                      Entropy (8bit):2.6999635962922897
                                                      Encrypted:false
                                                      SSDEEP:384:8hDCq2cCp1Cz2TCLqCM2CZCjiCsCblCnC/iCsCe5CECOwCFCkUCXCUoCjCtorCrN:8UEJ2R
                                                      MD5:394ADB4F11AD08A1CDC62F6B93C80487
                                                      SHA1:7B11EDB0A007B703CAE631F885C2AF1861B74F7B
                                                      SHA-256:F7BACBCC0262853479F0E24E0729682F7EE188D829233065A42184984521C4A7
                                                      SHA-512:027229012D3B05E941BB6487A3A10136111ADF7810533B7204786FB1C73C548C1FAAC87125B2C90935317023881FB8A383FDB49180DD94E52F07356CB86C0436
                                                      Malicious:false
                                                      Preview:ElfChnk.m...............m..........................~.......................................................................tB.w............................................=...........................................................................................................................f...............?...........................m...................M...F...............................................................&...................................................................................**.. ...m.........*13........./X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                      C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx

                                                      Download File
                                                      Process:C:\Windows\System32\svchost.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):65536
                                                      Entropy (8bit):4.954127815458915
                                                      Encrypted:false
                                                      SSDEEP:768:Iey39iM13dtfbSqyYcQGXrlhmQHZHm43/0YOb5ZH1t/OAwuM2eWE:4SE
                                                      MD5:C86B92612175F3CA9B0BFC41C7142ED4
                                                      SHA1:1EA93E73D8423370AE7A2A42A695856E349DEF1E
                                                      SHA-256:59162BD74579C6E2903A748ACF62B509B8F153D56231B3894824E27BDCCF93CE
                                                      SHA-512:525451F0E07C83F33A0EB77D8F04D6FB77690FBE1FB0C8ED78F9A1ECDF675B4BBAF523288250A99F8E3BB1C45F96F66F4D44673ED67FA9406086B1F34526F4B4
                                                      Malicious:false
                                                      Preview:ElfChnk.........F...............F...................1.......................................................................KA.................,.......................T...=...........................................................................................................................f...............?...........................m...................M...F...................................................................................................................................................**..x...........&............./X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                      C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx

                                                      Download File
                                                      Process:C:\Windows\System32\svchost.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):65536
                                                      Entropy (8bit):4.4721036275098065
                                                      Encrypted:false
                                                      SSDEEP:384:Bh8kbAP1gjk+Jk+yk/3Suhfmk+Adk+AkKuIk+2hk+Dk+rk+4k+ik+8k+4k+Uk+R9:BNAP1EHDzS0spmjmoToEEltkV48m
                                                      MD5:AD8997CC0670395A2E440483E5620108
                                                      SHA1:214DAC0485FFDD5222D780E6CF17B578C083C981
                                                      SHA-256:76B4B6BDF97BF4442E1C3EEFEB014F539B055B73AAB842B83237AF1FF96D7601
                                                      SHA-512:CD959BB8752841F05C9FBB92600631B3D0356E134ADDF461ADCA7F846D4436CFE216B94E505680DDDE88A7B0A43B9651A943C220DBDD6D60A924BD898C7EF4E7
                                                      Malicious:false
                                                      Preview:ElfChnk......................................I...K..........................................................................d..z................b...........................=...........................................................................................................................f...............?...........................m...................M...F.......................&.......................................~...................................U...............;...............................**..x............Ft.i...........w.&.........w..._.|.1+O.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                      C:\Windows\System32\winevt\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx

                                                      Download File
                                                      Process:C:\Windows\System32\svchost.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):65536
                                                      Entropy (8bit):4.451379779503274
                                                      Encrypted:false
                                                      SSDEEP:384:9haEdEqXAEJVvOEJSvEqEBEENEuDEaExEOEAE7EmEizEJ6ExEZEX/+EaEF5EOcEx:9VXmIBqr97fAIm4Eddji4CSpO
                                                      MD5:68857042E2D606C3B6C5BD27AA0DE043
                                                      SHA1:2B6946EBADF5593C0AF14B66526F963ED3E4E842
                                                      SHA-256:6329B1BDD4C6769CC0F853A3E1173E0515BE9089216C4902673574D8731B7D22
                                                      SHA-512:423A5A1494C79C41FB145FC9130401A424697EE10FBA4FD59E2F239D9F3B2E2A1FAA658215ED1632B69046A448386286ADEFB9894F4689396F4461120CF87354
                                                      Malicious:false
                                                      Preview:ElfChnk.....................................P.......~@......................................................................BI,.................$.......................L...=...........................................................................................................................f...............?...........................m...................M...F....................#...............!...9..=................O...=...........A...?.......;..ME..........}....................'..........5...........**...............2...9......../X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                      C:\Windows\System32\winevt\Logs\Microsoft-Windows-HelloForBusiness%4Operational.evtx

                                                      Download File
                                                      Process:C:\Windows\System32\svchost.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):65536
                                                      Entropy (8bit):2.403604045442358
                                                      Encrypted:false
                                                      SSDEEP:384:GhPFKlcLBKalKuDGK1GKgkKClKvQKqlKlaKu7dKrXK7CK53HKstKoIK8eKugGKIM:Gz8
                                                      MD5:4D13195DDF7927A4FB243F8B2F1C6D64
                                                      SHA1:B55CDA52CCAC6B47F3BBD3E01D1E4F9A0FA270E3
                                                      SHA-256:480F97FE3C7462AFFBCE48109C1E7EB813FE4C021B518DECA58D59A53758E553
                                                      SHA-512:832DCC81ED59F114AEC35956A25F2A8AA49373C8C2824C8AB628DAB5888C02A319CC71DE0090F775BE895A4ECF8CB332206037F80CB2BBD032CBF417143B7EB4
                                                      Malicious:false
                                                      Preview:ElfChnk.=...............=....................x..0z...i-.....................................................................D52................H.......................,...=...........................................................................................................................f...............?...........................m...................M...F...............................................................&...........................................................!.......................**..x...=.......m............./X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                      C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx

                                                      Download File
                                                      Process:C:\Windows\System32\svchost.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):65536
                                                      Entropy (8bit):4.101447601483418
                                                      Encrypted:false
                                                      SSDEEP:384:Xh+DEfbDisDTDqDPD1DPDXDuDTDGD8DMDRDcDvDhDlDEJDpDmXDyDsD6DwDKDOD0:XrqyaBHYPi
                                                      MD5:84D0F3AB5459A65F1D03AAF8131B2662
                                                      SHA1:3BE42A6359348B08A2C13D1534FD543270728742
                                                      SHA-256:E499F170775546E2B6F74FB4967E5B09E8F8FB273D3DEABC78C171FA05ABF195
                                                      SHA-512:4508A96A1DD49E92AD380B02B0FC97B5664A434D9800E7940028F26F83AC845479C4E61847A29035248EA9DF8102151FB19B820077B512F82733F8F0B5C957A9
                                                      Malicious:false
                                                      Preview:ElfChnk.........<...............<...........8.......|.J.......................................................................d'................$.......................L...=...........................................................................................................................f...............?...........................m...................M...F...............................................................&...................................................................................**..............F_G.4........./X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                      C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx

                                                      Download File
                                                      Process:C:\Windows\System32\svchost.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):65536
                                                      Entropy (8bit):4.1915129485080955
                                                      Encrypted:false
                                                      SSDEEP:384:ohdzpzAzKzyzIzazrzRztzPzxaz9OzJznzfzXz4zdz/znzYx3z9zrzmzYzwzYzXh:oK8WxvZ
                                                      MD5:A2267420DBA8BF5746CF28A82E9C251D
                                                      SHA1:71E96F2C7F2E2DE14B440FF8689D22121649E79F
                                                      SHA-256:FE65A193FB13BB1FD8BA2AAA63857F723F138DCEAE2B58169CA5F6A9D7F4678F
                                                      SHA-512:58DA9E16ADE2C1003C1F444F83938051E54DDCF9670993C3BE1D0B3A2A21A46710FB2969CA111E32DE84C8729EF36ED1FED5E104A6E9759DA415CA52B98770F9
                                                      Malicious:false
                                                      Preview:ElfChnk.....................................@...0...;.V@.......................................................................&................<.......................d...=...........................................................................................................................f...............?...........................m...................M...F...............................................................&...................................................................................**..............,o.{........../X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                      C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx

                                                      Download File
                                                      Process:C:\Windows\System32\svchost.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):65536
                                                      Entropy (8bit):1.7343279773937998
                                                      Encrypted:false
                                                      SSDEEP:384:ehXIVAIkIiWjIPIqIHyKINI1IOIZIUIpI7I26KX8IJXvILINIhIkI8IDITI0IfIk:eQ5ycYx
                                                      MD5:F7B55619D0BE46D6D6BF43AB5590382B
                                                      SHA1:0C1D7B10D1BDAD63A573D186BDB807335AE8FF0C
                                                      SHA-256:8F72F3742E85AF3A42E46D47FC9CA05805E779F892670345C845B567DCC6BC34
                                                      SHA-512:026686D3B42ABFDFBEFFF6B6B017C84D6AF001169C86428048407380E53892408BCA7E85FC5FC3F8BFE8E66CB175B7BF5C240E4BA3AA51878AEC896B1C55188B
                                                      Malicious:false
                                                      Preview:ElfChnk.......................................................................................................................%H................$.......................L...=...........................................................................................................................f...............?...........................m...................M...F............................................................h......................................................................................**...9..............9......../X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                      C:\Windows\System32\winevt\Logs\Microsoft-Windows-LiveId%4Operational.evtx

                                                      Download File
                                                      Process:C:\Windows\System32\svchost.exe
                                                      File Type:data
                                                      Category:modified
                                                      Size (bytes):74360
                                                      Entropy (8bit):5.529457640356771
                                                      Encrypted:false
                                                      SSDEEP:384:XhUa5Ia5qda5Ua5Ja5ka5Na5aua5Ya5xa5Ja56a59a5aOa5Ra5Ia5MzyzIzDO/aB:X91CwDDK
                                                      MD5:1E1197B6CC4F0DD5A0F8D1894F6402F9
                                                      SHA1:B579E28111B0D470F3ED5459E131D8AE81FAA587
                                                      SHA-256:E68DC676891BE121FD7F5AA628D5D20310452BF96662E23AEAD5AB9349EEFF1D
                                                      SHA-512:590FD21CB156C1BB053E4A75EE9E51487E8ACAFBC1DEC9BF17FFEE80C787B126B4D35F75F0CFE5BF134A5AF3D6CF02B365EA1EC3F59768E527341D026435760B
                                                      Malicious:false
                                                      Preview:ElfChnk.......................................... ....`......................................................................).L........................................8...=...........................................................................................................................f...............?...........................m...................M...F...............................................................&.......................!...........................................................**..............T...7b......../X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                      C:\Windows\System32\winevt\Logs\Microsoft-Windows-NCSI%4Operational.evtx

                                                      Download File
                                                      Process:C:\Windows\System32\svchost.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):65536
                                                      Entropy (8bit):2.107337154449543
                                                      Encrypted:false
                                                      SSDEEP:384:xh0QMqHM3EbMYFMOuM0cMn71MuMMxsM98M0n4MBHMovMmXMqQMrdMlOMZzMWHMBE:xZWa
                                                      MD5:43602B52B94F40E9FD5DEC126CA637CD
                                                      SHA1:2BDAEA591BEDF75BF6ABF86A573924438D65C051
                                                      SHA-256:A24799CEFCA3E020BFAA48AED20E77BEDDB418A76176B6987ED95E2C8E7E512A
                                                      SHA-512:5D7909281D5C8F4BE76DD6E03947A3C73FB3E8F228CA39AC51E2D7C11E16AADD2154E9A0F6345EB9738817FC6CD3D7B002B311B4DD0DD61E5BD36568980AFC92
                                                      Malicious:false
                                                      Preview:ElfChnk.........@...............@............l..Pn..!.;.....................................................................#f@.........................................>...=...........................................................................................................................f...............?...........................m...................M...F.......................&...........................................................................................................................**..............)..S...........w.&.........w..._.|.1+O.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                      C:\Windows\System32\winevt\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx

                                                      Download File
                                                      Process:C:\Windows\System32\svchost.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):65536
                                                      Entropy (8bit):3.2831581038708357
                                                      Encrypted:false
                                                      SSDEEP:384:Ehb1Sh151f21Q1c161J1fA1eE1cj1/q1f+1Cz1410C1F1f81H111f210111X1fIj:E6vPCDe2v/bgrJlrxbz3t3fAQmty
                                                      MD5:EBD7F38802BB7E8C516208D7E29FB46F
                                                      SHA1:661DD865EB112C88BA95447159F464A6CE201F3A
                                                      SHA-256:4676F48050612C933520EF17B2D5BAA16D35AF4E5FDA0BD2524CBE87027DE143
                                                      SHA-512:1694D02D6625A61402D7C7ABBC7E55113A14747DAE66558A82F5D8C89052E40B7B0C828AA9F9B7556826EC50092838A7A11239905B046CE9713DC3CC8234CBAA
                                                      Malicious:false
                                                      Preview:ElfChnk.0...............0...................`........HX..................................................................... M.j................0.......................X...=...........................................................................................................................f...............?...........................m...................M...F...........................................................................................1.......................................................**......0...........]........./X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                      C:\Windows\System32\winevt\Logs\Microsoft-Windows-Ntfs%4Operational.evtx

                                                      Download File
                                                      Process:C:\Windows\System32\svchost.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):65536
                                                      Entropy (8bit):4.323395721550838
                                                      Encrypted:false
                                                      SSDEEP:384:ChnIFwI1IcIIIEI1InI0IXInICIWIzIOILIqIhIXIJIrIPIMIiIMI/InIFIxImIo:CuxxVPRr
                                                      MD5:B5CA8BA246D6E6FC42AF1E5DA1734A60
                                                      SHA1:585C20FC72032E4C0DF37D6291BCC1528E9C763F
                                                      SHA-256:09277BE11D2B22D2E65D48BE13CA2ABE93DD9F30B310F470B278E048BA34E3A7
                                                      SHA-512:F010D47151837EFFBECCFA03431313F53A0FE6ECC18E5AE7F281555C992D4080AEBCF7D65AA6A67E9F4AC9A3196A9BE0072350ACA0A48260F3965664131D545D
                                                      Malicious:false
                                                      Preview:ElfChnk..................................... .........&.......................................................................&........................................0...=...........................................................................................................................f...............?...........................m...................M...F...............................................................&...................................................................................**..h...........r.........../X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                      C:\Windows\System32\winevt\Logs\Microsoft-Windows-Ntfs%4WHC.evtx

                                                      Download File
                                                      Process:C:\Windows\System32\svchost.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):65536
                                                      Entropy (8bit):2.154347429514829
                                                      Encrypted:false
                                                      SSDEEP:384:SuhqILI6I6IUI+I4IZIhISCI3hUICIOIDIMIfINIEdImIDIXIjlII+I/IAIiIkIp:lHZhxKkDBhT
                                                      MD5:B859C7249ABBA2277F7CCDC6623B631B
                                                      SHA1:A4C2A138D64E6D88F91B2DF0DFA4F7B2B5B0C136
                                                      SHA-256:BDAD5A8D76BFF9632DEEA59E5A930C5169A075509C3499F9DC982293FF48CE87
                                                      SHA-512:B1FEF8455886DF7CE95B2C9A944213B3E639639FAF661CFABCDC1A576D4478B1642F03CA79B284E07E37A80B1993973A50C0C853494E8423C8C095578FDAD8FC
                                                      Malicious:false
                                                      Preview:ElfChnk.........Q...............Q............o...q.....2......................................................................~x............................................=...........................................................................................................................f...............?...........................m...................M...F.......................&...........................................................................................................................**..................S...........w.&.........w..._.|.1+O.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                      C:\Windows\System32\winevt\Logs\Microsoft-Windows-Partition%4Diagnostic.evtx

                                                      Download File
                                                      Process:C:\Windows\System32\svchost.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):65536
                                                      Entropy (8bit):3.90007961083143
                                                      Encrypted:false
                                                      SSDEEP:768:241WS5OAT1rPgAT0nH15T0nO15T0nQ15T0nW15T0nr15T0nB15T0nh15T0nb15TT:QScA
                                                      MD5:6F4445FE4438DFA0407599097C4D8F4E
                                                      SHA1:F8BAEF616B258A654DFCA8D5CE41C97EE470CF41
                                                      SHA-256:DA5870E6C731509CA7C183B9E8D4BC6BE720D8AC3F48A9DE58F81D5653253362
                                                      SHA-512:A23B0C12286C879BC576F0C60B32BB514E91D885060124493FCCD0DE52533FAF4EC5CAD0788DECCEC0435B356732E1E3DEC18334CD23A74DFA594A33F2519611
                                                      Malicious:false
                                                      Preview:ElfChnk.Y.......[.......Y.......[............'.../....?t....................................................................|(r]........................................B...=...........................................................................................................................f...............?...........................m...................M...F...............................................................&...................................................................................**..8...Y........n_I.9......../X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                      C:\Windows\System32\winevt\Logs\Microsoft-Windows-PushNotification-Platform%4Operational.evtx

                                                      Download File
                                                      Process:C:\Windows\System32\svchost.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):91392
                                                      Entropy (8bit):5.027549711610884
                                                      Encrypted:false
                                                      SSDEEP:768:25HxZtxADR42DMB7XpAgtS72qCs4UnuT7sObzUxDxhYXDgTT4KQP0WAboSsn3QVo:SZsCpUuT7ONjYE+ZsCpUuT7R
                                                      MD5:76FAFCD5E2041199A53DF14B9F72F608
                                                      SHA1:3AA445FE20DD0E1B0695C42C3854A39B717D443B
                                                      SHA-256:138A756F0D32CF8799A178971EC8437FF0E29E3C8494A46F16FC6845F7F90DC2
                                                      SHA-512:F9D1E244953E3E5C9CDCE282B9E97D85F5A54056970388A681515893F872E66241D5E8E63BE31AE30DFADFA6A8EC4C49965E9A326DD1732A3F94958544867AA6
                                                      Malicious:false
                                                      Preview:ElfChnk..*.......*.......*.......*...........Y...[...........................................................................E................^...........................=...........................................................................................................................f...............?...........................m...................M...F............................................D...................>..................................................7............G..................**..8....*.......Jn.8b......../X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                      C:\Windows\System32\winevt\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx

                                                      Download File
                                                      Process:C:\Windows\System32\svchost.exe
                                                      File Type:DIY-Thermocam raw data (Lepton 2.x), scale 4-8, spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset 0.000000, slope 10384593717069655257060992658440192.000000
                                                      Category:dropped
                                                      Size (bytes):65536
                                                      Entropy (8bit):2.0535012752685757
                                                      Encrypted:false
                                                      SSDEEP:384:Rho8N8M8p8d8I8K8t8v681o8t8K8aI848s8D828P8N8285818n8U858w8v8yt8+e:Rj31lT
                                                      MD5:4023B6E174B8B9F1266E0AC0E2FF8D87
                                                      SHA1:F3E79237F08A0A6C88F76C0AA7C3C36D633C707F
                                                      SHA-256:9E330A8F61DDB102693CAC63CB3DDD48092ADF44298AD7AD6B7AD03D5FE7D698
                                                      SHA-512:02620D41B511B39C82CBA27E68E2525CD58B4907D2FF2B01E419156C7727DE8B1A3C707CE1A3066A43D0FA05D06ED95D4A72B34AAC3BD9917F1B9F2D5D0B36C8
                                                      Malicious:false
                                                      Preview:ElfChnk.........@...............@...........8f...g.............................................................................C........................................V...=...........................................................................................................................f...............?...........................m...................M...F.......................&...........................................................................................................................**..(...........e...S...........w.&.........w..._.|.1+O.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                      C:\Windows\System32\winevt\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx

                                                      Download File
                                                      Process:C:\Windows\System32\svchost.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):65536
                                                      Entropy (8bit):4.223285886823064
                                                      Encrypted:false
                                                      SSDEEP:384:zhuvnvmvJvBvdvrvwvSvovl+v4v6vvvmvcMvOyv4vCvAvTvGvP+v5vRvH8vUv5v7:zNzTEejRRTM2
                                                      MD5:70652E97A3942479DA8FEE046474A8F2
                                                      SHA1:78513126919AD94D4FE1B3686D33B07F85C0D1CE
                                                      SHA-256:B6FD3E3A93557382398ACD24A890E4CDC959697A687AE4B2951B9C7D677EB535
                                                      SHA-512:0E82764CB5F8318C5F1E300E18ECA13CEA50C3744454C458F42709703044833A263E7D56A5CB6C4B3F7512AB71000653148A9ACF9D5BB91963201144B53ACFC7
                                                      Malicious:false
                                                      Preview:ElfChnk.........................................P............................................................................n.................v...........................=...........................................................................................................................f...............?...........................m...................M...F.......................&.......................................f ..........................................................O.......................**..............l..-T...........w.&.........w..._.|.1+O.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                      C:\Windows\System32\winevt\Logs\Microsoft-Windows-SMBServer%4Operational.evtx

                                                      Download File
                                                      Process:C:\Windows\System32\svchost.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):65536
                                                      Entropy (8bit):3.091931529961002
                                                      Encrypted:false
                                                      SSDEEP:768:GS/Bp+UdTU8UqOUyGUwaUpcuUvKUruU6DUZ5UtaUKOUpSUv2UwLiUIeU7bUhCUrQ:L7rw
                                                      MD5:C61669DCCE9DE7CC963A0AFF3C82AB4A
                                                      SHA1:6CF2C91A1C00374376BA731B0C4CE749CB4028FE
                                                      SHA-256:B7D02B13254A75CD7CAF2159723FB98F146024EB297124BD4066F81BB5E24438
                                                      SHA-512:5B08B22248E7FFF1452DE6A4FEA4D60DB141B6C00C2247340004FB1F2DE17261A2FAA6174300B1B8F9492AE14D369FDA5C71C2F611AD40A15AAB6344C40473D3
                                                      Malicious:false
                                                      Preview:ElfChnk.....................................8...h......]....................................................................:\D.................C...........................=...................................}.......................<...............................................................f...............?...............................................M...F...........................................................&.......................................................................................**..h.............h............>.&.........>..'.W.U2..9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                      C:\Windows\System32\winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx

                                                      Download File
                                                      Process:C:\Windows\System32\svchost.exe
                                                      File Type:MS Windows Vista Event Log, 1 chunks (no. 0 in use), next record no. 27, DIRTY
                                                      Category:dropped
                                                      Size (bytes):69632
                                                      Entropy (8bit):4.176211403342668
                                                      Encrypted:false
                                                      SSDEEP:768:u3MEYS9jvhCeqi4hqQ4D/OX+/14e/8NVvl8QVQzo:aMEYw2l1VYo
                                                      MD5:0F8A06B6D76A8A65544ED7E11D7AD955
                                                      SHA1:5FDDB30BFB4E4BC8142C236299D87C89837DFF8E
                                                      SHA-256:F39C450D6EAE44F129E17560671120D346C8CB3293FDCF3EAD1A61C55CA0348D
                                                      SHA-512:51510D38A07DE2756031AA80B435E7B8C132D0763B128BDF5476A84FF3B38C04BA644FC327CFEF02719CA9BEAF8A4A7DF7FC5EAF9E52D0EDF16736ECBA41DB34
                                                      Malicious:false
                                                      Preview:ElfFile.....................................................................................................................|.~2........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                      C:\Windows\System32\winevt\Logs\Microsoft-Windows-SettingSync%4Debug.evtx

                                                      Download File
                                                      Process:C:\Windows\System32\svchost.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):65536
                                                      Entropy (8bit):4.30936231416051
                                                      Encrypted:false
                                                      SSDEEP:384:phd2h2x2z2W2q2Ez2S2h2HC1C+CACA2q282vo2Q2f2j2S42N262W2iC8CWCZSCv/:pGC5xBuL9Pc6isrzhF
                                                      MD5:B4546125CEB0E8AFB3A70D3191DFC84A
                                                      SHA1:22C09DCD596C8DC8F58E990B764BB91927EDE330
                                                      SHA-256:912A1FED2CEF40B39E2DE8973B6D5A397732997425BCA622E0BA56FCCBFF2FCA
                                                      SHA-512:9A4372BD4A6D06C7C0D6E9F0026BA2469CA2B0F02325D22DDE4627C5570585D43F081265F0F110F3A7F6365CC9BCA5EAE8C1CA9CECA7454EA6ED556BC6A2F3F4
                                                      Malicious:false
                                                      Preview:ElfChnk.<.......s.......P...................h...p...+i......................................................................D.6.................(.......................P...=...........................................................................................................................f...............?...........................m...................M...F...........................!b..................................&............................................................;......................**.. ...P........v...9......../X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                      C:\Windows\System32\winevt\Logs\Microsoft-Windows-Shell-Core%4AppDefaults.evtx

                                                      Download File
                                                      Process:C:\Windows\System32\svchost.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):65536
                                                      Entropy (8bit):3.4160919298317785
                                                      Encrypted:false
                                                      SSDEEP:1536:YtJTcmXTfu/hD9ouzDZx+DWQeD8yiM4C0BYEeKee6lFY99PXg95RA2IektFNEfJe:8JTcmXTfu/hD9ouzDZx+DWQeD8yiM4C8
                                                      MD5:214EEEF1FFC86F2272B6C7C4D7AF90C1
                                                      SHA1:A43C3BE59D7289F457BAD1EA17B2DC29AF1F6CC7
                                                      SHA-256:634C4C5CC17E9589C057900CDA5A6FB97440F785CFFB8AD2EC7075E047F8490F
                                                      SHA-512:1DEE2F7554B7CF7CAED7D3AE89690021BD59D0B74C91C194E3BDCBCC9C60C7ADD74924154F9D6855CD0B6A509EF56AE0E31E929CDCB734CA89DF7D3E8E5D6969
                                                      Malicious:false
                                                      Preview:ElfChnk.~...............~.......................x.........................................................................."*3|................0.......................X...=...........................................................................................................................f...............?...........................m...................M...F...............................................................&...................................................................................**......~.......=............./X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                      C:\Windows\System32\winevt\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx

                                                      Download File
                                                      Process:C:\Windows\System32\svchost.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):65536
                                                      Entropy (8bit):4.461438035686556
                                                      Encrypted:false
                                                      SSDEEP:1536:F7nSO9kZt81BmMwkKSj0ZRMFtLHN8k7kKuRhjHan5sm92u7pWqr2ECxu3dZtEWLh:F7nSO9kZt81BmMwkKSj0ZRMFtLHN8k7X
                                                      MD5:19791FA1338F11EB75C41B56C9654B10
                                                      SHA1:8176673D2C6E0BF9793DBF66C60AA359DC70138C
                                                      SHA-256:7D0F82BA657DAC22E546B5C673FB7D80FA871F78366967744C744EA5B3B895F8
                                                      SHA-512:F151F0D927A21035DE17EB6820251156B6A709B6ACA82F94D9192E61E0AB506CBCEC1764AC2CE89DA56C40BF51EF49D61B9025A5A25E8F199F9A331242AB0225
                                                      Malicious:false
                                                      Preview:ElfChnk.0&.......&......0&.......&............................................................................................?................0.......................X...=...........................................................................................................................f...............?...........................m...................M...F......................................................................................................................a~...y......................**......0&........k.7b......../X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                      C:\Windows\System32\winevt\Logs\Microsoft-Windows-ShellCommon-StartLayoutPopulation%4Operational.evtx

                                                      Download File
                                                      Process:C:\Windows\System32\svchost.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):65536
                                                      Entropy (8bit):1.9544130217659996
                                                      Encrypted:false
                                                      SSDEEP:384:Vhq7v7l7UZ7r7B7c7li7x/7Z7Z747A7rK7Rx7fy7P7C7I7F7W7DX7z7C7B7Z7f7T:VGzb
                                                      MD5:909B7CF9A65125FFEADDD0246E90F7E3
                                                      SHA1:0A9F3BBA9FE4DB522E14845D4203D0845A457A2F
                                                      SHA-256:5644B204FA2B13860C7D8899D0DD9306A33199F92700F085B7F6AE66A9043720
                                                      SHA-512:FC721ECCA1D771573B1D71FA43ABDECECEBB8B3C7F61158E2FB45C47A97D2470E197D7D5E9D8E319BB14160F191FE43584536F67EE2991659EE40204567F1A0B
                                                      Malicious:false
                                                      Preview:ElfChnk.........2...............4............\...^..........................................................................q6..........................................0...=...........................................................................................................................f...............?...........................m...................M...F...........................................m!..................&...........................................................e.......................**............................/X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                      C:\Windows\System32\winevt\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx

                                                      Download File
                                                      Process:C:\Windows\System32\svchost.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):65536
                                                      Entropy (8bit):4.259239867431575
                                                      Encrypted:false
                                                      SSDEEP:384:ahwuTDFbuJuuDu/uVuuvu7uu6uOuU/ueuu/uFuuVuauUmuPuuAutuu2kuzjuUaub:aHawuFBoRW3L463zLKxWNmu16S
                                                      MD5:81A611850500E1B7C7953F28DF899B13
                                                      SHA1:46681FC139E5B9E572EB9DE5BA258B5D4C796832
                                                      SHA-256:8B41DC75F1C1EECE9E0091790A0F05CF3668E43708824326C0B42164381D9569
                                                      SHA-512:6FFEAC1BDB46C363478CF6611586A96B02B0801AF074CADEE0B44B06E91AAB0B4BB9718807DEBBBD0300038730581E8193BD9552DF91851CBACFB83D72828E07
                                                      Malicious:false
                                                      Preview:ElfChnk.6...............=...................8........j.'....................................................................f+L.........................................F...=...........................................................................................................................f...............?...........................m...................M...F...............................................................&...................................................o...............................**......=........*............/X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                      C:\Windows\System32\winevt\Logs\Microsoft-Windows-SmbClient%4Security.evtx

                                                      Download File
                                                      Process:C:\Windows\System32\svchost.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):65536
                                                      Entropy (8bit):2.345112611627052
                                                      Encrypted:false
                                                      SSDEEP:384:Oheu/uSuWugu5uGuFu5ut1u7su+uPudu3uxuIuTuxufvuIUubuMuBuquZu/uKu9D:OP6ZDGl
                                                      MD5:B578ADB1DA7F50A9D3853C280D965A14
                                                      SHA1:0F487D0A0F7B59C37DC6F4802A18823B08A05153
                                                      SHA-256:E7EB81F6893534F3A22F0F5906B40B8DBCB736776BC159E501735ABB20A62893
                                                      SHA-512:ED25D1B698080F042CC736881D35148D3932C5A3BCB5839121499A606C02CA1E0558F2A576C127745DAEEAEA3F00A196ED6E08BAC529C4264D27850D34ADDF07
                                                      Malicious:false
                                                      Preview:ElfChnk.........H...............H............z.. |...F.}.....................................................................<R................$.......................L...=...........................................................................................................................f...............?...........................m...................M...F.......................&...........................................................................................................................**..............%,H(T...........w.&.........w..._.|.1+O.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                      C:\Windows\System32\winevt\Logs\Microsoft-Windows-StateRepository%4Operational.evtx

                                                      Download File
                                                      Process:C:\Windows\System32\svchost.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):65536
                                                      Entropy (8bit):3.2938855638206377
                                                      Encrypted:false
                                                      SSDEEP:384:MQahPAodANA9APA7SjAkxArIvjA2UlA/A3AnA7ATAnALAlAfMAYQAgiA/ABAxAsv:Ja9SNmIvvfek9kOb
                                                      MD5:59F19D538D15B54AB409EA2EF02605A6
                                                      SHA1:E4DA18223931685C4BFBE3F6FDE2CA175D5F3FEC
                                                      SHA-256:D4441EB602675EAD4A2943EDE30E5895D66E4214ED6D60E079402C7753330646
                                                      SHA-512:945B0556FA876A57F7872DA016EEBCBA556DF42838E6CCC40AED3803D84551E2C69571AD7C0FD245309E08160BE3FE6AAF08B59E005832960C793E647E79B32A
                                                      Malicious:false
                                                      Preview:ElfChnk.........r...............r...........8.........tv.....................................................................7.F................4.......................\...=...........................................................................................................................f...............?...........................m...................M...F...........................M........................%..........&...................................................................................**..............}y.._........./X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                      C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storage-Storport%4Health.evtx

                                                      Download File
                                                      Process:C:\Windows\System32\svchost.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):65536
                                                      Entropy (8bit):2.4253324435524357
                                                      Encrypted:false
                                                      SSDEEP:384:Mhk+pUYnpdo4pd+pdnpdwpdVpd+pdrpd4pdRpd/pdqpd9pdopdKpdXpd8pddpddd:MI
                                                      MD5:3DC6A027151D05D13605F6F1256466C7
                                                      SHA1:D84F56947A41093BA04C62DCA2980A470EC31B41
                                                      SHA-256:FCF6218ADA7CD8FD315B519427B35D04286978505E65CFDF62086181F3844F57
                                                      SHA-512:0C111709433AB715F55B94A13C02C1BA844A43D58B0E7F06C15D17E869A269741F9EEED053FE892ABB154B1EABC998148B584382AD8F45D9BD949F00C75780F7
                                                      Malicious:false
                                                      Preview:ElfChnk.&.......L.......&.......L............... ............................................................................E.........................................:...=...........................................................................................................................f...............?...........................m...................M...F...............................................................&...................................................................................**......&.......yN..^........./X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                      C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storage-Storport%4Operational.evtx

                                                      Download File
                                                      Process:C:\Windows\System32\svchost.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):65536
                                                      Entropy (8bit):4.1217312088618066
                                                      Encrypted:false
                                                      SSDEEP:384:jhmCpaKpmpL6pAsUpfwpAbdpABApAGQpTVp2LMpIJpAbWpW8pAWWpAJap8kpAE0r:j
                                                      MD5:6C0B24D7871DB109B7D7DDF5F43E4D01
                                                      SHA1:2D3173CBCD56C0C7B36FBFAC2FB7097ECC7F8C05
                                                      SHA-256:589AB76BE304D4108A691A290268D8A3C191F4C6F2AA2E72C8E689814DFCD435
                                                      SHA-512:EEAE188F82296781635ABB3C8AC54F1F8F02C4A55EACCBE319F00F4F80A6FA62632449AC706BB3B2E73849347798193AA4FEFACB45FC1D891141F90B070B79D4
                                                      Malicious:false
                                                      Preview:ElfChnk.........R...............R...............X....g......................................................................q...........................................D...=...........................................................................................................................f...............?...........................m...................M...F...............................................................&...............................i'..E...............................................**..............a...f........./X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                      C:\Windows\System32\winevt\Logs\Microsoft-Windows-StorageSpaces-Driver%4Operational.evtx

                                                      Download File
                                                      Process:C:\Windows\System32\svchost.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):65536
                                                      Entropy (8bit):4.236375551470027
                                                      Encrypted:false
                                                      SSDEEP:384:RhoCKCQC8CUCLCYC7CFCuC2C+CxC1Cl0Ct4CCC2C7CLCtCeCeCiCmjC0zCpDCMCx:R+fNJCRxkjZHgUL
                                                      MD5:FEA34410DE6DCA60C3741440E0D70E5A
                                                      SHA1:3C48ABB91208EA3FF84044B1444FD42D2BDC44D3
                                                      SHA-256:E99077580F274DD6E2E201992042A000C61DF1A027A8BF12C3B2541F797BF294
                                                      SHA-512:F9058F171E34477BBDB2C90A87262232C4C06B3CE01F3FB921350888D702A38933FFFD4FE17D2D2051C91CA449DCC4FC7AE8F3117E4FBFC937CD5459706BD30C
                                                      Malicious:false
                                                      Preview:ElfChnk.........P...............P...................O.N9.......................................................................$................V.......................~...=...........................................................................................................................f...............?...........................m...................M...F.......................&........................................%............................................................................../...**..@.............1.S...........w.&.........w..._.|.1+O.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                      C:\Windows\System32\winevt\Logs\Microsoft-Windows-Store%4Operational.evtx

                                                      Download File
                                                      Process:C:\Windows\System32\svchost.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):77176
                                                      Entropy (8bit):4.656190906288678
                                                      Encrypted:false
                                                      SSDEEP:384:JhVMjFM2MXWMj1MtMTMp0MB2M0MZ9ME+IFMbM2M2hVMjFM2MXWMj1MtMTMp0MB2e:JDgeIeDgeIXpby5NIZ8FbyhbyoYbyB
                                                      MD5:32F13A56B9E55C9F2D4E497A4ACC5BAA
                                                      SHA1:AA57D1D8560C1C7F1B8083D966035E8F1AB03D23
                                                      SHA-256:FFB5E23926BEC9F6A038BA0B92FE965CFCF012BC62CD66D334521AAD6AB6398C
                                                      SHA-512:E69AF3EC498F772983FEEDAF9867A958BBBB200FD7016106935F4E33C27C5ACA365834754CBB5138492656631725D56D69D7C91D203707C3CC282D659B02BE2C
                                                      Malicious:false
                                                      Preview:ElfChnk.M.......Z.......M.......Z...........@+..x-.....r......................................................................6.........................................4...=...........................................................................................................................f...............?...........................m...................M...F...............................................................&...................................................................................**..p...M.......R...jb......../X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                      C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storsvc%4Diagnostic.evtx

                                                      Download File
                                                      Process:C:\Windows\System32\svchost.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):65536
                                                      Entropy (8bit):3.1221868841414873
                                                      Encrypted:false
                                                      SSDEEP:768:OvgffnPNm/2sY3pLwIkJ2jLHbj9fr7w2imMFopTMFw3grHUP9I:/GaY
                                                      MD5:1BC786BBB839FB4A78EBCF251C02A81B
                                                      SHA1:9F856DEA741BA0C3A3DD76CCC0E9F56B987F2A78
                                                      SHA-256:F0F2BF17A5EBA916FE2C23338D700919E77FA13566DC885F206541F3EAE0E00B
                                                      SHA-512:55B7335EB9AB9714713976711720CEADF5522B48527B84CBDB94C3D36CF11E4E0703A6C3208DD2253D1C22EE913AE31D39684B4707BE911ED2E8F018DB19F911
                                                      Malicious:false
                                                      Preview:ElfChnk.........@...............@..................z..j....................................................................$~J................. .......................H...=...........................................................................................................................f...............?...........................m...................M...F.......................&.......................................fC...................................................................1..............**................8.S...........w.&.........w..._.|.1+O.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                      C:\Windows\System32\winevt\Logs\Microsoft-Windows-TZUtil%4Operational.evtx

