Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
dropper.exe

Overview

General Information

Sample name:dropper.exe
Analysis ID:1586515
MD5:8841148d7d1186d5e5087b672de0de05
SHA1:6a41bb74c3f451c322c642f80f147ac78bf6d0cb
SHA256:a39f3ede27a0b06104e10e50b42a526b83bb7131b21ca21f799c4629caeb131c
Infos:

Detection

Score:66
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for submitted file
Allocates memory in foreign processes
Changes security center settings (notifications, updates, antivirus, firewall)
Creates a thread in another existing process (thread injection)
Creates an autostart registry key pointing to binary in C:\Windows
Disable Windows Defender real time protection (registry)
Disables Windows Defender (deletes autostart)
Found direct / indirect Syscall (likely to bypass EDR)
Injects code into the Windows Explorer (explorer.exe)
Tries to delay execution (extensive OutputDebugStringW loop)
Writes to foreign memory regions
AV process strings found (often used to terminate AV products)
Checks if the current process is being debugged
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to dynamically determine API calls
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates or modifies windows services
Detected potential crypto function
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Enables debug privileges
Enables driver privileges
Enables security privileges
Found dropped PE file which has not been started or loaded
Found evasive API chain checking for process token information
Found potential string decryption / allocating functions
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries disk information (often used to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Uncommon Svchost Parent Process
Uses Microsoft's Enhanced Cryptographic Provider

Classification

Process Tree

  • System is w10x64native
  • dropper.exe (PID: 8180 cmdline: "C:\Users\user\Desktop\dropper.exe" MD5: 8841148D7D1186D5E5087B672DE0DE05)
    • conhost.exe (PID: 6712 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • cmd.exe (PID: 6692 cmdline: "C:\Windows\System32\cmd.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 1432 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
      • winlogon.exe (PID: 888 cmdline: winlogon.exe MD5: A987B43E6A8E8F894B98A3DF022DB518)
      • lsass.exe (PID: 952 cmdline: C:\Windows\system32\lsass.exe MD5: 15A556DEF233F112D127025AB51AC2D3)
      • svchost.exe (PID: 8 cmdline: C:\Windows\system32\svchost.exe -k DcomLaunch -p MD5: F586835082F632DC8D9404D83BC16316)
      • fontdrvhost.exe (PID: 800 cmdline: "fontdrvhost.exe" MD5: AB7AB4CF816D091EEE234C1D9BC4FD13)
      • fontdrvhost.exe (PID: 780 cmdline: "fontdrvhost.exe" MD5: AB7AB4CF816D091EEE234C1D9BC4FD13)
      • svchost.exe (PID: 1072 cmdline: C:\Windows\system32\svchost.exe -k RPCSS -p MD5: F586835082F632DC8D9404D83BC16316)
      • svchost.exe (PID: 1120 cmdline: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM MD5: F586835082F632DC8D9404D83BC16316)
      • dwm.exe (PID: 1184 cmdline: "dwm.exe" MD5: 5C27608411832C5B39BA04E33D53536C)
      • svchost.exe (PID: 1252 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc MD5: F586835082F632DC8D9404D83BC16316)
      • svchost.exe (PID: 1320 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule MD5: F586835082F632DC8D9404D83BC16316)
      • svchost.exe (PID: 1364 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService MD5: F586835082F632DC8D9404D83BC16316)
      • svchost.exe (PID: 1372 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc MD5: F586835082F632DC8D9404D83BC16316)
      • svchost.exe (PID: 1424 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc MD5: F586835082F632DC8D9404D83BC16316)
      • IntelCpHDCPSvc.exe (PID: 1448 cmdline: C:\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_3ea756ac68d34d21\IntelCpHDCPSvc.exe MD5: B6BAD2BD8596D9101874E9042B8E2D63)
      • svchost.exe (PID: 1488 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem MD5: F586835082F632DC8D9404D83BC16316)
      • svchost.exe (PID: 1516 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager MD5: F586835082F632DC8D9404D83BC16316)
      • svchost.exe (PID: 1584 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog MD5: F586835082F632DC8D9404D83BC16316)
      • svchost.exe (PID: 1672 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS MD5: F586835082F632DC8D9404D83BC16316)
      • IntelCpHeciSvc.exe (PID: 1772 cmdline: C:\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_3ea756ac68d34d21\IntelCpHeciSvc.exe MD5: 3B0DF35583675DE5A08E8D4C1271CEC0)
      • igfxCUIService.exe (PID: 1784 cmdline: C:\Windows\System32\DriverStore\FileRepository\cui_dch.inf_amd64_2e49f48165b8de10\igfxCUIService.exe MD5: 91038D45A86B5465E8B7E5CD63187150)
      • svchost.exe (PID: 1820 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p MD5: F586835082F632DC8D9404D83BC16316)
      • svchost.exe (PID: 1884 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p -s nsi MD5: F586835082F632DC8D9404D83BC16316)
      • svchost.exe (PID: 1952 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp MD5: F586835082F632DC8D9404D83BC16316)
      • svchost.exe (PID: 2040 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes MD5: F586835082F632DC8D9404D83BC16316)
      • svchost.exe (PID: 1860 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder MD5: F586835082F632DC8D9404D83BC16316)
      • svchost.exe (PID: 1512 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache MD5: F586835082F632DC8D9404D83BC16316)
      • svchost.exe (PID: 2108 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc MD5: F586835082F632DC8D9404D83BC16316)
      • svchost.exe (PID: 2240 cmdline: C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm MD5: F586835082F632DC8D9404D83BC16316)
      • svchost.exe (PID: 2344 cmdline: C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc MD5: F586835082F632DC8D9404D83BC16316)
      • svchost.exe (PID: 2404 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc MD5: F586835082F632DC8D9404D83BC16316)
      • svchost.exe (PID: 2464 cmdline: C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache MD5: F586835082F632DC8D9404D83BC16316)
      • svchost.exe (PID: 2552 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p MD5: F586835082F632DC8D9404D83BC16316)
      • svchost.exe (PID: 2636 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p MD5: F586835082F632DC8D9404D83BC16316)
      • svchost.exe (PID: 2640 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p MD5: F586835082F632DC8D9404D83BC16316)
      • svchost.exe (PID: 2672 cmdline: C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository MD5: F586835082F632DC8D9404D83BC16316)
      • svchost.exe (PID: 2712 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection MD5: F586835082F632DC8D9404D83BC16316)
      • spoolsv.exe (PID: 2824 cmdline: C:\Windows\System32\spoolsv.exe MD5: 001E4317FC877B5C0DB731694CCED48D)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

Sigma detected: CurrentVersion Autorun Keys Modification
Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: ....(Z.....#........., EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\dropper.exe, ProcessId: 8180, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HADES
Sigma detected: Uncommon Svchost Parent Process
Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\svchost.exe -k DcomLaunch -p, CommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch -p, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 6692, ParentProcessName: cmd.exe, ProcessCommandLine: C:\Windows\system32\svchost.exe -k DcomLaunch -p, ProcessId: 8, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Multi AV Scanner detection for submitted file
Source: dropper.exeVirustotal: Detection: 8%Perma Link
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF71745B240 BCryptGenRandom,SystemFunction036,BCryptGenRandom,SystemFunction036,0_2_00007FF71745B240
Source: C:\Windows\System32\cmd.exeCode function: 2_2_000002A38BE3E320 BCryptGenRandom,SystemFunction036,BCryptGenRandom,SystemFunction036,2_2_000002A38BE3E320
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFFE33DE320 BCryptGenRandom,SystemFunction036,BCryptGenRandom,SystemFunction036,2_2_00007FFFE33DE320
Source: dropper.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: ,@\??\C:\Users\user\AppData\Local\Temp\TCDE6CF.tmp.pdb source: svchost.exe, 00000011.00000000.2606510787.000001F7F9056000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.4276038238.000001F7F9056000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\winload_prod.pdb source: svchost.exe, 00000011.00000000.2606402041.000001F7F904F000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.4274307885.000001F7F904F000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: dropper.pdb source: dropper.exe
Source: Binary string: dll.pdb source: dropper.exe, 00000000.00000003.2372222616.000001C334F68000.00000004.00000020.00020000.00000000.sdmp, dropper.exe, 00000000.00000002.2374303231.000001C334FBB000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2605723952.000002A389CBF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2689759793.000002A389CBF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2698614434.000002A389CBD000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2656513493.000002A389CBF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2568753180.000002A389CBE000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2695185888.000002A389CBF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2562765111.000002A389CBE000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2695994903.000002A389CBD000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2690602010.000002A389CBE000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2696169955.000002A389CBD000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.4271090535.000002A389CAE000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2694052945.000002A389CBE000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2692383688.000002A389CBE000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.4287819193.00007FFFE33FE000.00000002.00000001.01000000.00000005.sdmp, cmd.exe, 00000002.00000003.2695470863.000002A389CBF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2630794085.000002A389CBE000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2696951557.000002A389CBD000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2691813927.000002A389CBE000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2551363198.000002A389CBF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2690466486.000002A389CBF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2563799537.000002A389CBF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2696565729.000002A389CBD000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2693403117.000002A389CC0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2693124610.000002A389CC0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2693913782.000002A389CC0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2695029867.000002A389CBE000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2696822808.000002A389CBD000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2700084272.000002A389CBD000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2694191724.000002A389CC0000.00000004.00
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\winload_prod.pdb @ source: svchost.exe, 00000011.00000000.2606402041.000001F7F904F000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.4274307885.000001F7F904F000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\47114209A62F3B9930F6B8998DFD4A991\download.error source: svchost.exe, 00000011.00000002.4272525988.000001F7F9024000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: (@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\47114209A62F3B9930F6B8998DFD4A991\download.error source: svchost.exe, 00000011.00000000.2606323549.000001F7F9024000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.4272525988.000001F7F9024000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062.pdb source: svchost.exe, 00000011.00000000.2606402041.000001F7F904F000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.4274307885.000001F7F904F000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: ,@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb source: svchost.exe, 00000011.00000002.4276863114.000001F7F906B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000000.2606547357.000001F7F906B000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\47114209A62F3B9930F6B8998DFD4A991 source: svchost.exe, 00000011.00000000.2606402041.000001F7F904F000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.4274307885.000001F7F904F000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: @C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\download.error source: svchost.exe, 00000011.00000000.2606323549.000001F7F9024000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.4272525988.000001F7F9024000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\download.error source: svchost.exe, 00000011.00000000.2606402041.000001F7F904F000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.4274307885.000001F7F904F000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\download.errorC source: svchost.exe, 00000011.00000000.2606402041.000001F7F904F000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.4274307885.000001F7F904F000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: *@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: svchost.exe, 00000011.00000002.4276863114.000001F7F906B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000000.2606547357.000001F7F906B000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: dll.pdb( source: dropper.exe, 00000000.00000003.2372222616.000001C334F68000.00000004.00000020.00020000.00000000.sdmp, dropper.exe, 00000000.00000002.2374303231.000001C334FBB000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2605723952.000002A389CBF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2689759793.000002A389CBF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2698614434.000002A389CBD000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2656513493.000002A389CBF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2568753180.000002A389CBE000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2695185888.000002A389CBF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2562765111.000002A389CBE000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2695994903.000002A389CBD000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2690602010.000002A389CBE000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2696169955.000002A389CBD000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.4271090535.000002A389CAE000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2694052945.000002A389CBE000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2692383688.000002A389CBE000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.4287819193.00007FFFE33FE000.00000002.00000001.01000000.00000005.sdmp, cmd.exe, 00000002.00000003.2695470863.000002A389CBF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2630794085.000002A389CBE000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2696951557.000002A389CBD000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2691813927.000002A389CBE000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2551363198.000002A389CBF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2690466486.000002A389CBF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2563799537.000002A389CBF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2696565729.000002A389CBD000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2693403117.000002A389CC0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2693124610.000002A389CC0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2693913782.000002A389CC0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2695029867.000002A389CBE000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2696822808.000002A389CBD000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2700084272.000002A389CBD000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2694191724.000002A389CC0000.00000004.0
Source: Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb* source: svchost.exe, 00000011.00000002.4276863114.000001F7F906B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000000.2606547357.000001F7F906B000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\47114209A62F3B9930F6B8998DFD4A991\ntkrnlmp.pdb source: svchost.exe, 00000011.00000000.2606323549.000001F7F9024000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.4272525988.000001F7F9024000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: ,@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: svchost.exe, 00000011.00000002.4276863114.000001F7F906B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000000.2606547357.000001F7F906B000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: +@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\47114209A62F3B9930F6B8998DFD4A991\download.error source: svchost.exe, 00000011.00000000.2606323549.000001F7F9024000.00000004.00000001.00020000.00000000.sdmp
Source: C:\Windows\System32\cmd.exeCode function: 2_2_000002A38BE4A380 OutputDebugStringW,CloseHandle,memset,FindFirstFileExW,FindClose,2_2_000002A38BE4A380
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFFE33EA380 OutputDebugStringW,CloseHandle,memset,FindFirstFileExW,FindClose,2_2_00007FFFE33EA380
Source: Joe Sandbox ViewIP Address: 1.1.1.1 1.1.1.1
Source: Joe Sandbox ViewIP Address: 1.1.1.1 1.1.1.1
Source: svchost.exe, 00000023.00000000.2657611210.000002849CA76000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000023.00000002.3076369034.000002849CA76000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.facebook.com/ equals www.facebook.com (Facebook)