                                                      Download File
                                                      Process:C:\Windows\System32\svchost.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):65536
                                                      Entropy (8bit):0.20387486944785113
                                                      Encrypted:false
                                                      SSDEEP:48:MJW4RrP+MZQNRBEZWTENO4bpBdoui/6FgVt:IDKNVaO8tob/6Fg
                                                      MD5:4A5AF5E17B8B3932073610AA6ED269B7
                                                      SHA1:8976CD7BDD57C51FDF6898265F881794153A3823
                                                      SHA-256:B1B47CF98F7F0272BE7146EC724E29BC6D5B6655ADA3347D943FEF1768743D78
                                                      SHA-512:41EC397D0146E190F7663D1247DFAB443747BDFA44E59C815E7718D10FD89B1D56982250B25858F0826BF4C400FF0B8D348E0BF6982198D52B8A447890DC6CAE
                                                      Malicious:false
                                                      Preview:ElfChnk.............................................Y........................................................................0.................. .......................H...=...........................................................................................................................f...............?...........................m...................M...F...............................................................&...................................................................................**................bN8b......../X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                      C:\Windows\System32\winevt\Logs\Microsoft-Windows-TaskScheduler%4Maintenance.evtx

                                                      Download File
                                                      Process:C:\Windows\System32\svchost.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):65536
                                                      Entropy (8bit):4.298848283351831
                                                      Encrypted:false
                                                      SSDEEP:1536:xKoKKK3KOKbKrK7KAKqKpK0KXKAK8KTK+KfKvKYKqK4KGKkKhKjK9KyKeKhK1KKr:xKoKKK3KOKbKrK7KAKqKpK0KXKAK8KTk
                                                      MD5:24899DD931E2249BE78BF4F9B927CF7A
                                                      SHA1:08FD253A3DB36E0413407874D81AE8CB31B19B98
                                                      SHA-256:B5F20D4757314E06CD4CA519CFC311AC7F5875D77F213C30B49E79AEF17C1760
                                                      SHA-512:D3F4D9A6CA3C1544B5379FC9AC793D7096060BEA2A5AD9E68BA998E67D2AC420D217841DBA6E3473FED9453518F398BA9DF6C75F8D85C92CC0BB0DCA2A6B3BD1
                                                      Malicious:false
                                                      Preview:ElfChnk.....................................X}........gC......................................................................i................,...........................=...........................................................................................................................f...............?...........................m...................M...F...............................................................&...................................................................................**..H...........N..)........../X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                      C:\Windows\System32\winevt\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx

                                                      Download File
                                                      Process:C:\Windows\System32\svchost.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):65536
                                                      Entropy (8bit):4.095961792452224
                                                      Encrypted:false
                                                      SSDEEP:384:5h8i4i/yi6iDiDi5iwiliM1iNiUiXKbieifiGiOiOiIiIiBigi1iVinixiEiVci+:5p6xKo4KN
                                                      MD5:DA8022DBEEC6371E22213B8CA3640F65
                                                      SHA1:DCFBBF5740DFECC45DCB14A851DA30ECA8CB3510
                                                      SHA-256:45C201BB901790DAFBE603DAEC32B06C9C1AAFE3977C158270358B5054583FC5
                                                      SHA-512:0B3B9EADE9F851C3F9B0D7647C11CFD94735B9299C0554945DF4C42AC746AD68AF3BB5BE8A25390352467824CD5339EE1784CB192D7AA0908952F0761A8FEB8A
                                                      Malicious:false
                                                      Preview:ElfChnk.....................................hQ..pS..@tKw......................................................................Z.............................................=...........................................................................................................................f...............?...............9.......B.......................M...F...........................................................&...............................................................q.......................**..................f...........>.&.........>..'.W.U2..9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                      C:\Windows\System32\winevt\Logs\Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx

                                                      Download File
                                                      Process:C:\Windows\System32\svchost.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):65536
                                                      Entropy (8bit):4.311527434619814
                                                      Encrypted:false
                                                      SSDEEP:768:uxSaa8NlaranavazaZa5agCadadaZadacaRaZasasaUaUaMacaIaYaEakaAagakP:yNG
                                                      MD5:3A23334262CFD803133FDF0FC91F2F77
                                                      SHA1:7465BFD19219E4D7C0E96984352B84036D3D7BF1
                                                      SHA-256:6F7995E4F6C16E726F8DD7CB25F3DCDAA059042247BEFA26F3533A3F9D9BFF33
                                                      SHA-512:39B9307BDB0C47C9B14C19AE9521B82910223F82F196F6791B7F4D796CD8FE8446C92F80CC6E4E7A213461634307CD2E86A8DD9CE683A10CEC1CC1B31E4D679A
                                                      Malicious:false
                                                      Preview:ElfChnk./.......x.......E.......................P....c.......................................................................f..................`...........................=...........................................................................................................................f...............?...........................m...................M...F...............................................................&...............................................9...................................**..H...E.......3..Y.9......../X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                      C:\Windows\System32\winevt\Logs\Microsoft-Windows-User Device Registration%4Admin.evtx

                                                      Download File
                                                      Process:C:\Windows\System32\svchost.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):65536
                                                      Entropy (8bit):3.930181050977604
                                                      Encrypted:false
                                                      SSDEEP:384:ThNXDcXxzXZXeX/XOXMXauXLiXCXVX1XYXZXeX+XiXfXuXFXRX9XsX5XLXzXgXyk:TyAgHHqOT
                                                      MD5:CE2A7383AB2F3DE2E7DFA5CB5751224A
                                                      SHA1:8DF9866A0B516BC9C49DC25B4E5C03B4FB61EB11
                                                      SHA-256:82597978880EA04CEE47F8B0911DE8E36D64DC83508414AFECFC2142932BD971
                                                      SHA-512:51631E75A324D30BB126D30FD9544DB62D54FB72892A4C369743EADD3BE271D6ECDAC7F6AD8EA267572A6126C4099EBE44DC6D19B529FF76E3BB13C79D8360F9
                                                      Malicious:false
                                                      Preview:ElfChnk.........J...............J...........8.......h.<......................................................................j^.................j...........................=...........................................................................................................................f...............?...........................m...................M...F.......................&...........................................................C...............................................................**..............C..?T...........w.&.........w..._.|.1+O.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                      C:\Windows\System32\winevt\Logs\Microsoft-Windows-User Profile Service%4Operational.evtx

                                                      Download File
                                                      Process:C:\Windows\System32\svchost.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):65536
                                                      Entropy (8bit):4.3347594567195324
                                                      Encrypted:false
                                                      SSDEEP:384:Nh2LmImemomHmOmamCm2m2m3mnBmGqmFmJmFmKmrm2mOmsmSmmmVmghmRmBmBSXf:N/f3
                                                      MD5:3137E56EC102C56E24A50C39D9653BA9
                                                      SHA1:21BF16E8673C231EFF2D5ADB1B21D69444621A17
                                                      SHA-256:9F6D155F4367B39EE272FACC1531B593DD3B6133FFBE984375AC12FF253BE9A5
                                                      SHA-512:C34868E2A1E97184258448D605FC2D04A1271B1455D59DB4B6F497EA97416138B16624F4ED6B5330CCA25509EC0A8C976880EA81C0EDD2CD00A526775E04AF57
                                                      Malicious:false
                                                      Preview:ElfChnk.........................................P...........................................................................4................Z...........................=...........................................................................................................................f...............?...........................m...................M...F...............................................................&...............3...................................................................**................y........../X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                      C:\Windows\System32\winevt\Logs\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx

                                                      Download File
                                                      Process:C:\Windows\System32\svchost.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):65536
                                                      Entropy (8bit):1.987602884262422
                                                      Encrypted:false
                                                      SSDEEP:384:Zh0h21c2kS27W2VP2en32x2U2x2V2d2N26A2q242R2V2Y2w25vb2C2k2o2g2s2IU:Z2C5
                                                      MD5:70BD898418C64F9459ACA543955A4477
                                                      SHA1:205E67815894FC835DAC183557664CE450B1B692
                                                      SHA-256:78EB94A830CA9A001931056254D068362421991507849AD1A350FB0DF99AFF4A
                                                      SHA-512:362108245408F63378BE71C958E27043420E783B47FD00DBC6A70096A349FA442490EF949203CBD8C0048066655112CF9749E5833C2718BB0CCECFF1EB7003D5
                                                      Malicious:false
                                                      Preview:ElfChnk......................................]..._..n.........................................................................u.................L.......................t...=...........................................................................................................................f...............?...........................m...................M...F...............................%...............................&...................................................................................**................+.g........./X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                      C:\Windows\System32\winevt\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx

                                                      Download File
                                                      Process:C:\Windows\System32\svchost.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):116936
                                                      Entropy (8bit):4.299540846506972
                                                      Encrypted:false
                                                      SSDEEP:384:vVhpR+daRsRjRQRPRZX8R6R/aRXRsRqRbR2R7RoR/RlR9R/RlRlRaRMR0lbRLRzT:NLlKU8cZWgLlKU8cZWM
                                                      MD5:7D58D4FA390D05C52559FE2CA73CA7A1
                                                      SHA1:F53508AA07432B6C787D9F6B4CE5671AE4B5DEE9
                                                      SHA-256:225BE50D7BE3D8FCEFA41085D095B67FE8FCCCA0F7B0AA7BF62F903F20785502
                                                      SHA-512:DD011B91686F1C574739F7C41F3D79269DF41D2321F4C5CEF9B5E81D1C2AE79E19B4896DACA9A511398C0E471D7C4BF540085ADC9A0B6BADE94170341ACA5221
                                                      Malicious:false
                                                      Preview:ElfChnk.Z...............Z..................................................................................................Xe.;....................2.......@..............=..........................................S.......................%...........................J...........................f...Z...........?......................................?.......M...F...a...........}...................................y.......&.....................................................................................**..X...Z........;..9..........>.&.........>..'.W.U2..9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                      C:\Windows\System32\winevt\Logs\Microsoft-Windows-Wcmsvc%4Operational.evtx

                                                      Download File
                                                      Process:C:\Windows\System32\svchost.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):65536
                                                      Entropy (8bit):4.389828813421261
                                                      Encrypted:false
                                                      SSDEEP:384:ahCh7whqhvh4h/hMNhihhiVqhXhPh5Vh+hth0qhPdh4zshS3hi9uhiZhhpYhAThM:akMfO1mGm/qH4
                                                      MD5:C545D34823C176D347BBECB862A8C5FF
                                                      SHA1:6AE3011F56BE2BDD9684792653191B1B562485AC
                                                      SHA-256:4C7D8481F1C66BC0E249703998E83F2C139EAB530D3FC88DD5FC55F60871CC34
                                                      SHA-512:AAD14A6EA8CA5AB46CF1C7B0D6E3729434FC524CC818E1E160055402DB05FEAE6C013A6D27196A23226C606C26D1BFEC38FAEBE12127C1043DAA8FFA1A79F524
                                                      Malicious:false
                                                      Preview:ElfChnk.........6...............6...........X.........t.....................................................................!...........................................l...=...........................................................................................................................f...............?...........................m...................M...F...........................................A...................&...................................................................9...............**..@...............,........./X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                      C:\Windows\System32\winevt\Logs\Microsoft-Windows-WebAuthN%4Operational.evtx

                                                      Download File
                                                      Process:C:\Windows\System32\svchost.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):65536
                                                      Entropy (8bit):3.5474735655308507
                                                      Encrypted:false
                                                      SSDEEP:384:Uh2VaVYVtVbVwVoVTVJVgVZVrVdVfVKVHVl/V+VnkVkgVOVEVRVtVsVCVFVhfV56:UWIreU7U7enh
                                                      MD5:6018FBEDB5B3FDADFFFB915F9EFEF18B
                                                      SHA1:E3F3C018027C3AC54657E13344D01C7B2AD23B4E
                                                      SHA-256:D4DD9D6CB9AE56C34F884F7F0906450EC5D5DA986FCD91CB28CF29A1C8C5B2C2
                                                      SHA-512:02016B6288F0077FABA07BD706F97FF1D6757CFA4B2913E19F4D9D17094954E68AED0F4537914CA6B3351C14D5CF91520653DF49181671DAF44175F9A1CC4D5F
                                                      Malicious:false
                                                      Preview:ElfChnk...............................................&.........................................................................................&...........................=...........................................................................................................................f...............?...........................m...................M...F.......................&...........................................................................................................................**..P...........F~..S...........w.&.........w..._.|.1+O.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                      C:\Windows\System32\winevt\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx

                                                      Download File
                                                      Process:C:\Windows\System32\svchost.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):65536
                                                      Entropy (8bit):4.287006845371397
                                                      Encrypted:false
                                                      SSDEEP:384:WhuZBwBQ/lrBwB7/FBwBK8bV5BwB5dYBwBkBwBHBwB/BwBGBwBkBwBd5BwBJ+BwH:W58bSk9
                                                      MD5:849B011E3C4985CFF3CA9A4852649771
                                                      SHA1:514A7F15DB441C5AAC36A9906D3D0F6F2662647E
                                                      SHA-256:17367D31C692D314634298C5523F398EFF16059F5507975638D4CC35055D1D95
                                                      SHA-512:651C89E3A9DEA3D5CFA395F3445CC3BC7A2FA8BC225B75250A17F5F326CF2B34F936E24A34D55B9D25052CBE157B953D0E52A616B7CFEBF3E04F9A47D784D7D7
                                                      Malicious:false
                                                      Preview:ElfChnk...............................................%%.....................................................................'r.............................................=...........................................................................................................................f...............?...........................m...................M...F...........................W...................................&................................*..................................................**..............6\. ^........./X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                      C:\Windows\System32\winevt\Logs\Microsoft-Windows-Winlogon%4Operational.evtx

                                                      Download File
                                                      Process:C:\Windows\System32\svchost.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):65536
                                                      Entropy (8bit):4.400496847603838
                                                      Encrypted:false
                                                      SSDEEP:384:ih1wUEFUEmUEMUEgUENUEqUEqUEWUEvUESUE4UE4UE3UEbUEpUEpUE9UEgUExUEt:iLs1WRqXJQe
                                                      MD5:8F6F2EAF889B2C30991D7AE557ED5ACE
                                                      SHA1:008D0ECE4563447E4032713DE33360C89447F1DA
                                                      SHA-256:0564F937AEBB515B0C9BF6C38FF414DE1D1C1DF0FF45947DB5A584087484DF3E
                                                      SHA-512:D77201A38953EB9650DDB7E5C99C878F3207E2AA3B9DDBDB7DD7EDB74C6C0DF9A08688E53042F48A5700B1A1420EDA8E0095DEF6AC0BDFC5EEEF89CC5DEFB5A3
                                                      Malicious:false
                                                      Preview:ElfChnk.........+...............+...........x}..................................................................................................(.......................P...=...........................................................................................................................f...............?...........................m...................M...F...............................................................&....5.......................................................3......................**.............. 2^O.9......../X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                      C:\Windows\System32\winevt\Logs\OneApp_IGCC.evtx

                                                      Download File
                                                      Process:C:\Windows\System32\svchost.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):65536
                                                      Entropy (8bit):3.4420031158763695
                                                      Encrypted:false
                                                      SSDEEP:384:Fw0+VsWZttC95UZhVhRoSxHJUBvv3R2ipXR7odz6L7RPLfVXYgXcIycjd52T42Si:F3sfo/0lQhxf27SVSVTuziNpBg12U
                                                      MD5:29331F11011EB2B0C80DD71613AFD445
                                                      SHA1:0A4971A895DAD4F27E1B6A6FCEBE4FE9854C332D
                                                      SHA-256:C0D16882AD91BE81F2F3C25F62D8E6AFEF8E4AB93A609DD95F3CD3E0DE39CBEF
                                                      SHA-512:4C038CB1096ED0CF4DB8E52D8464D8D1FBE38124DE20A70AF556003E168495594F0625C93DF9D602C0A1C6EC45BA115F8FD89EEC547639C341247001D18D8C52
                                                      Malicious:false
                                                      Preview:ElfChnk.........+...............+............Y...Z..........................................................................................................................=...........................................................................................................................w...............P...........................~...................M...m...........................x...............................................................&.......................................................**..x............Bo.,.........|.=O&.......|.=O.s.Q...W.E........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..j............{..P.r.o.v.i.d.e.r...G....=.......K...N.a.m.e.......O.n.e.A.p.p._.I.G.C.C._.W.i.n.S.e.r.v.i.c.e..A..M............a..E.v.e.n.t.I.D...'............)...Q.u.a.l.i.f.i.e.r.s................"...............V

                                                      C:\Windows\System32\winevt\Logs\Security.evtx

                                                      Download File
                                                      Process:C:\Windows\System32\svchost.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):65536
                                                      Entropy (8bit):4.3592390265678915
                                                      Encrypted:false
                                                      SSDEEP:384:dMvFRIBbotxeoZ3ojao5Beo5BVo5Bao5Bto5BSoZpojKo5BEo5B9oZSojFo5B+ol:mNc3gH/
                                                      MD5:FAE3154AB83917D5EE16653B4E48B553
                                                      SHA1:F2A1B2D6F3BB59F8B2348422CC2BF2E344C07A7B
                                                      SHA-256:52450A5A0F9E966FF412C75D7694FFAD5DCC1847AA81B766652B9522DBA9899A
                                                      SHA-512:3EDC488B1906D6ECF1B61F4B2F648F09656F70417C6EDF08128D9D3713E0CF250B28A2AFC3824812BB6CF66DB612CB045A179527CF6ED7DB6339B0BE63417BA1
                                                      Malicious:false
                                                      Preview:ElfChnk..................~.......~..........................................................................................'..`................Z...s...h...................=...................................................N...............................................w.......4.......................-...................................[...........).......M...R...:...........................&...............................>.......................3...........................................................**.......~......l.8.jb............&...........0.P\...3.Du?.......A..3...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.....\...........oT..S.y.s.t.e.m....A...............{..P.r.o.v.i.d.e.r.......F=.......K...N.a.m.e.......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.E.v.e.n.t.l.o.g..........)...G.u.i.d.....&.{.f.c.6.5.d.d.d.8.-.d.6.e.f.-.4.9.6.2.-.8.3.d.5.-.6.e.5.c.f.e.9.c.e.1.

                                                      C:\Windows\System32\winevt\Logs\System.evtx

                                                      Download File
                                                      Process:C:\Windows\System32\svchost.exe
                                                      File Type:data
                                                      Category:dropped
                                                      Size (bytes):65536
                                                      Entropy (8bit):4.431951257192215
                                                      Encrypted:false
                                                      SSDEEP:768:5CKhR8XwKiYI/fNXlxLp132INf7SxA+yO:AKz8XwK+Vxmaf7vHO
                                                      MD5:650D85A75954CAA021068923E67E82D9
                                                      SHA1:66514CC17275A8929A7DF695D4F65B2379CD3FA1
                                                      SHA-256:3D1F5B0372B3EEC406152090B448B6722949D1C60464522D61728DE6E80F13DE
                                                      SHA-512:9B28963708564B4BE1DA18AECBA20A270CD89C508CC3105EAEBAF3281801E695A1BD641034A284A3F94F3841800D3CACC86D5E98DFFAC2B0ADC8FB81F2EB52D9
                                                      Malicious:false
                                                      Preview:ElfChnk..................0.......0...................D.....................................................................Q.AE....................s...h...............N...=...................................................N...............................................w.......0.......................E...................................W...........).......M...3...:...................................................................&...........................................................................**.......0......l.8.jb.........}.T&........}.TA.P[J.......;.......A../...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.....X...........oT..S.y.s.t.e.m....A...............{..P.r.o.v.i.d.e.r.......F=.......K...N.a.m.e.......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.E.v.e.n.t.l.o.g..........)...G.u.i.d.....&.{.f.c.6.5.d.d.d.8.-.d.6.e.f.-.4.9.6.2.-.8.3.d.5.-.6.e.5.c.f.e.9.c.e.1.

                                                      C:\Windows\Temp\tempdll.dll

                                                      Download File
                                                      Process:C:\Users\user\Desktop\dropper.exe
                                                      File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                      Category:dropped
                                                      Size (bytes):344064
                                                      Entropy (8bit):6.323956595460371
                                                      Encrypted:false
                                                      SSDEEP:6144:jtOaldxmJnTjSniNw9+cu3AtSabwyOUUB7By5Er9oX0mP9agsgXFtHVgsA57v4jT:j0aldxmJnTjSiM+/QtSabRwbrJmVNVgc
                                                      MD5:4B02044C5A5742E6076842090C98A045
                                                      SHA1:060CD64808FE445043BC0E0EE4313267A594B8BA
                                                      SHA-256:2FD9A74BB8FB5D7BFFAECAD78066F9D52A54DA138653B3CEE562216AE9572EB6
                                                      SHA-512:DBE633B3DEF7FB07240EA6266B78B795A2723F4ECBB70E79F82882CD896449EB2A93192C9F03F4B6BF59E675D84BBB5DE996BB5398E15A77C4FBF8FDDA82752C
                                                      Malicious:false
                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........vS....................R.......R.......R.......R..........d............R.......R......Rich............................PE..d....y.g.........." ...&.....x...............................................p............`.............................................D....................@...............`......@...T.......................(.......@...............h............................text............................... ..`.rdata...K.......L..................@..@.data........0......................@....pdata.......@... ..................@..@.reloc.......`.......8..............@..B................................................................................................................................................................................................................................................................................................

                                                      Static File Info

                                                      General

                                                      File type:PE32+ executable (console) x86-64, for MS Windows
                                                      Entropy (8bit):7.103866110138709
                                                      TrID:
                                                      • Win64 Executable Console (202006/5) 92.65%
                                                      • Win64 Executable (generic) (12005/4) 5.51%
                                                      • Generic Win/DOS Executable (2004/3) 0.92%
                                                      • DOS Executable Generic (2002/1) 0.92%
                                                      • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                      File name:dropper.exe
                                                      File size:3'272'192 bytes
                                                      MD5:8841148d7d1186d5e5087b672de0de05
                                                      SHA1:6a41bb74c3f451c322c642f80f147ac78bf6d0cb
                                                      SHA256:a39f3ede27a0b06104e10e50b42a526b83bb7131b21ca21f799c4629caeb131c
                                                      SHA512:6a282bab68e3e16909e7ee4c8b5f226dd1e47eedffce3688d08f2d42b3e1b1756f2e9f70731140300744c90b278926cb7292c3ee9099fad38b626491b21aeceb
                                                      SSDEEP:49152:7mjO3FXEAZVrk3wceGM/M5E1d4D7asBsm0B39PIR+VhDkIvrSeVNFXy:QoMs4Pz/gu9ex
                                                      TLSH:5AE5AD12BA4659ECD15AC078834A4A73AA3574CE0B35B9FF05D486393FA9EE41F3C718
                                                      File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......l.F/(.(|(.(|(.(|!..|$.(|..)}*.(|..-}?.(|..,}!.(|..+}+.(|Z.)}-.(|(.)|..(|(.(|..(|E..|).(|E.*}).(|Rich(.(|................PE..d..

                                                      File Icon

                                                      Icon Hash:f0ecd6ce8d8e878b

                                                      Static PE Info

                                                      General

                                                      Entrypoint:0x140157940
                                                      Entrypoint Section:.text
                                                      Digitally signed:false
                                                      Imagebase:0x140000000
                                                      Subsystem:windows cui
                                                      Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
                                                      DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                                                      Time Stamp:0x677F7926 [Thu Jan 9 07:22:14 2025 UTC]
                                                      TLS Callbacks:0x40141ac0, 0x1
                                                      CLR (.Net) Version:
                                                      OS Version Major:6
                                                      OS Version Minor:0
                                                      File Version Major:6
                                                      File Version Minor:0
                                                      Subsystem Version Major:6
                                                      Subsystem Version Minor:0
                                                      Import Hash:0f026d0bef75c6cbd3ab3d29123202f8

                                                      Entrypoint Preview

                                                      Instruction
                                                      dec eax
                                                      sub esp, 28h
                                                      call 00007FFA9CB77AE8h
                                                      dec eax
                                                      add esp, 28h
                                                      jmp 00007FFA9CB77677h
                                                      int3
                                                      int3
                                                      int3
                                                      int3
                                                      int3
                                                      int3
                                                      int3
                                                      int3
                                                      int3
                                                      int3
                                                      int3
                                                      int3
                                                      int3
                                                      int3
                                                      int3
                                                      int3
                                                      int3
                                                      int3
                                                      int3
                                                      int3
                                                      nop word ptr [eax+eax+00000000h]
                                                      dec eax
                                                      sub esp, 10h
                                                      dec esp
                                                      mov dword ptr [esp], edx
                                                      dec esp
                                                      mov dword ptr [esp+08h], ebx
                                                      dec ebp
                                                      xor ebx, ebx
                                                      dec esp
                                                      lea edx, dword ptr [esp+18h]
                                                      dec esp
                                                      sub edx, eax
                                                      dec ebp
                                                      cmovb edx, ebx
                                                      dec esp
                                                      mov ebx, dword ptr [00000010h]
                                                      dec ebp
                                                      cmp edx, ebx
                                                      jnc 00007FFA9CB77818h
                                                      inc cx
                                                      and edx, 8D4DF000h
                                                      wait
                                                      add al, dh

                                                      Rich Headers

                                                      Programming Language:
                                                      • [IMP] VS2008 SP1 build 30729

                                                      Data Directories

                                                      NameVirtual AddressVirtual Size Is in Section
                                                      IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_IMPORT0x3118f40x140.rdata
                                                      IMAGE_DIRECTORY_ENTRY_RESOURCE0x31f0000xc00.rsrc
                                                      IMAGE_DIRECTORY_ENTRY_EXCEPTION0x3140000xa614.pdata
                                                      IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_BASERELOC0x3200000x211c.reloc
                                                      IMAGE_DIRECTORY_ENTRY_DEBUG0x2f08400x54.rdata
                                                      IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_TLS0x2f09000x28.rdata
                                                      IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x2f07000x140.rdata
                                                      IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_IAT0x1600000x400.rdata
                                                      IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                      IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                      Sections

                                                      NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                      .text0x10000x15e61f0x15e80037d1ba7cb17c11952eb14ba08390e777False0.4542443551622682data6.334020022501005IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                      .rdata0x1600000x1b28260x1b2a001e35dc0f6804763282557c47e9b0a1b8False0.7727465757118205data7.375832708680067IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                      .data0x3130000x4a80x200ef744485f4213ee83bc056a6050bc643False0.349609375data2.8066221483586262IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                      .pdata0x3140000xa6140xa8008b099baaa630e929887e4038b11ecff5False0.5122535342261905data6.076417940654896IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                      .rsrc0x31f0000xc000xc0099cb4f54180e8ca55c87941565cd8e59False0.7421875data6.01074092852454IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                      .reloc0x3200000x211c0x2200de20adeadf81341613c773d2cace82d8False0.4840303308823529data5.4176880353278785IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                      Resources

                                                      NameRVASizeTypeLanguageCountryZLIB Complexity
                                                      RT_ICON0x31f0c00xb28Device independent bitmap graphic, 21 x 64 x 32, image size 2688, resolution 3779 x 3779 px/mEnglishUnited States0.7629551820728291
                                                      RT_GROUP_ICON0x31fbe80x14dataEnglishUnited States1.1

                                                      Imports

                                                      DLLImport
                                                      api-ms-win-core-synch-l1-2-0.dllWaitOnAddress, WakeByAddressAll, WakeByAddressSingle
                                                      bcryptprimitives.dllProcessPrng
                                                      bcrypt.dllBCryptGenRandom
                                                      ADVAPI32.dllLsaAddAccountRights, SystemFunction036, AdjustTokenPrivileges, LookupPrivilegeValueW, LsaClose, GetTokenInformation, OpenProcessToken, LsaOpenPolicy
                                                      kernel32.dllGetEnvironmentVariableW, GetStdHandle, GetCurrentProcessId, GetCurrentDirectoryW, QueryPerformanceFrequency, SetLastError, HeapReAlloc, lstrlenW, ReleaseMutex, RtlVirtualUnwind, CreateFileW, RtlLookupFunctionEntry, GetConsoleMode, RtlCaptureContext, GetSystemInfo, GetFullPathNameW, MultiByteToWideChar, WriteConsoleW, WideCharToMultiByte, CreateThread, GetProcAddress, QueryPerformanceCounter, WaitForSingleObject, WaitForSingleObjectEx, LoadLibraryA, CreateMutexA, SwitchToThread, GetCurrentThread, SetThreadStackGuarantee, AddVectoredExceptionHandler, GetCurrentThreadId, GetSystemTimeAsFileTime, FormatMessageW, LoadLibraryExA, InitializeSListHead, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, HeapAlloc, HeapFree, GetProcessHeap, GetModuleFileNameW, Module32NextW, Module32FirstW, CreateToolhelp32Snapshot, GetProcessId, CloseHandle, GetLastError, GetCurrentProcess, GetModuleHandleA, VirtualQuery, GetModuleHandleW, OutputDebugStringW, SetFileInformationByHandle, IsProcessorFeaturePresent
                                                      oleaut32.dllSysFreeString, GetErrorInfo, SysStringLen
                                                      api-ms-win-core-winrt-error-l1-1-0.dllRoOriginateErrorW
                                                      ntdll.dllNtWriteFile, RtlNtStatusToDosError
                                                      VCRUNTIME140.dllmemcmp, memcpy, __C_specific_handler, __CxxFrameHandler3, __current_exception, memset, __current_exception_context, memmove, _CxxThrowException
                                                      api-ms-win-crt-string-l1-1-0.dllwcslen, strlen
                                                      api-ms-win-crt-math-l1-1-0.dllroundf, truncf, exp2f, ceil, __setusermatherr
                                                      api-ms-win-crt-runtime-l1-1-0.dll_initterm_e, exit, _exit, __p___argc, __p___argv, _cexit, _c_exit, _register_thread_local_exe_atexit_callback, _initterm, _get_initial_narrow_environment, _initialize_narrow_environment, _initialize_onexit_table, _register_onexit_function, _crt_atexit, terminate, _set_app_type, _seh_filter_exe, _configure_narrow_argv
                                                      api-ms-win-crt-stdio-l1-1-0.dll__p__commode, _set_fmode
                                                      api-ms-win-crt-locale-l1-1-0.dll_configthreadlocale
                                                      api-ms-win-crt-heap-l1-1-0.dllfree, _set_new_mode

                                                      Possible Origin

                                                      Language of compilation systemCountry where language is spokenMap
                                                      EnglishUnited States

                                                      Network Behavior

                                                      ⊘No network behavior found

                                                      Statistics

                                                      CPU Usage

                                                      Click to jump to process

                                                      Memory Usage

                                                      Click to jump to process

                                                      High Level Behavior Distribution

                                                      Click to dive into process behavior distribution

                                                      Behavior

                                                      Click to jump to process

                                                      System Behavior

                                                      General

                                                      Target ID:0
                                                      Start time:02:46:49
                                                      Start date:09/01/2025
                                                      Path:C:\Users\user\Desktop\dropper.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:"C:\Users\user\Desktop\dropper.exe"
                                                      Imagebase:0x7ff66cb40000
                                                      File size:3'272'192 bytes
                                                      MD5 hash:8841148D7D1186D5E5087B672DE0DE05
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Reputation:low
                                                      Has exited:true

                                                      General

                                                      Target ID:1
                                                      Start time:02:46:49
                                                      Start date:09/01/2025
                                                      Path:C:\Windows\System32\conhost.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                      Imagebase:0x7ff657890000
                                                      File size:875'008 bytes
                                                      MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Reputation:high
                                                      Has exited:true

                                                      General

                                                      Target ID:2
                                                      Start time:02:46:49
                                                      Start date:09/01/2025
                                                      Path:C:\Windows\System32\cmd.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:"C:\Windows\System32\cmd.exe"
                                                      Imagebase:0x7ff645a80000
                                                      File size:289'792 bytes
                                                      MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Reputation:high
                                                      Has exited:false

                                                      General

                                                      Target ID:3
                                                      Start time:02:46:49
                                                      Start date:09/01/2025
                                                      Path:C:\Windows\System32\conhost.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                      Imagebase:0x7ff657890000
                                                      File size:875'008 bytes
                                                      MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Reputation:high
                                                      Has exited:false

                                                      General

                                                      Target ID:7
                                                      Start time:02:47:07
                                                      Start date:09/01/2025
                                                      Path:C:\Windows\System32\winlogon.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:winlogon.exe
                                                      Imagebase:0x7ff659a30000
                                                      File size:944'128 bytes
                                                      MD5 hash:A987B43E6A8E8F894B98A3DF022DB518
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Reputation:moderate
                                                      Has exited:false

                                                      General

                                                      Target ID:8
                                                      Start time:02:47:07
                                                      Start date:09/01/2025
                                                      Path:C:\Windows\System32\lsass.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\lsass.exe
                                                      Imagebase:0x7ff6d2400000
                                                      File size:59'448 bytes
                                                      MD5 hash:15A556DEF233F112D127025AB51AC2D3
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Reputation:moderate
                                                      Has exited:false

                                                      General

                                                      Target ID:9
                                                      Start time:02:47:07
                                                      Start date:09/01/2025
                                                      Path:C:\Windows\System32\svchost.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\svchost.exe -k DcomLaunch -p
                                                      Imagebase:0x7ff6cb290000
                                                      File size:57'360 bytes
                                                      MD5 hash:F586835082F632DC8D9404D83BC16316
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Reputation:moderate
                                                      Has exited:false

                                                      General

                                                      Target ID:10
                                                      Start time:02:47:08
                                                      Start date:09/01/2025
                                                      Path:C:\Windows\System32\fontdrvhost.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:"fontdrvhost.exe"
                                                      Imagebase:0x7ff6a0db0000
                                                      File size:830'520 bytes
                                                      MD5 hash:AB7AB4CF816D091EEE234C1D9BC4FD13
                                                      Has elevated privileges:false
                                                      Has administrator privileges:false
                                                      Programmed in:C, C++ or other language
                                                      Reputation:moderate
                                                      Has exited:false

                                                      General

                                                      Target ID:11
                                                      Start time:02:47:08
                                                      Start date:09/01/2025
                                                      Path:C:\Windows\System32\fontdrvhost.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:"fontdrvhost.exe"
                                                      Imagebase:0x7ff6a0db0000
                                                      File size:830'520 bytes
                                                      MD5 hash:AB7AB4CF816D091EEE234C1D9BC4FD13
                                                      Has elevated privileges:false
                                                      Has administrator privileges:false
                                                      Programmed in:C, C++ or other language
                                                      Reputation:moderate
                                                      Has exited:false

                                                      General

                                                      Target ID:12
                                                      Start time:02:47:08
                                                      Start date:09/01/2025
                                                      Path:C:\Windows\System32\svchost.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\svchost.exe -k RPCSS -p
                                                      Imagebase:0x7ff6cb290000
                                                      File size:57'360 bytes
                                                      MD5 hash:F586835082F632DC8D9404D83BC16316
                                                      Has elevated privileges:true
                                                      Has administrator privileges:false
                                                      Programmed in:C, C++ or other language
                                                      Reputation:moderate
                                                      Has exited:false

                                                      General

                                                      Target ID:13
                                                      Start time:02:47:09
                                                      Start date:09/01/2025
                                                      Path:C:\Windows\System32\svchost.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
                                                      Imagebase:0x7ff6cb290000
                                                      File size:57'360 bytes
                                                      MD5 hash:F586835082F632DC8D9404D83BC16316
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Reputation:moderate
                                                      Has exited:false

                                                      General

                                                      Target ID:14
                                                      Start time:02:47:09
                                                      Start date:09/01/2025
                                                      Path:C:\Windows\System32\dwm.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:"dwm.exe"
                                                      Imagebase:0x7ff654d70000
                                                      File size:94'720 bytes
                                                      MD5 hash:5C27608411832C5B39BA04E33D53536C
                                                      Has elevated privileges:false
                                                      Has administrator privileges:false
                                                      Programmed in:C, C++ or other language
                                                      Has exited:false

                                                      General

                                                      Target ID:15
                                                      Start time:02:47:12
                                                      Start date:09/01/2025
                                                      Path:C:\Windows\System32\svchost.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
                                                      Imagebase:0x7ff6cb290000
                                                      File size:57'360 bytes
                                                      MD5 hash:F586835082F632DC8D9404D83BC16316
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Has exited:false

                                                      General

                                                      Target ID:16
                                                      Start time:02:47:12
                                                      Start date:09/01/2025
                                                      Path:C:\Windows\System32\svchost.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
                                                      Imagebase:0x7ff6cb290000
                                                      File size:57'360 bytes
                                                      MD5 hash:F586835082F632DC8D9404D83BC16316
                                                      Has elevated privileges:false
                                                      Has administrator privileges:false
                                                      Programmed in:C, C++ or other language
                                                      Has exited:false

                                                      General

                                                      Target ID:17
                                                      Start time:02:47:12
                                                      Start date:09/01/2025
                                                      Path:C:\Windows\System32\svchost.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
                                                      Imagebase:0x7ff6cb290000
                                                      File size:57'360 bytes
                                                      MD5 hash:F586835082F632DC8D9404D83BC16316
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Has exited:false

                                                      General

                                                      Target ID:18
                                                      Start time:02:47:13
                                                      Start date:09/01/2025
                                                      Path:C:\Windows\System32\svchost.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
                                                      Imagebase:0x7ff6cb290000
                                                      File size:57'360 bytes
                                                      MD5 hash:F586835082F632DC8D9404D83BC16316
                                                      Has elevated privileges:false
                                                      Has administrator privileges:false
                                                      Programmed in:C, C++ or other language
                                                      Has exited:false

                                                      General

                                                      Target ID:19
                                                      Start time:02:47:13
                                                      Start date:09/01/2025
                                                      Path:C:\Windows\System32\svchost.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                                                      Imagebase:0x7ff6cb290000
                                                      File size:57'360 bytes
                                                      MD5 hash:F586835082F632DC8D9404D83BC16316
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Has exited:false

                                                      General

                                                      Target ID:20
                                                      Start time:02:47:14
                                                      Start date:09/01/2025
                                                      Path:C:\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_3ea756ac68d34d21\IntelCpHDCPSvc.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_3ea756ac68d34d21\IntelCpHDCPSvc.exe
                                                      Imagebase:0x7ff636fc0000
                                                      File size:365'360 bytes
                                                      MD5 hash:B6BAD2BD8596D9101874E9042B8E2D63
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Has exited:false