Source: svchost.exe, 00000023.00000000.2657611210.000002849CA76000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000023.00000002.3076369034.000002849CA76000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
Source: lsass.exe, 00000007.00000000.2553372289.0000023C4A037000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalG2TLSRSASHA2562020CA1-1.crt0
Source: lsass.exe, 00000007.00000002.4308214441.0000023C49F97000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2552987377.0000023C49F97000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalR
Source: lsass.exe, 00000007.00000000.2553372289.0000023C4A037000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2552733926.0000023C49ED4000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000002.4302051843.0000023C49ED4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: lsass.exe, 00000007.00000002.4278914514.0000023C49669000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000002.4315231713.0000023C4A037000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000002.4315231713.0000023C4A04A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2553372289.0000023C4A037000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2552733926.0000023C49ED4000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2552091093.0000023C49669000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000002.4308214441.0000023C49F97000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2553372289.0000023C4A04A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000002.4302051843.0000023C49ED4000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000002.4315231713.0000023C4A047000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000002.4302051843.0000023C49E58000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2552158899.0000023C49671000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2552987377.0000023C49F97000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000002.4280883404.0000023C49671000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2552733926.0000023C49E58000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0B
Source: lsass.exe, 00000007.00000000.2552733926.0000023C49ED4000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2552603872.0000023C49E53000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000003.2877029512.0000023C49E43000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000002.4302051843.0000023C49ED4000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2552158899.0000023C49671000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000002.4280883404.0000023C49671000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG3.crt0B
Source: lsass.exe, 00000007.00000002.4315231713.0000023C4A04A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2553372289.0000023C4A037000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2552733926.0000023C49ED4000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2553372289.0000023C4A04A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000002.4302051843.0000023C49ED4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2SecureServerCA-2.crt0
Source: lsass.exe, 00000007.00000002.4302051843.0000023C49E58000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2552733926.0000023C49E58000.00000004.00000001.00020000.00000000.sdmp, dwm.exe, 0000000D.00000002.4355377873.0000013646269000.00000004.00000001.00020000.00000000.sdmp, dwm.exe, 0000000D.00000000.2571316086.0000013646269000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: lsass.exe, 00000007.00000002.4302051843.0000023C49E58000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2552733926.0000023C49E58000.00000004.00000001.00020000.00000000.sdmp, dwm.exe, 0000000D.00000002.4355377873.0000013646269000.00000004.00000001.00020000.00000000.sdmp, dwm.exe, 0000000D.00000000.2571316086.0000013646269000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: lsass.exe, 00000007.00000000.2553372289.0000023C4A037000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalG2TLSRSASHA2562020CA1-1.crl0H
Source: lsass.exe, 00000007.00000000.2553372289.0000023C4A037000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2552733926.0000023C49ED4000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000002.4302051843.0000023C49ED4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: lsass.exe, 00000007.00000002.4278914514.0000023C49669000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000002.4315231713.0000023C4A037000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000002.4315231713.0000023C4A04A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2553372289.0000023C4A037000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2552733926.0000023C49ED4000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2552091093.0000023C49669000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000002.4308214441.0000023C49F97000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2553372289.0000023C4A04A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000002.4302051843.0000023C49ED4000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000002.4315231713.0000023C4A047000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000002.4302051843.0000023C49E58000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2552158899.0000023C49671000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2552987377.0000023C49F97000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000002.4280883404.0000023C49671000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2552733926.0000023C49E58000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl0
Source: lsass.exe, 00000007.00000000.2553372289.0000023C4A037000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl0=
Source: lsass.exe, 00000007.00000000.2552733926.0000023C49ED4000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2552603872.0000023C49E53000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000003.2877029512.0000023C49E43000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000002.4302051843.0000023C49ED4000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2552158899.0000023C49671000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000002.4280883404.0000023C49671000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG3.crl0
Source: lsass.exe, 00000007.00000002.4315231713.0000023C4A04A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2553372289.0000023C4A037000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2552733926.0000023C49ED4000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2553372289.0000023C4A04A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000002.4302051843.0000023C49ED4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigicertSHA2SecureServerCA-1.crl0?
Source: lsass.exe, 00000007.00000000.2553372289.0000023C4A037000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalG2TLSRSASHA2562020CA1-1.crl0
Source: lsass.exe, 00000007.00000000.2553372289.0000023C4A037000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2552733926.0000023C49ED4000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000002.4302051843.0000023C49ED4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: lsass.exe, 00000007.00000002.4315231713.0000023C4A04A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2553372289.0000023C4A037000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2552733926.0000023C49ED4000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2553372289.0000023C4A04A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000002.4302051843.0000023C49ED4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigicertSHA2SecureServerCA-1.crl0~
Source: svchost.exe, 00000023.00000002.3076592460.000002849CAA3000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000023.00000000.2657782164.000002849CAA3000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ctldl.windowsupdate.com/
Source: lsass.exe, 00000007.00000003.2877090957.0000023C49EF2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2552906470.0000023C49EF3000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000002.4306518026.0000023C49EF3000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: lsass.exe, 00000007.00000000.2552603872.0000023C49E00000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000002.4296302031.0000023C49E00000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: lsass.exe, 00000007.00000002.4277761912.0000023C4962E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2552046187.0000023C4962E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702
Source: lsass.exe, 00000007.00000002.4278914514.0000023C49650000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2552091093.0000023C49650000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/ws-sx/ws-trust/200512
Source: lsass.exe, 00000007.00000002.4277761912.0000023C4962E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2552046187.0000023C4962E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: dropper.exeString found in binary or memory: http://ns.adobe.
Source: lsass.exe, 00000007.00000002.4278914514.0000023C49669000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000002.4315231713.0000023C4A037000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000002.4315231713.0000023C4A04A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2553372289.0000023C4A037000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2552733926.0000023C49ED4000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2552603872.0000023C49E53000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000003.2877029512.0000023C49E43000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2552091093.0000023C49669000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000002.4308214441.0000023C49F97000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2553372289.0000023C4A04A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000002.4302051843.0000023C49ED4000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000002.4315231713.0000023C4A047000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000002.4302051843.0000023C49E58000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2552158899.0000023C49671000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2552987377.0000023C49F97000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000002.4280883404.0000023C49671000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2552733926.0000023C49E58000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