                                                      General

                                                      Target ID:21
                                                      Start time:02:47:14
                                                      Start date:09/01/2025
                                                      Path:C:\Windows\System32\svchost.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                                                      Imagebase:0x7ff6cb290000
                                                      File size:57'360 bytes
                                                      MD5 hash:F586835082F632DC8D9404D83BC16316
                                                      Has elevated privileges:true
                                                      Has administrator privileges:false
                                                      Programmed in:C, C++ or other language
                                                      Has exited:false

                                                      General

                                                      Target ID:22
                                                      Start time:02:47:14
                                                      Start date:09/01/2025
                                                      Path:C:\Windows\System32\svchost.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                                                      Imagebase:0x7ff6cb290000
                                                      File size:57'360 bytes
                                                      MD5 hash:F586835082F632DC8D9404D83BC16316
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Has exited:false

                                                      General

                                                      Target ID:23
                                                      Start time:02:47:14
                                                      Start date:09/01/2025
                                                      Path:C:\Windows\System32\svchost.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                                                      Imagebase:0x7ff6cb290000
                                                      File size:57'360 bytes
                                                      MD5 hash:F586835082F632DC8D9404D83BC16316
                                                      Has elevated privileges:true
                                                      Has administrator privileges:false
                                                      Programmed in:C, C++ or other language
                                                      Has exited:false

                                                      General

                                                      Target ID:24
                                                      Start time:02:47:15
                                                      Start date:09/01/2025
                                                      Path:C:\Windows\System32\svchost.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                                                      Imagebase:0x7ff6cb290000
                                                      File size:57'360 bytes
                                                      MD5 hash:F586835082F632DC8D9404D83BC16316
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Has exited:false

                                                      General

                                                      Target ID:25
                                                      Start time:02:47:16
                                                      Start date:09/01/2025
                                                      Path:C:\Windows\System32\DriverStore\FileRepository\cui_dch.inf_amd64_2e49f48165b8de10\igfxCUIService.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\System32\DriverStore\FileRepository\cui_dch.inf_amd64_2e49f48165b8de10\igfxCUIService.exe
                                                      Imagebase:0x7ff795340000
                                                      File size:399'664 bytes
                                                      MD5 hash:91038D45A86B5465E8B7E5CD63187150
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Has exited:false

                                                      General

                                                      Target ID:26
                                                      Start time:02:47:16
                                                      Start date:09/01/2025
                                                      Path:C:\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_3ea756ac68d34d21\IntelCpHeciSvc.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_3ea756ac68d34d21\IntelCpHeciSvc.exe
                                                      Imagebase:0x7ff7a8f00000
                                                      File size:521'536 bytes
                                                      MD5 hash:3B0DF35583675DE5A08E8D4C1271CEC0
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Has exited:false

                                                      General

                                                      Target ID:27
                                                      Start time:02:47:16
                                                      Start date:09/01/2025
                                                      Path:C:\Windows\System32\svchost.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                                                      Imagebase:0x7ff6cb290000
                                                      File size:57'360 bytes
                                                      MD5 hash:F586835082F632DC8D9404D83BC16316
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Has exited:false

                                                      General

                                                      Target ID:28
                                                      Start time:02:47:17
                                                      Start date:09/01/2025
                                                      Path:C:\Windows\System32\svchost.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
                                                      Imagebase:0x7ff6cb290000
                                                      File size:57'360 bytes
                                                      MD5 hash:F586835082F632DC8D9404D83BC16316
                                                      Has elevated privileges:true
                                                      Has administrator privileges:false
                                                      Programmed in:C, C++ or other language
                                                      Has exited:false

                                                      General

                                                      Target ID:29
                                                      Start time:02:47:17
                                                      Start date:09/01/2025
                                                      Path:C:\Windows\System32\svchost.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                                                      Imagebase:0x7ff6cb290000
                                                      File size:57'360 bytes
                                                      MD5 hash:F586835082F632DC8D9404D83BC16316
                                                      Has elevated privileges:true
                                                      Has administrator privileges:false
                                                      Programmed in:C, C++ or other language
                                                      Has exited:false

                                                      General

                                                      Target ID:30
                                                      Start time:02:47:17
                                                      Start date:09/01/2025
                                                      Path:C:\Windows\System32\svchost.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                                                      Imagebase:0x7ff6cb290000
                                                      File size:57'360 bytes
                                                      MD5 hash:F586835082F632DC8D9404D83BC16316
                                                      Has elevated privileges:true
                                                      Has administrator privileges:false
                                                      Programmed in:C, C++ or other language
                                                      Has exited:false

                                                      General

                                                      Target ID:31
                                                      Start time:02:47:18
                                                      Start date:09/01/2025
                                                      Path:C:\Windows\System32\svchost.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                                                      Imagebase:0x7ff6cb290000
                                                      File size:57'360 bytes
                                                      MD5 hash:F586835082F632DC8D9404D83BC16316
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Has exited:false

                                                      General

                                                      Target ID:32
                                                      Start time:02:47:18
                                                      Start date:09/01/2025
                                                      Path:C:\Windows\System32\svchost.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                                                      Imagebase:0x7ff6cb290000
                                                      File size:57'360 bytes
                                                      MD5 hash:F586835082F632DC8D9404D83BC16316
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Has exited:false

                                                      General

                                                      Target ID:33
                                                      Start time:02:47:18
                                                      Start date:09/01/2025
                                                      Path:C:\Windows\System32\svchost.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
                                                      Imagebase:0x7ff6cb290000
                                                      File size:57'360 bytes
                                                      MD5 hash:F586835082F632DC8D9404D83BC16316
                                                      Has elevated privileges:true
                                                      Has administrator privileges:false
                                                      Programmed in:C, C++ or other language
                                                      Has exited:false

                                                      General

                                                      Target ID:34
                                                      Start time:02:47:18
                                                      Start date:09/01/2025
                                                      Path:C:\Windows\System32\svchost.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
                                                      Imagebase:0x7ff6cb290000
                                                      File size:57'360 bytes
                                                      MD5 hash:F586835082F632DC8D9404D83BC16316
                                                      Has elevated privileges:true
                                                      Has administrator privileges:false
                                                      Programmed in:C, C++ or other language
                                                      Has exited:false

                                                      General

                                                      Target ID:35
                                                      Start time:02:47:19
                                                      Start date:09/01/2025
                                                      Path:C:\Windows\System32\svchost.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
                                                      Imagebase:0x7ff6cb290000
                                                      File size:57'360 bytes
                                                      MD5 hash:F586835082F632DC8D9404D83BC16316
                                                      Has elevated privileges:true
                                                      Has administrator privileges:false
                                                      Programmed in:C, C++ or other language
                                                      Has exited:false

                                                      General

                                                      Target ID:36
                                                      Start time:02:47:19
                                                      Start date:09/01/2025
                                                      Path:C:\Windows\System32\svchost.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                                                      Imagebase:0x7ff6cb290000
                                                      File size:57'360 bytes
                                                      MD5 hash:F586835082F632DC8D9404D83BC16316
                                                      Has elevated privileges:true
                                                      Has administrator privileges:false
                                                      Programmed in:C, C++ or other language
                                                      Has exited:false

                                                      General

                                                      Target ID:37
                                                      Start time:02:47:19
                                                      Start date:09/01/2025
                                                      Path:C:\Windows\System32\svchost.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                                                      Imagebase:0x7ff6cb290000
                                                      File size:57'360 bytes
                                                      MD5 hash:F586835082F632DC8D9404D83BC16316
                                                      Has elevated privileges:true
                                                      Has administrator privileges:false
                                                      Programmed in:C, C++ or other language
                                                      Has exited:true

                                                      General

                                                      Target ID:38
                                                      Start time:02:47:20
                                                      Start date:09/01/2025
                                                      Path:C:\Windows\System32\svchost.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
                                                      Imagebase:0x7ff6cb290000
                                                      File size:57'360 bytes
                                                      MD5 hash:F586835082F632DC8D9404D83BC16316
                                                      Has elevated privileges:false
                                                      Has administrator privileges:false
                                                      Programmed in:C, C++ or other language
                                                      Has exited:false

                                                      General

                                                      Target ID:39
                                                      Start time:02:47:20
                                                      Start date:09/01/2025
                                                      Path:C:\Windows\System32\svchost.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                      Imagebase:0x7ff6cb290000
                                                      File size:57'360 bytes
                                                      MD5 hash:F586835082F632DC8D9404D83BC16316
                                                      Has elevated privileges:true
                                                      Has administrator privileges:false
                                                      Programmed in:C, C++ or other language
                                                      Has exited:false

                                                      General

                                                      Target ID:40
                                                      Start time:02:47:21
                                                      Start date:09/01/2025
                                                      Path:C:\Windows\System32\svchost.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                      Imagebase:0x7ff6cb290000
                                                      File size:57'360 bytes
                                                      MD5 hash:F586835082F632DC8D9404D83BC16316
                                                      Has elevated privileges:true
                                                      Has administrator privileges:false
                                                      Programmed in:C, C++ or other language
                                                      Has exited:false

                                                      General

                                                      Target ID:41
                                                      Start time:02:47:21
                                                      Start date:09/01/2025
                                                      Path:C:\Windows\System32\svchost.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                      Imagebase:0x7ff6cb290000
                                                      File size:57'360 bytes
                                                      MD5 hash:F586835082F632DC8D9404D83BC16316
                                                      Has elevated privileges:true
                                                      Has administrator privileges:false
                                                      Programmed in:C, C++ or other language
                                                      Has exited:false

                                                      General

                                                      Target ID:42
                                                      Start time:02:47:21
                                                      Start date:09/01/2025
                                                      Path:C:\Windows\System32\svchost.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                                      Imagebase:0x7ff6cb290000
                                                      File size:57'360 bytes
                                                      MD5 hash:F586835082F632DC8D9404D83BC16316
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Has exited:false

                                                      General

                                                      Target ID:43
                                                      Start time:02:47:22
                                                      Start date:09/01/2025
                                                      Path:C:\Windows\System32\svchost.exe
                                                      Wow64 process (32bit):false
                                                      Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                                                      Imagebase:0x7ff6cb290000
                                                      File size:57'360 bytes
                                                      MD5 hash:F586835082F632DC8D9404D83BC16316
                                                      Has elevated privileges:true
                                                      Has administrator privileges:true
                                                      Programmed in:C, C++ or other language
                                                      Has exited:false

                                                      Disassembly

                                                      Reset < >

                                                        Execution Graph

                                                        Execution Coverage:11.8%
                                                        Dynamic/Decrypted Code Coverage:0%
                                                        Signature Coverage:31.4%
                                                        Total number of Nodes:688
                                                        Total number of Limit Nodes:58
                                                        execution_graph 4539 7ff66cb429a0 4540 7ff66cb50350 33 API calls 4539->4540 4541 7ff66cb429f5 4540->4541 4542 7ff66cb42ce8 4541->4542 4543 7ff66cb429ff 4541->4543 4545 7ff66cc9f370 22 API calls 4542->4545 4544 7ff66cc89810 22 API calls 4543->4544 4546 7ff66cb42af4 memset 4544->4546 4548 7ff66cb42d29 4545->4548 4547 7ff66cb42bda OutputDebugStringW 4546->4547 4549 7ff66cb42b33 4546->4549 4550 7ff66cb42bf0 4547->4550 4549->4547 4627 7ff66cb41000 4628 7ff66cb4101c 4627->4628 4629 7ff66cb410a2 4627->4629 4633 7ff66cb4102c 4628->4633 4640 7ff66cc7d3c0 ProcessPrng 4628->4640 4630 7ff66cc9ef20 22 API calls 4629->4630 4631 7ff66cb410ae 4630->4631 4632 7ff66cb41158 4631->4632 4634 7ff66cb410cc 4631->4634 4635 7ff66cc9ef20 22 API calls 4632->4635 4637 7ff66cb410dc 4634->4637 4641 7ff66cc7d3c0 ProcessPrng 4634->4641 4639 7ff66cb41164 4635->4639 4640->4633 4641->4637 4642 7ff66cb42940 4643 7ff66cb42977 4642->4643 4644 7ff66cb42986 4642->4644 4645 7ff66cc9e5b0 25 API calls 4644->4645 4645->4643 4712 7ff66cb42120 4713 7ff66cb53010 25 API calls 4712->4713 4714 7ff66cb4214b 4713->4714 4556 7ff66cb54560 4557 7ff66cb5458a 4556->4557 4558 7ff66cb548a5 4557->4558 4561 7ff66cb54795 4557->4561 4562 7ff66cb54613 4557->4562 4559 7ff66cc9ed93 22 API calls 4558->4559 4560 7ff66cb548bd 4559->4560 4562->4561 4564 7ff66cc98c00 4562->4564 4565 7ff66cc98cd4 4564->4565 4566 7ff66cc98c17 4564->4566 4567 7ff66cc9ed93 22 API calls 4565->4567 4566->4565 4570 7ff66cc98c6d 4566->4570 4568 7ff66cc98cba 4567->4568 4569 7ff66cc9ed93 22 API calls 4568->4569 4577 7ff66cc98cc1 4568->4577 4571 7ff66cc98cf8 4569->4571 4570->4568 4587 7ff66cc98b90 4570->4587 4591 7ff66cb5afd0 4571->4591 4574 7ff66cc98d3b 4575 7ff66cc98d44 4574->4575 4576 7ff66cc98f16 4574->4576 4598 7ff66cb5ad10 4575->4598 4579 7ff66cc9efa0 22 API calls 4576->4579 4577->4562 4581 7ff66cc98f67 4579->4581 4580 7ff66cc98d6e 4580->4581 4583 7ff66cc98da5 4580->4583 4582 7ff66cc9edb0 22 API calls 4581->4582 4584 7ff66cc98f78 4582->4584 4586 7ff66cc98eae 4583->4586 4605 7ff66cc81950 4583->4605 4584->4562 4586->4562 4588 7ff66cc98bc0 4587->4588 4589 7ff66cc98ba7 4587->4589 4588->4568 4589->4588 4590 7ff66cc98bbe RtlReAllocateHeap 4589->4590 4590->4588 4592 7ff66cb5b006 4591->4592 4593 7ff66cb5afda 4591->4593 4592->4574 4612 7ff66cb5b240 4593->4612 4595 7ff66cb5afe5 4595->4592 4596 7ff66cc9edb0 22 API calls 4595->4596 4597 7ff66cb5b028 4596->4597 4597->4574 4599 7ff66cb5ad28 4598->4599 4600 7ff66cb5ad35 4599->4600 4601 7ff66cb5ad92 4599->4601 4602 7ff66cc9f460 22 API calls 4599->4602 4600->4580 4601->4600 4603 7ff66cc9f450 22 API calls 4601->4603 4602->4601 4604 7ff66cb5adf4 4603->4604 4606 7ff66cc81a2b 4605->4606 4609 7ff66cc81989 4605->4609 4607 7ff66cc7ab50 22 API calls 4606->4607 4611 7ff66cc81a65 4607->4611 4608 7ff66cc819e7 4608->4586 4609->4608 4617 7ff66cc77220 4609->4617 4611->4586 4614 7ff66cb5b2aa 4612->4614 4616 7ff66cb5b253 4612->4616 4613 7ff66cb5b278 BCryptGenRandom 4615 7ff66cb5b29c SystemFunction036 4613->4615 4613->4616 4614->4595 4615->4614 4615->4616 4616->4613 4616->4614 4618 7ff66cc7723d 4617->4618 4619 7ff66cc77264 4618->4619 4620 7ff66cc9ed93 22 API calls 4618->4620 4621 7ff66cc9ed93 22 API calls 4619->4621 4623 7ff66cc772b4 4619->4623 4620->4619 4622 7ff66cc772e2 4621->4622 4623->4608 4715 7ff66cb54260 4716 7ff66cb5426a 4715->4716 4717 7ff66cb5427f 4715->4717 4722 7ff66cc74300 4716->4722 4721 7ff66cb54278 4727 7ff66cc74970 4722->4727 4724 7ff66cc74332 RoOriginateErrorW 4725 7ff66cb54271 4724->4725 4726 7ff66cc73fc0 GetErrorInfo 4725->4726 4726->4721 4730 7ff66cc7499a 4727->4730 4728 7ff66cc74bb5 4728->4724 4729 7ff66cc74cc5 4731 7ff66cc9ed93 22 API calls 4729->4731 4730->4728 4730->4729 4733 7ff66cc74a23 4730->4733 4732 7ff66cc74cdd 4731->4732 4732->4724 4733->4728 4735 7ff66cc9d7a0 4733->4735 4736 7ff66cc9d861 4735->4736 4737 7ff66cc9d7b2 4735->4737 4739 7ff66cc9ed93 22 API calls 4736->4739 4737->4736 4741 7ff66cc9d7fa 4737->4741 4738 7ff66cc9d847 4740 7ff66cc9ed93 22 API calls 4738->4740 4744 7ff66cc9d84e 4738->4744 4739->4738 4743 7ff66cc9d885 4740->4743 4741->4738 4742 7ff66cc98b90 RtlReAllocateHeap 4741->4742 4742->4738 4743->4733 4744->4733 4646 7ff66cc97940 4649 7ff66cc97c2c 4646->4649 4650 7ff66cc97c4f GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter 4649->4650 4651 7ff66cc97949 4649->4651 4650->4651 3901 7ff66cb452d0 3968 7ff66cc89810 3901->3968 3904 7ff66cb454aa OutputDebugStringW 3905 7ff66cb454cd 3904->3905 3975 7ff66cb421c0 3905->3975 3907 7ff66cb453f6 3907->3904 3908 7ff66cb454ed 3955 7ff66cb454fc 3908->3955 4005 7ff66cb50ae0 3908->4005 3910 7ff66cb45544 3911 7ff66cb45551 3910->3911 3915 7ff66cb4562f 3910->3915 3912 7ff66cc89810 22 API calls 3911->3912 3913 7ff66cb455ca memset 3912->3913 3914 7ff66cb4580a OutputDebugStringW 3913->3914 3917 7ff66cb4560a 3913->3917 3914->3955 3916 7ff66cc89810 22 API calls 3915->3916 3918 7ff66cb45715 memset 3916->3918 3917->3914 3919 7ff66cb4592a OutputDebugStringW 3918->3919 3923 7ff66cb4574e 3918->3923 3920 7ff66cb45946 3919->3920 3921 7ff66cc89810 22 API calls 3920->3921 3922 7ff66cb45a03 3921->3922 4031 7ff66cc899d0 3922->4031 3923->3919 3925 7ff66cb45a27 3926 7ff66cc89810 22 API calls 3925->3926 3927 7ff66cb45a99 memset 3926->3927 3928 7ff66cb45b8a OutputDebugStringW 3927->3928 3932 7ff66cb45ad5 3927->3932 3929 7ff66cb45ba6 3928->3929 4064 7ff66cb467d0 3929->4064 3931 7ff66cb45bca 3933 7ff66cc89810 22 API calls 3931->3933 3932->3928 3934 7ff66cb45c43 memset 3933->3934 3935 7ff66cb45d2a OutputDebugStringW 3934->3935 3939 7ff66cb45c7c 3934->3939 3936 7ff66cb45d46 3935->3936 4073 7ff66cb47340 3936->4073 3939->3935 3940 7ff66cb45d6c 3942 7ff66cc89810 22 API calls 3940->3942 3941 7ff66cb45e41 memset OutputDebugStringW GetModuleHandleA 3943 7ff66cb45f3a 3941->3943 3949 7ff66cb45efb 3941->3949 3945 7ff66cb45de3 memset 3942->3945 4119 7ff66cc73d00 GetLastError 3943->4119 3947 7ff66cb4600a OutputDebugStringW 3945->3947 3952 7ff66cb45e1c 3945->3952 3947->3949 3948 7ff66cb46051 3950 7ff66cb4616b 3948->3950 3951 7ff66cb4605b 3948->3951 3949->3955 4099 7ff66cb44d10 3949->4099 3953 7ff66cc89810 22 API calls 3950->3953 3954 7ff66cb46071 VirtualQuery 3951->3954 3952->3947 3956 7ff66cb461bf memset 3953->3956 3957 7ff66cb46090 3954->3957 3958 7ff66cb46224 3954->3958 3959 7ff66cb4641a OutputDebugStringW 3956->3959 3966 7ff66cb461ff 3956->3966 3957->3958 3961 7ff66cb4609d 3957->3961 3960 7ff66cc89810 22 API calls 3958->3960 3959->3955 3962 7ff66cb46286 memset 3960->3962 3963 7ff66cc89810 22 API calls 3961->3963 3962->3959 3962->3966 3964 7ff66cb4610d memset 3963->3964 3965 7ff66cb4653a OutputDebugStringW 3964->3965 3967 7ff66cb46146 3964->3967 3965->3955 3966->3959 3967->3965 3969 7ff66cc8983a 3968->3969 3970 7ff66cb453bb memset 3969->3970 3972 7ff66cc898f9 3969->3972 4120 7ff66cc9f370 3969->4120 3970->3904 3970->3907 4125 7ff66cc9ed93 3972->4125 3976 7ff66cb4220a 3975->3976 3977 7ff66cb42820 3975->3977 3979 7ff66cb4222d 3976->3979 3980 7ff66cc9e2a0 22 API calls 3976->3980 4338 7ff66cc9e090 3977->4338 3981 7ff66cb42888 3979->3981 3987 7ff66cb4223a 3979->3987 3980->3979 3983 7ff66cc9f370 22 API calls 3981->3983 3982 7ff66cb423fb 3984 7ff66cc89810 22 API calls 3982->3984 3985 7ff66cb428bc 3983->3985 3986 7ff66cb42455 memset 3984->3986 3989 7ff66cb42924 3985->3989 3993 7ff66cc9e5b0 25 API calls 3985->3993 3988 7ff66cb426aa OutputDebugStringW 3986->3988 3997 7ff66cb4249b 3986->3997 3987->3982 3990 7ff66cb424c0 3987->3990 3991 7ff66cb426c0 3988->3991 3989->3908 3992 7ff66cc89810 22 API calls 3990->3992 3995 7ff66cb4280e 3991->3995 4346 7ff66cc9e5b0 3991->4346 3994 7ff66cb425b7 memset 3992->3994 3993->3989 3996 7ff66cb4276a OutputDebugStringW 3994->3996 4000 7ff66cb425fd 3994->4000 3995->3908 4004 7ff66cb42780 3996->4004 3997->3988 3999 7ff66cb428cb 4003 7ff66cc9ed93 22 API calls 3999->4003 4000->3996 4001 7ff66cb427ce memcpy 4001->3991 4003->3985 4004->3999 4004->4001 4008 7ff66cb50b63 4005->4008 4009 7ff66cb50b24 4005->4009 4006 7ff66cb50b4f 4357 7ff66cc70110 memset 4006->4357 4011 7ff66cc9ed93 22 API calls 4008->4011 4029 7ff66cb50b82 4008->4029 4009->4006 4012 7ff66cb50bc8 4009->4012 4010 7ff66cb50b5e 4013 7ff66cb50c16 memcpy 4010->4013 4014 7ff66cb50fed 4011->4014 4015 7ff66cb50be9 memcpy memcpy 4012->4015 4013->4014 4020 7ff66cb50c42 4013->4020 4017 7ff66cc9ed93 22 API calls 4014->4017 4015->4013 4016 7ff66cb50c66 memcpy memcpy 4021 7ff66cb50ca8 4016->4021 4022 7ff66cb50cb2 4016->4022 4019 7ff66cb51008 4017->4019 4019->3910 4020->4014 4020->4016 4024 7ff66cc89810 22 API calls 4021->4024 4021->4029 4363 7ff66cb55190 4022->4363 4025 7ff66cb50dc2 memset 4024->4025 4026 7ff66cb50eba OutputDebugStringW 4025->4026 4028 7ff66cb50e04 4025->4028 4027 7ff66cb50ed6 4026->4027 4027->4029 4030 7ff66cc9f370 22 API calls 4027->4030 4028->4026 4029->3910 4030->4019 4032 7ff66cc8a539 4031->4032 4034 7ff66cc899ff 4031->4034 4033 7ff66cc9ed93 22 API calls 4032->4033 4061 7ff66cc89fad 4033->4061 4034->4032 4040 7ff66cc89a2e 4034->4040 4035 7ff66cc9f510 22 API calls 4036 7ff66cc8a537 4035->4036 4036->3925 4038 7ff66cc89c3c 4411 7ff66cc9f510 4038->4411 4040->4038 4042 7ff66cc8a271 memcpy 4040->4042 4043 7ff66cc8a451 4040->4043 4044 7ff66cc8a028 memcpy 4040->4044 4046 7ff66cc89590 22 API calls 4040->4046 4048 7ff66cc8a4b4 4040->4048 4050 7ff66cc8a4cc 4040->4050 4051 7ff66cc8a460 4040->4051 4052 7ff66cc8a120 memcpy 4040->4052 4053 7ff66cc89b6f memcpy 4040->4053 4056 7ff66cc8a1c0 memcpy 4040->4056 4057 7ff66cc8a47c 4040->4057 4058 7ff66cc8a4e4 4040->4058 4060 7ff66cc8a494 4040->4060 4040->4061 4062 7ff66cc97100 22 API calls 4040->4062 4063 7ff66cc97280 22 API calls 4040->4063 4388 7ff66cc97580 4040->4388 4404 7ff66cc9ecf0 4040->4404 4042->4040 4047 7ff66cc9ecf0 22 API calls 4043->4047 4044->4040 4045 7ff66cc9ecf0 22 API calls 4045->4048 4046->4040 4047->4051 4049 7ff66cc9ecf0 22 API calls 4048->4049 4049->4050 4054 7ff66cc9ecf0 22 API calls 4050->4054 4055 7ff66cc9ecf0 22 API calls 4051->4055 4052->4040 4053->4040 4054->4058 4055->4057 4056->4040 4059 7ff66cc9ecf0 22 API calls 4057->4059 4058->3925 4059->4060 4060->4045 4061->4035 4062->4040 4063->4040 4065 7ff66cc899d0 40 API calls 4064->4065 4067 7ff66cb467f6 4065->4067 4066 7ff66cb46956 4069 7ff66cc9ed93 22 API calls 4066->4069 4067->4066 4071 7ff66cb4683e memcpy 4067->4071 4070 7ff66cb4696b 4069->4070 4070->3931 4072 7ff66cb4685f 4071->4072 4072->3931 4074 7ff66cb47391 4073->4074 4075 7ff66cb47b4e 4073->4075 4077 7ff66cc9dfc0 2 API calls 4074->4077 4080 7ff66cb473a7 4074->4080 4076 7ff66cc9e090 3 API calls 4075->4076 4076->4080 4077->4075 4078 7ff66cb47baa 4081 7ff66cc9f370 22 API calls 4078->4081 4079 7ff66cb4759b 4082 7ff66cc89810 22 API calls 4079->4082 4080->4078 4083 7ff66cb473cc 4080->4083 4093 7ff66cb47a2d 4081->4093 4084 7ff66cb475f5 memset 4082->4084 4083->4079 4086 7ff66cb47660 4083->4086 4087 7ff66cb477ea OutputDebugStringW 4084->4087 4092 7ff66cb4763b 4084->4092 4089 7ff66cc89810 22 API calls 4086->4089 4098 7ff66cb47800 4087->4098 4088 7ff66cb45d62 4088->3940 4088->3941 4090 7ff66cb476ec memset 4089->4090 4091 7ff66cb47aca OutputDebugStringW 4090->4091 4095 7ff66cb47739 4090->4095 4091->4093 4092->4087 4093->4088 4438 7ff66cc9e080 WakeByAddressSingle 4093->4438 4094 7ff66cc89810 22 API calls 4096 7ff66cb47921 memset 4094->4096 4095->4091 4097 7ff66cb479fa OutputDebugStringW 4096->4097 4096->4098 4097->4098 4098->4093 4098->4094 4098->4097 4100 7ff66cb44dd1 memset 4099->4100 4101 7ff66cb44d33 4099->4101 4102 7ff66cb451cc OutputDebugStringW 4100->4102 4103 7ff66cb44e1f 4101->4103 4105 7ff66cb44d5f memset 4101->4105 4104 7ff66cb451da 4102->4104 4106 7ff66cc89810 22 API calls 4103->4106 4104->3948 4105->4102 4107 7ff66cb44ead memset 4106->4107 4108 7ff66cb44f9a OutputDebugStringW 4107->4108 4111 7ff66cb44ee5 4107->4111 4112 7ff66cb44fbc 4108->4112 4109 7ff66cb45168 memset 4109->4102 4110 7ff66cb4500c strlen 4110->4112 4111->4108 4112->4109 4112->4110 4113 7ff66cb45064 memcmp 4112->4113 4113->4112 4114 7ff66cb45075 4113->4114 4115 7ff66cc89810 22 API calls 4114->4115 4116 7ff66cb4510b memset 4115->4116 4117 7ff66cb4528a OutputDebugStringW 4116->4117 4118 7ff66cb45143 4116->4118 4117->4104 4118->4117 4119->3949 4131 7ff66cc9efa0 4120->4131 4126 7ff66cc9eda2 4125->4126 4127 7ff66cc9edaa 4125->4127 4335 7ff66cc89550 4126->4335 4129 7ff66cc9edb0 22 API calls 4127->4129 4130 7ff66cc9edaf 4129->4130 4134 7ff66cc7e010 4131->4134 4140 7ff66cc7d1a0 4134->4140 4169 7ff66cc7e380 4140->4169 4142 7ff66cc7d1af 4175 7ff66cc7e530 4142->4175 4171 7ff66cc7e3a3 4169->4171 4170 7ff66cc7e3f2 4172 7ff66cc7e5e6 22 API calls 4170->4172 4171->4170 4178 7ff66cc7e5e6 4171->4178 4174 7ff66cc7e429 4172->4174 4174->4142 4176 7ff66cc7e5e6 22 API calls 4175->4176 4177 7ff66cc7e55d 4176->4177 4180 7ff66cc7e621 4178->4180 4179 7ff66cc7e70b 4181 7ff66cc7e795 4179->4181 4182 7ff66cc7e713 4179->4182 4180->4179 4183 7ff66cc7e64f 4180->4183 4197 7ff66cc9e2a0 4180->4197 4185 7ff66cc7ab50 22 API calls 4181->4185 4248 7ff66cc7ab50 4182->4248 4189 7ff66cc7e693 4183->4189 4205 7ff66cc7db24 4183->4205 4187 7ff66cc7e78f 4185->4187 4191 7ff66cc7ab50 22 API calls 4187->4191 4223 7ff66cc76310 4189->4223 4193 7ff66cc7e83d 4191->4193 4192 7ff66cc7e6de 4192->4187 4236 7ff66cc7e890 4192->4236 4195 7ff66cc76310 22 API calls 4193->4195 4196 7ff66cc7e874 4195->4196 4196->4170 4198 7ff66cc9e2bc 4197->4198 4199 7ff66cc9e44b 4198->4199 4200 7ff66cc9e440 4198->4200 4201 7ff66cc9e3e2 WaitOnAddress 4198->4201 4202 7ff66cc9efa0 20 API calls 4199->4202 4200->4183 4201->4198 4203 7ff66cc9e404 GetLastError 4201->4203 4204 7ff66cc9e47d 4202->4204 4203->4198 4206 7ff66cc7db4e 4205->4206 4208 7ff66cc7db48 4205->4208 4206->4208 4253 7ff66cc7b0a0 4206->4253 4209 7ff66cc7dd64 4208->4209 4257 7ff66cc7a2c0 4208->4257 4209->4189 4211 7ff66cc7dc41 4212 7ff66cc7dcd9 4211->4212 4213 7ff66cc7dc65 4211->4213 4214 7ff66cc7de35 2 API calls 4212->4214 4216 7ff66cc7dc7c 4213->4216 4264 7ff66cc9dfc0 4213->4264 4222 7ff66cc7dcca 4214->4222 4261 7ff66cc7de35 4216->4261 4222->4189 4224 7ff66cc7632c 4223->4224 4225 7ff66cc7632a 4223->4225 4226 7ff66cc9e5c7 4224->4226 4227 7ff66cc9e659 4224->4227 4225->4192 4228 7ff66cc9e5ef 4226->4228 4231 7ff66cc9e5da WakeByAddressSingle 4226->4231 4294 7ff66cc9f040 4227->4294 4230 7ff66cc9e5f9 4228->4230 4233 7ff66cc9e60e 4228->4233 4234 7ff66cc9e620 WakeByAddressSingle 4228->4234 4230->4233 4235 7ff66cc9e644 WakeByAddressAll 4230->4235 4233->4192 4234->4233 4234->4235 4235->4233 4297 7ff66cc827c0 4236->4297 4239 7ff66cc7ab50 22 API calls 4240 7ff66cc7e8fe 4239->4240 4243 7ff66cc7e93d 4240->4243 4244 7ff66cc7e9b2 4240->4244 4241 7ff66cc7e9b0 4241->4179 4242 7ff66cc8933e 4242->4179 4243->4241 4320 7ff66cc9f440 4243->4320 4244->4242 4245 7ff66cc9f370 22 API calls 4244->4245 4245->4242 4249 7ff66cc7ab87 4248->4249 4250 7ff66cc9efa0 22 API calls 4249->4250 4251 7ff66cc7ab96 4249->4251 4252 7ff66cc7ac3a 4250->4252 4251->4187 4252->4187 4254 7ff66cc7b0bc 4253->4254 4256 7ff66cc7b0d2 4253->4256 4269 7ff66cc78fa0 4254->4269 4256->4208 4258 7ff66cc7a2d7 4257->4258 4260 7ff66cc7a314 4258->4260 4286 7ff66cc9e680 4258->4286 4260->4211 4290 7ff66cc7c7f0 4261->4290 4263 7ff66cc7de5e 4268 7ff66cc9dfd9 4264->4268 4265 7ff66cc9e000 4265->4216 4266 7ff66cc9e02c WaitOnAddress 4267 7ff66cc9e049 GetLastError 4266->4267 4266->4268 4267->4268 4268->4265 4268->4266 4270 7ff66cc80740 17 API calls 4269->4270 4274 7ff66cc78fd2 4270->4274 4271 7ff66cc79128 SetLastError GetEnvironmentVariableW 4273 7ff66cc79149 GetLastError 4271->4273 4271->4274 4272 7ff66cc9da70 17 API calls 4272->4274 4273->4274 4276 7ff66cc79249 GetLastError 4273->4276 4274->4271 4274->4272 4275 7ff66cc78fe2 4274->4275 4277 7ff66cc79163 GetLastError 4274->4277 4279 7ff66cc791ce 4274->4279 4275->4256 4276->4275 4277->4274 4278 7ff66cc79350 4277->4278 4280 7ff66cc9f040 17 API calls 4278->4280 4281 7ff66cc79339 4279->4281 4282 7ff66cc791d7 4279->4282 4285 7ff66cc7934e 4280->4285 4283 7ff66cc9f450 17 API calls 4281->4283 4284 7ff66cc7aec0 17 API calls 4282->4284 4283->4285 4284->4275 4285->4256 4287 7ff66cc9e697 4286->4287 4288 7ff66cc81950 22 API calls 4287->4288 4289 7ff66cc9e6ee 4287->4289 4288->4289 4289->4260 4291 7ff66cc7c82d 4290->4291 4293 7ff66cc7c808 4290->4293 4292 7ff66cc9dfc0 WaitOnAddress GetLastError 4291->4292 4292->4293 4293->4263 4295 7ff66cc9efa0 22 API calls 4294->4295 4296 7ff66cc9f07d 4295->4296 4298 7ff66cc827cd 4297->4298 4299 7ff66cc7e8a5 4298->4299 4323 7ff66cc7da10 4298->4323 4299->4239 4332 7ff66cc96f40 4320->4332 4324 7ff66cc7ab50 22 API calls 4323->4324 4325 7ff66cc7da5c 4324->4325 4326 7ff66cc9f18c 22 API calls 4325->4326 4327 7ff66cc7da93 4326->4327 4328 7ff66cc7ab50 22 API calls 4327->4328 4329 7ff66cc7daec 4328->4329 4330 7ff66cc9f18c 22 API calls 4329->4330 4331 7ff66cc7db23 4330->4331 4333 7ff66cc9efa0 22 API calls 4332->4333 4334 7ff66cc96fae 4333->4334 4336 7ff66cc9efa0 22 API calls 4335->4336 4337 7ff66cc89588 4336->4337 4339 7ff66cc9e184 4338->4339 4342 7ff66cc9e0bd 4338->4342 4340 7ff66cc9e13e 4341 7ff66cc9e172 4340->4341 4345 7ff66cc9e16c WakeByAddressAll 4340->4345 4341->3976 4342->4340 4342->4341 4343 7ff66cc9e115 WaitOnAddress 4342->4343 4343->4342 4344 7ff66cc9e132 GetLastError 4343->4344 4344->4342 4345->4341 4347 7ff66cc9e5c7 4346->4347 4348 7ff66cc9e659 4346->4348 4349 7ff66cc9e5ef 4347->4349 4352 7ff66cc9e5da WakeByAddressSingle 4347->4352 4350 7ff66cc9f040 22 API calls 4348->4350 4351 7ff66cc9e5f9 4349->4351 4354 7ff66cc9e60e 4349->4354 4355 7ff66cc9e620 WakeByAddressSingle 4349->4355 4353 7ff66cc9e671 4350->4353 4351->4354 4356 7ff66cc9e644 WakeByAddressAll 4351->4356 4354->3995 4355->4354 4355->4356 4356->4354 4361 7ff66cc70177 4357->4361 4358 7ff66cc71c10 22 API calls 4358->4361 4359 7ff66cc7029f memcpy 4359->4010 4360 7ff66cc726b0 22 API calls 4360->4361 4361->4358 4361->4359 4361->4360 4364 7ff66cb551ef 4363->4364 4367 7ff66cb551c4 4363->4367 4365 7ff66cb55265 4364->4365 4368 7ff66cc70a60 4364->4368 4365->4021 4367->4021 4367->4367 4370 7ff66cc70ac1 4368->4370 4369 7ff66cc70f21 4369->4364 4370->4369 4371 7ff66cc70f8c 4370->4371 4374 7ff66cc70f0b 4370->4374 4372 7ff66cc9f460 22 API calls 4371->4372 4373 7ff66cc70f9b 4372->4373 4376 7ff66cc9f460 4374->4376 4385 7ff66cc97020 4376->4385 4386 7ff66cc9efa0 22 API calls 4385->4386 4387 7ff66cc9708e 4386->4387 4389 7ff66cc975ae 4388->4389 4390 7ff66cc97592 4388->4390 4389->4390 4413 7ff66cc9f128 4389->4413 4390->4040 4405 7ff66cc9ed01 4404->4405 4406 7ff66cc9ed24 4405->4406 4407 7ff66cc9ed93 22 API calls 4405->4407 4408 7ff66cc9ed93 22 API calls 4406->4408 4410 7ff66cc9ed5d 4406->4410 4407->4406 4409 7ff66cc9ed92 4408->4409 4410->4040 4416 7ff66cc94bd0 4411->4416 4414 7ff66cc9efa0 22 API calls 4413->4414 4415 7ff66cc9f18b 4414->4415 4417 7ff66cc94bf9 4416->4417 4427 7ff66cc94c3b 4416->4427 4419 7ff66cc9f510 22 API calls 4417->4419 4417->4427 4418 7ff66cc94ed8 4420 7ff66cc9efa0 22 API calls 4418->4420 4419->4427 4421 7ff66cc94f4c 4420->4421 4422 7ff66cc9efa0 22 API calls 4421->4422 4423 7ff66cc94fc1 4422->4423 4424 7ff66cc9f460 22 API calls 4423->4424 4425 7ff66cc94fd3 4424->4425 4427->4418 4427->4421 4427->4423 4428 7ff66cc94d7f 4427->4428 4429 7ff66cc9f510 22 API calls 4427->4429 4431 7ff66cc9ef20 4427->4431 4430 7ff66cc9efa0 22 API calls 4428->4430 4429->4427 4430->4418 4432 7ff66cc9f040 22 API calls 4431->4432 4433 7ff66cc9ef3e 4432->4433 4434 7ff66cc9efa0 22 API calls 4433->4434 4435 7ff66cc9ef9c 4434->4435 4436 7ff66cc7e010 22 API calls 4435->4436 4437 7ff66cc9efc1 4436->4437 4439 7ff66cb41350 4440 7ff66cb41f68 4439->4440 4441 7ff66cb413b7 4439->4441 4442 7ff66cc9e090 3 API calls 4440->4442 4443 7ff66cb41f54 4441->4443 4448 7ff66cb413cf 4441->4448 4442->4448 4496 7ff66cc9e480 4443->4496 4445 7ff66cb41ee9 4451 7ff66cc9e5b0 25 API calls 4445->4451 4454 7ff66cb41f39 4445->4454 4446 7ff66cb41fbe 4449 7ff66cc9f370 22 API calls 4446->4449 4447 7ff66cb413f3 4450 7ff66cb42053 4447->4450 4464 7ff66cb4141f 4447->4464 4448->4446 4448->4447 4460 7ff66cb41fed 4449->4460 4452 7ff66cc9edb0 22 API calls 4450->4452 4451->4454 4452->4460 4455 7ff66cb4209e 4457 7ff66cb4200b 4458 7ff66cc9f370 22 API calls 4457->4458 4458->4460 4501 7ff66cb53010 4460->4501 4461 7ff66cc89810 22 API calls 4462 7ff66cb41dda memset 4461->4462 4463 7ff66cb41eba OutputDebugStringW 4462->4463 4462->4464 4463->4464 4464->4445 4464->4457 4464->4461 4464->4463 4465 7ff66cb50350 4464->4465 4492 7ff66cb53070 4464->4492 4468 7ff66cb503d3 4465->4468 4469 7ff66cb50394 4465->4469 4466 7ff66cb503bf 4467 7ff66cc70110 24 API calls 4466->4467 4472 7ff66cb503ce 4467->4472 4471 7ff66cc9ed93 22 API calls 4468->4471 4490 7ff66cb503f2 4468->4490 4469->4466 4470 7ff66cb5044d 4469->4470 4473 7ff66cb5046e memcpy memcpy 4470->4473 4474 7ff66cb50905 4471->4474 4475 7ff66cb5049b memcpy 4472->4475 4473->4475 4477 7ff66cc9ed93 22 API calls 4474->4477 4475->4474 4478 7ff66cb504cc 4475->4478 4476 7ff66cb50922 4514 7ff66cc9f450 4476->4514 4481 7ff66cb50920 4477->4481 4478->4474 4478->4476 4480 7ff66cb504fb 4478->4480 4480->4476 4482 7ff66cb5050b memcpy memcpy 4480->4482 4481->4464 4483 7ff66cb50562 memcpy memset 4482->4483 4484 7ff66cb50558 4482->4484 4483->4484 4485 7ff66cc89810 22 API calls 4484->4485 4484->4490 4486 7ff66cb50709 memset 4485->4486 4487 7ff66cb507fa OutputDebugStringW 4486->4487 4489 7ff66cb5074b 4486->4489 4488 7ff66cb50816 4487->4488 4488->4490 4491 7ff66cc9f370 22 API calls 4488->4491 4489->4487 4490->4464 4491->4481 4493 7ff66cb53321 4492->4493 4495 7ff66cb530a8 4492->4495 4520 7ff66cc982d0 4493->4520 4495->4464 4497 7ff66cc9e4a9 4496->4497 4498 7ff66cc9e59d 4497->4498 4499 7ff66cc9e536 WaitOnAddress 4497->4499 4498->4445 4499->4497 4500 7ff66cc9e553 GetLastError 4499->4500 4500->4497 4502 7ff66cb53021 4501->4502 4503 7ff66cb5304a 4502->4503 4504 7ff66cc9e5c7 4502->4504 4505 7ff66cc9e659 4502->4505 4503->4455 4506 7ff66cc9e5ef 4504->4506 4509 7ff66cc9e5da WakeByAddressSingle 4504->4509 4507 7ff66cc9f040 22 API calls 4505->4507 4508 7ff66cc9e5f9 4506->4508 4511 7ff66cc9e620 WakeByAddressSingle 4506->4511 4512 7ff66cc9e60e 4506->4512 4510 7ff66cc9e671 4507->4510 4508->4512 4513 7ff66cc9e644 WakeByAddressAll 4508->4513 4511->4512 4511->4513 4512->4455 4513->4512 4517 7ff66cc96fb0 4514->4517 4518 7ff66cc9efa0 22 API calls 4517->4518 4519 7ff66cc9701e 4518->4519 4521 7ff66cc983f6 4520->4521 4524 7ff66cc982fc 4520->4524 4529 7ff66cc89470 4521->4529 4523 7ff66cc9834b 4523->4495 4524->4521 4524->4523 4525 7ff66cc98402 4524->4525 4526 7ff66cc986b1 4525->4526 4527 7ff66cc9842c memset 4525->4527 4534 7ff66cc894c0 4526->4534 4527->4523 4530 7ff66cc8947e 4529->4530 4531 7ff66cc89486 4529->4531 4530->4523 4532 7ff66cc9efa0 22 API calls 4531->4532 4533 7ff66cc894b8 4532->4533 4535 7ff66cc894ce 4534->4535 4536 7ff66cc894da 4534->4536 4535->4523 4537 7ff66cc9edb0 22 API calls 4536->4537 4538 7ff66cc894e5 4537->4538 4551 7ff66cb42db0 4552 7ff66cc89810 22 API calls 4551->4552 4553 7ff66cb42ef3 memset 4552->4553 4554 7ff66cb42fda OutputDebugStringW 4553->4554 4555 7ff66cb4300b 4554->4555 4652 7ff66cb41190 4653 7ff66cb4119a 4652->4653 4654 7ff66cb411b4 4653->4654 4655 7ff66cc9e080 WakeByAddressSingle 4653->4655 4656 7ff66cb412d0 4664 7ff66cc93410 4656->4664 4658 7ff66cc9f510 22 API calls 4660 7ff66cc936f0 4658->4660 4659 7ff66cc935b2 4662 7ff66cc9f510 22 API calls 4659->4662 4661 7ff66cc934bf 4661->4658 4661->4660 4663 7ff66cc93793 4662->4663 4664->4659 4664->4660 4664->4661 4665 7ff66cc8f2e0 4664->4665 4666 7ff66cc8f2f3 4665->4666 4667 7ff66cc8f314 4666->4667 4670 7ff66cc8f33a 4666->4670 4671 7ff66cc97400 4666->4671 4667->4664 4670->4667 4678 7ff66cc95130 4670->4678 4672 7ff66cc9755d 4671->4672 4676 7ff66cc974ab 4671->4676 4673 7ff66cc9f128 22 API calls 4672->4673 4675 7ff66cc97571 4673->4675 4674 7ff66cc9751d 4674->4670 4676->4674 4677 7ff66cc9f128 22 API calls 4676->4677 4677->4672 4679 7ff66cc95147 4678->4679 4680 7ff66cc9513f 4678->4680 4679->4680 4683 7ff66cc95000 4679->4683 4680->4667 4682 7ff66cc951c9 4682->4667 4684 7ff66cc9508a 4683->4684 4689 7ff66cc95014 4683->4689 4688 7ff66cc9ef20 22 API calls 4684->4688 4691 7ff66cc95072 4684->4691 4685 7ff66cc9510c 4687 7ff66cc9f450 22 API calls 4685->4687 4686 7ff66cc9f460 22 API calls 4686->4685 4687->4684 4690 7ff66cc95127 4688->4690 4689->4684 4689->4685 4689->4686 4689->4691 4692 7ff66cc9513f 4690->4692 4693 7ff66cc95000 22 API calls 4690->4693 4691->4682 4692->4682 4694 7ff66cc951c9 4693->4694 4694->4682 4695 7ff66cb41250 4697 7ff66cb41261 4695->4697 4696 7ff66cb4128a 4697->4696 4698 7ff66cc9e5c7 4697->4698 4699 7ff66cc9e659 4697->4699 4700 7ff66cc9e5ef 4698->4700 4703 7ff66cc9e5da WakeByAddressSingle 4698->4703 4701 7ff66cc9f040 22 API calls 4699->4701 4702 7ff66cc9e5f9 4700->4702 4705 7ff66cc9e60e 4700->4705 4706 7ff66cc9e620 WakeByAddressSingle 4700->4706 4704 7ff66cc9e671 4701->4704 4702->4705 4707 7ff66cc9e644 WakeByAddressAll 4702->4707 4706->4705 4706->4707 4707->4705 4745 7ff66cb41230 4746 7ff66cb4124e 4745->4746 4747 7ff66cc9e5c7 4746->4747 4748 7ff66cc9e659 4746->4748 4749 7ff66cc9e5ef 4747->4749 4752 7ff66cc9e5da WakeByAddressSingle 4747->4752 4750 7ff66cc9f040 22 API calls 4748->4750 4751 7ff66cc9e5f9 4749->4751 4754 7ff66cc9e60e 4749->4754 4755 7ff66cc9e620 WakeByAddressSingle 4749->4755 4753 7ff66cc9e671 4750->4753 4751->4754 4756 7ff66cc9e644 WakeByAddressAll 4751->4756 4755->4754 4755->4756 4756->4754 4624 7ff66cb51f30 memset 4625 7ff66cb5200a OutputDebugStringW 4624->4625 4626 7ff66cb51f6a 4624->4626 4626->4625

                                                        Executed Functions

                                                        Function 00007FF66CB452D0 Relevance: 43.0, APIs: 21, Strings: 3, Instructions: 967COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1884984156.00007FF66CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB40000, based on PE: true
                                                        • Associated: 00000000.00000002.1884952705.00007FF66CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885265997.00007FF66CCA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885265997.00007FF66CE14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885597629.00007FF66CE53000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885626153.00007FF66CE54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_7ff66cb40000_dropper.jbxd
                                                        Similarity
                                                        • API ID: memset$DebugOutputString$HandleModuleQueryVirtual
                                                        • String ID: C:\Windows\System32\Resolved full path for module: $ntdll.dll$ntdll.dllNormalized full path for ntdll.dll:
                                                        • API String ID: 3283594973-2956908514
                                                        • Opcode ID: 403cf2ea962f212df09327bdebad9e8a6cc54156f37926260f0d2ea106956ae8
                                                        • Instruction ID: a3cc6abcba2184bee34e39d6fcef8380765894290b7818f81441b273cae8b348
                                                        • Opcode Fuzzy Hash: 403cf2ea962f212df09327bdebad9e8a6cc54156f37926260f0d2ea106956ae8
                                                        • Instruction Fuzzy Hash: 29A28D32A19FD189EB318F24D8547E93375FB46B89F448236DA4D9BB9ADF399244C300
                                                        Function 00007FF66CB47340 Relevance: 19.8, APIs: 6, Strings: 5, Instructions: 512COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 190 7ff66cb47340-7ff66cb4738b 191 7ff66cb47391-7ff66cb473a1 190->191 192 7ff66cb47b53-7ff66cb47b91 call 7ff66cc9e090 190->192 193 7ff66cb473a7-7ff66cb473b7 191->193 194 7ff66cb47b46-7ff66cb47b4e call 7ff66cc9dfc0 191->194 197 7ff66cb47b96-7ff66cb47ba4 call 7ff66cc9df20 192->197 193->197 198 7ff66cb473bd-7ff66cb473c6 193->198 194->192 201 7ff66cb473cc-7ff66cb473de 197->201 202 7ff66cb47baa-7ff66cb47bd9 call 7ff66cc9f370 197->202 198->201 198->202 204 7ff66cb4759b-7ff66cb47635 call 7ff66cc89810 memset 201->204 205 7ff66cb473e4-7ff66cb47529 201->205 214 7ff66cb47bdb-7ff66cb47be9 call 7ff66cc9e080 202->214 219 7ff66cb4763b-7ff66cb4764d 204->219 220 7ff66cb477ea-7ff66cb477fe OutputDebugStringW 204->220 208 7ff66cb4752d-7ff66cb47545 205->208 211 7ff66cb47547-7ff66cb47562 208->211 212 7ff66cb47580-7ff66cb4758c 208->212 216 7ff66cb47568-7ff66cb47573 211->216 217 7ff66cb47660-7ff66cb47733 call 7ff66cc89810 memset 211->217 212->204 218 7ff66cb4758e-7ff66cb47599 212->218 229 7ff66cb47b28-7ff66cb47b45 214->229 216->211 225 7ff66cb47575 216->225 236 7ff66cb47739-7ff66cb4774b 217->236 237 7ff66cb47aca-7ff66cb47ade OutputDebugStringW 217->237 218->208 221 7ff66cb4775e-7ff66cb4778e 219->221 222 7ff66cb47653-7ff66cb4765b 219->222 226 7ff66cb47811-7ff66cb47832 220->226 227 7ff66cb47800-7ff66cb4780c call 7ff66cb57e80 220->227 231 7ff66cb47790-7ff66cb477ba 221->231 228 7ff66cb477bc-7ff66cb477cd 222->228 225->212 233 7ff66cb47842-7ff66cb47846 226->233 227->226 238 7ff66cb477d0-7ff66cb477d7 228->238 231->228 231->231 234 7ff66cb47a2d-7ff66cb47a40 233->234 235 7ff66cb4784c-7ff66cb4784f 233->235 241 7ff66cb47a46 234->241 242 7ff66cb47b05-7ff66cb47b15 234->242 239 7ff66cb47851-7ff66cb47856 235->239 240 7ff66cb47860-7ff66cb4787a 235->240 243 7ff66cb47a4b-7ff66cb47a6e 236->243 244 7ff66cb47751-7ff66cb47759 236->244 246 7ff66cb47af1-7ff66cb47b03 237->246 247 7ff66cb47ae0-7ff66cb47aec call 7ff66cb57e80 237->247 238->220 245 7ff66cb477d9-7ff66cb477e8 238->245 248 7ff66cb47889-7ff66cb47959 call 7ff66cc89810 memset 239->248 240->240 249 7ff66cb4787c-7ff66cb47887 240->249 250 7ff66cb47b1b-7ff66cb47b22 241->250 242->250 254 7ff66cb47bee-7ff66cb47bfb call 7ff66cc9df20 242->254 251 7ff66cb47a70-7ff66cb47a9a 243->251 252 7ff66cb47a9c-7ff66cb47aad 244->252 245->220 245->238 246->242 246->250 247->246 262 7ff66cb479fa-7ff66cb47a11 OutputDebugStringW 248->262 263 7ff66cb4795f-7ff66cb47971 248->263 249->248 250->214 250->229 251->251 251->252 257 7ff66cb47ab0-7ff66cb47ab7 252->257 254->250 261 7ff66cb47c01-7ff66cb47c06 254->261 257->237 260 7ff66cb47ab9-7ff66cb47ac8 257->260 260->237 260->257 261->250 264 7ff66cb47a17-7ff66cb47a28 call 7ff66cb57e80 262->264 265 7ff66cb47840 262->265 266 7ff66cb47980-7ff66cb4799f 263->266 267 7ff66cb47973-7ff66cb4797b 263->267 264->265 265->233 270 7ff66cb479a0-7ff66cb479ca 266->270 269 7ff66cb479cc-7ff66cb479dd 267->269 272 7ff66cb479e0-7ff66cb479e7 269->272 270->269 270->270 272->262 273 7ff66cb479e9-7ff66cb479f8 272->273 273->262 273->272
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1884984156.00007FF66CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB40000, based on PE: true
                                                        • Associated: 00000000.00000002.1884952705.00007FF66CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885265997.00007FF66CCA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885265997.00007FF66CE14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885597629.00007FF66CE53000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885626153.00007FF66CE54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_7ff66cb40000_dropper.jbxd
                                                        Similarity
                                                        • API ID: DebugOutputStringmemset
                                                        • String ID: arenegyl$called `Result::unwrap()` on an `Err` value$modnarod$setybdet$uespemos
                                                        • API String ID: 1084755268-2410307170
                                                        • Opcode ID: 707195158be99daa0345d2d6dfb10878092491002d0d2e90c37638fdee1e5e78
                                                        • Instruction ID: 8ae0aaf7368d583a3034edaff9200f514310569c89faf35c15cbfd929f5ded19
                                                        • Opcode Fuzzy Hash: 707195158be99daa0345d2d6dfb10878092491002d0d2e90c37638fdee1e5e78
                                                        • Instruction Fuzzy Hash: 4822D172B19F9195EB218F64D8547E92371FB0A788F408236DE1DABB99EF78D241C340
                                                        Function 00007FF66CB44D10 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 295stringCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 274 7ff66cb44d10-7ff66cb44d2d 275 7ff66cb44dd1-7ff66cb44e1a memset 274->275 276 7ff66cb44d33-7ff66cb44d48 274->276 277 7ff66cb451cc-7ff66cb451d4 OutputDebugStringW 275->277 278 7ff66cb44e1f 276->278 279 7ff66cb44d4e-7ff66cb44d59 276->279 281 7ff66cb451da-7ff66cb451f3 277->281 280 7ff66cb44e24-7ff66cb44edf call 7ff66cc89810 memset 278->280 279->280 282 7ff66cb44d5f-7ff66cb44dcc memset 279->282 285 7ff66cb44f9a-7ff66cb44fba OutputDebugStringW 280->285 286 7ff66cb44ee5-7ff66cb44ef7 280->286 282->277 289 7ff66cb44fbc-7ff66cb44fc5 call 7ff66cb57e80 285->289 290 7ff66cb44fca-7ff66cb44fd1 285->290 287 7ff66cb44ef9-7ff66cb44f01 286->287 288 7ff66cb44f03-7ff66cb44f26 286->288 291 7ff66cb44f62-7ff66cb44f7e 287->291 292 7ff66cb44f30-7ff66cb44f60 288->292 289->290 294 7ff66cb45168-7ff66cb451c3 memset 290->294 295 7ff66cb44fd7-7ff66cb44ff8 290->295 297 7ff66cb44f80-7ff66cb44f87 291->297 292->291 292->292 294->277 296 7ff66cb4500c-7ff66cb45062 strlen call 7ff66cc8f580 295->296 301 7ff66cb45000-7ff66cb45006 296->301 302 7ff66cb45064-7ff66cb45073 memcmp 296->302 297->285 299 7ff66cb44f89-7ff66cb44f98 297->299 299->285 299->297 301->294 301->296 302->301 303 7ff66cb45075-7ff66cb4513d call 7ff66cc89810 memset 302->303 306 7ff66cb4528a-7ff66cb452aa OutputDebugStringW 303->306 307 7ff66cb45143-7ff66cb45155 303->307 308 7ff66cb452ac-7ff66cb452b5 call 7ff66cb57e80 306->308 309 7ff66cb452ba-7ff66cb452c6 306->309 310 7ff66cb4515b-7ff66cb45163 307->310 311 7ff66cb451f4-7ff66cb45217 307->311 308->309 309->281 313 7ff66cb45252-7ff66cb4526e 310->313 314 7ff66cb45220-7ff66cb45250 311->314 315 7ff66cb45270-7ff66cb45277 313->315 314->313 314->314 315->306 316 7ff66cb45279-7ff66cb45288 315->316 316->306 316->315
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1884984156.00007FF66CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB40000, based on PE: true
                                                        • Associated: 00000000.00000002.1884952705.00007FF66CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885265997.00007FF66CCA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885265997.00007FF66CE14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885597629.00007FF66CE53000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885626153.00007FF66CE54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_7ff66cb40000_dropper.jbxd
                                                        Similarity
                                                        • API ID: DebugOutputStringmemset$memcmpstrlen
                                                        • String ID: c
                                                        • API String ID: 2294051181-112844655
                                                        • Opcode ID: 5a593e86e7cc359cd5a51f1e2bad1487d34419007ad4e225184c499bcfe31643
                                                        • Instruction ID: b67fe254bb32bcd143e7bed9751f434fb0f8dce6d53a7b50f93f159efb6da0f8
                                                        • Opcode Fuzzy Hash: 5a593e86e7cc359cd5a51f1e2bad1487d34419007ad4e225184c499bcfe31643
                                                        • Instruction Fuzzy Hash: C9E17E22A1CFD5C5EB218B14E4417AAB7B1FB89785F408236DA8D87B59EF3CD185CB00
                                                        Function 00007FF66CB421C0 Relevance: 17.9, APIs: 5, Strings: 5, Instructions: 438COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 317 7ff66cb421c0-7ff66cb42204 318 7ff66cb4220a-7ff66cb42219 317->318 319 7ff66cb42820-7ff66cb4286d call 7ff66cc9e090 317->319 320 7ff66cb4221f-7ff66cb42227 318->320 321 7ff66cb42873-7ff66cb42882 call 7ff66cc9e2a0 318->321 319->320 319->321 320->321 323 7ff66cb4222d-7ff66cb42234 320->323 326 7ff66cb42888-7ff66cb428bc call 7ff66cc9f370 321->326 327 7ff66cb4223a-7ff66cb42246 321->327 323->326 323->327 338 7ff66cb428e0-7ff66cb42922 326->338 329 7ff66cb4224c-7ff66cb42390 327->329 330 7ff66cb423fb-7ff66cb42495 call 7ff66cc89810 memset 327->330 333 7ff66cb42394-7ff66cb423ac 329->333 340 7ff66cb4249b-7ff66cb424ad 330->340 341 7ff66cb426aa-7ff66cb426be OutputDebugStringW 330->341 336 7ff66cb423e0-7ff66cb423ec 333->336 337 7ff66cb423ae-7ff66cb423c9 333->337 336->330 339 7ff66cb423ee-7ff66cb423f9 336->339 344 7ff66cb424c0-7ff66cb425f7 call 7ff66cc89810 memset 337->344 345 7ff66cb423cf-7ff66cb423da 337->345 342 7ff66cb42924-7ff66cb42932 338->342 343 7ff66cb42933-7ff66cb42938 call 7ff66cc9e5b0 338->343 339->333 348 7ff66cb424b3-7ff66cb424bb 340->348 349 7ff66cb42622-7ff66cb42645 340->349 346 7ff66cb426d1-7ff66cb426de 341->346 347 7ff66cb426c0-7ff66cb426cc call 7ff66cb57e80 341->347 343->342 361 7ff66cb425fd-7ff66cb4260f 344->361 362 7ff66cb4276a-7ff66cb4277e OutputDebugStringW 344->362 345->337 352 7ff66cb423dc 345->352 354 7ff66cb427f2-7ff66cb42808 346->354 347->346 355 7ff66cb4267c-7ff66cb4268d 348->355 358 7ff66cb42650-7ff66cb4267a 349->358 352->336 359 7ff66cb428be-7ff66cb428c6 call 7ff66cc9e5b0 354->359 360 7ff66cb4280e-7ff66cb4281f 354->360 363 7ff66cb42690-7ff66cb42697 355->363 358->355 358->358 359->360 365 7ff66cb42615-7ff66cb4261d 361->365 366 7ff66cb426e3-7ff66cb42706 361->366 367 7ff66cb42791-7ff66cb4279f 362->367 368 7ff66cb42780-7ff66cb4278c call 7ff66cb57e80 362->368 363->341 369 7ff66cb42699-7ff66cb426a8 363->369 372 7ff66cb4273c-7ff66cb4274d 365->372 371 7ff66cb42710-7ff66cb4273a 366->371 374 7ff66cb428cb 367->374 375 7ff66cb427a5-7ff66cb427a9 367->375 368->367 369->341 369->363 371->371 371->372 377 7ff66cb42750-7ff66cb42757 372->377 376 7ff66cb428ce-7ff66cb428db call 7ff66cc9ed93 374->376 378 7ff66cb427ab-7ff66cb427c8 call 7ff66cb57e70 375->378 379 7ff66cb427d3 375->379 376->338 377->362 382 7ff66cb42759-7ff66cb42768 377->382 378->376 385 7ff66cb427ce-7ff66cb427d1 378->385 380 7ff66cb427d9-7ff66cb427ee memcpy 379->380 380->354 382->362 382->377 385->380
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1884984156.00007FF66CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB40000, based on PE: true
                                                        • Associated: 00000000.00000002.1884952705.00007FF66CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885265997.00007FF66CCA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885265997.00007FF66CE14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885597629.00007FF66CE53000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885626153.00007FF66CE54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_7ff66cb40000_dropper.jbxd
                                                        Similarity
                                                        • API ID: DebugOutputStringmemset$memcpy
                                                        • String ID: arenegyl$called `Result::unwrap()` on an `Err` value$modnarod$setybdet$uespemos
                                                        • API String ID: 293864031-2410307170
                                                        • Opcode ID: eab3799eabcbcf5108897a25bc579edc0c9204dc6de0a1bb15edb4153dedf3a4
                                                        • Instruction ID: 4655fa5ef2dcaadefbf80bf576d8f76740c136211a118fe9072a1b2965ef0013
                                                        • Opcode Fuzzy Hash: eab3799eabcbcf5108897a25bc579edc0c9204dc6de0a1bb15edb4153dedf3a4
                                                        • Instruction Fuzzy Hash: B802D372A19F9189EB20CF60D8587E92371FB4A799F408236DE1D9BB99DF389241C341
                                                        Function 00007FF66CB41350 Relevance: 14.6, APIs: 2, Strings: 6, Instructions: 570COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 453 7ff66cb41350-7ff66cb413b1 454 7ff66cb41f68-7ff66cb41fa6 call 7ff66cc9e090 453->454 455 7ff66cb413b7-7ff66cb413c9 453->455 461 7ff66cb41fab-7ff66cb41fb8 call 7ff66cc9df20 454->461 457 7ff66cb413cf-7ff66cb413df 455->457 458 7ff66cb41f54-7ff66cb41f5c call 7ff66cc9e480 455->458 457->461 462 7ff66cb413e5-7ff66cb413ed 457->462 472 7ff66cb41f61-7ff66cb41f66 call 7ff66cc9e5b0 458->472 465 7ff66cb41fbe-7ff66cb41fed call 7ff66cc9f370 461->465 466 7ff66cb413f3-7ff66cb41419 call 7ff66cb57e70 461->466 462->465 462->466 475 7ff66cb42062-7ff66cb420b3 call 7ff66cb53010 465->475 473 7ff66cb4141f-7ff66cb41be4 466->473 474 7ff66cb42053-7ff66cb4205d call 7ff66cc9edb0 466->474 484 7ff66cb41f39-7ff66cb41f53 472->484 478 7ff66cb41bfb-7ff66cb41c02 473->478 474->475 481 7ff66cb41ee9-7ff66cb41f0a call 7ff66cb57e80 478->481 482 7ff66cb41c08-7ff66cb41c56 call 7ff66cb50350 478->482 489 7ff66cb41f0c-7ff66cb41f1c 481->489 490 7ff66cb41f22-7ff66cb41f37 481->490 491 7ff66cb41c5c-7ff66cb41c6a 482->491 492 7ff66cb4200b-7ff66cb42051 call 7ff66cc9f370 482->492 489->490 493 7ff66cb41fef-7ff66cb41ffc call 7ff66cc9df20 489->493 490->472 490->484 494 7ff66cb41c70-7ff66cb41c77 491->494 495 7ff66cb41d24-7ff66cb41d56 call 7ff66cb53070 491->495 492->475 493->490 508 7ff66cb42002-7ff66cb42006 493->508 497 7ff66cb41cf9-7ff66cb41d00 494->497 498 7ff66cb41c7d-7ff66cb41c8a 494->498 506 7ff66cb41d58 495->506 507 7ff66cb41d6c-7ff66cb41e12 call 7ff66cc89810 memset 495->507 497->495 505 7ff66cb41d02-7ff66cb41d05 497->505 503 7ff66cb41c90-7ff66cb41cf7 498->503 503->497 503->503 509 7ff66cb41d10-7ff66cb41d22 505->509 506->507 510 7ff66cb41d5a-7ff66cb41d67 call 7ff66cb57e80 506->510 514 7ff66cb41e18-7ff66cb41e2a 507->514 515 7ff66cb41eba-7ff66cb41ecd OutputDebugStringW 507->515 508->490 509->495 509->509 510->507 516 7ff66cb41e2c-7ff66cb41e34 514->516 517 7ff66cb41e40-7ff66cb41e5f 514->517 518 7ff66cb41bf0-7ff66cb41bf4 515->518 519 7ff66cb41ed3-7ff66cb41ee4 call 7ff66cb57e80 515->519 521 7ff66cb41e8c-7ff66cb41e9d 516->521 522 7ff66cb41e60-7ff66cb41e8a 517->522 518->478 519->518 524 7ff66cb41ea0-7ff66cb41ea7 521->524 522->521 522->522 524->515 525 7ff66cb41ea9-7ff66cb41eb8 524->525 525->515 525->524
                                                        APIs
                                                        Strings
                                                        • called `Result::unwrap()` on an `Err` value, xrefs: 00007FF66CB41FD1
                                                        • FindFirstFileWFindNextFileWNtQueryDirectoryFileRegQueryValueExWNtEnumerateKeyGetAsyncKeyStateSetWindowsHookExWLogonUserWCredEnumerateWCreateProcessWNtQueryInformationProcessVirtualQueryExGetProcessIdNtOpenProcessNtWriteVirtualMemoryNtReadVirtualMemoryLoadLibra, xrefs: 00007FF66CB41962
                                                        • Thread32NextVirtualFreeWaitForSingleObjectTerminateThreadSuspendThreadResumeThreadIsWow64ProcessModule32FirstWModule32NextWGetCurrentProcessIdProcess32FirstWProcess32NextWZwOpenKeyZwCreateKeyZwSetValueKeyZwCloseCreateRemoteThreadNtQuerySystemInformationEnumPro, xrefs: 00007FF66CB41787
                                                        • NtGetContextThreadNtSetContextThreadNtCloseNtCreateThreadExNtCreateProcessExNtQueryInformationThreadGetProcessIdOfThreadWriteProcessMemoryReadProcessMemoryOpenProcessVirtualProtectExCloseHandleVirtualAllocVirtualProtectOpenThreadCreateToolhelp32SnapshotThread3, xrefs: 00007FF66CB415CC
                                                        • NtProtectVirtualMemoryNtAllocateVirtualMemoryNtMapViewOfSectionNtUnmapViewOfSectionNtOpenFileLdrLoadDllEtwEventWriteFullEtwEventWriteEtwEventWriteTransferWDEnableMpWDEnableMpScanStartMpSampleSubmitMpAmsiNotifyMpSampleQueryMpAmsiScanMpThreatActionNtResumeThread, xrefs: 00007FF66CB41434
                                                        • RtlCaptureStackBackTraceLoadLibraryAGetProcAddressLdrGetDllHandleByMappingLdrRegisterDllNotificationVirtualAllocExVirtualFreeExNtCreateSectionFailed to encrypt function name, xrefs: 00007FF66CB41B0B
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1884984156.00007FF66CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB40000, based on PE: true
                                                        • Associated: 00000000.00000002.1884952705.00007FF66CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885265997.00007FF66CCA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885265997.00007FF66CE14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885597629.00007FF66CE53000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885626153.00007FF66CE54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_7ff66cb40000_dropper.jbxd
                                                        Similarity
                                                        • API ID: memcpy$memset$DebugOutputString
                                                        • String ID: FindFirstFileWFindNextFileWNtQueryDirectoryFileRegQueryValueExWNtEnumerateKeyGetAsyncKeyStateSetWindowsHookExWLogonUserWCredEnumerateWCreateProcessWNtQueryInformationProcessVirtualQueryExGetProcessIdNtOpenProcessNtWriteVirtualMemoryNtReadVirtualMemoryLoadLibra$NtGetContextThreadNtSetContextThreadNtCloseNtCreateThreadExNtCreateProcessExNtQueryInformationThreadGetProcessIdOfThreadWriteProcessMemoryReadProcessMemoryOpenProcessVirtualProtectExCloseHandleVirtualAllocVirtualProtectOpenThreadCreateToolhelp32SnapshotThread3$NtProtectVirtualMemoryNtAllocateVirtualMemoryNtMapViewOfSectionNtUnmapViewOfSectionNtOpenFileLdrLoadDllEtwEventWriteFullEtwEventWriteEtwEventWriteTransferWDEnableMpWDEnableMpScanStartMpSampleSubmitMpAmsiNotifyMpSampleQueryMpAmsiScanMpThreatActionNtResumeThread$RtlCaptureStackBackTraceLoadLibraryAGetProcAddressLdrGetDllHandleByMappingLdrRegisterDllNotificationVirtualAllocExVirtualFreeExNtCreateSectionFailed to encrypt function name$Thread32NextVirtualFreeWaitForSingleObjectTerminateThreadSuspendThreadResumeThreadIsWow64ProcessModule32FirstWModule32NextWGetCurrentProcessIdProcess32FirstWProcess32NextWZwOpenKeyZwCreateKeyZwSetValueKeyZwCloseCreateRemoteThreadNtQuerySystemInformationEnumPro$called `Result::unwrap()` on an `Err` value
                                                        • API String ID: 4266836622-765071994
                                                        • Opcode ID: 4e728c34351f87a12fa70ec622b7e4d18ed9bbafdfb128dc4861bb50e82fccaf
                                                        • Instruction ID: 3a165f85c10707ee42eadda8e867759502530c93afe036e4d41541dae1f5e563
                                                        • Opcode Fuzzy Hash: 4e728c34351f87a12fa70ec622b7e4d18ed9bbafdfb128dc4861bb50e82fccaf
                                                        • Instruction Fuzzy Hash: 9372E937A09FE1DAE791CB50E8847E933F4B749349F904239CA8D8A755EF789264C342
                                                        Function 00007FF66CC982D0 Relevance: 7.8, APIs: 1, Strings: 4, Instructions: 294COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 526 7ff66cc982d0-7ff66cc982f6 527 7ff66cc983f6-7ff66cc983fd call 7ff66cc89470 526->527 528 7ff66cc982fc-7ff66cc98323 526->528 536 7ff66cc9871f-7ff66cc9872f 527->536 530 7ff66cc98325-7ff66cc98333 528->530 531 7ff66cc9834b-7ff66cc98378 call 7ff66cb52110 528->531 533 7ff66cc98335-7ff66cc98346 530->533 534 7ff66cc9837d-7ff66cc98384 530->534 531->536 537 7ff66cc983d4-7ff66cc983e5 533->537 534->527 539 7ff66cc98386-7ff66cc983cc 534->539 537->527 541 7ff66cc983e7-7ff66cc983f4 537->541 539->527 540 7ff66cc983ce-7ff66cc983d1 539->540 540->537 541->527 542 7ff66cc98402-7ff66cc9841e call 7ff66cb57e70 541->542 544 7ff66cc98423-7ff66cc98426 542->544 545 7ff66cc986b1-7ff66cc986c0 call 7ff66cc894c0 544->545 546 7ff66cc9842c-7ff66cc98469 memset 544->546 545->536 548 7ff66cc9846f-7ff66cc9849b 546->548 549 7ff66cc986c2-7ff66cc986c5 546->549 551 7ff66cc984a0-7ff66cc984a4 548->551 552 7ff66cc986c9-7ff66cc986f2 549->552 553 7ff66cc984ce-7ff66cc98612 551->553 554 7ff66cc984a6 551->554 552->536 555 7ff66cc986f4-7ff66cc98702 552->555 556 7ff66cc98614-7ff66cc98619 553->556 557 7ff66cc98637-7ff66cc98645 553->557 558 7ff66cc984b0-7ff66cc984c9 554->558 555->536 559 7ff66cc98704-7ff66cc9871c call 7ff66cb57e80 555->559 560 7ff66cc98620-7ff66cc98635 556->560 561 7ff66cc98697-7ff66cc986a3 557->561 562 7ff66cc98647-7ff66cc9868f 557->562 558->558 563 7ff66cc984cb 558->563 559->536 560->557 560->560 561->562 562->551 565 7ff66cc98695-7ff66cc986af 562->565 563->553 565->552
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1884984156.00007FF66CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB40000, based on PE: true
                                                        • Associated: 00000000.00000002.1884952705.00007FF66CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885265997.00007FF66CCA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885265997.00007FF66CE14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885597629.00007FF66CE53000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885626153.00007FF66CE54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_7ff66cb40000_dropper.jbxd
                                                        Similarity
                                                        • API ID: memset
                                                        • String ID: arenegyl$modnarod$setybdet$uespemos
                                                        • API String ID: 2221118986-66988881
                                                        • Opcode ID: 85201e277d138761cbe728bf533cd289af68283fb86aac04e37c5c66c197f42c
                                                        • Instruction ID: fca91b04035d8ac9d4c69bf3e64105e1a1030337fff79e5b30cdd6a1b4f84ffa
                                                        • Opcode Fuzzy Hash: 85201e277d138761cbe728bf533cd289af68283fb86aac04e37c5c66c197f42c
                                                        • Instruction Fuzzy Hash: E8A16A62F19B9586EE509F19A8017AB6671BB45BE8F485732DE6C9F7C0EF3CE141C200
                                                        Function 00007FF66CB53070 Relevance: 5.2, Strings: 4, Instructions: 197COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1884984156.00007FF66CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB40000, based on PE: true
                                                        • Associated: 00000000.00000002.1884952705.00007FF66CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885265997.00007FF66CCA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885265997.00007FF66CE14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885597629.00007FF66CE53000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885626153.00007FF66CE54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_7ff66cb40000_dropper.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: arenegyl$modnarod$setybdep$uespemos
                                                        • API String ID: 0-169184043
                                                        • Opcode ID: 41e41b3e5bf85884944af84c50470beff421076fe93f83052b09c5bd714c4b6a
                                                        • Instruction ID: cf4050ac829a65029fe43903c7747df71c1c93ea77ee5b44e0f000280a3072c9
                                                        • Opcode Fuzzy Hash: 41e41b3e5bf85884944af84c50470beff421076fe93f83052b09c5bd714c4b6a
                                                        • Instruction Fuzzy Hash: BB6138A2F14B9542FB118FB9A451BF92B70A71AB44F80A236DF5E67741EF3892D1C200
                                                        Function 00007FF66CB5B240 Relevance: 3.0, APIs: 2, Instructions: 48COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 636 7ff66cb5b240-7ff66cb5b251 637 7ff66cb5b253-7ff66cb5b26d 636->637 638 7ff66cb5b2b2 636->638 639 7ff66cb5b278-7ff66cb5b29a BCryptGenRandom 637->639 640 7ff66cb5b2b4-7ff66cb5b2c4 638->640 641 7ff66cb5b29c-7ff66cb5b2a8 SystemFunction036 639->641 642 7ff66cb5b270-7ff66cb5b276 639->642 641->642 643 7ff66cb5b2aa-7ff66cb5b2b0 641->643 642->638 642->639 643->640
                                                        APIs
                                                        • BCryptGenRandom.BCRYPT(?,00000000,?,00007FF66CB5AFE5,?,?,?,00007FF66CC98D3B), ref: 00007FF66CB5B292
                                                        • SystemFunction036.ADVAPI32(?,?,?,00007FF66CC98D3B), ref: 00007FF66CB5B2A3
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1884984156.00007FF66CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB40000, based on PE: true
                                                        • Associated: 00000000.00000002.1884952705.00007FF66CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885265997.00007FF66CCA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885265997.00007FF66CE14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885597629.00007FF66CE53000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885626153.00007FF66CE54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_7ff66cb40000_dropper.jbxd
                                                        Similarity
                                                        • API ID: CryptFunction036RandomSystem
                                                        • String ID:
                                                        • API String ID: 1232939966-0
                                                        • Opcode ID: 7e5db19c811421e7a1f6f9ad99314db73b2ca63ffc2781fa5743b06b543232d8
                                                        • Instruction ID: 1e953013b9ae0694ba975d818a51b8045f1fc0a01739c469f51bc157930fe9a2
                                                        • Opcode Fuzzy Hash: 7e5db19c811421e7a1f6f9ad99314db73b2ca63ffc2781fa5743b06b543232d8
                                                        • Instruction Fuzzy Hash: 1AF04422F08965C1FD601EA76D04438B9702F1A7F1D684335ED3DCBBD4DC2C98864200
                                                        Function 00007FF66CB50350 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 340COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 386 7ff66cb50350-7ff66cb50392 387 7ff66cb503d3-7ff66cb503ec call 7ff66cb57e70 386->387 388 7ff66cb50394-7ff66cb503af 386->388 398 7ff66cb503f2-7ff66cb50435 387->398 399 7ff66cb508ef-7ff66cb50900 call 7ff66cc9ed93 387->399 389 7ff66cb5044d-7ff66cb50496 call 7ff66cc73560 call 7ff66cb50040 memcpy * 2 388->389 390 7ff66cb503b5-7ff66cb503bd 388->390 408 7ff66cb5049b-7ff66cb504c6 memcpy 389->408 393 7ff66cb5043a-7ff66cb50447 call 7ff66cc9d770 390->393 394 7ff66cb503bf-7ff66cb503ce call 7ff66cc70110 390->394 393->389 393->394 394->408 404 7ff66cb508d8-7ff66cb508ee 398->404 407 7ff66cb50905 399->407 410 7ff66cb50907-7ff66cb50920 call 7ff66cc9ed93 407->410 408->407 409 7ff66cb504cc-7ff66cb504d3 408->409 411 7ff66cb504d9-7ff66cb504ed call 7ff66cb57ea0 409->411 412 7ff66cb50922 409->412 418 7ff66cb50979-7ff66cb509ab 410->418 417 7ff66cb504f2-7ff66cb504f5 411->417 416 7ff66cb50928-7ff66cb5094c call 7ff66cc9f450 412->416 416->418 417->410 422 7ff66cb504fb-7ff66cb50505 417->422 420 7ff66cb509ad-7ff66cb509c1 call 7ff66cb57e80 418->420 421 7ff66cb509c6-7ff66cb509df 418->421 420->421 422->416 425 7ff66cb5050b-7ff66cb50556 memcpy * 2 422->425 426 7ff66cb50558-7ff66cb5055d 425->426 427 7ff66cb50562-7ff66cb5065b memcpy memset call 7ff66cb55330 call 7ff66cb55290 425->427 428 7ff66cb5068f-7ff66cb50745 call 7ff66cc89810 memset 426->428 427->428 437 7ff66cb5065d-7ff66cb5068a 427->437 435 7ff66cb507fa-7ff66cb50814 OutputDebugStringW 428->435 436 7ff66cb5074b-7ff66cb5075d 428->436 440 7ff66cb50816-7ff66cb50822 call 7ff66cb57e80 435->440 441 7ff66cb50827-7ff66cb5089a call 7ff66cc73af0 435->441 438 7ff66cb50769-7ff66cb5078c 436->438 439 7ff66cb5075f-7ff66cb50767 436->439 437->404 444 7ff66cb50790-7ff66cb507c0 438->444 443 7ff66cb507c2-7ff66cb507d3 439->443 440->441 448 7ff66cb5094e-7ff66cb50974 call 7ff66cc9f370 441->448 449 7ff66cb508a0-7ff66cb508d3 call 7ff66cb57e80 441->449 447 7ff66cb507e0-7ff66cb507e7 443->447 444->443 444->444 447->435 450 7ff66cb507e9-7ff66cb507f8 447->450 448->418 449->404 450->435 450->447
                                                        APIs
                                                        Strings
                                                        • a Display implementation returned an error unexpectedlyC:\Users\Harrison\.rustup\toolchains\nightly-x86_64-pc-windows-msvc\lib/rustlib/src/rust\library\alloc\src\string.rs, xrefs: 00007FF66CB5095A
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1884984156.00007FF66CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB40000, based on PE: true
                                                        • Associated: 00000000.00000002.1884952705.00007FF66CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885265997.00007FF66CCA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885265997.00007FF66CE14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885597629.00007FF66CE53000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885626153.00007FF66CE54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_7ff66cb40000_dropper.jbxd
                                                        Similarity
                                                        • API ID: memcpy$memset$DebugOutputString
                                                        • String ID: a Display implementation returned an error unexpectedlyC:\Users\Harrison\.rustup\toolchains\nightly-x86_64-pc-windows-msvc\lib/rustlib/src/rust\library\alloc\src\string.rs
                                                        • API String ID: 4266836622-2517649730
                                                        • Opcode ID: 8cd81cc711510f730354fd452093fcd88ed3fc07938c9f534f988fd47017f559
                                                        • Instruction ID: 167278c15c74d30e0cb2eda3e4f220c2063f76082568fc635787078f3b86dbd1
                                                        • Opcode Fuzzy Hash: 8cd81cc711510f730354fd452093fcd88ed3fc07938c9f534f988fd47017f559
                                                        • Instruction Fuzzy Hash: D3F16A32A09FD289E7718F25E8507E92374FB45799F804235DA9D8BB8ADF799284C340
                                                        Function 00007FF66CB429A0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 218COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1884984156.00007FF66CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB40000, based on PE: true
                                                        • Associated: 00000000.00000002.1884952705.00007FF66CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885265997.00007FF66CCA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885265997.00007FF66CE14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885597629.00007FF66CE53000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885626153.00007FF66CE54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_7ff66cb40000_dropper.jbxd
                                                        Similarity
                                                        • API ID: memcpy$memset$DebugOutputString
                                                        • String ID: Failed to encrypt function name
                                                        • API String ID: 4266836622-2980051713
                                                        • Opcode ID: 0ae7235a5337a845177e813551c4689ad07840be7921dbfd3013a9b7174a933a
                                                        • Instruction ID: 3fca4449b3c6c9ccd86e966ff98c3c38568d87ddad7b5d5d87aab76987dc8cba
                                                        • Opcode Fuzzy Hash: 0ae7235a5337a845177e813551c4689ad07840be7921dbfd3013a9b7174a933a
                                                        • Instruction Fuzzy Hash: 83A1A572E14BE189EB318F64E8487E86770FB59758F448239CE5C9BB9ADF789250C340
                                                        Function 00007FF66CB42DB0 Relevance: 3.1, APIs: 2, Instructions: 69COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1884984156.00007FF66CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB40000, based on PE: true
                                                        • Associated: 00000000.00000002.1884952705.00007FF66CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885265997.00007FF66CCA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885265997.00007FF66CE14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885597629.00007FF66CE53000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885626153.00007FF66CE54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_7ff66cb40000_dropper.jbxd
                                                        Similarity
                                                        • API ID: DebugOutputStringmemset
                                                        • String ID:
                                                        • API String ID: 1084755268-0
                                                        • Opcode ID: 658c34695ddbc0d0f6071a905188a982a537a11a2d546ba85b442598897b3e61
                                                        • Instruction ID: b21c575a6f0d6aba6baeb94b6cd24c662e845838683e3de3a711ca7907aad4b9
                                                        • Opcode Fuzzy Hash: 658c34695ddbc0d0f6071a905188a982a537a11a2d546ba85b442598897b3e61
                                                        • Instruction Fuzzy Hash: 2641AD72205BC199E7768F21EC483D933A8F70875DF804229DA988EB99DF798349C300
                                                        Function 00007FF66CB51F30 Relevance: 3.1, APIs: 2, Instructions: 65COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 627 7ff66cb51f30-7ff66cb51f64 memset 628 7ff66cb5200a-7ff66cb52026 OutputDebugStringW 627->628 629 7ff66cb51f6a-7ff66cb51f7c 627->629 630 7ff66cb51f88-7ff66cb51fab 629->630 631 7ff66cb51f7e-7ff66cb51f86 629->631 633 7ff66cb51fb0-7ff66cb51fda 630->633 632 7ff66cb51fdc-7ff66cb51fea 631->632 634 7ff66cb51ff0-7ff66cb51ff7 632->634 633->632 633->633 634->628 635 7ff66cb51ff9-7ff66cb52008 634->635 635->628 635->634
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1884984156.00007FF66CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB40000, based on PE: true
                                                        • Associated: 00000000.00000002.1884952705.00007FF66CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885265997.00007FF66CCA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885265997.00007FF66CE14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885597629.00007FF66CE53000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885626153.00007FF66CE54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_7ff66cb40000_dropper.jbxd
                                                        Similarity
                                                        • API ID: DebugOutputStringmemset
                                                        • String ID:
                                                        • API String ID: 1084755268-0
                                                        • Opcode ID: dbe8b314e803bdf58eb38950bb7c846acb6e651d970314a15dd942edcc0ba3a8
                                                        • Instruction ID: 0471d5664f519b9c3b4b4e02a6002104e2461916982f2df0dc9ca973481f1ec0
                                                        • Opcode Fuzzy Hash: dbe8b314e803bdf58eb38950bb7c846acb6e651d970314a15dd942edcc0ba3a8
                                                        • Instruction Fuzzy Hash: C0213D22F29BA581EF218B64E1547B99231DB9A7C4F948331DA4E97F86EF1DC2418300