Source: lsass.exe, 00000007.00000002.4315231713.0000023C4A04A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2553372289.0000023C4A037000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2552733926.0000023C49ED4000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2553372289.0000023C4A04A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000002.4302051843.0000023C49ED4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0H
Source: lsass.exe, 00000007.00000000.2553372289.0000023C4A037000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0Q
Source: svchost.exe, 00000015.00000002.4295455670.0000024C3C520000.00000002.00000001.00040000.00000000.sdmpString found in binary or memory: http://schemas.micro
Source: lsass.exe, 00000007.00000002.4277761912.0000023C4962E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2552046187.0000023C4962E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policy
Source: lsass.exe, 00000007.00000002.4278914514.0000023C49650000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2552091093.0000023C49650000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: lsass.exe, 00000007.00000002.4278914514.0000023C49650000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000002.4277761912.0000023C4962E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2552091093.0000023C49650000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2552046187.0000023C4962E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/07/securitypolicy
Source: lsass.exe, 00000007.00000002.4277761912.0000023C4962E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2552046187.0000023C4962E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: lsass.exe, 00000007.00000002.4277761912.0000023C4962E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2552046187.0000023C4962E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/wsdl/erties
Source: lsass.exe, 00000007.00000002.4277761912.0000023C4962E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2552046187.0000023C4962E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/wsdl/soap12/
Source: lsass.exe, 00000007.00000002.4277761912.0000023C4962E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2552046187.0000023C4962E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/wsdl/soap12/P
Source: lsass.exe, 00000007.00000002.4315231713.0000023C4A04A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2553372289.0000023C4A037000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2552733926.0000023C49ED4000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2553372289.0000023C4A04A000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000002.4302051843.0000023C49ED4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com/CPS0
Source: svchost.exe, 00000020.00000002.4307373490.0000018B61457000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.msftconnecttest.com
Source: svchost.exe, 00000020.00000000.2650476455.0000018B61457000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000002.4307373490.0000018B61457000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.msftconnecttest.com/connecttest.txt
Source: lsass.exe, 00000007.00000003.2877090957.0000023C49EF2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2552906470.0000023C49EF3000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000002.4306518026.0000023C49EF3000.00000004.00000001.00020000.00000000.sdmp, dwm.exe, 0000000D.00000002.4355377873.0000013646269000.00000004.00000001.00020000.00000000.sdmp, dwm.exe, 0000000D.00000000.2571316086.0000013646269000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.quovadis.bm0
Source: svchost.exe, 00000008.00000002.4326120012.000001738107D000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000008.00000000.2558051921.000001738107D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.onenote.net/livetile/?Language=
Source: dropper.exe, tempdll.dll.0.drString found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-support
Source: svchost.exe, 00000028.00000000.2679256726.000001FF40C5C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://excel.office.comSRD1%
Source: svchost.exe, 00000023.00000003.2775213918.000002849CA1A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000023.00000000.2657091325.000002849CA13000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000023.00000002.3075768926.000002849CA1F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/
Source: lsass.exe, 00000007.00000003.2877090957.0000023C49EF2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2552906470.0000023C49EF3000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000002.4306518026.0000023C49EF3000.00000004.00000001.00020000.00000000.sdmp, dwm.exe, 0000000D.00000002.4355377873.0000013646269000.00000004.00000001.00020000.00000000.sdmp, dwm.exe, 0000000D.00000000.2571316086.0000013646269000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ocsp.quovadisoffshore.com0
Source: svchost.exe, 00000028.00000000.2678394704.000001FF40B3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://outlook.com
Source: svchost.exe, 00000028.00000000.2679256726.000001FF40C5C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://outlook.comSRD1-
Source: svchost.exe, 00000028.00000000.2678394704.000001FF40B3C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://outlook.comcom
Source: svchost.exe, 00000028.00000000.2679256726.000001FF40C5C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://powerpoint.office.comSRD13
Source: svchost.exe, 00000008.00000000.2558119838.0000017381084000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4327160465.0000017381084000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://spclient.wg.spotify.com/v1/live-tile-xml?region=
Source: svchost.exe, 00000008.00000000.2557840708.000001738101F000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4319974116.000001738101F000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000008.00000000.2556743069.00000173806AE000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4296129717.00000173806AE000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://windows.msn.cn/shellRESP
Source: svchost.exe, 00000008.00000000.2557840708.000001738101F000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4319974116.000001738101F000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000008.00000000.2556743069.00000173806AE000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4296129717.00000173806AE000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://windows.msn.com/shell
Source: Microsoft-Windows-PushNotification-Platform%4Operational.evtx.22.drString found in binary or memory: https://wns2-ch1p.notify.windows.com/?token=AwYAAAA0qUCblRLXYIZevE%2bmLQlefqcv3h4wEzuouckPnJzjdA2VgT
Source: Microsoft-Windows-PushNotification-Platform%4Operational.evtx.22.drString found in binary or memory: https://wns2-ch1p.notify.windows.com/?token=AwYAAABGUrF%2b1sXEjJggZdLxqERBktUbt%2fKiMEYjoor2hY%2b581
Source: svchost.exe, 00000028.00000002.4336314019.000001FF408E4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://word.office.com
Source: svchost.exe, 00000028.00000000.2677479128.000001FF408E4000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.4336314019.000001FF408E4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://word.office.com.com
Source: svchost.exe, 00000028.00000000.2677479128.000001FF408E4000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.4336314019.000001FF408E4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://word.office.com.comory
Source: svchost.exe, 00000028.00000000.2677049721.000001FF407D7000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000028.00000000.2679256726.000001FF40C5C000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://word.office.comSRD1#
Source: svchost.exe, 00000028.00000002.4336816715.000001FF40984000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000028.00000000.2677605092.000001FF40984000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.office.com/pwaimages
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF717447CB0 memset,OutputDebugStringW,memset,OutputDebugStringW,memset,OutputDebugStringW,CreateToolhelp32Snapshot,memset,OutputDebugStringW,Module32FirstW,memset,memset,OutputDebugStringW,memset,OutputDebugStringW,OutputDebugStringW,memset,memset,OutputDebugStringW,OutputDebugStringW,memset,OutputDebugStringW,memset,memset,OutputDebugStringW,OutputDebugStringW,memset,OutputDebugStringW,memset,OutputDebugStringW,memset,OutputDebugStringW,memcmp,memcmp,memcmp,memset,memset,OutputDebugStringW,memset,memset,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,Module32NextW,memset,OutputDebugStringW,NtClose,memset,OutputDebugStringW,0_2_00007FF717447CB0
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF71744A5A0 memset,OutputDebugStringW,memset,OutputDebugStringW,memset,OutputDebugStringW,memset,OutputDebugStringW,memset,OutputDebugStringW,memset,OutputDebugStringW,memset,OutputDebugStringW,NtOpenFile,memset,memset,OutputDebugStringW,OutputDebugStringW,NtCreateSection,memset,memset,OutputDebugStringW,OutputDebugStringW,GetCurrentProcess,NtMapViewOfSection,NtClose,0_2_00007FF71744A5A0
Source: C:\Windows\System32\cmd.exeCode function: 2_2_000002A38BE453B0 NtReadFile,WaitForSingleObject,RtlNtStatusToDosError,2_2_000002A38BE453B0
Source: C:\Windows\System32\cmd.exeCode function: 2_2_000002A38BE4A7A0 NtReadFile,WaitForSingleObject,RtlNtStatusToDosError,2_2_000002A38BE4A7A0
Source: C:\Windows\System32\cmd.exeCode function: 2_2_000002A38BE4A8C0 NtWriteFile,WaitForSingleObject,RtlNtStatusToDosError,GetModuleHandleW,FormatMessageW,GetLastError,2_2_000002A38BE4A8C0
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFFE33E53B0 NtReadFile,WaitForSingleObject,RtlNtStatusToDosError,2_2_00007FFFE33E53B0
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFFE33CC860 memset,OutputDebugStringW,NtQueryInformationProcess,memset,RtlFreeHeap,memset,OutputDebugStringW,memset,OutputDebugStringW,memset,memset,OutputDebugStringW,OutputDebugStringW,memcmp,memcmp,RtlFreeHeap,memset,OutputDebugStringW,2_2_00007FFFE33CC860
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFFE33EA7A0 NtReadFile,WaitForSingleObject,RtlNtStatusToDosError,2_2_00007FFFE33EA7A0
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFFE33D4D50 NtCreateKey,memset,NtSetValueKey,memset,memset,memset,OutputDebugStringW,OutputDebugStringW,NtClose,2_2_00007FFFE33D4D50
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFFE33CA4E0 memset,OutputDebugStringW,memset,OutputDebugStringW,memset,OutputDebugStringW,memset,OutputDebugStringW,memset,OutputDebugStringW,memset,OutputDebugStringW,memset,OutputDebugStringW,NtOpenFile,memset,memset,OutputDebugStringW,OutputDebugStringW,NtCreateSection,memset,memset,OutputDebugStringW,OutputDebugStringW,GetCurrentProcess,NtMapViewOfSection,NtClose,2_2_00007FFFE33CA4E0
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFFE33EA8C0 NtWriteFile,WaitForSingleObject,RtlNtStatusToDosError,2_2_00007FFFE33EA8C0
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF7174530700_2_00007FF717453070
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF717444D100_2_00007FF717444D10
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF717447CB00_2_00007FF717447CB0
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF7175982D00_2_00007FF7175982D0
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF7174452D00_2_00007FF7174452D0
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF7174413500_2_00007FF717441350
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF7174473400_2_00007FF717447340
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF717442DB00_2_00007FF717442DB0
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF7174469B00_2_00007FF7174469B0
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF71744A5A00_2_00007FF71744A5A0
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF7174421C00_2_00007FF7174421C0
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF717570A600_2_00007FF717570A60
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF717580C700_2_00007FF717580C70
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF717572A700_2_00007FF717572A70
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF7175716400_2_00007FF717571640
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF71758A8500_2_00007FF71758A850
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF717593D100_2_00007FF717593D10
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF717452AE00_2_00007FF717452AE0
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF7175701100_2_00007FF717570110
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF717571F100_2_00007FF717571F10
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF71758F2E00_2_00007FF71758F2E0
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF7174549100_2_00007FF717454910
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF717572F800_2_00007FF717572F80
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF7175735600_2_00007FF717573560
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF71759E7700_2_00007FF71759E770
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF717572D400_2_00007FF717572D40
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF7175719500_2_00007FF717571950
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF7175723200_2_00007FF717572320
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF7175987300_2_00007FF717598730
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF7175732100_2_00007FF717573210
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF717571C100_2_00007FF717571C10
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF7175727E00_2_00007FF7175727E0
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF7174533B00_2_00007FF7174533B0
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF7175899D00_2_00007FF7175899D0
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF717570FA00_2_00007FF717570FA0
Source: C:\Windows\System32\cmd.exeCode function: 2_2_000002A38BE542302_2_000002A38BE54230
Source: C:\Windows\System32\cmd.exeCode function: 2_2_000002A38BE410402_2_000002A38BE41040
Source: C:\Windows\System32\cmd.exeCode function: 2_2_000002A38BE32E402_2_000002A38BE32E40
Source: C:\Windows\System32\cmd.exeCode function: 2_2_000002A38BE580102_2_000002A38BE58010
Source: C:\Windows\System32\cmd.exeCode function: 2_2_000002A38BE402102_2_000002A38BE40210
Source: C:\Windows\System32\cmd.exeCode function: 2_2_000002A38BE3E4102_2_000002A38BE3E410
Source: C:\Windows\System32\cmd.exeCode function: 2_2_000002A38BE5B4102_2_000002A38BE5B410
Source: C:\Windows\System32\cmd.exeCode function: 2_2_000002A38BE54E202_2_000002A38BE54E20
Source: C:\Windows\System32\cmd.exeCode function: 2_2_000002A38BE406202_2_000002A38BE40620
Source: C:\Windows\System32\cmd.exeCode function: 2_2_000002A38BE221F02_2_000002A38BE221F0
Source: C:\Windows\System32\cmd.exeCode function: 2_2_000002A38BE339D02_2_000002A38BE339D0
Source: C:\Windows\System32\cmd.exeCode function: 2_2_000002A38BE399E02_2_000002A38BE399E0
Source: C:\Windows\System32\cmd.exeCode function: 2_2_000002A38BE22DE02_2_000002A38BE22DE0
Source: C:\Windows\System32\cmd.exeCode function: 2_2_000002A38BE269E02_2_000002A38BE269E0
Source: C:\Windows\System32\cmd.exeCode function: 2_2_000002A38BE4B7B02_2_000002A38BE4B7B0
Source: C:\Windows\System32\cmd.exeCode function: 2_2_000002A38BE5AFB02_2_000002A38BE5AFB0
Source: C:\Windows\System32\cmd.exeCode function: 2_2_000002A38BE35D902_2_000002A38BE35D90
Source: C:\Windows\System32\cmd.exeCode function: 2_2_000002A38BE397902_2_000002A38BE39790
Source: C:\Windows\System32\cmd.exeCode function: 2_2_000002A38BE40D702_2_000002A38BE40D70
Source: C:\Windows\System32\cmd.exeCode function: 2_2_000002A38BE273702_2_000002A38BE27370
Source: C:\Windows\System32\cmd.exeCode function: 2_2_000002A38BE5C9802_2_000002A38BE5C980
Source: C:\Windows\System32\cmd.exeCode function: 2_2_000002A38BE5AB502_2_000002A38BE5AB50
Source: C:\Windows\System32\cmd.exeCode function: 2_2_000002A38BE213502_2_000002A38BE21350
Source: C:\Windows\System32\cmd.exeCode function: 2_2_000002A38BE3ED602_2_000002A38BE3ED60
Source: C:\Windows\System32\cmd.exeCode function: 2_2_000002A38BE553302_2_000002A38BE55330
Source: C:\Windows\System32\cmd.exeCode function: 2_2_000002A38BE3F9402_2_000002A38BE3F940
Source: C:\Windows\System32\cmd.exeCode function: 2_2_000002A38BE24D402_2_000002A38BE24D40
Source: C:\Windows\System32\cmd.exeCode function: 2_2_000002A38BE579102_2_000002A38BE57910
Source: C:\Windows\System32\cmd.exeCode function: 2_2_000002A38BE3FF102_2_000002A38BE3FF10
Source: C:\Windows\System32\cmd.exeCode function: 2_2_000002A38BE415102_2_000002A38BE41510
Source: C:\Windows\System32\cmd.exeCode function: 2_2_000002A38BE395102_2_000002A38BE39510
Source: C:\Windows\System32\cmd.exeCode function: 2_2_000002A38BE253002_2_000002A38BE25300
Source: C:\Windows\System32\cmd.exeCode function: 2_2_000002A38BE40AE02_2_000002A38BE40AE0
Source: C:\Windows\System32\cmd.exeCode function: 2_2_000002A38BE316E02_2_000002A38BE316E0
Source: C:\Windows\System32\cmd.exeCode function: 2_2_000002A38BE2A4E02_2_000002A38BE2A4E0
Source: C:\Windows\System32\cmd.exeCode function: 2_2_000002A38BE27CE02_2_000002A38BE27CE0
Source: C:\Windows\System32\cmd.exeCode function: 2_2_000002A38BE4A8C02_2_000002A38BE4A8C0
Source: C:\Windows\System32\cmd.exeCode function: 2_2_000002A38BE3F2A02_2_000002A38BE3F2A0
Source: C:\Windows\System32\cmd.exeCode function: 2_2_000002A38BE304702_2_000002A38BE30470
Source: C:\Windows\System32\cmd.exeCode function: 2_2_000002A38BE412802_2_000002A38BE41280
Source: C:\Windows\System32\cmd.exeCode function: 2_2_000002A38BE3FC502_2_000002A38BE3FC50
Source: C:\Windows\System32\cmd.exeCode function: 2_2_000002A38BE376502_2_000002A38BE37650
Source: C:\Windows\System32\cmd.exeCode function: 2_2_000002A38BE418602_2_000002A38BE41860
Source: C:\Windows\System32\cmd.exeCode function: 2_2_000002A38BE2C8602_2_000002A38BE2C860
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFFE33C73702_2_00007FFFE33C7370
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFFE33C13502_2_00007FFFE33C1350
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFFE33C53002_2_00007FFFE33C5300
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFFE33C69E02_2_00007FFFE33C69E0
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFFE33C21F02_2_00007FFFE33C21F0
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFFE33D39D02_2_00007FFFE33D39D0
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFFE33CC8602_2_00007FFFE33CC860
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFFE33D86302_2_00007FFFE33D8630
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFFE33D2E402_2_00007FFFE33D2E40
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFFE33D16E02_2_00007FFFE33D16E0
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFFE33C4D402_2_00007FFFE33C4D40
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFFE33D4D502_2_00007FFFE33D4D50
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFFE33C2DE02_2_00007FFFE33C2DE0
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFFE33D04702_2_00007FFFE33D0470
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFFE33CF4802_2_00007FFFE33CF480
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFFE33C7CE02_2_00007FFFE33C7CE0
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFFE33CA4E02_2_00007FFFE33CA4E0
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFFE33F53302_2_00007FFFE33F5330
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFFE33FAB502_2_00007FFFE33FAB50
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFFE33DE4102_2_00007FFFE33DE410
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFFE33FB4102_2_00007FFFE33FB410
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFFE33E12802_2_00007FFFE33E1280
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFFE33D7A802_2_00007FFFE33D7A80
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFFE33F42302_2_00007FFFE33F4230
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFFE33E0AE02_2_00007FFFE33E0AE0
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFFE33DF2A02_2_00007FFFE33DF2A0
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFFE33FC9802_2_00007FFFE33FC980
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFFE33DF9402_2_00007FFFE33DF940
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFFE33ED9402_2_00007FFFE33ED940
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFFE33D99E02_2_00007FFFE33D99E0
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFFE33D2A002_2_00007FFFE33D2A00
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFFE33E02102_2_00007FFFE33E0210
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFFE33E18602_2_00007FFFE33E1860
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFFE33DA8702_2_00007FFFE33DA870
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFFE33E10402_2_00007FFFE33E1040
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFFE33F79102_2_00007FFFE33F7910
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFFE33E28A02_2_00007FFFE33E28A0
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFFE33D28D02_2_00007FFFE33D28D0
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFFE33D97902_2_00007FFFE33D9790
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFFE33F2FF02_2_00007FFFE33F2FF0
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFFE33F80102_2_00007FFFE33F8010
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFFE33D27A02_2_00007FFFE33D27A0
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFFE33FAFB02_2_00007FFFE33FAFB0
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFFE33EB7B02_2_00007FFFE33EB7B0
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFFE33ED7C02_2_00007FFFE33ED7C0
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFFE33E06202_2_00007FFFE33E0620