                                                        Non-executed Functions

                                                        Function 00007FF66CC80C70 Relevance: 18.3, APIs: 7, Strings: 3, Instructions: 760COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1884984156.00007FF66CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB40000, based on PE: true
                                                        • Associated: 00000000.00000002.1884952705.00007FF66CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885265997.00007FF66CCA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885265997.00007FF66CE14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885597629.00007FF66CE53000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885626153.00007FF66CE54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_7ff66cb40000_dropper.jbxd
                                                        Similarity
                                                        • API ID: ErrorLast$FullNamePath
                                                        • String ID: \\?\$\\?\UNC\$internal error: entered unreachable code/rustc/a4cb3c831823d9baa56c3d90514b75b2660116fa\library\alloc\src\vec\mod.rs
                                                        • API String ID: 2482867836-264738257
                                                        • Opcode ID: 10febf7e6dee918acc188ab995bb6000061b47809a2ad7427b972003d6653ef3
                                                        • Instruction ID: 678277bd98b66035c3b7fe3ac17c3c38c3dc22d055a82ae50c61ed60634db952
                                                        • Opcode Fuzzy Hash: 10febf7e6dee918acc188ab995bb6000061b47809a2ad7427b972003d6653ef3
                                                        • Instruction Fuzzy Hash: E0621D62E0AED2D5FB718B29D444BBB2AF1AB01796F444535CA6D9F6D0CF7CE5818300
                                                        Function 00007FF66CC97D54 Relevance: 13.6, APIs: 9, Instructions: 71COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1884984156.00007FF66CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB40000, based on PE: true
                                                        • Associated: 00000000.00000002.1884952705.00007FF66CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885265997.00007FF66CCA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885265997.00007FF66CE14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885597629.00007FF66CE53000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885626153.00007FF66CE54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_7ff66cb40000_dropper.jbxd
                                                        Similarity
                                                        • API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                        • String ID:
                                                        • API String ID: 313767242-0
                                                        • Opcode ID: 8bbd5aa1730cd332274f21e033dfa46fe5b836ac888b46510952249dd751b1d7
                                                        • Instruction ID: 9c695b65eb13756b56aecaadeedd3caa53629ee1bdb406644cb88ef4110e8146
                                                        • Opcode Fuzzy Hash: 8bbd5aa1730cd332274f21e033dfa46fe5b836ac888b46510952249dd751b1d7
                                                        • Instruction Fuzzy Hash: D3310C76609F81C6EB609FA0E8847E97374FB84749F44403ADA4E8BB99DF38D548C710
                                                        Function 00007FF66CC899D0 Relevance: 7.1, APIs: 5, Instructions: 807COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1884984156.00007FF66CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB40000, based on PE: true
                                                        • Associated: 00000000.00000002.1884952705.00007FF66CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885265997.00007FF66CCA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885265997.00007FF66CE14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885597629.00007FF66CE53000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885626153.00007FF66CE54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_7ff66cb40000_dropper.jbxd
                                                        Similarity
                                                        • API ID: memcpy
                                                        • String ID:
                                                        • API String ID: 3510742995-0
                                                        • Opcode ID: 69eba22a76fe83035c01e21fb3ee72b3bf31f5be31894dd397aa1db117448883
                                                        • Instruction ID: 08ee5b7c200000b51a072401d7c3a930644a57b6640c606d6893f344e8b54502
                                                        • Opcode Fuzzy Hash: 69eba22a76fe83035c01e21fb3ee72b3bf31f5be31894dd397aa1db117448883
                                                        • Instruction Fuzzy Hash: AD621013A1AA91EDFB108B6584016FE2F30F755799F448635EA5E9FBC9DE38E242D300
                                                        Function 00007FF66CC97C2C Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1884984156.00007FF66CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB40000, based on PE: true
                                                        • Associated: 00000000.00000002.1884952705.00007FF66CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885265997.00007FF66CCA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885265997.00007FF66CE14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885597629.00007FF66CE53000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885626153.00007FF66CE54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_7ff66cb40000_dropper.jbxd
                                                        Similarity
                                                        • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                        • String ID:
                                                        • API String ID: 2933794660-0
                                                        • Opcode ID: c596656461ae3f3076c1521dd9a9436d70232416d0a161f68c67e46cb5c13d68
                                                        • Instruction ID: 0f6e9e43aa105cbbc2898f32b9a38af0b57113924eab4af0c7e51a64ba6414f9
                                                        • Opcode Fuzzy Hash: c596656461ae3f3076c1521dd9a9436d70232416d0a161f68c67e46cb5c13d68
                                                        • Instruction Fuzzy Hash: C2111832B15F46CAEB008FB0E8552A833B4FB59759F440E35EA6E8ABA4DF78D1548340
                                                        Function 00007FF66CC9E770 Relevance: 4.1, Strings: 3, Instructions: 376COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1884984156.00007FF66CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB40000, based on PE: true
                                                        • Associated: 00000000.00000002.1884952705.00007FF66CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885265997.00007FF66CCA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885265997.00007FF66CE14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885597629.00007FF66CE53000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885626153.00007FF66CE54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_7ff66cb40000_dropper.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: Authenti$GenuineI$HygonGen
                                                        • API String ID: 0-696657513
                                                        • Opcode ID: f2e61712f0c5d9f69d27e50b952c7d1e10019fb747e75d8b3847ba665d39cf31
                                                        • Instruction ID: 5ba4f03e49943dbdededeaf8c42d3f2884340f215eb9cfc4180cf7358ef3cf15
                                                        • Opcode Fuzzy Hash: f2e61712f0c5d9f69d27e50b952c7d1e10019fb747e75d8b3847ba665d39cf31
                                                        • Instruction Fuzzy Hash: B4B139A3B359A146FB198B56BD12BB909A1B358BCCF04643CED5F9BBC0CD7CDA508241
                                                        Function 00007FF66CC70110 Relevance: 3.0, APIs: 2, Instructions: 467COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1884984156.00007FF66CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB40000, based on PE: true
                                                        • Associated: 00000000.00000002.1884952705.00007FF66CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885265997.00007FF66CCA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885265997.00007FF66CE14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885597629.00007FF66CE53000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885626153.00007FF66CE54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_7ff66cb40000_dropper.jbxd
                                                        Similarity
                                                        • API ID: memcpymemset
                                                        • String ID:
                                                        • API String ID: 1297977491-0
                                                        • Opcode ID: 25b5068a9a1db7c9942569100e3b28caeafde2c73725c3a1ff454f1de202b71a
                                                        • Instruction ID: 19bd21986e3502141a2bf650db6388618f092e7d2480c8cef4245c5344b3cced
                                                        • Opcode Fuzzy Hash: 25b5068a9a1db7c9942569100e3b28caeafde2c73725c3a1ff454f1de202b71a
                                                        • Instruction Fuzzy Hash: 50125166C28FD941E223973968027BBAB10EFFB748E11D317FED831E45DB1CA241A654
                                                        Function 00007FF66CC71F10 Relevance: 2.8, Strings: 2, Instructions: 284COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1884984156.00007FF66CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB40000, based on PE: true
                                                        • Associated: 00000000.00000002.1884952705.00007FF66CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885265997.00007FF66CCA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885265997.00007FF66CE14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885597629.00007FF66CE53000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885626153.00007FF66CE54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_7ff66cb40000_dropper.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: 33333333$UUUUUUUU
                                                        • API String ID: 0-3483174168
                                                        • Opcode ID: cff9d24c3fc3692150ad18937845d9fa878edfc3b39f359c130e8016678a4c49
                                                        • Instruction ID: 3a81f71bb059842e67eaceedc94535e03550869ade922beb697c2acde78d5c9a
                                                        • Opcode Fuzzy Hash: cff9d24c3fc3692150ad18937845d9fa878edfc3b39f359c130e8016678a4c49
                                                        • Instruction Fuzzy Hash: 0591E843B681F003F7624B7D1D66566EFA25545BD370DF152EEE423A86C038CC2AE3A5
                                                        Function 00007FF66CC72320 Relevance: 2.8, Strings: 2, Instructions: 273COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1884984156.00007FF66CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB40000, based on PE: true
                                                        • Associated: 00000000.00000002.1884952705.00007FF66CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885265997.00007FF66CCA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885265997.00007FF66CE14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885597629.00007FF66CE53000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885626153.00007FF66CE54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_7ff66cb40000_dropper.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: 33333333$UUUUUUUU
                                                        • API String ID: 0-3483174168
                                                        • Opcode ID: 14b31b35ad291ddad897dd1f2a0e82a6c76d055b51b98b879fc08f69398a6c0a
                                                        • Instruction ID: 0f8bec32a5713e29220c994287e2471ec9503f957c585ffdc4d845ef937708d5
                                                        • Opcode Fuzzy Hash: 14b31b35ad291ddad897dd1f2a0e82a6c76d055b51b98b879fc08f69398a6c0a
                                                        • Instruction Fuzzy Hash: 6691DA4375A3D48FAB52CB7E194498A6E90E12AFC835CF069CE8D27322D436D557C392
                                                        Function 00007FF66CC8F2E0 Relevance: 1.4, Strings: 1, Instructions: 134COMMON
                                                        Download Yara Rule
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1884984156.00007FF66CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB40000, based on PE: true
                                                        • Associated: 00000000.00000002.1884952705.00007FF66CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885265997.00007FF66CCA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885265997.00007FF66CE14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885597629.00007FF66CE53000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885626153.00007FF66CE54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_7ff66cb40000_dropper.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID: 0123456789abcdefBorrowMutErroralready borrowed:
                                                        • API String ID: 0-1320686809
                                                        • Opcode ID: 41d177af72eeddb10c22de4c3264fd25b0561db59cdec1d9bd2e9693263e96c7
                                                        • Instruction ID: 6fb57ac1cdfebd9b062bda1aafc02796cdb78441c85dacb1f0a5ab8b2caf58bd
                                                        • Opcode Fuzzy Hash: 41d177af72eeddb10c22de4c3264fd25b0561db59cdec1d9bd2e9693263e96c7
                                                        • Instruction Fuzzy Hash: C2512D63B196E0DEE32187789400EAC3FB19B15B49F094095CFD85FFC6C62AD119E751
                                                        Function 00007FF66CC70FA0 Relevance: .4, Instructions: 391COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1884984156.00007FF66CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB40000, based on PE: true
                                                        • Associated: 00000000.00000002.1884952705.00007FF66CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885265997.00007FF66CCA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885265997.00007FF66CE14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885597629.00007FF66CE53000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885626153.00007FF66CE54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_7ff66cb40000_dropper.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 26b839506847f24fc4f5c51154a888ab0d611c7331cf839320317adbb1efd074
                                                        • Instruction ID: 8f111ffcefa95280f37d29eecd1d19d0dafacdaee04a1355606189801aa6c64f
                                                        • Opcode Fuzzy Hash: 26b839506847f24fc4f5c51154a888ab0d611c7331cf839320317adbb1efd074
                                                        • Instruction Fuzzy Hash: 3BF1D262718B8481E6128B6AB4556A7E760FFDD7E4F45A212FFCC67B18DF38D2818700
                                                        Function 00007FF66CC93D10 Relevance: .4, Instructions: 390COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1884984156.00007FF66CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB40000, based on PE: true
                                                        • Associated: 00000000.00000002.1884952705.00007FF66CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885265997.00007FF66CCA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885265997.00007FF66CE14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885597629.00007FF66CE53000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885626153.00007FF66CE54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_7ff66cb40000_dropper.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: f11c5b38006027b9234eaea3e496288aefec6e0257f4ec47831e89d5fe555790
                                                        • Instruction ID: 17acbc03ed8da13173205990f89280629c7d51f341a6a68cc9f23079c1791ab9
                                                        • Opcode Fuzzy Hash: f11c5b38006027b9234eaea3e496288aefec6e0257f4ec47831e89d5fe555790
                                                        • Instruction Fuzzy Hash: C6E18C97F29F9641F723433994022B466306FA77E9A04D336FDB9B6ED1DF25A2429200
                                                        Function 00007FF66CC70A60 Relevance: .3, Instructions: 305COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1884984156.00007FF66CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB40000, based on PE: true
                                                        • Associated: 00000000.00000002.1884952705.00007FF66CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885265997.00007FF66CCA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885265997.00007FF66CE14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885597629.00007FF66CE53000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885626153.00007FF66CE54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_7ff66cb40000_dropper.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: d47f3e9b11dc4a54e4f11e78fefacc45221f5563bb6d7024a26e78833e66dd3c
                                                        • Instruction ID: b2ec3306b215dec7d6481e5a13f2310bf0205ed3663bda0faa5691414804b72c
                                                        • Opcode Fuzzy Hash: d47f3e9b11dc4a54e4f11e78fefacc45221f5563bb6d7024a26e78833e66dd3c
                                                        • Instruction Fuzzy Hash: 00D1B322518AD482F2129B7DA5166EBE371FFD9398F54A311FFC826A14EF38E1C58700
                                                        Function 00007FF66CC73560 Relevance: .2, Instructions: 249COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1884984156.00007FF66CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB40000, based on PE: true
                                                        • Associated: 00000000.00000002.1884952705.00007FF66CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885265997.00007FF66CCA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885265997.00007FF66CE14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885597629.00007FF66CE53000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885626153.00007FF66CE54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_7ff66cb40000_dropper.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: a7129c2044a4066c2b7ac891e204a05a9f8a1a369dd49303d74f275ccfacac7a
                                                        • Instruction ID: deb616b2fbd193f8ef22aad882b4af6c825d17ab869a370ed745d4ddf213ac41
                                                        • Opcode Fuzzy Hash: a7129c2044a4066c2b7ac891e204a05a9f8a1a369dd49303d74f275ccfacac7a
                                                        • Instruction Fuzzy Hash: 05C13F62D19FC542E7236739A4032F6E320FFEA384F00D312EEC47595AEB69E2459754
                                                        Function 00007FF66CC71640 Relevance: .2, Instructions: 235COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1884984156.00007FF66CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB40000, based on PE: true
                                                        • Associated: 00000000.00000002.1884952705.00007FF66CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885265997.00007FF66CCA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885265997.00007FF66CE14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885597629.00007FF66CE53000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885626153.00007FF66CE54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_7ff66cb40000_dropper.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: b20f7bc080719c1c1f3ae5b196f2442c1df25a9a2f5e432d3dc0e4515f377300
                                                        • Instruction ID: 2542ae72c4ccfa20196c65beb1892f13c0bd88adc0b991ce806802190909264d
                                                        • Opcode Fuzzy Hash: b20f7bc080719c1c1f3ae5b196f2442c1df25a9a2f5e432d3dc0e4515f377300
                                                        • Instruction Fuzzy Hash: 6971A3A3754B64867A04CFF2A830897E7A5F359FC4B19B425AF8D27F18CA3CC552D640
                                                        Function 00007FF66CC71C10 Relevance: .2, Instructions: 216COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1884984156.00007FF66CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB40000, based on PE: true
                                                        • Associated: 00000000.00000002.1884952705.00007FF66CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885265997.00007FF66CCA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885265997.00007FF66CE14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885597629.00007FF66CE53000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885626153.00007FF66CE54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_7ff66cb40000_dropper.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 5c7b83c72bfdaeea47df758e94a65eedecb787c00f8c8408b0aba7e0cdd93293
                                                        • Instruction ID: 04ce1c79c3dc486284b13dc6190a47992693366f3e16b1af04b184d47aee14c1
                                                        • Opcode Fuzzy Hash: 5c7b83c72bfdaeea47df758e94a65eedecb787c00f8c8408b0aba7e0cdd93293
                                                        • Instruction Fuzzy Hash: 0E61D4A2F718B693B642CEB185279A82E24F764BC2303A532DD1E67740CD74ED4FD215
                                                        Function 00007FF66CC73210 Relevance: .2, Instructions: 210COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1884984156.00007FF66CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB40000, based on PE: true
                                                        • Associated: 00000000.00000002.1884952705.00007FF66CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885265997.00007FF66CCA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885265997.00007FF66CE14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885597629.00007FF66CE53000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885626153.00007FF66CE54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_7ff66cb40000_dropper.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 516913f712a79e31602e76090d16c532121ebdbc7cbb616029c414f36c94abab
                                                        • Instruction ID: 457270f5b50bb61aa528683f3fab3dfe895481d90fd9d043ceb4ef80d636bc9e
                                                        • Opcode Fuzzy Hash: 516913f712a79e31602e76090d16c532121ebdbc7cbb616029c414f36c94abab
                                                        • Instruction Fuzzy Hash: 0C51EB63729B14456A40CFE2BD609AB6690B758BD4F49B436FE4DA7709CE3CCB829240
                                                        Function 00007FF66CC71950 Relevance: .2, Instructions: 210COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1884984156.00007FF66CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB40000, based on PE: true
                                                        • Associated: 00000000.00000002.1884952705.00007FF66CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885265997.00007FF66CCA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885265997.00007FF66CE14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885597629.00007FF66CE53000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885626153.00007FF66CE54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_7ff66cb40000_dropper.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: e49d64f606b30b5e613b7687bc14d59ee01eaa8d31e2a8703c4f9323d8549704
                                                        • Instruction ID: d416797be00467981505a8bf5a77a3e2a1a5905893b636c8e13afd6d057c9589
                                                        • Opcode Fuzzy Hash: e49d64f606b30b5e613b7687bc14d59ee01eaa8d31e2a8703c4f9323d8549704
                                                        • Instruction Fuzzy Hash: 176173A3315BA4427A04CFF2BD3199BABA5F649BD8B00F435EE8D57B1CDA3CC4518640
                                                        Function 00007FF66CC72A70 Relevance: .2, Instructions: 210COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1884984156.00007FF66CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB40000, based on PE: true
                                                        • Associated: 00000000.00000002.1884952705.00007FF66CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885265997.00007FF66CCA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885265997.00007FF66CE14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885597629.00007FF66CE53000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885626153.00007FF66CE54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_7ff66cb40000_dropper.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 63f73319fad2da576f3d5b9983d65f57c7789e905c01965cd88b4a1bca77e753
                                                        • Instruction ID: ac863f4bedc9bddaddae5922fc041a548a0128ccda551c0194af9db404a13d21
                                                        • Opcode Fuzzy Hash: 63f73319fad2da576f3d5b9983d65f57c7789e905c01965cd88b4a1bca77e753
                                                        • Instruction Fuzzy Hash: 35511963725B24456A40DFF2BD609AB6650B76CFD4F49B422FE8CA7705CE3CCB869240
                                                        Function 00007FF66CC727E0 Relevance: .2, Instructions: 190COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1884984156.00007FF66CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB40000, based on PE: true
                                                        • Associated: 00000000.00000002.1884952705.00007FF66CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885265997.00007FF66CCA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885265997.00007FF66CE14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885597629.00007FF66CE53000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885626153.00007FF66CE54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_7ff66cb40000_dropper.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 4a5052886ae8791df3e3aade1c897a77a9afdf7e8fe609916b5f9302e4dbc497
                                                        • Instruction ID: c06ad373f088eac6773fd2505e3dcc1f82ea758196c565d403a05ddc2eec12b5
                                                        • Opcode Fuzzy Hash: 4a5052886ae8791df3e3aade1c897a77a9afdf7e8fe609916b5f9302e4dbc497
                                                        • Instruction Fuzzy Hash: 2951D6F3725A10526E45CFA3BC24AB69652BB1CFD4F40E421DE0D9BB1ACE3CCA569340
                                                        Function 00007FF66CC72F80 Relevance: .2, Instructions: 190COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1884984156.00007FF66CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB40000, based on PE: true
                                                        • Associated: 00000000.00000002.1884952705.00007FF66CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885265997.00007FF66CCA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885265997.00007FF66CE14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885597629.00007FF66CE53000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885626153.00007FF66CE54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_7ff66cb40000_dropper.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: 7bcd44aacf1be6df8b683f518df340d7f83a1aa97022882a5af4655f99829e9a
                                                        • Instruction ID: 031cdd25f8197c5c57da5a8c2ab3e41862ac2129b1330e0fbd5ef58862bbe5cf
                                                        • Opcode Fuzzy Hash: 7bcd44aacf1be6df8b683f518df340d7f83a1aa97022882a5af4655f99829e9a
                                                        • Instruction Fuzzy Hash: 6751DAF3726A10425E45CFA2BC249B69652FA1CBD4F40D431DF1D97B09CE3CCA529340
                                                        Function 00007FF66CC72D40 Relevance: .2, Instructions: 170COMMON
                                                        Download Yara Rule
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1884984156.00007FF66CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB40000, based on PE: true
                                                        • Associated: 00000000.00000002.1884952705.00007FF66CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885265997.00007FF66CCA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885265997.00007FF66CE14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885597629.00007FF66CE53000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885626153.00007FF66CE54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_7ff66cb40000_dropper.jbxd
                                                        Similarity
                                                        • API ID:
                                                        • String ID:
                                                        • API String ID:
                                                        • Opcode ID: dbee0296d68a45a4e5011e14e78ef7d3f61107bd3d503f6abe85d47c4473e09a
                                                        • Instruction ID: 483b6cafddcb58c2d63febc22e83b766fe4bb801c7eb542a8cf0cfa7ab332378
                                                        • Opcode Fuzzy Hash: dbee0296d68a45a4e5011e14e78ef7d3f61107bd3d503f6abe85d47c4473e09a
                                                        • Instruction Fuzzy Hash: FB41F163719A24827E58EFE2BE71877A651B75CBD0F48B436EE4E97704CE3CC5828240
                                                        Function 00007FF66CB50AE0 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 307COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        • a Display implementation returned an error unexpectedlyC:\Users\Harrison\.rustup\toolchains\nightly-x86_64-pc-windows-msvc\lib/rustlib/src/rust\library\alloc\src\string.rs, xrefs: 00007FF66CB51016
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1884984156.00007FF66CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB40000, based on PE: true
                                                        • Associated: 00000000.00000002.1884952705.00007FF66CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885265997.00007FF66CCA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885265997.00007FF66CE14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885597629.00007FF66CE53000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885626153.00007FF66CE54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_7ff66cb40000_dropper.jbxd
                                                        Similarity
                                                        • API ID: memcpy$memset$DebugOutputString
                                                        • String ID: a Display implementation returned an error unexpectedlyC:\Users\Harrison\.rustup\toolchains\nightly-x86_64-pc-windows-msvc\lib/rustlib/src/rust\library\alloc\src\string.rs
                                                        • API String ID: 4266836622-2517649730
                                                        • Opcode ID: d1736ec547d2abe973e590ccb738b20439c6e624a7869f35f4785296af16e1aa
                                                        • Instruction ID: f5830c496de6a3f98029d396e0fbdca0c8294ac5bb236ba5f23ec9d8a6f31b6e
                                                        • Opcode Fuzzy Hash: d1736ec547d2abe973e590ccb738b20439c6e624a7869f35f4785296af16e1aa
                                                        • Instruction Fuzzy Hash: 2AE18D32A08FD189EB658F21E8507E92775FB49789F844136DA4D8FB86DF7DA244C340
                                                        Function 00007FF66CC78FA0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 243COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        • internal error: entered unreachable code/rustc/a4cb3c831823d9baa56c3d90514b75b2660116fa\library\alloc\src\vec\mod.rs, xrefs: 00007FF66CC79350
                                                        Memory Dump Source
                                                        • Source File: 00000000.00000002.1884984156.00007FF66CB41000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF66CB40000, based on PE: true
                                                        • Associated: 00000000.00000002.1884952705.00007FF66CB40000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885265997.00007FF66CCA0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885265997.00007FF66CE14000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885597629.00007FF66CE53000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                        • Associated: 00000000.00000002.1885626153.00007FF66CE54000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_0_2_7ff66cb40000_dropper.jbxd
                                                        Similarity
                                                        • API ID: ErrorLast$EnvironmentVariable
                                                        • String ID: internal error: entered unreachable code/rustc/a4cb3c831823d9baa56c3d90514b75b2660116fa\library\alloc\src\vec\mod.rs
                                                        • API String ID: 2691138088-1438511490
                                                        • Opcode ID: 68dc738b262730e3924a47c8be6157fdbafb472d655655e111a4667a0615b10b
                                                        • Instruction ID: 519c61a5961ef0645c75e03a7910c7caf72ca85271fbf2ae27be927aa0ff7e01
                                                        • Opcode Fuzzy Hash: 68dc738b262730e3924a47c8be6157fdbafb472d655655e111a4667a0615b10b
                                                        • Instruction Fuzzy Hash: F3A19AB2B15FC189EB618F26D8443E92375FB48B99F048135DE1D9FB89DE38E6818350

                                                        Execution Graph

                                                        Execution Coverage:4.3%
                                                        Dynamic/Decrypted Code Coverage:0%
                                                        Signature Coverage:0%
                                                        Total number of Nodes:484
                                                        Total number of Limit Nodes:49
                                                        execution_graph 11530 7ffd3582a330 11533 7ffd3582a468 11530->11533 11534 7ffd3582a479 11533->11534 11538 7ffd3582a33b 11533->11538 11535 7ffd3582a4e8 11534->11535 11539 7ffd3582a47e 11534->11539 11541 7ffd3582a5ec IsProcessorFeaturePresent 11535->11541 11537 7ffd3582a4f2 11539->11538 11540 7ffd3582a49b _initialize_onexit_table 11539->11540 11540->11538 11542 7ffd3582a612 11541->11542 11543 7ffd3582a620 memset RtlCaptureContext RtlLookupFunctionEntry 11542->11543 11544 7ffd3582a696 memset IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 11543->11544 11545 7ffd3582a65a RtlVirtualUnwind 11543->11545 11546 7ffd3582a716 11544->11546 11545->11544 11546->11537 10710 7ffd357f21f0 10711 7ffd357f223a 10710->10711 10712 7ffd357f2850 10710->10712 10714 7ffd357f225d 10711->10714 10715 7ffd3582c4b0 38 API calls 10711->10715 10740 7ffd3582c2a0 10712->10740 10716 7ffd357f28b8 10714->10716 10721 7ffd357f226a 10714->10721 10715->10714 10718 7ffd3582d3f0 38 API calls 10716->10718 10717 7ffd357f242b 10720 7ffd35824070 38 API calls 10717->10720 10719 7ffd357f28ec 10718->10719 10724 7ffd357f2954 10719->10724 10727 7ffd3582c7c0 41 API calls 10719->10727 10722 7ffd357f2485 memset 10720->10722 10721->10717 10725 7ffd357f24f0 10721->10725 10723 7ffd357f26da OutputDebugStringW 10722->10723 10732 7ffd357f24cb 10722->10732 10728 7ffd357f26f0 10723->10728 10726 7ffd35824070 38 API calls 10725->10726 10729 7ffd357f25e7 memset 10726->10729 10727->10724 10730 7ffd357f283e 10728->10730 10748 7ffd3582c7c0 10728->10748 10731 7ffd357f279a OutputDebugStringW 10729->10731 10735 7ffd357f262d 10729->10735 10738 7ffd357f27b0 10731->10738 10732->10723 10734 7ffd357f28fb 10737 7ffd3582cfa3 38 API calls 10734->10737 10735->10731 10736 7ffd357f27fe memcpy 10736->10728 10737->10719 10738->10734 10738->10736 10741 7ffd3582c2cd 10740->10741 10742 7ffd3582c394 10740->10742 10743 7ffd3582c34e 10741->10743 10744 7ffd3582c382 10741->10744 10745 7ffd3582c325 WaitOnAddress 10741->10745 10743->10744 10746 7ffd3582c37c WakeByAddressAll 10743->10746 10744->10711 10745->10741 10747 7ffd3582c342 GetLastError 10745->10747 10746->10744 10747->10741 10749 7ffd3582c7d7 10748->10749 10750 7ffd3582c869 10748->10750 10752 7ffd3582c7ff 10749->10752 10753 7ffd3582c7ea WakeByAddressSingle 10749->10753 10751 7ffd3582d160 38 API calls 10750->10751 10755 7ffd3582c881 10751->10755 10754 7ffd3582c809 10752->10754 10756 7ffd3582c81e 10752->10756 10757 7ffd3582c830 WakeByAddressSingle 10752->10757 10754->10756 10758 7ffd3582c854 WakeByAddressAll 10754->10758 10756->10730 10757->10756 10757->10758 10758->10756 10891 7ffd357f7370 10892 7ffd357f73c1 10891->10892 10897 7ffd357f7b7e 10891->10897 10895 7ffd357f73d7 10892->10895 10917 7ffd3582c1d0 10892->10917 10893 7ffd3582c2a0 3 API calls 10893->10895 10896 7ffd357f7bda 10895->10896 10901 7ffd357f73fc 10895->10901 10899 7ffd3582d3f0 38 API calls 10896->10899 10897->10893 10898 7ffd357f75cb 10900 7ffd35824070 38 API calls 10898->10900 10913 7ffd357f7a5d 10899->10913 10902 7ffd357f7625 memset 10900->10902 10901->10898 10903 7ffd357f7690 10901->10903 10904 7ffd357f781a OutputDebugStringW 10902->10904 10910 7ffd357f766b 10902->10910 10907 7ffd35824070 38 API calls 10903->10907 10916 7ffd357f7830 10904->10916 10906 7ffd357f7b58 10908 7ffd357f771c memset 10907->10908 10909 7ffd357f7afa OutputDebugStringW 10908->10909 10912 7ffd357f7769 10908->10912 10909->10913 10910->10904 10911 7ffd35824070 38 API calls 10914 7ffd357f7951 memset 10911->10914 10912->10909 10913->10906 10922 7ffd3582c290 WakeByAddressSingle 10913->10922 10915 7ffd357f7a2a OutputDebugStringW 10914->10915 10914->10916 10915->10916 10916->10911 10916->10913 10916->10915 10921 7ffd3582c1e9 10917->10921 10918 7ffd3582c210 10918->10897 10919 7ffd3582c23c WaitOnAddress 10920 7ffd3582c259 GetLastError 10919->10920 10919->10921 10920->10921 10921->10918 10921->10919 10759 7ffd357f4d40 10760 7ffd357f4d63 10759->10760 10761 7ffd357f4e01 memset 10759->10761 10762 7ffd357f4e4f 10760->10762 10764 7ffd357f4d8f memset 10760->10764 10763 7ffd357f51fc OutputDebugStringW 10761->10763 10766 7ffd35824070 38 API calls 10762->10766 10765 7ffd357f520a 10763->10765 10764->10763 10767 7ffd357f4edd memset 10766->10767 10768 7ffd357f4fca OutputDebugStringW 10767->10768 10770 7ffd357f4f15 10767->10770 10772 7ffd357f4fec 10768->10772 10769 7ffd357f5198 memset 10769->10763 10770->10768 10771 7ffd357f503c strlen 10771->10772 10772->10769 10772->10771 10773 7ffd357f5094 memcmp 10772->10773 10773->10772 10774 7ffd357f50a5 10773->10774 10775 7ffd35824070 38 API calls 10774->10775 10776 7ffd357f513b memset 10775->10776 10777 7ffd357f52ba OutputDebugStringW 10776->10777 10778 7ffd357f5173 10776->10778 10777->10765 10778->10777 10410 7ffd358039d0 10456 7ffd35824070 10410->10456 10412 7ffd35803b11 memset 10413 7ffd35803bfa OutputDebugStringW 10412->10413 10415 7ffd35803b4c 10412->10415 10414 7ffd35803c1d 10413->10414 10416 7ffd35803c47 10414->10416 10418 7ffd35803d3f 10414->10418 10415->10413 10417 7ffd35824070 38 API calls 10416->10417 10419 7ffd35803cdc memset 10417->10419 10454 7ffd35803d5e 10418->10454 10477 7ffd3582cfa3 10418->10477 10420 7ffd35803e2a OutputDebugStringW 10419->10420 10427 7ffd35803d1e 10419->10427 10423 7ffd35803e46 10420->10423 10422 7ffd3580452f 10426 7ffd3582cfa3 38 API calls 10422->10426 10424 7ffd35803e6b 10423->10424 10474 7ffd3582d262 10423->10474 10428 7ffd3582d262 38 API calls 10424->10428 10432 7ffd35803e86 10424->10432 10429 7ffd3580454b 10426->10429 10427->10420 10428->10432 10430 7ffd35803ea9 10468 7ffd3580e410 memset 10430->10468 10432->10430 10434 7ffd35803f33 10432->10434 10433 7ffd35803eb5 10436 7ffd35803f7e memcpy 10433->10436 10435 7ffd35803f51 memcpy memcpy 10434->10435 10435->10436 10436->10422 10439 7ffd35803fb0 10436->10439 10437 7ffd35803fdc memcpy memcpy 10440 7ffd35804029 10437->10440 10441 7ffd358040b2 10437->10441 10439->10422 10439->10437 10463 7ffd35807ed0 10440->10463 10442 7ffd35824070 38 API calls 10441->10442 10444 7ffd35804121 memset 10442->10444 10445 7ffd3580421a OutputDebugStringW 10444->10445 10446 7ffd35804163 10444->10446 10447 7ffd35804236 10445->10447 10446->10445 10447->10454 10483 7ffd3582d3f0 10447->10483 10448 7ffd3580430a 10450 7ffd35824070 38 API calls 10448->10450 10449 7ffd35804069 10449->10441 10449->10448 10452 7ffd358043d4 memset 10450->10452 10453 7ffd358044ca OutputDebugStringW 10452->10453 10455 7ffd35804416 10452->10455 10453->10454 10455->10453 10460 7ffd3582409a 10456->10460 10457 7ffd35824189 10457->10412 10458 7ffd3582d3f0 38 API calls 10459 7ffd35824159 10458->10459 10461 7ffd3582cfa3 38 API calls 10459->10461 10460->10457 10460->10458 10460->10459 10462 7ffd358241e5 10461->10462 10462->10412 10464 7ffd35807f2f 10463->10464 10466 7ffd35807f04 10463->10466 10465 7ffd35807fa5 10464->10465 10486 7ffd3580ed60 10464->10486 10465->10449 10466->10449 10466->10466 10470 7ffd3580e477 10468->10470 10469 7ffd358109b0 38 API calls 10469->10470 10470->10469 10471 7ffd3580e59f memcpy 10470->10471 10473 7ffd3580ff10 38 API calls 10470->10473 10471->10433 10473->10470 10703 7ffd3582d2a0 10474->10703 10478 7ffd3582cfb2 10477->10478 10479 7ffd3582cfba 10477->10479 10707 7ffd35823f80 10478->10707 10481 7ffd3582cfc0 38 API calls 10479->10481 10482 7ffd3582cfbf 10481->10482 10484 7ffd3582d0c0 38 API calls 10483->10484 10485 7ffd3582d470 10484->10485 10488 7ffd3580edc1 10486->10488 10487 7ffd3580f221 10487->10464 10488->10487 10489 7ffd3580f28c 10488->10489 10492 7ffd3580f20b 10488->10492 10490 7ffd3582d4a0 38 API calls 10489->10490 10491 7ffd3580f29b 10490->10491 10494 7ffd3582d4a0 10492->10494 10499 7ffd35829790 10494->10499 10502 7ffd3582d0c0 10499->10502 10505 7ffd35818be0 10502->10505 10511 7ffd35817e10 10505->10511 10507 7ffd35818bfe 10508 7ffd35818cc9 10507->10508 10522 7ffd3582cfc0 10507->10522 10530 7ffd35818f50 10511->10530 10513 7ffd35817e1f 10515 7ffd35817e63 10513->10515 10536 7ffd35816100 10513->10536 10520 7ffd35817e74 10515->10520 10544 7ffd35816eb0 10515->10544 10521 7ffd35817f1e 10520->10521 10547 7ffd35818170 10520->10547 10521->10507 10523 7ffd3582cfd8 10522->10523 10524 7ffd3582d0c0 38 API calls 10523->10524 10525 7ffd3582d034 10524->10525 10526 7ffd3582d160 38 API calls 10525->10526 10527 7ffd3582d05e 10526->10527 10528 7ffd3582d0c0 38 API calls 10527->10528 10529 7ffd3582d0bc 10528->10529 10532 7ffd35818f73 10530->10532 10531 7ffd35818fc2 10533 7ffd358190c6 38 API calls 10531->10533 10532->10531 10563 7ffd358190c6 10532->10563 10535 7ffd35818ff9 10533->10535 10535->10513 10537 7ffd35816150 10536->10537 10540 7ffd35816129 10536->10540 10538 7ffd3582cfa3 38 API calls 10537->10538 10539 7ffd3581628c 10538->10539 10539->10515 10540->10537 10543 7ffd35816155 10540->10543 10541 7ffd35816254 10541->10515 10542 7ffd35818050 38 API calls 10542->10543 10543->10541 10543->10542 10638 7ffd3581b7b0 10544->10638 10546 7ffd35816ed1 10549 7ffd35818196 10547->10549 10548 7ffd358182b5 10548->10521 10549->10548 10550 7ffd35818309 10549->10550 10551 7ffd35818318 10549->10551 10559 7ffd358182a3 10549->10559 10552 7ffd3582d4a0 38 API calls 10550->10552 10553 7ffd3582d490 38 API calls 10551->10553 10552->10551 10554 7ffd3581832a 10553->10554 10555 7ffd35818355 10554->10555 10556 7ffd35818418 10554->10556 10558 7ffd35815e00 38 API calls 10555->10558 10557 7ffd3582d0c0 38 API calls 10556->10557 10560 7ffd3581846a 10557->10560 10562 7ffd358183ae 10558->10562 10561 7ffd3582d480 38 API calls 10559->10561 10560->10521 10561->10548 10562->10521 10565 7ffd35819101 10563->10565 10564 7ffd358191eb 10566 7ffd358191f3 10564->10566 10567 7ffd35819275 10564->10567 10565->10564 10569 7ffd3581912f 10565->10569 10582 7ffd3582c4b0 10565->10582 10633 7ffd35815e00 10566->10633 10568 7ffd35815e00 38 API calls 10567->10568 10572 7ffd3581926f 10568->10572 10574 7ffd35819173 10569->10574 10590 7ffd358186f4 10569->10590 10576 7ffd35815e00 38 API calls 10572->10576 10608 7ffd358127d0 10574->10608 10578 7ffd3581931d 10576->10578 10577 7ffd358191be 10577->10572 10621 7ffd35819370 10577->10621 10580 7ffd358127d0 38 API calls 10578->10580 10581 7ffd35819354 10580->10581 10581->10531 10583 7ffd3582c4cc 10582->10583 10584 7ffd3582c650 10583->10584 10585 7ffd3582c65b 10583->10585 10587 7ffd3582c5f2 WaitOnAddress 10583->10587 10584->10569 10586 7ffd3582d0c0 36 API calls 10585->10586 10588 7ffd3582c68d 10586->10588 10587->10583 10589 7ffd3582c614 GetLastError 10587->10589 10589->10583 10591 7ffd3581871e 10590->10591 10593 7ffd35818718 10590->10593 10592 7ffd358162e0 38 API calls 10591->10592 10591->10593 10592->10593 10594 7ffd35814f30 38 API calls 10593->10594 10595 7ffd35818934 10593->10595 10596 7ffd35818811 10594->10596 10595->10574 10597 7ffd35818835 10596->10597 10598 7ffd358188a9 10596->10598 10600 7ffd3582c1d0 WaitOnAddress GetLastError 10597->10600 10601 7ffd3581884c 10597->10601 10599 7ffd35818a05 WaitOnAddress GetLastError 10598->10599 10603 7ffd3581889a 10599->10603 10600->10601 10602 7ffd35818a05 WaitOnAddress GetLastError 10601->10602 10604 7ffd35818881 10602->10604 10603->10574 10605 7ffd35812700 WakeByAddressSingle 10604->10605 10606 7ffd3581888d 10605->10606 10607 7ffd35814f30 38 API calls 10606->10607 10607->10603 10609 7ffd358127ea 10608->10609 10610 7ffd358127ec 10608->10610 10609->10577 10611 7ffd3582c7d7 10610->10611 10612 7ffd3582c869 10610->10612 10613 7ffd3582c7ff 10611->10613 10615 7ffd3582c7ea WakeByAddressSingle 10611->10615 10614 7ffd3582d160 35 API calls 10612->10614 10616 7ffd3582c809 10613->10616 10618 7ffd3582c81e 10613->10618 10619 7ffd3582c830 WakeByAddressSingle 10613->10619 10617 7ffd3582c881 10614->10617 10616->10618 10620 7ffd3582c854 WakeByAddressAll 10616->10620 10618->10577 10619->10618 10619->10620 10620->10618 10622 7ffd3581d210 38 API calls 10621->10622 10623 7ffd35819385 10622->10623 10624 7ffd35815e00 38 API calls 10623->10624 10625 7ffd358193de 10624->10625 10626 7ffd35819492 10625->10626 10627 7ffd3581941d 10625->10627 10628 7ffd35823d8e 10626->10628 10629 7ffd3582d3f0 38 API calls 10626->10629 10630 7ffd3582d480 38 API calls 10627->10630 10631 7ffd35819490 10627->10631 10628->10564 10629->10628 10632 7ffd358194e7 10630->10632 10631->10564 10632->10564 10634 7ffd35815e37 10633->10634 10635 7ffd3582d0c0 38 API calls 10634->10635 10637 7ffd35815e46 10634->10637 10636 7ffd35815eea 10635->10636 10636->10572 10637->10572 10641 7ffd3581b7c6 10638->10641 10639 7ffd3581ba43 10645 7ffd3581b966 10639->10645 10675 7ffd3582d480 10639->10675 10641->10639 10644 7ffd3581b94b 10641->10644 10641->10645 10672 7ffd3582d490 10641->10672 10643 7ffd3582d480 31 API calls 10656 7ffd3581bc3d 10643->10656 10644->10643 10644->10645 10645->10546 10646 7ffd3581bde8 SetLastError GetFullPathNameW 10647 7ffd3581be13 GetLastError 10646->10647 10646->10656 10648 7ffd3581beea GetLastError 10647->10648 10647->10656 10661 7ffd3581bcbb 10648->10661 10649 7ffd3581be2d GetLastError 10651 7ffd3581c27e 10649->10651 10649->10656 10700 7ffd3582d160 10651->10700 10652 7ffd3581c26a 10654 7ffd3582d490 31 API calls 10652->10654 10658 7ffd3581c27c 10654->10658 10655 7ffd3581c010 10657 7ffd3581c033 memcpy 10655->10657 10662 7ffd3582bf80 31 API calls 10655->10662 10656->10646 10656->10649 10656->10652 10659 7ffd3581c015 10656->10659 10656->10661 10668 7ffd3581beca 10656->10668 10678 7ffd3582bf80 10656->10678 10660 7ffd3581c057 10657->10660 10657->10661 10658->10546 10659->10655 10666 7ffd3581c2b4 10659->10666 10693 7ffd358133c0 10660->10693 10661->10546 10665 7ffd3581c25e 10662->10665 10663 7ffd3581bfee memcpy 10663->10655 10663->10657 10665->10657 10669 7ffd3582cfa3 31 API calls 10666->10669 10667 7ffd3581c13d 10667->10659 10670 7ffd3581c298 10667->10670 10668->10663 10668->10667 10669->10658 10671 7ffd3582cfa3 31 API calls 10670->10671 10671->10658 10673 7ffd35829720 38 API calls 10672->10673 10674 7ffd3582d49f 10673->10674 10676 7ffd358296b0 38 API calls 10675->10676 10677 7ffd3582d48f 10676->10677 10679 7ffd3582bf98 10678->10679 10680 7ffd3582cfa3 37 API calls 10679->10680 10681 7ffd3582bfdc 10679->10681 10680->10681 10682 7ffd3582cfa3 37 API calls 10681->10682 10686 7ffd3582c02a 10681->10686 10683 7ffd3582c05f 10682->10683 10684 7ffd3582d0c0 37 API calls 10683->10684 10685 7ffd3582c09c 10684->10685 10687 7ffd3582c0cd 10685->10687 10688 7ffd358145d0 37 API calls 10685->10688 10686->10656 10689 7ffd3582c0dd memcpy 10687->10689 10690 7ffd3582c0fb 10687->10690 10691 7ffd3582c10b 10687->10691 10688->10687 10689->10691 10692 7ffd35815ae0 37 API calls 10690->10692 10691->10656 10692->10691 10694 7ffd358133dd 10693->10694 10695 7ffd35813403 10694->10695 10696 7ffd3582cfa3 38 API calls 10694->10696 10697 7ffd3582cfa3 38 API calls 10695->10697 10699 7ffd3581344c 10695->10699 10696->10695 10698 7ffd3581347a 10697->10698 10699->10661 10701 7ffd3582d0c0 38 API calls 10700->10701 10702 7ffd3582d19d 10701->10702 10704 7ffd3582d2d2 10703->10704 10705 7ffd3582d0c0 38 API calls 10704->10705 10706 7ffd3582d3e9 10705->10706 10708 7ffd3582d0c0 38 API calls 10707->10708 10709 7ffd35823fb8 10708->10709 10779 7ffd357f1350 10780 7ffd357f13b7 10779->10780 10781 7ffd357f1f98 10779->10781 10783 7ffd357f1f84 10780->10783 10787 7ffd357f13cf 10780->10787 10782 7ffd3582c2a0 3 API calls 10781->10782 10782->10787 10847 7ffd3582c690 10783->10847 10785 7ffd357f13f3 10791 7ffd357f2083 10785->10791 10804 7ffd357f141f 10785->10804 10786 7ffd357f1fee 10788 7ffd3582d3f0 38 API calls 10786->10788 10787->10785 10787->10786 10789 7ffd357f201d 10788->10789 10852 7ffd35805d30 10789->10852 10790 7ffd3582c7c0 41 API calls 10792 7ffd357f1f69 10790->10792 10793 7ffd3582cfc0 38 API calls 10791->10793 10793->10789 10795 7ffd357f1f19 10795->10790 10795->10792 10796 7ffd357f20ce 10798 7ffd357f203b 10799 7ffd3582d3f0 38 API calls 10798->10799 10799->10789 10801 7ffd35824070 38 API calls 10802 7ffd357f1e0a memset 10801->10802 10803 7ffd357f1eea OutputDebugStringW 10802->10803 10802->10804 10803->10804 10804->10795 10804->10798 10804->10801 10804->10803 10805 7ffd35802e40 10804->10805 10843 7ffd358099e0 10804->10843 10806 7ffd35824070 38 API calls 10805->10806 10807 7ffd35802f8b memset 10806->10807 10808 7ffd3580307a OutputDebugStringW 10807->10808 10810 7ffd35802fc6 10807->10810 10809 7ffd3580309d 10808->10809 10811 7ffd358030fa 10809->10811 10813 7ffd358030bf 10809->10813 10810->10808 10814 7ffd3582cfa3 38 API calls 10811->10814 10841 7ffd35803119 10811->10841 10812 7ffd358030e9 10815 7ffd3580e410 40 API calls 10812->10815 10813->10812 10818 7ffd35803172 10813->10818 10816 7ffd35803801 10814->10816 10817 7ffd358030f5 10815->10817 10821 7ffd3582cfa3 38 API calls 10816->10821 10819 7ffd358031bd memcpy 10817->10819 10820 7ffd35803190 memcpy memcpy 10818->10820 10819->10816 10823 7ffd358031ee 10819->10823 10820->10819 10826 7ffd3580381c 10821->10826 10822 7ffd3580381e 10824 7ffd3582d490 38 API calls 10822->10824 10823->10816 10823->10822 10825 7ffd35803216 10823->10825 10824->10826 10825->10822 10827 7ffd3580323c memcpy memcpy 10825->10827 10826->10804 10828 7ffd35803283 10827->10828 10829 7ffd35803292 memcpy memset 10827->10829 10830 7ffd35824070 38 API calls 10828->10830 10832 7ffd35803333 10829->10832 10831 7ffd35803522 memset 10830->10831 10833 7ffd3580361a OutputDebugStringW 10831->10833 10835 7ffd35803564 10831->10835 10832->10828 10834 7ffd3580338e 10832->10834 10837 7ffd35803636 10833->10837 10836 7ffd35824070 38 API calls 10834->10836 10835->10833 10838 7ffd35803448 memset 10836->10838 10839 7ffd3582d3f0 38 API calls 10837->10839 10837->10841 10840 7ffd3580378a OutputDebugStringW 10838->10840 10842 7ffd3580348a 10838->10842 10839->10826 10840->10841 10841->10804 10842->10840 10844 7ffd35809c91 10843->10844 10846 7ffd35809a18 10843->10846 10865 7ffd3582afb0 10844->10865 10846->10804 10851 7ffd3582c6b9 10847->10851 10848 7ffd3582c7ad 10848->10795 10849 7ffd3582c746 WaitOnAddress 10850 7ffd3582c763 GetLastError 10849->10850 10849->10851 10850->10851 10851->10848 10851->10849 10853 7ffd35805d41 10852->10853 10854 7ffd35805d6a 10853->10854 10855 7ffd3582c7d7 10853->10855 10856 7ffd3582c869 10853->10856 10854->10796 10857 7ffd3582c7ff 10855->10857 10859 7ffd3582c7ea WakeByAddressSingle 10855->10859 10858 7ffd3582d160 38 API calls 10856->10858 10860 7ffd3582c809 10857->10860 10862 7ffd3582c81e 10857->10862 10863 7ffd3582c830 WakeByAddressSingle 10857->10863 10861 7ffd3582c881 10858->10861 10860->10862 10864 7ffd3582c854 WakeByAddressAll 10860->10864 10862->10796 10863->10862 10863->10864 10864->10862 10866 7ffd3582b0d6 10865->10866 10867 7ffd3582afdc 10865->10867 10881 7ffd35823ec0 10866->10881 10869 7ffd3582b02b 10867->10869 10871 7ffd3582b005 10867->10871 10877 7ffd358022d0 10869->10877 10871->10866 10872 7ffd3582b0e2 10871->10872 10873 7ffd3582b391 10872->10873 10874 7ffd3582b10c memset 10872->10874 10886 7ffd35823f10 10873->10886 10876 7ffd3582b04e 10874->10876 10876->10846 10878 7ffd35802322 10877->10878 10879 7ffd35802726 memcpy 10878->10879 10880 7ffd358023bc 10878->10880 10879->10880 10880->10876 10882 7ffd35823ece 10881->10882 10883 7ffd35823ed6 10881->10883 10882->10876 10884 7ffd3582d0c0 38 API calls 10883->10884 10885 7ffd35823f08 10884->10885 10887 7ffd35823f1e 10886->10887 10888 7ffd35823f2a 10886->10888 10887->10876 10889 7ffd3582cfc0 38 API calls 10888->10889 10890 7ffd35823f35 10889->10890 10923 7ffd357f29d0 10924 7ffd35802e40 53 API calls 10923->10924 10925 7ffd357f2a25 10924->10925 10926 7ffd357f2d18 10925->10926 10927 7ffd357f2a2f 10925->10927 10929 7ffd3582d3f0 38 API calls 10926->10929 10928 7ffd35824070 38 API calls 10927->10928 10930 7ffd357f2b24 memset 10928->10930 10931 7ffd357f2d59 10929->10931 10932 7ffd357f2c0a OutputDebugStringW 10930->10932 10933 7ffd357f2b63 10930->10933 10934 7ffd357f2c20 10932->10934 10933->10932