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFFE33F4E202_2_00007FFFE33F4E20
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFFE33D76502_2_00007FFFE33D7650
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFFE33EEEF02_2_00007FFFE33EEEF0
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFFE33DFF102_2_00007FFFE33DFF10
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFFE33DED602_2_00007FFFE33DED60
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFFE33E0D702_2_00007FFFE33E0D70
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFFE33D5D902_2_00007FFFE33D5D90
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFFE33DFC502_2_00007FFFE33DFC50
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFFE33D95102_2_00007FFFE33D9510
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFFE33E15102_2_00007FFFE33E1510
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFFE33E65102_2_00007FFFE33E6510
Source: C:\Users\user\Desktop\dropper.exeProcess token adjusted: Load DriverJump to behavior
Source: C:\Users\user\Desktop\dropper.exeProcess token adjusted: SecurityJump to behavior
Source: C:\Windows\System32\cmd.exeCode function: String function: 00007FFFE33F7280 appears 62 times
Source: Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx.22.drBinary string: 1\Device\HarddiskVolume4\Windows\SysWOW64\curl.exe?\Device\HarddiskVolume4\Program Files (x86)\AutoIt3\AutoIt3.exed
Source: Microsoft-Windows-Security-Mitigations%4KernelMode.evtx.22.drBinary string: 4\Device\HarddiskVolume4\Windows\System32\spoolsv.exe
Source: Microsoft-Windows-SMBServer%4Operational.evtx.22.drBinary string: computer WORKGROUP:\Device\NetBT_Tcpip_{68C65ED0-D5FC-471F-BF0F-95C04D2E3B08}
Source: Microsoft-Windows-Security-Mitigations%4KernelMode.evtx.22.drBinary string: {\Device\HarddiskVolume4\Users\user\AppData\Local\Google\Chrome\User Data\SwReporter\92.267.200\software_reporter_tool.exe=
Source: Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.22.drBinary string: \\?\Volume{cb7fdaf7-d8ae-4a24-98ab-ca007942ac33}\Device\HarddiskVolume1an
Source: Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx.22.drBinary string: 1\Device\HarddiskVolume4\Windows\System32\curl.exe?\Device\HarddiskVolume4\Program Files (x86)\AutoIt3\AutoIt3.exe
Source: System.evtx.22.drBinary string: \Device\HarddiskVolume4\Windows\SysWOW64\tzutil.exe<
Source: System.evtx.22.drBinary string: .\Device\HarddiskVolume2\EFI\Microsoft\Boot\BCD~
Source: Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx.22.drBinary string: 1\Device\HarddiskVolume4\Windows\SysWOW64\curl.exe?\Device\HarddiskVolume4\Program Files (x86)\AutoIt3\AutoIt3.exeo
Source: Microsoft-Windows-Security-Mitigations%4KernelMode.evtx.22.drBinary string: {\Device\HarddiskVolume4\Users\user\AppData\Local\Google\Chrome\User Data\SwReporter\93.269.200\software_reporter_tool.exe2
Source: Microsoft-Windows-SmbClient%4Connectivity.evtx.22.drBinary string: :\Device\NetBT_Tcpip_{68C65ED0-D5FC-471F-BF0F-95C04D2E3B08}
Source: Microsoft-Windows-Security-Mitigations%4KernelMode.evtx.22.drBinary string: 4\Device\HarddiskVolume4\Windows\System32\dllhost.exeQC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}T
Source: Microsoft-Windows-Security-Mitigations%4KernelMode.evtx.22.drBinary string: {\Device\HarddiskVolume4\Users\user\AppData\Local\Google\Chrome\User Data\SwReporter\93.269.200\software_reporter_tool.exe4
Source: Microsoft-Windows-Security-Mitigations%4KernelMode.evtx.22.drBinary string: {\Device\HarddiskVolume4\Users\user\AppData\Local\Google\Chrome\User Data\SwReporter\93.269.200\software_reporter_tool.exe3
Source: Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx.22.drBinary string: 1\Device\HarddiskVolume4\Windows\SysWOW64\curl.exe?\Device\HarddiskVolume4\Program Files (x86)\AutoIt3\AutoIt3.exeD
Source: Microsoft-Windows-Security-Mitigations%4KernelMode.evtx.22.drBinary string: {\Device\HarddiskVolume4\Users\user\AppData\Local\Google\Chrome\User Data\SwReporter\93.269.200\software_reporter_tool.exe<
Source: Microsoft-Windows-SMBServer%4Operational.evtx.22.drBinary string: \Device\NetbiosSmb
Source: Microsoft-Windows-Security-Mitigations%4KernelMode.evtx.22.drBinary string: {\Device\HarddiskVolume4\Users\user\AppData\Local\Google\Chrome\User Data\SwReporter\93.269.200\software_reporter_tool.exe=
Source: System.evtx.22.drBinary string: \Device\HarddiskVolume4\Program Files (x86)\AutoIt3\AutoIt3.exe
Source: Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx.22.drBinary string: 1\Device\HarddiskVolume4\Windows\SysWOW64\curl.exe?\Device\HarddiskVolume4\Program Files (x86)\AutoIt3\AutoIt3.exe
Source: Microsoft-Windows-Diagnostics-Performance%4Operational.evtx.22.drBinary string: C:\Device\HarddiskVolume4
Source: Microsoft-Windows-CodeIntegrity%4Operational.evtx.22.drBinary string: 0\Device\HarddiskVolume4\Windows\Temp\tempdll.dll4\Device\HarddiskVolume4\Windows\System32\dllhost.exe
Source: Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx.22.drBinary string: 1\Device\HarddiskVolume4\Windows\System32\curl.exe?\Device\HarddiskVolume4\Program Files (x86)\AutoIt3\AutoIt3.exeo
Source: System.evtx.22.drBinary string: \\?\Volume{cb7fdaf7-d8ae-4a24-98ab-ca007942ac33}\Device\HarddiskVolume1iceV
Source: Microsoft-Windows-Security-Mitigations%4KernelMode.evtx.22.drBinary string: {\Device\HarddiskVolume4\Users\user\AppData\Local\Google\Chrome\User Data\SwReporter\92.267.200\software_reporter_tool.exe3
Source: Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx.22.drBinary string: 1\Device\HarddiskVolume4\Windows\SysWOW64\curl.exe?\Device\HarddiskVolume4\Program Files (x86)\AutoIt3\AutoIt3.exeT_AH**
Source: System.evtx.22.drBinary string: \\?\Volume{cb7fdaf7-d8ae-4a24-98ab-ca007942ac33}\Device\HarddiskVolume1ys
Source: Microsoft-Windows-Security-Mitigations%4KernelMode.evtx.22.drBinary string: _\Device\HarddiskVolume4\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\acrocef_1\RdrCEF.exe
Source: classification engineClassification label: mal66.evad.winEXE@5/60@0/1
Source: C:\Windows\System32\cmd.exeCode function: 2_2_000002A38BE4A8C0 NtWriteFile,WaitForSingleObject,RtlNtStatusToDosError,GetModuleHandleW,FormatMessageW,GetLastError,2_2_000002A38BE4A8C0
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFFE33D8630 LsaOpenPolicy,GetCurrentProcess,OpenProcessToken,GetTokenInformation,LsaAddAccountRights,LsaClose,LsaClose,LsaClose,memset,OutputDebugStringW,memset,OutputDebugStringW,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,memset,OutputDebugStringW,memset,memset,OutputDebugStringW,OutputDebugStringW,2_2_00007FFFE33D8630
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF717447CB0 memset,OutputDebugStringW,memset,OutputDebugStringW,memset,OutputDebugStringW,CreateToolhelp32Snapshot,memset,OutputDebugStringW,Module32FirstW,memset,memset,OutputDebugStringW,memset,OutputDebugStringW,OutputDebugStringW,memset,memset,OutputDebugStringW,OutputDebugStringW,memset,OutputDebugStringW,memset,memset,OutputDebugStringW,OutputDebugStringW,memset,OutputDebugStringW,memset,OutputDebugStringW,memset,OutputDebugStringW,memcmp,memcmp,memcmp,memset,memset,OutputDebugStringW,memset,memset,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,Module32NextW,memset,OutputDebugStringW,NtClose,memset,OutputDebugStringW,0_2_00007FF717447CB0
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6712:304:WilStaging_02
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1432:304:WilStaging_02
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6712:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1432:120:WilError_03
Source: C:\Users\user\Desktop\dropper.exeFile created: C:\Windows\Temp\tempdll.dllJump to behavior
Source: dropper.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\dropper.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: C:\Windows\System32\svchost.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: C:\Windows\System32\svchost.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
Source: dropper.exeVirustotal: Detection: 8%
Source: unknownProcess created: C:\Users\user\Desktop\dropper.exe "C:\Users\user\Desktop\dropper.exe"
Source: C:\Users\user\Desktop\dropper.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\dropper.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe"
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\dropper.exeProcess created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe"Jump to behavior
Source: C:\Users\user\Desktop\dropper.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\Desktop\dropper.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Users\user\Desktop\dropper.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\Desktop\dropper.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\cmd.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Windows\System32\cmd.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\cmd.exeSection loaded: edgegdi.dllJump to behavior
Source: C:\Windows\System32\cmd.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Windows\System32\cmd.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\System32\winlogon.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Windows\System32\winlogon.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Windows\System32\lsass.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Windows\System32\lsass.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_3ea756ac68d34d21\IntelCpHDCPSvc.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_3ea756ac68d34d21\IntelCpHDCPSvc.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_3ea756ac68d34d21\IntelCpHDCPSvc.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_3ea756ac68d34d21\IntelCpHeciSvc.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_3ea756ac68d34d21\IntelCpHeciSvc.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_3ea756ac68d34d21\IntelCpHeciSvc.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Windows\System32\DriverStore\FileRepository\cui_dch.inf_amd64_2e49f48165b8de10\igfxCUIService.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Windows\System32\DriverStore\FileRepository\cui_dch.inf_amd64_2e49f48165b8de10\igfxCUIService.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\DriverStore\FileRepository\cui_dch.inf_amd64_2e49f48165b8de10\igfxCUIService.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Windows\System32\spoolsv.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Windows\System32\spoolsv.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Windows\System32\cmd.exeAutomated click: OK
Source: C:\Windows\System32\cmd.exeAutomated click: OK
Source: C:\Windows\System32\cmd.exeAutomated click: OK
Source: C:\Windows\System32\cmd.exeAutomated click: OK
Source: C:\Windows\System32\cmd.exeAutomated click: OK
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: dropper.exeStatic PE information: Virtual size of .text is bigger than: 0x100000