                                                        Executed Functions

                                                        Function 00007FFD358039D0 Relevance: 26.9, APIs: 13, Strings: 2, Instructions: 603COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 29 7ffd358039d0-7ffd35803b46 call 7ffd35824070 memset 32 7ffd35803b4c-7ffd35803b5e 29->32 33 7ffd35803bfa-7ffd35803c1b OutputDebugStringW 29->33 34 7ffd35803b6a-7ffd35803b8d 32->34 35 7ffd35803b60-7ffd35803b68 32->35 36 7ffd35803c2b-7ffd35803c33 33->36 37 7ffd35803c1d-7ffd35803c26 call 7ffd35809d30 33->37 39 7ffd35803b90-7ffd35803bc0 34->39 38 7ffd35803bc2-7ffd35803bde 35->38 41 7ffd35803c39-7ffd35803c41 36->41 42 7ffd35803d3f-7ffd35803d58 call 7ffd35809d20 36->42 37->36 44 7ffd35803be0-7ffd35803be7 38->44 39->38 39->39 41->42 45 7ffd35803c47-7ffd35803d18 call 7ffd35824070 memset 41->45 49 7ffd35804519-7ffd3580452a call 7ffd3582cfa3 42->49 50 7ffd35803d5e-7ffd35803d8e 42->50 44->33 47 7ffd35803be9-7ffd35803bf8 44->47 52 7ffd35803e2a-7ffd35803e44 OutputDebugStringW 45->52 53 7ffd35803d1e-7ffd35803d30 45->53 47->33 47->44 58 7ffd3580452f 49->58 55 7ffd358042f3-7ffd35804309 50->55 59 7ffd35803e57-7ffd35803e69 52->59 60 7ffd35803e46-7ffd35803e52 call 7ffd35809d30 52->60 56 7ffd35803d93-7ffd35803db6 53->56 57 7ffd35803d32-7ffd35803d3a 53->57 62 7ffd35803dc0-7ffd35803df0 56->62 61 7ffd35803df2-7ffd35803e0e 57->61 63 7ffd35804532-7ffd3580454b call 7ffd3582cfa3 58->63 65 7ffd35803e6b-7ffd35803e84 59->65 66 7ffd35803eba-7ffd35803ee8 call 7ffd3582d262 59->66 60->59 71 7ffd35803e10-7ffd35803e17 61->71 62->61 62->62 79 7ffd35804578-7ffd358045b6 63->79 67 7ffd35803e86-7ffd35803e99 65->67 68 7ffd35803eed-7ffd35803f1b call 7ffd3582d262 65->68 66->68 72 7ffd35803f33-7ffd35803f79 call 7ffd35811860 call 7ffd35802b30 memcpy * 2 67->72 73 7ffd35803e9f-7ffd35803ea7 67->73 78 7ffd35803f20-7ffd35803f2d call 7ffd3582bdb0 68->78 71->52 76 7ffd35803e19-7ffd35803e28 71->76 88 7ffd35803f7e-7ffd35803faa memcpy 72->88 77 7ffd35803ea9-7ffd35803eb5 call 7ffd3580e410 73->77 73->78 76->52 76->71 77->88 78->72 78->77 88->58 89 7ffd35803fb0-7ffd35803fb7 88->89 90 7ffd35803fb9-7ffd35803fd6 call 7ffd35809d20 89->90 91 7ffd35803fe1 89->91 90->63 98 7ffd35803fdc-7ffd35803fdf 90->98 93 7ffd35803fe7-7ffd35804023 memcpy * 2 91->93 95 7ffd35804029-7ffd3580406d call 7ffd35807ed0 93->95 96 7ffd358040b2-7ffd3580415d call 7ffd35824070 memset 93->96 95->96 104 7ffd3580406f-7ffd35804083 95->104 102 7ffd3580421a-7ffd35804234 OutputDebugStringW 96->102 103 7ffd35804163-7ffd35804175 96->103 98->93 107 7ffd35804247-7ffd358042ba call 7ffd35811e10 102->107 108 7ffd35804236-7ffd35804242 call 7ffd35809d30 102->108 105 7ffd35804177-7ffd3580417f 103->105 106 7ffd35804181-7ffd358041a4 103->106 104->96 109 7ffd35804085-7ffd3580409e 104->109 110 7ffd358041e2-7ffd358041fe 105->110 111 7ffd358041b0-7ffd358041e0 106->111 119 7ffd358042c0-7ffd358042e0 107->119 120 7ffd3580454d-7ffd35804573 call 7ffd3582d3f0 107->120 108->107 114 7ffd358040a0-7ffd358040a3 109->114 115 7ffd35804200-7ffd35804207 110->115 111->110 111->111 117 7ffd3580430a-7ffd3580431a 114->117 118 7ffd358040a9-7ffd358040b0 114->118 115->102 123 7ffd35804209-7ffd35804218 115->123 121 7ffd3580431c 117->121 122 7ffd35804323-7ffd35804410 call 7ffd35824070 memset 117->122 118->96 118->114 119->55 124 7ffd358042e2-7ffd358042ee call 7ffd35809d30 119->124 120->79 121->122 129 7ffd358044ca-7ffd358044e4 OutputDebugStringW 122->129 130 7ffd35804416-7ffd35804428 122->130 123->102 123->115 124->55 131 7ffd358044f7-7ffd35804514 129->131 132 7ffd358044e6-7ffd358044f2 call 7ffd35809d30 129->132 133 7ffd3580442a-7ffd35804432 130->133 134 7ffd35804434-7ffd35804457 130->134 131->55 132->131 136 7ffd35804492-7ffd358044ae 133->136 137 7ffd35804460-7ffd35804490 134->137 138 7ffd358044b0-7ffd358044b7 136->138 137->136 137->137 138->129 139 7ffd358044b9-7ffd358044c8 138->139 139->129 139->138
                                                        APIs
                                                        Strings
                                                        • a Display implementation returned an error unexpectedlyC:\Users\Harrison\.rustup\toolchains\nightly-x86_64-pc-windows-msvc\lib/rustlib/src/rust\library\alloc\src\string.rs, xrefs: 00007FFD35804559
                                                        • , xrefs: 00007FFD35803A7E
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.3197738493.00007FFD357F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFD357F0000, based on PE: true
                                                        • Associated: 00000002.00000002.3196831522.00007FFD357F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3199502615.00007FFD3582E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3200873382.00007FFD35843000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3201862509.00007FFD35844000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_7ffd357f0000_cmd.jbxd
                                                        Similarity
                                                        • API ID: memcpy$DebugOutputStringmemset
                                                        • String ID: $a Display implementation returned an error unexpectedlyC:\Users\Harrison\.rustup\toolchains\nightly-x86_64-pc-windows-msvc\lib/rustlib/src/rust\library\alloc\src\string.rs
                                                        • API String ID: 4201822616-3424599729
                                                        • Opcode ID: ed1087d9a686b1eaa5fd72b424d276ba4566e79deac30bbc11a36390656a22a4
                                                        • Instruction ID: 009151c17e02bcf2061ba42190d1756fca0b140ef42ebaadaf8c4565cdd8ddbd
                                                        • Opcode Fuzzy Hash: ed1087d9a686b1eaa5fd72b424d276ba4566e79deac30bbc11a36390656a22a4
                                                        • Instruction Fuzzy Hash: 2752A232B15BCA98EB71CF20D8607EA2364FB45B88F405235DB4D5BB9AEF799245D300
                                                        Function 00007FFD35802E40 Relevance: 25.0, APIs: 13, Strings: 1, Instructions: 529COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 140 7ffd35802e40-7ffd35802fc0 call 7ffd35824070 memset 143 7ffd3580307a-7ffd3580309b OutputDebugStringW 140->143 144 7ffd35802fc6-7ffd35802fd8 140->144 147 7ffd358030ab-7ffd358030b3 143->147 148 7ffd3580309d-7ffd358030a6 call 7ffd35809d30 143->148 145 7ffd35802fda-7ffd35802fe2 144->145 146 7ffd35802fe4-7ffd35803007 144->146 149 7ffd35803042-7ffd3580305e 145->149 150 7ffd35803010-7ffd35803040 146->150 152 7ffd358030fa-7ffd35803113 call 7ffd35809d20 147->152 153 7ffd358030b5-7ffd358030bd 147->153 148->147 155 7ffd35803060-7ffd35803067 149->155 150->149 150->150 161 7ffd358037eb-7ffd358037fc call 7ffd3582cfa3 152->161 162 7ffd35803119-7ffd3580315a 152->162 153->152 156 7ffd358030bf-7ffd358030d9 153->156 155->143 158 7ffd35803069-7ffd35803078 155->158 159 7ffd35803172-7ffd358031b8 call 7ffd35811860 call 7ffd35802b30 memcpy * 2 156->159 160 7ffd358030df-7ffd358030e7 156->160 158->143 158->155 176 7ffd358031bd-7ffd358031e8 memcpy 159->176 164 7ffd358030e9-7ffd358030f5 call 7ffd3580e410 160->164 165 7ffd3580315f-7ffd3580316c call 7ffd3582bdb0 160->165 171 7ffd35803801 161->171 166 7ffd358037d4-7ffd358037ea 162->166 164->176 165->159 165->164 175 7ffd35803803-7ffd3580381c call 7ffd3582cfa3 171->175 184 7ffd35803881-7ffd358038bd 175->184 176->171 179 7ffd358031ee 176->179 181 7ffd358031f4-7ffd35803210 call 7ffd35809d50 179->181 182 7ffd3580381e-7ffd35803834 179->182 181->175 190 7ffd35803216-7ffd35803236 181->190 185 7ffd3580383b-7ffd35803854 call 7ffd3582d490 182->185 188 7ffd358038d1-7ffd358038ea 184->188 189 7ffd358038bf-7ffd358038cc call 7ffd35809d30 184->189 185->184 189->188 190->185 193 7ffd3580323c-7ffd35803281 memcpy * 2 190->193 194 7ffd35803283-7ffd3580328d 193->194 195 7ffd35803292-7ffd35803388 memcpy memset call 7ffd35808070 call 7ffd35807fd0 193->195 196 7ffd358034af-7ffd3580355e call 7ffd35824070 memset 194->196 195->196 207 7ffd3580338e-7ffd3580339d 195->207 202 7ffd3580361a-7ffd35803634 OutputDebugStringW 196->202 203 7ffd35803564-7ffd35803576 196->203 208 7ffd35803647-7ffd358036ba call 7ffd35811df0 202->208 209 7ffd35803636-7ffd35803642 call 7ffd35809d30 202->209 205 7ffd35803578-7ffd35803580 203->205 206 7ffd35803582-7ffd358035a5 203->206 210 7ffd358035e2-7ffd358035f3 205->210 211 7ffd358035b0-7ffd358035e0 206->211 212 7ffd358033a6-7ffd35803484 call 7ffd35824070 memset 207->212 213 7ffd3580339f 207->213 219 7ffd35803856-7ffd3580387c call 7ffd3582d3f0 208->219 220 7ffd358036c0-7ffd358036ee call 7ffd35809d30 208->220 209->208 217 7ffd35803600-7ffd35803607 210->217 211->210 211->211 225 7ffd3580378a-7ffd358037a4 OutputDebugStringW 212->225 226 7ffd3580348a-7ffd3580349c 212->226 213->212 217->202 221 7ffd35803609-7ffd35803618 217->221 219->184 220->166 221->202 221->217 230 7ffd358037b7-7ffd358037cd 225->230 231 7ffd358037a6-7ffd358037b2 call 7ffd35809d30 225->231 227 7ffd358036f3-7ffd35803716 226->227 228 7ffd358034a2-7ffd358034aa 226->228 233 7ffd35803720-7ffd35803750 227->233 232 7ffd35803752-7ffd3580376e 228->232 230->166 231->230 235 7ffd35803770-7ffd35803777 232->235 233->232 233->233 235->225 236 7ffd35803779-7ffd35803788 235->236 236->225 236->235
                                                        APIs
                                                        Strings
                                                        • a Display implementation returned an error unexpectedlyC:\Users\Harrison\.rustup\toolchains\nightly-x86_64-pc-windows-msvc\lib/rustlib/src/rust\library\alloc\src\string.rs, xrefs: 00007FFD35803862
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.3197738493.00007FFD357F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFD357F0000, based on PE: true
                                                        • Associated: 00000002.00000002.3196831522.00007FFD357F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3199502615.00007FFD3582E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3200873382.00007FFD35843000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3201862509.00007FFD35844000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_7ffd357f0000_cmd.jbxd
                                                        Similarity
                                                        • API ID: memcpy$memset$DebugOutputString
                                                        • String ID: a Display implementation returned an error unexpectedlyC:\Users\Harrison\.rustup\toolchains\nightly-x86_64-pc-windows-msvc\lib/rustlib/src/rust\library\alloc\src\string.rs
                                                        • API String ID: 4266836622-2517649730
                                                        • Opcode ID: 9689f64de2b983799eb92ded43608e3fcaf248a8afa5c0ab1898bbafa55b948d
                                                        • Instruction ID: a6bb6a3d4eb698228f643f95026d4f7c457b88ed4df24824bd0bf0c154463167
                                                        • Opcode Fuzzy Hash: 9689f64de2b983799eb92ded43608e3fcaf248a8afa5c0ab1898bbafa55b948d
                                                        • Instruction Fuzzy Hash: 1D429D32B19BC699EB718F21D8603E92764FB45B88F404235DB8D0BB8ADF799349D341
                                                        Function 00007FFD357F7370 Relevance: 19.8, APIs: 6, Strings: 5, Instructions: 512COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 237 7ffd357f7370-7ffd357f73bb 238 7ffd357f7b83-7ffd357f7bc1 call 7ffd3582c2a0 237->238 239 7ffd357f73c1-7ffd357f73d1 237->239 245 7ffd357f7bc6-7ffd357f7bd4 call 7ffd3582c1a0 238->245 241 7ffd357f73d7-7ffd357f73e7 239->241 242 7ffd357f7b76-7ffd357f7b7e call 7ffd3582c1d0 239->242 241->245 246 7ffd357f73ed-7ffd357f73f6 241->246 242->238 247 7ffd357f73fc-7ffd357f740e 245->247 248 7ffd357f7bda-7ffd357f7c09 call 7ffd3582d3f0 245->248 246->247 246->248 251 7ffd357f75cb-7ffd357f7665 call 7ffd35824070 memset 247->251 252 7ffd357f7414-7ffd357f7559 247->252 261 7ffd357f7c0b-7ffd357f7c19 call 7ffd3582c290 248->261 265 7ffd357f766b-7ffd357f767d 251->265 266 7ffd357f781a-7ffd357f782e OutputDebugStringW 251->266 255 7ffd357f755d-7ffd357f7575 252->255 258 7ffd357f7577-7ffd357f7592 255->258 259 7ffd357f75b0-7ffd357f75bc 255->259 262 7ffd357f7598-7ffd357f75a3 258->262 263 7ffd357f7690-7ffd357f7763 call 7ffd35824070 memset 258->263 259->251 264 7ffd357f75be-7ffd357f75c9 259->264 279 7ffd357f7b58-7ffd357f7b75 261->279 262->258 268 7ffd357f75a5 262->268 281 7ffd357f7769-7ffd357f777b 263->281 282 7ffd357f7afa-7ffd357f7b0e OutputDebugStringW 263->282 264->255 271 7ffd357f7683-7ffd357f768b 265->271 272 7ffd357f778e-7ffd357f77be 265->272 269 7ffd357f7841-7ffd357f7862 266->269 270 7ffd357f7830-7ffd357f783c call 7ffd35809d30 266->270 268->259 277 7ffd357f7872-7ffd357f7876 269->277 270->269 278 7ffd357f77ec-7ffd357f77fd 271->278 275 7ffd357f77c0-7ffd357f77ea 272->275 275->275 275->278 284 7ffd357f787c-7ffd357f787f 277->284 285 7ffd357f7a5d-7ffd357f7a70 277->285 283 7ffd357f7800-7ffd357f7807 278->283 288 7ffd357f7a7b-7ffd357f7a9e 281->288 289 7ffd357f7781-7ffd357f7789 281->289 291 7ffd357f7b21-7ffd357f7b33 282->291 292 7ffd357f7b10-7ffd357f7b1c call 7ffd35809d30 282->292 283->266 290 7ffd357f7809-7ffd357f7818 283->290 293 7ffd357f7881-7ffd357f7886 284->293 294 7ffd357f7890-7ffd357f78aa 284->294 286 7ffd357f7b35-7ffd357f7b45 285->286 287 7ffd357f7a76 285->287 296 7ffd357f7b4b-7ffd357f7b52 286->296 300 7ffd357f7c1e-7ffd357f7c2b call 7ffd3582c1a0 286->300 287->296 297 7ffd357f7aa0-7ffd357f7aca 288->297 298 7ffd357f7acc-7ffd357f7add 289->298 290->266 290->283 291->286 291->296 292->291 301 7ffd357f78b9-7ffd357f7989 call 7ffd35824070 memset 293->301 294->294 295 7ffd357f78ac-7ffd357f78b7 294->295 295->301 296->261 296->279 297->297 297->298 303 7ffd357f7ae0-7ffd357f7ae7 298->303 300->296 308 7ffd357f7c31-7ffd357f7c36 300->308 309 7ffd357f7a2a-7ffd357f7a41 OutputDebugStringW 301->309 310 7ffd357f798f-7ffd357f79a1 301->310 303->282 307 7ffd357f7ae9-7ffd357f7af8 303->307 307->282 307->303 308->296 313 7ffd357f7a47-7ffd357f7a58 call 7ffd35809d30 309->313 314 7ffd357f7870 309->314 311 7ffd357f79a3-7ffd357f79ab 310->311 312 7ffd357f79b0-7ffd357f79cf 310->312 315 7ffd357f79fc-7ffd357f7a0d 311->315 316 7ffd357f79d0-7ffd357f79fa 312->316 313->314 314->277 318 7ffd357f7a10-7ffd357f7a17 315->318 316->315 316->316 318->309 320 7ffd357f7a19-7ffd357f7a28 318->320 320->309 320->318
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.3197738493.00007FFD357F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFD357F0000, based on PE: true
                                                        • Associated: 00000002.00000002.3196831522.00007FFD357F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3199502615.00007FFD3582E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3200873382.00007FFD35843000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3201862509.00007FFD35844000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_7ffd357f0000_cmd.jbxd
                                                        Similarity
                                                        • API ID: DebugOutputStringmemset
                                                        • String ID: arenegyl$called `Result::unwrap()` on an `Err` value$modnarod$setybdet$uespemos
                                                        • API String ID: 1084755268-2410307170
                                                        • Opcode ID: 7760c54a6c5f10477ab89a5ce51ae536a971f476f7558458677c57535550c02d
                                                        • Instruction ID: a2399dff565ad3f0ea593f13ac456669a09e35c1e96814546c98c17f360e9995
                                                        • Opcode Fuzzy Hash: 7760c54a6c5f10477ab89a5ce51ae536a971f476f7558458677c57535550c02d
                                                        • Instruction Fuzzy Hash: 4522E3A6B14B9645EB20CF64E8647E93361FB05B98F808236DF1D5BB95EF38E241D340
                                                        Function 00007FFD357F4D40 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 295stringCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 321 7ffd357f4d40-7ffd357f4d5d 322 7ffd357f4d63-7ffd357f4d78 321->322 323 7ffd357f4e01-7ffd357f4e4a memset 321->323 324 7ffd357f4e4f 322->324 325 7ffd357f4d7e-7ffd357f4d89 322->325 326 7ffd357f51fc-7ffd357f5204 OutputDebugStringW 323->326 327 7ffd357f4e54-7ffd357f4f0f call 7ffd35824070 memset 324->327 325->327 328 7ffd357f4d8f-7ffd357f4dfc memset 325->328 329 7ffd357f520a-7ffd357f5223 326->329 332 7ffd357f4fca-7ffd357f4fea OutputDebugStringW 327->332 333 7ffd357f4f15-7ffd357f4f27 327->333 328->326 336 7ffd357f4fec-7ffd357f4ff5 call 7ffd35809d30 332->336 337 7ffd357f4ffa-7ffd357f5001 332->337 334 7ffd357f4f29-7ffd357f4f31 333->334 335 7ffd357f4f33-7ffd357f4f56 333->335 341 7ffd357f4f92-7ffd357f4fae 334->341 342 7ffd357f4f60-7ffd357f4f90 335->342 336->337 339 7ffd357f5007-7ffd357f5028 337->339 340 7ffd357f5198-7ffd357f51f3 memset 337->340 343 7ffd357f503c-7ffd357f5092 strlen call 7ffd35825580 339->343 340->326 344 7ffd357f4fb0-7ffd357f4fb7 341->344 342->341 342->342 348 7ffd357f5094-7ffd357f50a3 memcmp 343->348 349 7ffd357f5030-7ffd357f5036 343->349 344->332 346 7ffd357f4fb9-7ffd357f4fc8 344->346 346->332 346->344 348->349 350 7ffd357f50a5-7ffd357f516d call 7ffd35824070 memset 348->350 349->340 349->343 353 7ffd357f52ba-7ffd357f52da OutputDebugStringW 350->353 354 7ffd357f5173-7ffd357f5185 350->354 355 7ffd357f52dc-7ffd357f52e5 call 7ffd35809d30 353->355 356 7ffd357f52ea-7ffd357f52f6 353->356 357 7ffd357f518b-7ffd357f5193 354->357 358 7ffd357f5224-7ffd357f5247 354->358 355->356 356->329 361 7ffd357f5282-7ffd357f529e 357->361 359 7ffd357f5250-7ffd357f5280 358->359 359->359 359->361 362 7ffd357f52a0-7ffd357f52a7 361->362 362->353 363 7ffd357f52a9-7ffd357f52b8 362->363 363->353 363->362
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.3197738493.00007FFD357F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFD357F0000, based on PE: true
                                                        • Associated: 00000002.00000002.3196831522.00007FFD357F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3199502615.00007FFD3582E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3200873382.00007FFD35843000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3201862509.00007FFD35844000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_7ffd357f0000_cmd.jbxd
                                                        Similarity
                                                        • API ID: DebugOutputStringmemset$memcmpstrlen
                                                        • String ID: c
                                                        • API String ID: 2294051181-112844655
                                                        • Opcode ID: a99a8362994182443d460f0a35a543525b0d7538c43e9128a993a57949b76bad
                                                        • Instruction ID: b645ba2815d3db8675817b4ed4e0f1c5409d4d02c33a35330fe19caa495eb297
                                                        • Opcode Fuzzy Hash: a99a8362994182443d460f0a35a543525b0d7538c43e9128a993a57949b76bad
                                                        • Instruction Fuzzy Hash: 60E19E62B1CB8A95EB218B24E4617BAB7A1FF85B84F404235DB8D03B55EF3CE185D740
                                                        Function 00007FFD357F21F0 Relevance: 17.9, APIs: 5, Strings: 5, Instructions: 440COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 364 7ffd357f21f0-7ffd357f2234 365 7ffd357f223a-7ffd357f2249 364->365 366 7ffd357f2850-7ffd357f289d call 7ffd3582c2a0 364->366 367 7ffd357f28a3-7ffd357f28b2 call 7ffd3582c4b0 365->367 368 7ffd357f224f-7ffd357f2257 365->368 366->367 366->368 373 7ffd357f226a-7ffd357f2276 367->373 374 7ffd357f28b8-7ffd357f28ec call 7ffd3582d3f0 367->374 368->367 370 7ffd357f225d-7ffd357f2264 368->370 370->373 370->374 376 7ffd357f242b-7ffd357f24c5 call 7ffd35824070 memset 373->376 377 7ffd357f227c-7ffd357f23c0 373->377 384 7ffd357f2910-7ffd357f2952 374->384 386 7ffd357f24cb-7ffd357f24dd 376->386 387 7ffd357f26da-7ffd357f26ee OutputDebugStringW 376->387 379 7ffd357f23c4-7ffd357f23dc 377->379 382 7ffd357f2410-7ffd357f241c 379->382 383 7ffd357f23de-7ffd357f23f9 379->383 382->376 392 7ffd357f241e-7ffd357f2429 382->392 390 7ffd357f23ff-7ffd357f240a 383->390 391 7ffd357f24f0-7ffd357f2627 call 7ffd35824070 memset 383->391 388 7ffd357f2963-7ffd357f2968 call 7ffd3582c7c0 384->388 389 7ffd357f2954-7ffd357f2962 384->389 393 7ffd357f24e3-7ffd357f24eb 386->393 394 7ffd357f2652-7ffd357f2675 386->394 398 7ffd357f2701-7ffd357f270e 387->398 399 7ffd357f26f0-7ffd357f26fc call 7ffd35809d30 387->399 388->389 390->383 397 7ffd357f240c 390->397 408 7ffd357f279a-7ffd357f27ae OutputDebugStringW 391->408 409 7ffd357f262d-7ffd357f263f 391->409 392->379 401 7ffd357f26ac-7ffd357f26bd 393->401 404 7ffd357f2680-7ffd357f26aa 394->404 397->382 400 7ffd357f2822-7ffd357f2838 398->400 399->398 406 7ffd357f28ee-7ffd357f28f6 call 7ffd3582c7c0 400->406 407 7ffd357f283e-7ffd357f284f 400->407 410 7ffd357f26c0-7ffd357f26c7 401->410 404->401 404->404 406->407 411 7ffd357f27c1-7ffd357f27cf 408->411 412 7ffd357f27b0-7ffd357f27bc call 7ffd35809d30 408->412 413 7ffd357f2645-7ffd357f264d 409->413 414 7ffd357f2713-7ffd357f273f 409->414 410->387 415 7ffd357f26c9-7ffd357f26d8 410->415 420 7ffd357f28fb 411->420 421 7ffd357f27d5-7ffd357f27d9 411->421 412->411 419 7ffd357f276c-7ffd357f277d 413->419 417 7ffd357f2740-7ffd357f276a 414->417 415->387 415->410 417->417 417->419 423 7ffd357f2780-7ffd357f2787 419->423 426 7ffd357f28fe-7ffd357f290b call 7ffd3582cfa3 420->426 424 7ffd357f27db-7ffd357f27f8 call 7ffd35809d20 421->424 425 7ffd357f2803 421->425 423->408 428 7ffd357f2789-7ffd357f2798 423->428 424->426 432 7ffd357f27fe-7ffd357f2801 424->432 430 7ffd357f2809-7ffd357f281e memcpy 425->430 426->384 428->408 428->423 430->400 432->430
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.3197738493.00007FFD357F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFD357F0000, based on PE: true
                                                        • Associated: 00000002.00000002.3196831522.00007FFD357F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3199502615.00007FFD3582E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3200873382.00007FFD35843000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3201862509.00007FFD35844000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_7ffd357f0000_cmd.jbxd
                                                        Similarity
                                                        • API ID: DebugOutputStringmemset$memcpy
                                                        • String ID: arenegyl$called `Result::unwrap()` on an `Err` value$modnarod$setybdet$uespemos
                                                        • API String ID: 293864031-2410307170
                                                        • Opcode ID: 2b8b1b3890193a5683e3120ba43e33a864b8d9a1fba94803cb782c47358c8554
                                                        • Instruction ID: 46bb183dc73e6da0b26022d027f4489a1a3d5e977febbf2a8709d650b17b7911
                                                        • Opcode Fuzzy Hash: 2b8b1b3890193a5683e3120ba43e33a864b8d9a1fba94803cb782c47358c8554
                                                        • Instruction Fuzzy Hash: F002D3B6B15B8689EB20CF60E8647E93760FB05B98F808236DF5D5BB95DF389241D340
                                                        Function 00007FFD357F1350 Relevance: 14.6, APIs: 2, Strings: 6, Instructions: 576COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 433 7ffd357f1350-7ffd357f13b1 434 7ffd357f13b7-7ffd357f13c9 433->434 435 7ffd357f1f98-7ffd357f1fd6 call 7ffd3582c2a0 433->435 437 7ffd357f1f84-7ffd357f1f8c call 7ffd3582c690 434->437 438 7ffd357f13cf-7ffd357f13df 434->438 439 7ffd357f1fdb-7ffd357f1fe8 call 7ffd3582c1a0 435->439 452 7ffd357f1f91-7ffd357f1f96 call 7ffd3582c7c0 437->452 438->439 440 7ffd357f13e5-7ffd357f13ed 438->440 443 7ffd357f13f3-7ffd357f1419 call 7ffd35809d20 439->443 444 7ffd357f1fee-7ffd357f201d call 7ffd3582d3f0 439->444 440->443 440->444 454 7ffd357f2083-7ffd357f208d call 7ffd3582cfc0 443->454 455 7ffd357f141f-7ffd357f1c16 443->455 456 7ffd357f2092-7ffd357f20e3 call 7ffd35805d30 444->456 461 7ffd357f1f69-7ffd357f1f83 452->461 454->456 459 7ffd357f1c2b-7ffd357f1c32 455->459 462 7ffd357f1f19-7ffd357f1f3a call 7ffd35809d30 459->462 463 7ffd357f1c38-7ffd357f1c86 call 7ffd35802e40 459->463 469 7ffd357f1f3c-7ffd357f1f4c 462->469 470 7ffd357f1f52-7ffd357f1f67 462->470 471 7ffd357f203b-7ffd357f2081 call 7ffd3582d3f0 463->471 472 7ffd357f1c8c-7ffd357f1c9a 463->472 469->470 474 7ffd357f201f-7ffd357f202c call 7ffd3582c1a0 469->474 470->452 470->461 471->456 475 7ffd357f1d54-7ffd357f1d86 call 7ffd358099e0 472->475 476 7ffd357f1ca0-7ffd357f1ca7 472->476 474->470 489 7ffd357f2032-7ffd357f2036 474->489 487 7ffd357f1d9c-7ffd357f1e42 call 7ffd35824070 memset 475->487 488 7ffd357f1d88 475->488 479 7ffd357f1d29-7ffd357f1d30 476->479 480 7ffd357f1cad-7ffd357f1cba 476->480 479->475 485 7ffd357f1d32-7ffd357f1d35 479->485 483 7ffd357f1cc0-7ffd357f1d27 480->483 483->479 483->483 486 7ffd357f1d40-7ffd357f1d52 485->486 486->475 486->486 494 7ffd357f1eea-7ffd357f1efd OutputDebugStringW 487->494 495 7ffd357f1e48-7ffd357f1e5a 487->495 488->487 490 7ffd357f1d8a-7ffd357f1d97 call 7ffd35809d30 488->490 489->470 490->487 496 7ffd357f1f03-7ffd357f1f14 call 7ffd35809d30 494->496 497 7ffd357f1c20-7ffd357f1c24 494->497 498 7ffd357f1e5c-7ffd357f1e64 495->498 499 7ffd357f1e70-7ffd357f1e8f 495->499 496->497 497->459 501 7ffd357f1ebc-7ffd357f1ecd 498->501 502 7ffd357f1e90-7ffd357f1eba 499->502 504 7ffd357f1ed0-7ffd357f1ed7 501->504 502->501 502->502 504->494 505 7ffd357f1ed9-7ffd357f1ee8 504->505 505->494 505->504
                                                        APIs
                                                        Strings
                                                        • Thread32NextVirtualFreeWaitForSingleObjectTerminateThreadSuspendThreadResumeThreadIsWow64ProcessModule32FirstWModule32NextWGetCurrentProcessIdProcess32FirstWProcess32NextWZwOpenKeyZwCreateKeyZwSetValueKeyZwCloseCreateRemoteThreadNtQuerySystemInformationEnumPro, xrefs: 00007FFD357F1787
                                                        • FindFirstFileWFindNextFileWNtQueryDirectoryFileRegQueryValueExWNtEnumerateKeyGetAsyncKeyStateSetWindowsHookExWLogonUserWCredEnumerateWCreateProcessWNtQueryInformationProcessVirtualQueryExGetProcessIdNtOpenProcessNtWriteVirtualMemoryNtReadVirtualMemoryLoadLibra, xrefs: 00007FFD357F1962
                                                        • RtlCaptureStackBackTraceLoadLibraryAGetProcAddressLdrGetDllHandleByMappingLdrRegisterDllNotificationVirtualAllocExVirtualFreeExEnumProcessModulesGetModuleFileNameExWNtCreateSectionFailed to encrypt function name, xrefs: 00007FFD357F1B0B
                                                        • NtProtectVirtualMemoryNtAllocateVirtualMemoryNtMapViewOfSectionNtUnmapViewOfSectionNtOpenFileLdrLoadDllEtwEventWriteFullEtwEventWriteEtwEventWriteTransferWDEnableMpWDEnableMpScanStartMpSampleSubmitMpAmsiNotifyMpSampleQueryMpAmsiScanMpThreatActionNtResumeThread, xrefs: 00007FFD357F1434
                                                        • NtGetContextThreadNtSetContextThreadNtCloseNtCreateThreadExNtCreateProcessExNtQueryInformationThreadGetProcessIdOfThreadWriteProcessMemoryReadProcessMemoryOpenProcessVirtualProtectExCloseHandleVirtualAllocVirtualProtectOpenThreadCreateToolhelp32SnapshotThread3, xrefs: 00007FFD357F15CC
                                                        • called `Result::unwrap()` on an `Err` value, xrefs: 00007FFD357F2001
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.3197738493.00007FFD357F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFD357F0000, based on PE: true
                                                        • Associated: 00000002.00000002.3196831522.00007FFD357F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3199502615.00007FFD3582E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3200873382.00007FFD35843000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3201862509.00007FFD35844000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_7ffd357f0000_cmd.jbxd
                                                        Similarity
                                                        • API ID: DebugOutputStringmemset
                                                        • String ID: FindFirstFileWFindNextFileWNtQueryDirectoryFileRegQueryValueExWNtEnumerateKeyGetAsyncKeyStateSetWindowsHookExWLogonUserWCredEnumerateWCreateProcessWNtQueryInformationProcessVirtualQueryExGetProcessIdNtOpenProcessNtWriteVirtualMemoryNtReadVirtualMemoryLoadLibra$NtGetContextThreadNtSetContextThreadNtCloseNtCreateThreadExNtCreateProcessExNtQueryInformationThreadGetProcessIdOfThreadWriteProcessMemoryReadProcessMemoryOpenProcessVirtualProtectExCloseHandleVirtualAllocVirtualProtectOpenThreadCreateToolhelp32SnapshotThread3$NtProtectVirtualMemoryNtAllocateVirtualMemoryNtMapViewOfSectionNtUnmapViewOfSectionNtOpenFileLdrLoadDllEtwEventWriteFullEtwEventWriteEtwEventWriteTransferWDEnableMpWDEnableMpScanStartMpSampleSubmitMpAmsiNotifyMpSampleQueryMpAmsiScanMpThreatActionNtResumeThread$RtlCaptureStackBackTraceLoadLibraryAGetProcAddressLdrGetDllHandleByMappingLdrRegisterDllNotificationVirtualAllocExVirtualFreeExEnumProcessModulesGetModuleFileNameExWNtCreateSectionFailed to encrypt function name$Thread32NextVirtualFreeWaitForSingleObjectTerminateThreadSuspendThreadResumeThreadIsWow64ProcessModule32FirstWModule32NextWGetCurrentProcessIdProcess32FirstWProcess32NextWZwOpenKeyZwCreateKeyZwSetValueKeyZwCloseCreateRemoteThreadNtQuerySystemInformationEnumPro$called `Result::unwrap()` on an `Err` value
                                                        • API String ID: 1084755268-2364454806
                                                        • Opcode ID: 401b34dd8081ac19dfc3cb1908acf6400fc2134abb10f05ac024b51e5c1262f4
                                                        • Instruction ID: 4308a87c95883c042799da094ddf85d777388904dfacc55f0ad4f493e1578154
                                                        • Opcode Fuzzy Hash: 401b34dd8081ac19dfc3cb1908acf6400fc2134abb10f05ac024b51e5c1262f4
                                                        • Instruction Fuzzy Hash: 08721D77605F9A9AE791CB10E8943E937E4FB08744F904239CB8D477A0EF789268D346
                                                        Function 00007FFD358060B0 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 238threadwindowCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        APIs
                                                        Strings
                                                        • Bill Keaners Virus NotificationFailed to remap system modules: , xrefs: 00007FFD35806232
                                                        • YOU HAVE BEEN INFECTED BY BILLC:\Users\Harrison\.rustup\toolchains\nightly-x86_64-pc-windows-msvc\lib/rustlib/src/rust\library\core\src\iter\traits\iterator.rs, xrefs: 00007FFD358061FB
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.3197738493.00007FFD357F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFD357F0000, based on PE: true
                                                        • Associated: 00000002.00000002.3196831522.00007FFD357F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3199502615.00007FFD3582E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3200873382.00007FFD35843000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3201862509.00007FFD35844000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_7ffd357f0000_cmd.jbxd
                                                        Similarity
                                                        • API ID: DebugOutputStringmemset$CallsDisableErrorLastLibraryMessageThread
                                                        • String ID: Bill Keaners Virus NotificationFailed to remap system modules: $YOU HAVE BEEN INFECTED BY BILLC:\Users\Harrison\.rustup\toolchains\nightly-x86_64-pc-windows-msvc\lib/rustlib/src/rust\library\core\src\iter\traits\iterator.rs
                                                        • API String ID: 941661592-2279533013
                                                        • Opcode ID: 733bc35e339cce3e4c071547e0d5796fff2ccca9504961028c5eea382130f005
                                                        • Instruction ID: 71cfd0c29bd8dd54f66fd66e8a83168d94917cfb6e946eb5b40f276e73ab6ff3
                                                        • Opcode Fuzzy Hash: 733bc35e339cce3e4c071547e0d5796fff2ccca9504961028c5eea382130f005
                                                        • Instruction Fuzzy Hash: 25D18125A04ACA99F7224F39D8523F863B0FF54B59F085234EF8C17665EF39A286D340
                                                        Function 00007FFD357F29D0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 218COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.3197738493.00007FFD357F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFD357F0000, based on PE: true
                                                        • Associated: 00000002.00000002.3196831522.00007FFD357F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3199502615.00007FFD3582E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3200873382.00007FFD35843000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3201862509.00007FFD35844000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_7ffd357f0000_cmd.jbxd
                                                        Similarity
                                                        • API ID: DebugOutputStringmemset
                                                        • String ID: Failed to encrypt function name
                                                        • API String ID: 1084755268-2980051713
                                                        • Opcode ID: e8a3bff0397db5e87d4842b3ec7f1800e514b1066d2f0661054545d74f0ec709
                                                        • Instruction ID: d39f5b5ab9e42d87ae351aa1bbe588071c15c227cdd119d6cdf643bcb87c2de5
                                                        • Opcode Fuzzy Hash: e8a3bff0397db5e87d4842b3ec7f1800e514b1066d2f0661054545d74f0ec709
                                                        • Instruction Fuzzy Hash: DBA1AF73A04BD688EB208B64E8557E87760FB15B98F444239CF5C1BB96DF789291D380