Source: dropper.exeStatic PE information: Image base 0x140000000 > 0x60000000
Source: dropper.exeStatic file information: File size 3272192 > 1048576
Source: dropper.exeStatic PE information: Raw size of .text is bigger than: 0x100000 < 0x15e800
Source: dropper.exeStatic PE information: Raw size of .rdata is bigger than: 0x100000 < 0x1b2a00
Source: dropper.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: dropper.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: dropper.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: dropper.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: dropper.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: dropper.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: dropper.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: dropper.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: ,@\??\C:\Users\user\AppData\Local\Temp\TCDE6CF.tmp.pdb source: svchost.exe, 00000011.00000000.2606510787.000001F7F9056000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.4276038238.000001F7F9056000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\winload_prod.pdb source: svchost.exe, 00000011.00000000.2606402041.000001F7F904F000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.4274307885.000001F7F904F000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: dropper.pdb source: dropper.exe
Source: Binary string: dll.pdb source: dropper.exe, 00000000.00000003.2372222616.000001C334F68000.00000004.00000020.00020000.00000000.sdmp, dropper.exe, 00000000.00000002.2374303231.000001C334FBB000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2605723952.000002A389CBF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2689759793.000002A389CBF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2698614434.000002A389CBD000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2656513493.000002A389CBF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2568753180.000002A389CBE000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2695185888.000002A389CBF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2562765111.000002A389CBE000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2695994903.000002A389CBD000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2690602010.000002A389CBE000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2696169955.000002A389CBD000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.4271090535.000002A389CAE000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2694052945.000002A389CBE000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2692383688.000002A389CBE000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.4287819193.00007FFFE33FE000.00000002.00000001.01000000.00000005.sdmp, cmd.exe, 00000002.00000003.2695470863.000002A389CBF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2630794085.000002A389CBE000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2696951557.000002A389CBD000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2691813927.000002A389CBE000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2551363198.000002A389CBF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2690466486.000002A389CBF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2563799537.000002A389CBF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2696565729.000002A389CBD000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2693403117.000002A389CC0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2693124610.000002A389CC0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2693913782.000002A389CC0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2695029867.000002A389CBE000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2696822808.000002A389CBD000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2700084272.000002A389CBD000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2694191724.000002A389CC0000.00000004.00
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\winload_prod.pdb @ source: svchost.exe, 00000011.00000000.2606402041.000001F7F904F000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.4274307885.000001F7F904F000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\47114209A62F3B9930F6B8998DFD4A991\download.error source: svchost.exe, 00000011.00000002.4272525988.000001F7F9024000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: (@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\47114209A62F3B9930F6B8998DFD4A991\download.error source: svchost.exe, 00000011.00000000.2606323549.000001F7F9024000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.4272525988.000001F7F9024000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062.pdb source: svchost.exe, 00000011.00000000.2606402041.000001F7F904F000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.4274307885.000001F7F904F000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: ,@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb source: svchost.exe, 00000011.00000002.4276863114.000001F7F906B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000000.2606547357.000001F7F906B000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\47114209A62F3B9930F6B8998DFD4A991 source: svchost.exe, 00000011.00000000.2606402041.000001F7F904F000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.4274307885.000001F7F904F000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: @C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\download.error source: svchost.exe, 00000011.00000000.2606323549.000001F7F9024000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.4272525988.000001F7F9024000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\download.error source: svchost.exe, 00000011.00000000.2606402041.000001F7F904F000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.4274307885.000001F7F904F000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\36C00AF489401A26639ABBA698DE76062\download.errorC source: svchost.exe, 00000011.00000000.2606402041.000001F7F904F000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.4274307885.000001F7F904F000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: *@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: svchost.exe, 00000011.00000002.4276863114.000001F7F906B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000000.2606547357.000001F7F906B000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: dll.pdb( source: dropper.exe, 00000000.00000003.2372222616.000001C334F68000.00000004.00000020.00020000.00000000.sdmp, dropper.exe, 00000000.00000002.2374303231.000001C334FBB000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2605723952.000002A389CBF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2689759793.000002A389CBF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2698614434.000002A389CBD000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2656513493.000002A389CBF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2568753180.000002A389CBE000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2695185888.000002A389CBF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2562765111.000002A389CBE000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2695994903.000002A389CBD000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2690602010.000002A389CBE000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2696169955.000002A389CBD000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.4271090535.000002A389CAE000.00000004.00000001.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2694052945.000002A389CBE000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2692383688.000002A389CBE000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000002.4287819193.00007FFFE33FE000.00000002.00000001.01000000.00000005.sdmp, cmd.exe, 00000002.00000003.2695470863.000002A389CBF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2630794085.000002A389CBE000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2696951557.000002A389CBD000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2691813927.000002A389CBE000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2551363198.000002A389CBF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2690466486.000002A389CBF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2563799537.000002A389CBF000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2696565729.000002A389CBD000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2693403117.000002A389CC0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2693124610.000002A389CC0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2693913782.000002A389CC0000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2695029867.000002A389CBE000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2696822808.000002A389CBD000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2700084272.000002A389CBD000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000002.00000003.2694191724.000002A389CC0000.00000004.0
Source: Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb* source: svchost.exe, 00000011.00000002.4276863114.000001F7F906B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000000.2606547357.000001F7F906B000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: @\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\47114209A62F3B9930F6B8998DFD4A991\ntkrnlmp.pdb source: svchost.exe, 00000011.00000000.2606323549.000001F7F9024000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.4272525988.000001F7F9024000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: ,@\??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: svchost.exe, 00000011.00000002.4276863114.000001F7F906B000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000011.00000000.2606547357.000001F7F906B000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: +@\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\47114209A62F3B9930F6B8998DFD4A991\download.error source: svchost.exe, 00000011.00000000.2606323549.000001F7F9024000.00000004.00000001.00020000.00000000.sdmp
Source: dropper.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: dropper.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: dropper.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: dropper.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: dropper.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFFE33EC730 WaitForSingleObjectEx,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetCurrentProcess,memset,GetProcAddress,GetCurrentProcess,lstrlenW,GetCurrentProcessId,CreateMutexA,CloseHandle,GetProcAddress,GetCurrentProcess,GetProcAddress,GetCurrentProcess,ReleaseMutex,2_2_00007FFFE33EC730
Source: C:\Users\user\Desktop\dropper.exeFile created: C:\Windows\Temp\tempdll.dllJump to dropped file
Source: C:\Users\user\Desktop\dropper.exeFile created: C:\Windows\Temp\tempdll.dllJump to dropped file