                                                        Non-executed Functions

                                                        Function 0000018DB5570470 Relevance: 58.5, APIs: 21, Strings: 12, Instructions: 749COMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 960 18db5570470-18db557058e memset OutputDebugStringW memset OutputDebugStringW 961 18db5570594-18db557063b memset OutputDebugStringW 960->961 962 18db557063c-18db557063f 960->962 963 18db5570833-18db557087e memset OutputDebugStringW 962->963 964 18db5570645-18db5570679 call 18db558a160 962->964 967 18db5570888-18db5570919 call 18db556c680 call 18db5594070 memset 963->967 964->967 968 18db557067f-18db5570687 964->968 983 18db557091f-18db5570931 967->983 984 18db5570a1a-18db5570a35 OutputDebugStringW 967->984 970 18db55706f2-18db5570769 memset OutputDebugStringW 968->970 971 18db5570689-18db55706b0 968->971 976 18db557076c call 18db5584390 970->976 973 18db55706b2 971->973 974 18db55706bb-18db55706d0 971->974 973->974 977 18db55706d2-18db55706d6 call 18db5579d30 974->977 978 18db55706db-18db55706ed call 18db5579d30 974->978 980 18db5570771-18db5570774 976->980 977->978 978->970 985 18db5570940-18db5570992 memset OutputDebugStringW 980->985 986 18db557077a-18db5570808 call 18db5594070 memset 980->986 989 18db5570933-18db557093b 983->989 990 18db5570997-18db55709ba 983->990 987 18db5570a37-18db5570a40 call 18db5579d30 984->987 988 18db5570a45-18db5570a99 call 18db55629d0 984->988 985->988 998 18db557080e-18db5570820 986->998 999 18db5570c2a-18db5570c3e OutputDebugStringW 986->999 987->988 1006 18db5570a9c call 18db5562de0 988->1006 995 18db55709ec-18db55709fd 989->995 996 18db55709c0-18db55709ea 990->996 997 18db5570a00-18db5570a07 995->997 996->995 996->996 997->984 1003 18db5570a09-18db5570a18 997->1003 1004 18db5570ba3-18db5570bcf 998->1004 1005 18db5570826-18db557082e 998->1005 1001 18db5570c51-18db5570c60 999->1001 1002 18db5570c40-18db5570c4c call 18db5579d30 999->1002 1008 18db5570c62-18db5570c89 1001->1008 1009 18db5570ccb-18db5570cd2 1001->1009 1002->1001 1003->984 1003->997 1012 18db5570bd0-18db5570bfa 1004->1012 1010 18db5570bfc-18db5570c0d 1005->1010 1011 18db5570aa1-18db5570aaf 1006->1011 1013 18db5570c94-18db5570ca9 1008->1013 1014 18db5570c8b 1008->1014 1021 18db5570cdc-18db5570d22 call 18db55629d0 1009->1021 1017 18db5570c10-18db5570c17 1010->1017 1015 18db5570ac2-18db5570b04 call 18db55629d0 1011->1015 1016 18db5570ab1-18db5570ab8 1011->1016 1012->1010 1012->1012 1018 18db5570cb4-18db5570cc6 call 18db5579d30 1013->1018 1019 18db5570cab-18db5570caf call 18db5579d30 1013->1019 1014->1013 1027 18db5570b07 call 18db5562de0 1015->1027 1016->1015 1017->999 1022 18db5570c19-18db5570c28 1017->1022 1018->1009 1019->1018 1030 18db5570d25 call 18db5562de0 1021->1030 1022->999 1022->1017 1029 18db5570b0c-18db5570b22 1027->1029 1031 18db5570b24 1029->1031 1032 18db5570b30-18db5570b76 call 18db55629d0 1029->1032 1033 18db5570d2a-18db5570d38 1030->1033 1031->1032 1039 18db5570b79 call 18db5562de0 1032->1039 1034 18db5570d4b-18db5570e34 memset OutputDebugStringW memset OutputDebugStringW 1033->1034 1035 18db5570d3a-18db5570d41 1033->1035 1040 18db5571213-18db557122b call 18db55749b0 1034->1040 1041 18db5570e3a-18db5570e7a call 18db55749b0 1034->1041 1035->1034 1042 18db5570b7e-18db5570b8c 1039->1042 1049 18db5571235-18db5571267 call 18db55749b0 1040->1049 1041->1049 1050 18db5570e80-18db5570f05 call 18db5594070 call 18db55749b0 1041->1050 1042->1021 1044 18db5570b92-18db5570b99 1042->1044 1044->1004 1060 18db5571271-18db5571278 1049->1060 1058 18db5570f19-18db5570f2a call 18db55749b0 1050->1058 1059 18db5570f07-18db5570f14 call 18db5579d30 1050->1059 1065 18db5570f2d call 18db55716e0 1058->1065 1059->1058 1064 18db5571282-18db5571289 1060->1064 1067 18db5571293-18db5571303 call 18db5594070 call 18db55749b0 1064->1067 1066 18db5570f32-18db5570f35 1065->1066 1066->1060 1068 18db5570f3b-18db5570fb9 call 18db5594070 call 18db55749b0 1066->1068 1077 18db5571317-18db5571328 call 18db55749b0 1067->1077 1078 18db5571305-18db5571312 call 18db5579d30 1067->1078 1079 18db5570fcd-18db5570fe9 call 18db5564d40 1068->1079 1080 18db5570fbb-18db5570fc8 call 18db5579d30 1068->1080 1078->1077 1079->1064 1087 18db5570fef-18db5571070 call 18db5594070 call 18db55749b0 1079->1087 1080->1079 1092 18db5571084-18db55710e6 call 18db55749b0 call 18db5579dc0 1087->1092 1093 18db5571072-18db557107f call 18db5579d30 1087->1093 1092->1067 1100 18db55710ec-18db55711ee GetLastError call 18db5594070 call 18db55749b0 1092->1100 1093->1092 1105 18db5571202-18db5571209 1100->1105 1106 18db55711f0-18db55711fd call 18db5579d30 1100->1106 1105->1040 1106->1105
                                                        APIs
                                                        Strings
                                                        • Locating kernel32.dll in the target process...kernel32.dllFailed to locate kernel32.dll in the target process.Found kernel32.dll base at: , xrefs: 0000018DB5570F19
                                                        • Failed to allocate memory for DLL path in target process.Failed to allocate memory for DLL path.Writing DLL path to allocated memory...Failed to write DLL path to target process memory.Failed to write DLL path.DLL path written to target process memory successf, xrefs: 0000018DB5571213
                                                        • LoadLibraryAFailed to locate LoadLibraryA in the target process.Resolved LoadLibraryA address in target process: , xrefs: 0000018DB5570FD4
                                                        • Writing DLL path to allocated memory...Failed to write DLL path to target process memory.Failed to write DLL path.DLL path written to target process memory successfully at: 0x, xrefs: 0000018DB5570E3D
                                                        • VirtualAllocExGetCurrentProcessIdOpenProcessReadProcessMemoryCloseHandleWriteProcessMemoryCreateToolhelp32SnapshotModule32FirstWModule32NextWThread32FirstThread32NextOpenThreadSuspendThreadResumeThreadGetProcessIdOfThreadNtCloseNtQueryInformationProcess, xrefs: 0000018DB5570A64
                                                        • kernel32.dllNtCreateSectionNtMapViewOfSectionNtOpenFileZwOpenKeyZwCreateKeyZwSetValueKeyZwCloseVirtualAllocExGetCurrentProcessIdOpenProcessReadProcessMemoryCloseHandleWriteProcessMemoryCreateToolhelp32SnapshotModule32FirstWModule32NextWThread32FirstThread32Nex, xrefs: 0000018DB5570A8A, 0000018DB5570AF5, 0000018DB5570B67, 0000018DB5570D13
                                                        • All resources cleaned up successfully. Exiting function.Failed to create remote thread. NTSTATUS: , LastError: , xrefs: 0000018DB5571317
                                                        • Failed to create remote thread.Invalid process handle.Located module '' at base address: , xrefs: 0000018DB5571202
                                                        • CreateRemoteThreadkernel32.dllNtCreateSectionNtMapViewOfSectionNtOpenFileZwOpenKeyZwCreateKeyZwSetValueKeyZwCloseVirtualAllocExGetCurrentProcessIdOpenProcessReadProcessMemoryCloseHandleWriteProcessMemoryCreateToolhelp32SnapshotModule32FirstWModule32NextWThread, xrefs: 0000018DB5570B41
                                                        • Failed to write DLL data to the file system.Failed to resolve VirtualAllocEx dynamicallyFailed to resolve WriteProcessMemory dynamicallyFailed to resolve CreateRemoteThread dynamicallyFailed to resolve CloseHandle dynamicallyC:\Windows\Temp\tempdll.dll, xrefs: 0000018DB5570CCB
                                                        • C:\Windows\Temp\tempdll.dllReading DLL from disk at path: , xrefs: 0000018DB5570645
                                                        • DLL data is empty.DLL already exists at , xrefs: 0000018DB5570877
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.3189089015.0000018DB5561000.00000020.00000001.01000000.00000005.sdmp, Offset: 0000018DB5560000, based on PE: true
                                                        • Associated: 00000002.00000002.3188107092.0000018DB5560000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3190828771.0000018DB559E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3191904476.0000018DB55B3000.00000008.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3193008099.0000018DB55B4000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_18db5560000_cmd.jbxd
                                                        Similarity
                                                        • API ID: memset$DebugOutputString
                                                        • String ID: All resources cleaned up successfully. Exiting function.Failed to create remote thread. NTSTATUS: , LastError: $C:\Windows\Temp\tempdll.dllReading DLL from disk at path: $CreateRemoteThreadkernel32.dllNtCreateSectionNtMapViewOfSectionNtOpenFileZwOpenKeyZwCreateKeyZwSetValueKeyZwCloseVirtualAllocExGetCurrentProcessIdOpenProcessReadProcessMemoryCloseHandleWriteProcessMemoryCreateToolhelp32SnapshotModule32FirstWModule32NextWThread$DLL data is empty.DLL already exists at $Failed to allocate memory for DLL path in target process.Failed to allocate memory for DLL path.Writing DLL path to allocated memory...Failed to write DLL path to target process memory.Failed to write DLL path.DLL path written to target process memory successf$Failed to create remote thread.Invalid process handle.Located module '' at base address: $Failed to write DLL data to the file system.Failed to resolve VirtualAllocEx dynamicallyFailed to resolve WriteProcessMemory dynamicallyFailed to resolve CreateRemoteThread dynamicallyFailed to resolve CloseHandle dynamicallyC:\Windows\Temp\tempdll.dll$LoadLibraryAFailed to locate LoadLibraryA in the target process.Resolved LoadLibraryA address in target process: $Locating kernel32.dll in the target process...kernel32.dllFailed to locate kernel32.dll in the target process.Found kernel32.dll base at: $VirtualAllocExGetCurrentProcessIdOpenProcessReadProcessMemoryCloseHandleWriteProcessMemoryCreateToolhelp32SnapshotModule32FirstWModule32NextWThread32FirstThread32NextOpenThreadSuspendThreadResumeThreadGetProcessIdOfThreadNtCloseNtQueryInformationProcess$Writing DLL path to allocated memory...Failed to write DLL path to target process memory.Failed to write DLL path.DLL path written to target process memory successfully at: 0x$kernel32.dllNtCreateSectionNtMapViewOfSectionNtOpenFileZwOpenKeyZwCreateKeyZwSetValueKeyZwCloseVirtualAllocExGetCurrentProcessIdOpenProcessReadProcessMemoryCloseHandleWriteProcessMemoryCreateToolhelp32SnapshotModule32FirstWModule32NextWThread32FirstThread32Nex
                                                        • API String ID: 1905100485-484227781
                                                        • Opcode ID: 8dc5711205e4c546c9b3452254c9f632374efe67bddf50cf9e95db6d51225af3
                                                        • Instruction ID: 1c11847de5c2dd3e1b37dd2e7ebae5df33b5e56f0f7141485de21d92ba094817
                                                        • Opcode Fuzzy Hash: 8dc5711205e4c546c9b3452254c9f632374efe67bddf50cf9e95db6d51225af3
                                                        • Instruction Fuzzy Hash: FE823B31214FC588EB228F25F8453E963F0FB96789F858225EE4817BA9EF398345C754
                                                        Function 0000018DB55716E0 Relevance: 35.5, APIs: 19, Strings: 1, Instructions: 503processCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        • Executed
                                                        • Not Executed
                                                        control_flow_graph 1860 18db55716e0-18db55717c1 memset OutputDebugStringW GetProcessId 1861 18db557188d-18db55718e6 memset 1860->1861 1862 18db55717c7-18db55717de CreateToolhelp32Snapshot 1860->1862 1865 18db55718ea OutputDebugStringW 1861->1865 1863 18db55717e4-18db55717fb call 18db5579f20 1862->1863 1864 18db55718f5-18db55718fc 1862->1864 1868 18db5571906-18db5571927 call 18db5579e00 Module32FirstW 1863->1868 1873 18db5571801-18db557187b memset OutputDebugStringW 1863->1873 1864->1868 1867 18db55718f0 1865->1867 1870 18db5571fce-18db5572015 1867->1870 1874 18db557192d-18db5571978 1868->1874 1875 18db5571e26-18db5571e3a call 18db5579f20 1868->1875 1873->1867 1876 18db557187d-18db5571884 call 18db557af50 1873->1876 1877 18db5571980-18db5571999 call 18db5579e30 1874->1877 1875->1874 1884 18db5571e40-18db5571e43 1875->1884 1881 18db5571889-18db557188b 1876->1881 1885 18db55719f0-18db5571ab8 call 18db5594070 memset 1877->1885 1886 18db557199b-18db55719e7 memset OutputDebugStringW 1877->1886 1881->1867 1887 18db5571e51-18db5571ede memset 1884->1887 1888 18db5571e45-18db5571e4c call 18db557af50 1884->1888 1894 18db5571abe-18db5571ad0 1885->1894 1895 18db5571b6a-18db5571b8b OutputDebugStringW 1885->1895 1890 18db5571c28-18db5571c36 Module32NextW 1886->1890 1887->1865 1888->1887 1890->1877 1893 18db5571c3c-18db5571c50 call 18db5579f20 1890->1893 1893->1877 1907 18db5571c56-18db5571c59 1893->1907 1899 18db5571ad2-18db5571ada 1894->1899 1900 18db5571adc-18db5571afb 1894->1900 1897 18db5571b8d-18db5571b96 call 18db5579d30 1895->1897 1898 18db5571b9b-18db5571bc0 1895->1898 1897->1898 1903 18db5571bc2-18db5571bcc 1898->1903 1904 18db5571c11-18db5571c1b 1898->1904 1905 18db5571b35-18db5571b46 1899->1905 1906 18db5571b00-18db5571b33 1900->1906 1908 18db5571bd0-18db5571bd3 1903->1908 1904->1890 1909 18db5571c1d-18db5571c23 call 18db5579d30 1904->1909 1910 18db5571b50-18db5571b57 1905->1910 1906->1905 1906->1906 1911 18db5571c5b-18db5571c62 call 18db557af50 1907->1911 1912 18db5571c67-18db5571d0f call 18db5594070 memset 1907->1912 1915 18db5571d3a-18db5571dfb call 18db5594070 memset 1908->1915 1916 18db5571bd9-18db5571c0f 1908->1916 1909->1890 1910->1895 1918 18db5571b59-18db5571b68 1910->1918 1911->1912 1921 18db55720aa-18db55720c4 OutputDebugStringW 1912->1921 1922 18db5571d15-18db5571d27 1912->1922 1927 18db5571e01-18db5571e13 1915->1927 1928 18db5571f7a-18db5571f94 OutputDebugStringW 1915->1928 1916->1904 1916->1908 1918->1895 1918->1910 1921->1881 1924 18db55720ca-18db55720db call 18db5579d30 1921->1924 1925 18db5571d2d-18db5571d35 1922->1925 1926 18db5572016-18db5572039 1922->1926 1924->1881 1931 18db5572072-18db557208e 1925->1931 1929 18db5572040-18db5572070 1926->1929 1934 18db5571ee3-18db5571f0f 1927->1934 1935 18db5571e19-18db5571e21 1927->1935 1932 18db5571fa7-18db5571fb5 1928->1932 1933 18db5571f96-18db5571fa2 call 18db5579d30 1928->1933 1929->1929 1929->1931 1936 18db5572090-18db5572097 1931->1936 1940 18db5571fc9 1932->1940 1941 18db5571fb7-18db5571fc4 call 18db5579d30 1932->1941 1933->1932 1937 18db5571f10-18db5571f40 1934->1937 1942 18db5571f42-18db5571f5e 1935->1942 1936->1921 1943 18db5572099-18db55720a8 1936->1943 1937->1937 1937->1942 1940->1870 1941->1940 1944 18db5571f60-18db5571f67 1942->1944 1943->1921 1943->1936 1944->1928 1946 18db5571f69-18db5571f78 1944->1946 1946->1928 1946->1944
                                                        APIs
                                                        Strings
                                                        • kernel32.dllFailed to locate kernel32.dll in the target process.Found kernel32.dll base at: , xrefs: 0000018DB5571738
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.3189089015.0000018DB5561000.00000020.00000001.01000000.00000005.sdmp, Offset: 0000018DB5560000, based on PE: true
                                                        • Associated: 00000002.00000002.3188107092.0000018DB5560000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3190828771.0000018DB559E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3191904476.0000018DB55B3000.00000008.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3193008099.0000018DB55B4000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_18db5560000_cmd.jbxd
                                                        Similarity
                                                        • API ID: memset$DebugOutputString$Module32$CreateErrorFirstLastNextProcessSnapshotToolhelp32
                                                        • String ID: kernel32.dllFailed to locate kernel32.dll in the target process.Found kernel32.dll base at:
                                                        • API String ID: 3715241126-3640807919
                                                        • Opcode ID: f650f3965e8bdb54a4ef8db158ca35023031fcf05ff0b3bd87ddfd87d1638588
                                                        • Instruction ID: b480fd7e6d16bd422660492ae065a7c5e41d127a5ffa1c0b318e30819b313cd3
                                                        • Opcode Fuzzy Hash: f650f3965e8bdb54a4ef8db158ca35023031fcf05ff0b3bd87ddfd87d1638588
                                                        • Instruction Fuzzy Hash: 8942C831614FC589F7328F24E8417E863B5FB96749F859221EE491BAE5EF398395C300
                                                        Function 0000018DB5564D40 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 295stringCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.3189089015.0000018DB5561000.00000020.00000001.01000000.00000005.sdmp, Offset: 0000018DB5560000, based on PE: true
                                                        • Associated: 00000002.00000002.3188107092.0000018DB5560000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3190828771.0000018DB559E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3191904476.0000018DB55B3000.00000008.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3193008099.0000018DB55B4000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_18db5560000_cmd.jbxd
                                                        Similarity
                                                        • API ID: DebugOutputStringmemset$memcmpstrlen
                                                        • String ID: c
                                                        • API String ID: 2294051181-112844655
                                                        • Opcode ID: 4394bea11df96680a750f5f0d1c5b3c8108adbd8e6e6c9e9f50e24a4e7eacf6c
                                                        • Instruction ID: 1aaedcbbc56b94d21ed6934beaa62595be86d326a72dc045f13ab729afc28196
                                                        • Opcode Fuzzy Hash: 4394bea11df96680a750f5f0d1c5b3c8108adbd8e6e6c9e9f50e24a4e7eacf6c
                                                        • Instruction Fuzzy Hash: 74E18032618BC485EB218F15F4417EAB7F1FB8A785F858225EA8943B95EF3DC285C700
                                                        Function 0000018DB55669E0 Relevance: 18.0, APIs: 6, Strings: 4, Instructions: 479COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.3189089015.0000018DB5561000.00000020.00000001.01000000.00000005.sdmp, Offset: 0000018DB5560000, based on PE: true
                                                        • Associated: 00000002.00000002.3188107092.0000018DB5560000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3190828771.0000018DB559E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3191904476.0000018DB55B3000.00000008.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3193008099.0000018DB55B4000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_18db5560000_cmd.jbxd
                                                        Similarity
                                                        • API ID: DebugOutputStringmemset
                                                        • String ID: arenegyl$modnarod$setybdet$uespemos
                                                        • API String ID: 1084755268-66988881
                                                        • Opcode ID: d03c909489f8b567af717f7a7deb4a8a6dba1245a0d552de165b9294efc43a01
                                                        • Instruction ID: aae29bb868d76820077674bb16694dd41b62fe15ed676bd12c04838c61d3efb6
                                                        • Opcode Fuzzy Hash: d03c909489f8b567af717f7a7deb4a8a6dba1245a0d552de165b9294efc43a01
                                                        • Instruction Fuzzy Hash: A2229F72611FC189FB21CFA0E8547DD23B5E716798F818226EE495BB9AEF398345C340
                                                        Function 0000018DB55621F0 Relevance: 17.9, APIs: 5, Strings: 5, Instructions: 440COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.3189089015.0000018DB5561000.00000020.00000001.01000000.00000005.sdmp, Offset: 0000018DB5560000, based on PE: true
                                                        • Associated: 00000002.00000002.3188107092.0000018DB5560000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3190828771.0000018DB559E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3191904476.0000018DB55B3000.00000008.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3193008099.0000018DB55B4000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_18db5560000_cmd.jbxd
                                                        Similarity
                                                        • API ID: DebugOutputStringmemset$memcpy
                                                        • String ID: arenegyl$called `Result::unwrap()` on an `Err` value$modnarod$setybdet$uespemos
                                                        • API String ID: 293864031-2410307170
                                                        • Opcode ID: e5defab2256fd89ad628390450379904b137d1c08009ad006c96280e43a84705
                                                        • Instruction ID: f6697f5a6bde612ba75baad6b7035843ba5427587661df17a140af426883c56c
                                                        • Opcode Fuzzy Hash: e5defab2256fd89ad628390450379904b137d1c08009ad006c96280e43a84705
                                                        • Instruction Fuzzy Hash: 5602BF72611FC489EB218F60E8547ED23B0F746799F828226EE595BBD9EF388341C340
                                                        Function 0000018DB559A5EC Relevance: 13.6, APIs: 9, Instructions: 71COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.3189089015.0000018DB5561000.00000020.00000001.01000000.00000005.sdmp, Offset: 0000018DB5560000, based on PE: true
                                                        • Associated: 00000002.00000002.3188107092.0000018DB5560000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3190828771.0000018DB559E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3191904476.0000018DB55B3000.00000008.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3193008099.0000018DB55B4000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_18db5560000_cmd.jbxd
                                                        Similarity
                                                        • API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                        • String ID:
                                                        • API String ID: 313767242-0
                                                        • Opcode ID: d03019518c56e25ee5a8d1d249ed9694f867fde2062d97edec67c5f27bdadc10
                                                        • Instruction ID: 4d88dcd0aafbf7c03baa13e9bfcd30394c824e09d99923e13d526d0a1d7fdfaa
                                                        • Opcode Fuzzy Hash: d03019518c56e25ee5a8d1d249ed9694f867fde2062d97edec67c5f27bdadc10
                                                        • Instruction Fuzzy Hash: 95310A76205F809AEB609F60E8407DD73B5F78A745F85842AEA4E47B99EF3CC648C710
                                                        Function 00007FFD3582A5EC Relevance: 13.6, APIs: 9, Instructions: 71COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.3197738493.00007FFD357F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFD357F0000, based on PE: true
                                                        • Associated: 00000002.00000002.3196831522.00007FFD357F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3199502615.00007FFD3582E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3200873382.00007FFD35843000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3201862509.00007FFD35844000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_7ffd357f0000_cmd.jbxd
                                                        Similarity
                                                        • API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                        • String ID:
                                                        • API String ID: 313767242-0
                                                        • Opcode ID: d03019518c56e25ee5a8d1d249ed9694f867fde2062d97edec67c5f27bdadc10
                                                        • Instruction ID: 786eff2cf4a8c0fe81f581911d88d0dd61b5d3af8ac314e4d7fa30d2f2c98004
                                                        • Opcode Fuzzy Hash: d03019518c56e25ee5a8d1d249ed9694f867fde2062d97edec67c5f27bdadc10
                                                        • Instruction Fuzzy Hash: 61313972708B868AEB609F61E8503F97765FB88B84F44443ADB4E47B98EF78D548C704
                                                        Function 0000018DB558A8C0 Relevance: 12.6, APIs: 6, Strings: 1, Instructions: 301filenativesynchronizationCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.3189089015.0000018DB5561000.00000020.00000001.01000000.00000005.sdmp, Offset: 0000018DB5560000, based on PE: true
                                                        • Associated: 00000002.00000002.3188107092.0000018DB5560000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3190828771.0000018DB559E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3191904476.0000018DB55B3000.00000008.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3193008099.0000018DB55B4000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_18db5560000_cmd.jbxd
                                                        Similarity
                                                        • API ID: Error$FileFormatHandleLastMessageModuleObjectSingleStatusWaitWrite
                                                        • String ID: NTDLL.DLL
                                                        • API String ID: 415079386-1613819793
                                                        • Opcode ID: ffed6a8691bb262886920d7399c36b8e8ca446f5b19f8d79c4a7150492a7172d
                                                        • Instruction ID: 1ed24e02374c02519b57fbc2107128ff59b41ee993391f474a6db37621b9bfa2
                                                        • Opcode Fuzzy Hash: ffed6a8691bb262886920d7399c36b8e8ca446f5b19f8d79c4a7150492a7172d
                                                        • Instruction Fuzzy Hash: 1ED16B32205FC099E7358F20E8447E927F1F7463AAFDA8275EA9946BD4DF7887858300
                                                        Function 00007FFD3581A8C0 Relevance: 12.6, APIs: 6, Strings: 1, Instructions: 301filenativesynchronizationCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.3197738493.00007FFD357F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFD357F0000, based on PE: true
                                                        • Associated: 00000002.00000002.3196831522.00007FFD357F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3199502615.00007FFD3582E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3200873382.00007FFD35843000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3201862509.00007FFD35844000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_7ffd357f0000_cmd.jbxd
                                                        Similarity
                                                        • API ID: Error$FileFormatHandleLastMessageModuleObjectSingleStatusWaitWrite
                                                        • String ID: NTDLL.DLL
                                                        • API String ID: 415079386-1613819793
                                                        • Opcode ID: c7a4a45d7877fa9a80f705a4c200f6a235b92a03bacb9ee86b05aefda7667e13
                                                        • Instruction ID: 5d61109a4aeb17a1dec3ffe5c78b9ff2cc904afc39898a88665e433899de84ab
                                                        • Opcode Fuzzy Hash: c7a4a45d7877fa9a80f705a4c200f6a235b92a03bacb9ee86b05aefda7667e13
                                                        • Instruction Fuzzy Hash: 70D17A36B09BC789E7318F20E8607F826A5BB44B98F544136DF9E06B94DF789785E340
                                                        Function 0000018DB558A380 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 139COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        • C:\Windows\Temp\tempdll.dllReading DLL from disk at path: , xrefs: 0000018DB558A389
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.3189089015.0000018DB5561000.00000020.00000001.01000000.00000005.sdmp, Offset: 0000018DB5560000, based on PE: true
                                                        • Associated: 00000002.00000002.3188107092.0000018DB5560000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3190828771.0000018DB559E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3191904476.0000018DB55B3000.00000008.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3193008099.0000018DB55B4000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_18db5560000_cmd.jbxd
                                                        Similarity
                                                        • API ID: CloseFind$FileFirstHandlememset
                                                        • String ID: C:\Windows\Temp\tempdll.dllReading DLL from disk at path:
                                                        • API String ID: 4181070385-2284096931
                                                        • Opcode ID: 34bccfb1b2eb7c794fcbf1a84e3fb99ad4fdc8fc518fb8e40e75125d0aa03e49
                                                        • Instruction ID: 75faa4534a4c1fb4b45b50a2e2a15f842c3782fcfd2913f66c7b373847c2c023
                                                        • Opcode Fuzzy Hash: 34bccfb1b2eb7c794fcbf1a84e3fb99ad4fdc8fc518fb8e40e75125d0aa03e49
                                                        • Instruction Fuzzy Hash: 9A518332600B4086EB748F61F8487DE77F0F7467A9F908225DEA90BBD5DF3992858700
                                                        Function 0000018DB559AB50 Relevance: 7.8, APIs: 1, Strings: 4, Instructions: 296COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.3189089015.0000018DB5561000.00000020.00000001.01000000.00000005.sdmp, Offset: 0000018DB5560000, based on PE: true
                                                        • Associated: 00000002.00000002.3188107092.0000018DB5560000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3190828771.0000018DB559E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3191904476.0000018DB55B3000.00000008.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3193008099.0000018DB55B4000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_18db5560000_cmd.jbxd
                                                        Similarity
                                                        • API ID: memset
                                                        • String ID: arenegyl$modnarod$setybdet$uespemos
                                                        • API String ID: 2221118986-66988881
                                                        • Opcode ID: c273a004d073242d9d75f774e59af2c0a54f541896cd6076bf3a64caba8b06a2
                                                        • Instruction ID: 33615b0be2b154ffbee49e35f3affd7bba8e04bd3a0e22dee6966d86ea7ae57d
                                                        • Opcode Fuzzy Hash: c273a004d073242d9d75f774e59af2c0a54f541896cd6076bf3a64caba8b06a2
                                                        • Instruction Fuzzy Hash: 22A14872B15B9486EE509F19B8013DA67B1A746BE4F899731EEAD1B7C0EE3CC241D340
                                                        Function 0000018DB559AFB0 Relevance: 7.8, APIs: 1, Strings: 4, Instructions: 294COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.3189089015.0000018DB5561000.00000020.00000001.01000000.00000005.sdmp, Offset: 0000018DB5560000, based on PE: true
                                                        • Associated: 00000002.00000002.3188107092.0000018DB5560000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3190828771.0000018DB559E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3191904476.0000018DB55B3000.00000008.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3193008099.0000018DB55B4000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_18db5560000_cmd.jbxd
                                                        Similarity
                                                        • API ID: memset
                                                        • String ID: arenegyl$modnarod$setybdet$uespemos
                                                        • API String ID: 2221118986-66988881
                                                        • Opcode ID: 89cb1448f8fe010d3a20d73c54152bbbb83aa94d3f5f60c44ebccdfc65d9ac20
                                                        • Instruction ID: bb3c89b596f4c83869068c79474a10609b63251577bc6da8a825c0a7f81c4528
                                                        • Opcode Fuzzy Hash: 89cb1448f8fe010d3a20d73c54152bbbb83aa94d3f5f60c44ebccdfc65d9ac20
                                                        • Instruction Fuzzy Hash: 2BA1F372B15B9486FE509F5AB8013DA67B1B746BA4F999331EEAC177C0DE3CD2419300
                                                        Function 00007FFD3582AFB0 Relevance: 7.8, APIs: 1, Strings: 4, Instructions: 294COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.3197738493.00007FFD357F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFD357F0000, based on PE: true
                                                        • Associated: 00000002.00000002.3196831522.00007FFD357F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3199502615.00007FFD3582E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3200873382.00007FFD35843000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3201862509.00007FFD35844000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_7ffd357f0000_cmd.jbxd
                                                        Similarity
                                                        • API ID: memset
                                                        • String ID: arenegyl$modnarod$setybdet$uespemos
                                                        • API String ID: 2221118986-66988881
                                                        • Opcode ID: 3307e8769bf9a53a833e0c47a619130cb0ae68f9f37e19d8241f575669528261
                                                        • Instruction ID: 2e4309f8b938b69073411cce79b5310d5722d0d85e78e9f824fd518a0c605136
                                                        • Opcode Fuzzy Hash: 3307e8769bf9a53a833e0c47a619130cb0ae68f9f37e19d8241f575669528261
                                                        • Instruction Fuzzy Hash: 45A17A62F1979A86EE109F5AB8253AA6A91FB44FE4F485331DFAC177C0DE3CD141E200
                                                        Function 0000018DB55853B0 Relevance: 4.8, APIs: 3, Instructions: 263filenativesynchronizationCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.3189089015.0000018DB5561000.00000020.00000001.01000000.00000005.sdmp, Offset: 0000018DB5560000, based on PE: true
                                                        • Associated: 00000002.00000002.3188107092.0000018DB5560000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3190828771.0000018DB559E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3191904476.0000018DB55B3000.00000008.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3193008099.0000018DB55B4000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_18db5560000_cmd.jbxd
                                                        Similarity
                                                        • API ID: FileObjectReadSingleWait
                                                        • String ID:
                                                        • API String ID: 631497895-0
                                                        • Opcode ID: 67c72246823a0681b8c4a8448917b2e6d9aaaedcd267c38e5ddcbad88e6551d5
                                                        • Instruction ID: f598c6705f903dabcbda8083e12803a51ee5f8ddbc07ee8d2402b33e8062c4a0
                                                        • Opcode Fuzzy Hash: 67c72246823a0681b8c4a8448917b2e6d9aaaedcd267c38e5ddcbad88e6551d5
                                                        • Instruction Fuzzy Hash: 7AA18F32300F8096EB248E25E9043D967F1B7067AAFD68671FE6947BD4EF79C6858300
                                                        Function 0000018DB558A7A0 Relevance: 4.6, APIs: 3, Instructions: 74filenativesynchronizationCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.3189089015.0000018DB5561000.00000020.00000001.01000000.00000005.sdmp, Offset: 0000018DB5560000, based on PE: true
                                                        • Associated: 00000002.00000002.3188107092.0000018DB5560000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3190828771.0000018DB559E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3191904476.0000018DB55B3000.00000008.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3193008099.0000018DB55B4000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_18db5560000_cmd.jbxd
                                                        Similarity
                                                        • API ID: ErrorFileObjectReadSingleStatusWait
                                                        • String ID:
                                                        • API String ID: 3583596364-0
                                                        • Opcode ID: 1da58ea186231a0f7315c95dff934c67a8b525bad67fa97c252c166cc7286c88
                                                        • Instruction ID: 77dc93e5bb488355d73b5c67b9a97a2d78c1c22966f8c2502689b4f7d5e39f4d
                                                        • Opcode Fuzzy Hash: 1da58ea186231a0f7315c95dff934c67a8b525bad67fa97c252c166cc7286c88
                                                        • Instruction Fuzzy Hash: 8E315A32A10F809AE720CF34E8407D937B5E749368F958224FA5A82BD8EF38C695C740
                                                        Function 0000018DB55760B0 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 238threadwindowCOMMON
                                                        Download Yara Rule

                                                        Control-flow Graph

                                                        APIs
                                                        Strings
                                                        • YOU HAVE BEEN INFECTED BY BILLC:\Users\Harrison\.rustup\toolchains\nightly-x86_64-pc-windows-msvc\lib/rustlib/src/rust\library\core\src\iter\traits\iterator.rs, xrefs: 0000018DB55761FB
                                                        • Bill Keaners Virus NotificationFailed to remap system modules: , xrefs: 0000018DB5576232
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.3189089015.0000018DB5561000.00000020.00000001.01000000.00000005.sdmp, Offset: 0000018DB5560000, based on PE: true
                                                        • Associated: 00000002.00000002.3188107092.0000018DB5560000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3190828771.0000018DB559E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3191904476.0000018DB55B3000.00000008.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3193008099.0000018DB55B4000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_18db5560000_cmd.jbxd
                                                        Similarity
                                                        • API ID: DebugOutputStringmemset$CallsDisableErrorLastLibraryMessageThread
                                                        • String ID: Bill Keaners Virus NotificationFailed to remap system modules: $YOU HAVE BEEN INFECTED BY BILLC:\Users\Harrison\.rustup\toolchains\nightly-x86_64-pc-windows-msvc\lib/rustlib/src/rust\library\core\src\iter\traits\iterator.rs
                                                        • API String ID: 941661592-2279533013
                                                        • Opcode ID: 38c4df6ab7028c9941154242f94b5f774958c9b7a3cf28c48766c2f8ac8605b1
                                                        • Instruction ID: 9ecf24f57e41c108082318c0b3cda2651d22843b1b856a0bf3beab69f5abcf2d
                                                        • Opcode Fuzzy Hash: 38c4df6ab7028c9941154242f94b5f774958c9b7a3cf28c48766c2f8ac8605b1
                                                        • Instruction Fuzzy Hash: 7AD13231504FC499F7224F28E8463E8A3F1FF5635AF859225FE88166A5EF369386C340
                                                        Function 0000018DB558BC40 Relevance: 17.9, APIs: 7, Strings: 3, Instructions: 409COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.3189089015.0000018DB5561000.00000020.00000001.01000000.00000005.sdmp, Offset: 0000018DB5560000, based on PE: true
                                                        • Associated: 00000002.00000002.3188107092.0000018DB5560000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3190828771.0000018DB559E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3191904476.0000018DB55B3000.00000008.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3193008099.0000018DB55B4000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_18db5560000_cmd.jbxd
                                                        Similarity
                                                        • API ID: ErrorLast$FullNamePathmemcpy
                                                        • String ID: \\?\$\\?\UNC\$internal error: entered unreachable code/rustc/a4cb3c831823d9baa56c3d90514b75b2660116fa\library\alloc\src\vec\mod.rs
                                                        • API String ID: 674145353-264738257
                                                        • Opcode ID: e2ecec9641d672354c35334f02de41ac815b17a11119a411aa4b1c7baa62af10
                                                        • Instruction ID: 321bb8bbb7a9041ec33153b5ed2642cf87ceb35363b5a90fa143877b3b098b66
                                                        • Opcode Fuzzy Hash: e2ecec9641d672354c35334f02de41ac815b17a11119a411aa4b1c7baa62af10
                                                        • Instruction Fuzzy Hash: A6025972601B8085EB758F65E8443E963F8F306BA9FD68566EB994B6C4DF78C7818300
                                                        Function 0000018DB5583B80 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 243COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        • internal error: entered unreachable code/rustc/a4cb3c831823d9baa56c3d90514b75b2660116fa\library\alloc\src\vec\mod.rs, xrefs: 0000018DB5583F30
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.3189089015.0000018DB5561000.00000020.00000001.01000000.00000005.sdmp, Offset: 0000018DB5560000, based on PE: true
                                                        • Associated: 00000002.00000002.3188107092.0000018DB5560000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3190828771.0000018DB559E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3191904476.0000018DB55B3000.00000008.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3193008099.0000018DB55B4000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_18db5560000_cmd.jbxd
                                                        Similarity
                                                        • API ID: ErrorLast$EnvironmentVariable
                                                        • String ID: internal error: entered unreachable code/rustc/a4cb3c831823d9baa56c3d90514b75b2660116fa\library\alloc\src\vec\mod.rs
                                                        • API String ID: 2691138088-1438511490
                                                        • Opcode ID: a8445cfed583d5251d7f525310e5c38a969190012ee19b687adebf5920b8b1df
                                                        • Instruction ID: 1cb45e7fd052fe36846083ced0f608be4b45f2f0043231326d7c244393920e6f
                                                        • Opcode Fuzzy Hash: a8445cfed583d5251d7f525310e5c38a969190012ee19b687adebf5920b8b1df
                                                        • Instruction Fuzzy Hash: 40A148B2200F8485EB618F26EC443E963B4F746B99F968525EE5C5BBD9DE38C3818350
                                                        Function 00007FFD35813B80 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 243COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        • internal error: entered unreachable code/rustc/a4cb3c831823d9baa56c3d90514b75b2660116fa\library\alloc\src\vec\mod.rs, xrefs: 00007FFD35813F30
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.3197738493.00007FFD357F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFD357F0000, based on PE: true
                                                        • Associated: 00000002.00000002.3196831522.00007FFD357F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3199502615.00007FFD3582E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3200873382.00007FFD35843000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3201862509.00007FFD35844000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_7ffd357f0000_cmd.jbxd
                                                        Similarity
                                                        • API ID: ErrorLast$EnvironmentVariable
                                                        • String ID: internal error: entered unreachable code/rustc/a4cb3c831823d9baa56c3d90514b75b2660116fa\library\alloc\src\vec\mod.rs
                                                        • API String ID: 2691138088-1438511490
                                                        • Opcode ID: 070ad722f130e4ff0ca96f13f1fa1786d97355ba3654709ab6070b5a7c54a9bb
                                                        • Instruction ID: 88baa55f115720a2621489c167fdf6d7355c47b2ba0c756b5bf22b0ed623acce
                                                        • Opcode Fuzzy Hash: 070ad722f130e4ff0ca96f13f1fa1786d97355ba3654709ab6070b5a7c54a9bb
                                                        • Instruction Fuzzy Hash: FFA17AA2B04ACA85EB718F26D8643F92764FB44F98F108535DF5C5BB89DE38D282D340
                                                        Function 0000018DB5589DC0 Relevance: 9.2, APIs: 6, Instructions: 180COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.3189089015.0000018DB5561000.00000020.00000001.01000000.00000005.sdmp, Offset: 0000018DB5560000, based on PE: true
                                                        • Associated: 00000002.00000002.3188107092.0000018DB5560000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3190828771.0000018DB559E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3191904476.0000018DB55B3000.00000008.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3193008099.0000018DB55B4000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_18db5560000_cmd.jbxd
                                                        Similarity
                                                        • API ID: ErrorLast$CloseHandle
                                                        • String ID:
                                                        • API String ID: 3463825546-0
                                                        • Opcode ID: 15f3bc612f8892eafb275b5396dcf15e6c6d1523e8ba766b23b6127d3abdca4f
                                                        • Instruction ID: ebdd61bc39382ac67476bf48b87a580d251eeecb0db9e1e56a76280e709316b4
                                                        • Opcode Fuzzy Hash: 15f3bc612f8892eafb275b5396dcf15e6c6d1523e8ba766b23b6127d3abdca4f
                                                        • Instruction Fuzzy Hash: 0971B1B1604B5085FB668F61A5043E93BF0A746F9AFD6C571FD4907BC8DE29CA85CB00
                                                        Function 0000018DB558ADC0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 202COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.3189089015.0000018DB5561000.00000020.00000001.01000000.00000005.sdmp, Offset: 0000018DB5560000, based on PE: true
                                                        • Associated: 00000002.00000002.3188107092.0000018DB5560000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3190828771.0000018DB559E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3191904476.0000018DB55B3000.00000008.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3193008099.0000018DB55B4000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_18db5560000_cmd.jbxd
                                                        Similarity
                                                        • API ID: Handle$CloseConsoleErrorLastMode
                                                        • String ID: called `Result::unwrap()` on an `Err` value
                                                        • API String ID: 1170577072-2333694755
                                                        • Opcode ID: 7386bfed59b85a5b089caff814a4fd3ce99b5ee6720e2d7d50c860cff9acbf3e
                                                        • Instruction ID: 4bb0b38bfd360a608afa7ab34786f63ebb2c0123613e90c477ccce24f16fdefa
                                                        • Opcode Fuzzy Hash: 7386bfed59b85a5b089caff814a4fd3ce99b5ee6720e2d7d50c860cff9acbf3e
                                                        • Instruction Fuzzy Hash: F39170B6610F9088FB118F61F4403D96BF1A7067AAFC5C626FE9916AC9DF78C285C300
                                                        Function 00007FFD3581ADC0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 202COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.3197738493.00007FFD357F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFD357F0000, based on PE: true
                                                        • Associated: 00000002.00000002.3196831522.00007FFD357F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3199502615.00007FFD3582E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3200873382.00007FFD35843000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3201862509.00007FFD35844000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_7ffd357f0000_cmd.jbxd
                                                        Similarity
                                                        • API ID: Handle$CloseConsoleErrorLastMode
                                                        • String ID: called `Result::unwrap()` on an `Err` value
                                                        • API String ID: 1170577072-2333694755
                                                        • Opcode ID: d3f8241ead872ad73c2426530aed2ed4068c552042143b37c70fce03d71c10d0
                                                        • Instruction ID: 5fb734375daeabb409f5810b07329d7d4924509963451f8ecb8b4ffa5e1ed29d
                                                        • Opcode Fuzzy Hash: d3f8241ead872ad73c2426530aed2ed4068c552042143b37c70fce03d71c10d0
                                                        • Instruction Fuzzy Hash: 8B919262B0879B88FB119B65D4603FD2B60AB05B98F448535EF9D13B99DF3CD285E340
                                                        Function 0000018DB558B0E0 Relevance: 7.6, APIs: 5, Instructions: 147COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.3189089015.0000018DB5561000.00000020.00000001.01000000.00000005.sdmp, Offset: 0000018DB5560000, based on PE: true
                                                        • Associated: 00000002.00000002.3188107092.0000018DB5560000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3190828771.0000018DB559E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3191904476.0000018DB55B3000.00000008.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3193008099.0000018DB55B4000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_18db5560000_cmd.jbxd
                                                        Similarity
                                                        • API ID: ConsoleErrorLastWrite$ByteCharMultiWide
                                                        • String ID:
                                                        • API String ID: 1956605914-0
                                                        • Opcode ID: bc6ea8a625286ab0a8054021b8405d894c01c3fab86ca13ade8d1d82f62da186
                                                        • Instruction ID: 04e1b6de34cd68a6a816c7512341bcefeb3b93100dcbb1af9030f478f8f00f62
                                                        • Opcode Fuzzy Hash: bc6ea8a625286ab0a8054021b8405d894c01c3fab86ca13ade8d1d82f62da186
                                                        • Instruction Fuzzy Hash: CE518E71604F9085FB608FA1F8443EE67B5F7467A6FC68231AA8947AD9DF7887858300
                                                        Function 00007FFD3581B0E0 Relevance: 7.6, APIs: 5, Instructions: 147COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.3197738493.00007FFD357F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFD357F0000, based on PE: true
                                                        • Associated: 00000002.00000002.3196831522.00007FFD357F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3199502615.00007FFD3582E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3200873382.00007FFD35843000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3201862509.00007FFD35844000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_7ffd357f0000_cmd.jbxd
                                                        Similarity
                                                        • API ID: ConsoleErrorLastWrite$ByteCharMultiWide
                                                        • String ID:
                                                        • API String ID: 1956605914-0
                                                        • Opcode ID: bc6ea8a625286ab0a8054021b8405d894c01c3fab86ca13ade8d1d82f62da186
                                                        • Instruction ID: 17d84e87818184015797d12878f4a4e54b5552fc72595b04c7b87c2c45267d9b
                                                        • Opcode Fuzzy Hash: bc6ea8a625286ab0a8054021b8405d894c01c3fab86ca13ade8d1d82f62da186
                                                        • Instruction Fuzzy Hash: 5A51CE21B0869B85F7609B69D8243FD6651FB08FD5F904231EA4D4BBD8DF3CA689E340
                                                        Function 0000018DB559A1CC Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.3189089015.0000018DB5561000.00000020.00000001.01000000.00000005.sdmp, Offset: 0000018DB5560000, based on PE: true
                                                        • Associated: 00000002.00000002.3188107092.0000018DB5560000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3190828771.0000018DB559E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3191904476.0000018DB55B3000.00000008.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3193008099.0000018DB55B4000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_18db5560000_cmd.jbxd
                                                        Similarity
                                                        • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                        • String ID:
                                                        • API String ID: 2933794660-0
                                                        • Opcode ID: 6edbb3fd13094330cdc7f06bdb8bfa20a36bb9b7d606bf60de730f4b72130cfe
                                                        • Instruction ID: 9c09b460a946b9af61e9a3a0ac2e85102c696745e26f5864af11849d2d19b693
                                                        • Opcode Fuzzy Hash: 6edbb3fd13094330cdc7f06bdb8bfa20a36bb9b7d606bf60de730f4b72130cfe
                                                        • Instruction Fuzzy Hash: 34111532710F048AEF008F60E8583A833B4F75AB59F850E35EA6D867A4DF78D2948340
                                                        Function 00007FFD3582A1CC Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.3197738493.00007FFD357F1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFD357F0000, based on PE: true
                                                        • Associated: 00000002.00000002.3196831522.00007FFD357F0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3199502615.00007FFD3582E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3200873382.00007FFD35843000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3201862509.00007FFD35844000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_7ffd357f0000_cmd.jbxd
                                                        Similarity
                                                        • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                        • String ID:
                                                        • API String ID: 2933794660-0
                                                        • Opcode ID: 6edbb3fd13094330cdc7f06bdb8bfa20a36bb9b7d606bf60de730f4b72130cfe
                                                        • Instruction ID: 43eff164414ed2387f2d8ea422aea2594ea6d664f44ae81e842063596a6016c1
                                                        • Opcode Fuzzy Hash: 6edbb3fd13094330cdc7f06bdb8bfa20a36bb9b7d606bf60de730f4b72130cfe
                                                        • Instruction Fuzzy Hash: DD111822B14B068AEB009B61E8643B833A4FB19B98F440E35EF6D467A4DF78D1948340
                                                        Function 0000018DB55629D0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 218COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.3189089015.0000018DB5561000.00000020.00000001.01000000.00000005.sdmp, Offset: 0000018DB5560000, based on PE: true
                                                        • Associated: 00000002.00000002.3188107092.0000018DB5560000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3190828771.0000018DB559E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3191904476.0000018DB55B3000.00000008.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3193008099.0000018DB55B4000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_18db5560000_cmd.jbxd
                                                        Similarity
                                                        • API ID: DebugOutputStringmemset
                                                        • String ID: Failed to encrypt function name
                                                        • API String ID: 1084755268-2980051713
                                                        • Opcode ID: a27cfad827d6ae0a999ba0a18242da53c4d1df53253adeb34094dc71fa201e46
                                                        • Instruction ID: c9127d30048dabb3767a08c8046762ae98bbf5b113c64186268181ef04ca023f
                                                        • Opcode Fuzzy Hash: a27cfad827d6ae0a999ba0a18242da53c4d1df53253adeb34094dc71fa201e46
                                                        • Instruction Fuzzy Hash: 5CA1B072A10BD488EB308F64E8447EC67B0F75A759F858229EE581BBD6DF788391C340
                                                        Function 0000018DB556F100 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 173COMMON
                                                        Download Yara Rule
                                                        APIs
                                                        Strings
                                                        Memory Dump Source
                                                        • Source File: 00000002.00000002.3189089015.0000018DB5561000.00000020.00000001.01000000.00000005.sdmp, Offset: 0000018DB5560000, based on PE: true
                                                        • Associated: 00000002.00000002.3188107092.0000018DB5560000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3190828771.0000018DB559E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3191904476.0000018DB55B3000.00000008.00000001.01000000.00000005.sdmpDownload File
                                                        • Associated: 00000002.00000002.3193008099.0000018DB55B4000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                        Joe Sandbox IDA Plugin
                                                        • Snapshot File: hcaresult_2_2_18db5560000_cmd.jbxd
                                                        Similarity
                                                        • API ID: DebugOutputStringmemset
                                                        • String ID: LL file.
                                                        • API String ID: 1084755268-1255835901
                                                        • Opcode ID: dc372ee067a9702d27070e02f97289e2543f7d12e08caf81bb61d40d7eb219ea
                                                        • Instruction ID: f2cb9d63ac8da09210501ea95ccb9bdb95c7fc9a78bf3434eb09a0b823fd0bd0
                                                        • Opcode Fuzzy Hash: dc372ee067a9702d27070e02f97289e2543f7d12e08caf81bb61d40d7eb219ea
                                                        • Instruction Fuzzy Hash: 2A716C32711BC488EB618F61E8503EC67B0F78AB89F858126EE495BB99DF35C685C300