Boot Survival

barindex
Creates an autostart registry key pointing to binary in C:\Windows
Source: C:\Users\user\Desktop\dropper.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run HADESJump to behavior
Source: C:\Windows\System32\cmd.exeRegistry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WdBootJump to behavior
Source: C:\Users\user\Desktop\dropper.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run HADESJump to behavior
Source: C:\Users\user\Desktop\dropper.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run HADESJump to behavior

Malware Analysis System Evasion

barindex
Tries to delay execution (extensive OutputDebugStringW loop)
Source: C:\Users\user\Desktop\dropper.exeSection loaded: OutputDebugStringW count: 1273
Source: C:\Windows\System32\cmd.exeSection loaded: OutputDebugStringW count: 1973
Source: C:\Users\user\Desktop\dropper.exeDropped PE file which has not been started: C:\Windows\Temp\tempdll.dllJump to dropped file
Source: C:\Windows\System32\cmd.exeCheck user administrative privileges: GetTokenInformation,DecisionNodesgraph_2-22046
Source: C:\Windows\System32\svchost.exe TID: 2440Thread sleep time: -30000s >= -30000sJump to behavior
Source: C:\Windows\System32\svchost.exeFile opened: PhysicalDrive0Jump to behavior
Source: C:\Windows\System32\cmd.exeCode function: 2_2_000002A38BE4A380 OutputDebugStringW,CloseHandle,memset,FindFirstFileExW,FindClose,2_2_000002A38BE4A380
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFFE33EA380 OutputDebugStringW,CloseHandle,memset,FindFirstFileExW,FindClose,2_2_00007FFFE33EA380
Source: lsass.exe, 00000007.00000000.2552249828.0000023C496A6000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: pvmicshutdownNT SERVICE
Source: spoolsv.exe, 0000002A.00000002.4270538224.0000000000A10000.00000004.00000001.00020000.00000000.sdmp, spoolsv.exe, 0000002A.00000000.2684274538.0000000000A10000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll99`
Source: svchost.exe, 00000008.00000000.2557118766.0000017380813000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: (@vmicheartbeat
Source: svchost.exe, 00000016.00000002.4273476641.000001C798840000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000000.2620524896.000001C798840000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: @Microsoft-Windows-Hyper-V-Hypervisor
Source: lsass.exe, 00000007.00000000.2552249828.0000023C496A6000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: pvmicvssNT SERVICE
Source: svchost.exe, 00000008.00000002.4319974116.0000017381000000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: vmicshutdown
Source: svchost.exe, 00000008.00000002.4306219442.0000017380839000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: vmicvss
Source: svchost.exe, 00000008.00000000.2557118766.0000017380813000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: $@vmicshutdown
Source: svchost.exe, 0000000B.00000002.4279290939.0000014232E2A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000B.00000000.2564541737.0000014232E2A000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000000.2649098237.0000018B60A24000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000000.2649278978.0000018B60A82000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000002.4278217528.0000018B60A82000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000020.00000002.4274189703.0000018B60A24000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
Source: svchost.exe, 0000001E.00000000.2644245181.000001B124000000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcUmRdpServiceDsSvcfhsvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionsvsvcStorSvcWwanSvcvmicvssDevQueryBrokerNgcSvcsysmainNetmanTabletInputServicePcaSvcDisplayEnhancementServiceIPxlatCfgSvcDeviceAssociationServiceNcbServiceEmbeddedModeSensorServicewlansvcCscServiceWPDBusEnumMixedRealityOpenXRSvc
Source: lsass.exe, 00000007.00000000.2552249828.0000023C496A6000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: pvmicheartbeatNT SERVICE
Source: svchost.exe, 00000029.00000002.4282173935.00000277F185E000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000029.00000000.2682010527.00000277F185E000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll&
Source: svchost.exe, 00000020.00000000.2649278978.0000018B60ABB000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWLightWeight Filter-0000
Source: svchost.exe, 0000000B.00000002.4280303809.0000014232E43000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000B.00000000.2564582536.0000014232E43000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW`
Source: svchost.exe, 00000008.00000000.2557118766.0000017380813000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: @vmicshutdown
Source: lsass.exe, 00000007.00000002.4276700785.0000023C49613000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2552007153.0000023C49613000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000C.00000000.2567256879.0000018A89213000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.4272294754.0000018A89213000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000F.00000002.4278914950.0000028EFA052000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 0000000F.00000000.2599356615.0000028EFA052000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000010.00000002.4276942664.0000019114E29000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000010.00000000.2603893605.0000019114E29000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.4273476641.000001C798840000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000016.00000000.2620524896.000001C798840000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000017.00000000.2629191587.00000284B5E2A000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: svchost.exe, 00000008.00000000.2557118766.0000017380813000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: @vmicheartbeat
Source: svchost.exe, 00000008.00000002.4319974116.0000017381000000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: vmicheartbeat
Source: C:\Windows\System32\cmd.exeProcess information queried: ProcessInformationJump to behavior
Source: C:\Windows\System32\svchost.exeProcess queried: DebugObjectHandleJump to behavior
Source: C:\Windows\System32\svchost.exeProcess queried: DebugObjectHandleJump to behavior
Source: C:\Windows\System32\svchost.exeProcess queried: DebugObjectHandleJump to behavior
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF717597D54 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF717597D54
Source: C:\Windows\System32\cmd.exeCode function: 2_2_000002A38BE30470 memset,OutputDebugStringW,OutputDebugStringW,memset,OutputDebugStringW,memset,OutputDebugStringW,memset,OutputDebugStringW,memset,memset,OutputDebugStringW,memset,memset,OutputDebugStringW,OutputDebugStringW,OutputDebugStringW,memset,OutputDebugStringW,memset,OutputDebugStringW,GetLastError,2_2_000002A38BE30470
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFFE33EC730 WaitForSingleObjectEx,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetCurrentProcess,memset,GetProcAddress,GetCurrentProcess,lstrlenW,GetCurrentProcessId,CreateMutexA,CloseHandle,GetProcAddress,GetCurrentProcess,GetProcAddress,GetCurrentProcess,ReleaseMutex,2_2_00007FFFE33EC730
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFFE33DA590 LoadLibraryExA,FormatMessageW,GetProcessHeap,HeapFree,2_2_00007FFFE33DA590
Source: C:\Users\user\Desktop\dropper.exeProcess token adjusted: DebugJump to behavior
Source: C:\Windows\System32\cmd.exeProcess token adjusted: DebugJump to behavior
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF717597D54 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,0_2_00007FF717597D54
Source: C:\Windows\System32\cmd.exeCode function: 2_2_000002A38BE5A5EC IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_000002A38BE5A5EC
Source: C:\Windows\System32\cmd.exeCode function: 2_2_00007FFFE33FA5EC IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00007FFFE33FA5EC
Source: C:\Users\user\Desktop\dropper.exeMemory allocated: page read and write | page guardJump to behavior

HIPS / PFW / Operating System Protection Evasion

barindex
Allocates memory in foreign processes
Source: C:\Users\user\Desktop\dropper.exeMemory allocated: C:\Windows\System32\cmd.exe base: 2A389A50000 protect: page read and writeJump to behavior
Creates a thread in another existing process (thread injection)
Source: C:\Users\user\Desktop\dropper.exeThread created: C:\Windows\System32\cmd.exe EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\winlogon.exe EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\lsass.exe EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\svchost.exe EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\fontdrvhost.exe EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\fontdrvhost.exe EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\svchost.exe EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\svchost.exe EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\dwm.exe EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\svchost.exe EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\svchost.exe EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\svchost.exe EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\svchost.exe EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\svchost.exe EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_3ea756ac68d34d21\IntelCpHDCPSvc.exe EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\svchost.exe EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\svchost.exe EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\svchost.exe EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\svchost.exe EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_3ea756ac68d34d21\IntelCpHeciSvc.exe EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\DriverStore\FileRepository\cui_dch.inf_amd64_2e49f48165b8de10\igfxCUIService.exe EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\svchost.exe EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\svchost.exe EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\svchost.exe EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\svchost.exe EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\svchost.exe EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\svchost.exe EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\svchost.exe EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\svchost.exe EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\svchost.exe EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\svchost.exe EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\svchost.exe EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\svchost.exe EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\svchost.exe EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\svchost.exe EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\svchost.exe EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\svchost.exe EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: C:\Windows\System32\spoolsv.exe EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 6F04F0Jump to behavior
Source: C:\Windows\System32\cmd.exeThread created: unknown EIP: 6F04F0Jump to behavior
Disables Windows Defender (deletes autostart)
Source: C:\Windows\System32\cmd.exeRegistry value deleted: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender DisableAntiSpywareJump to behavior
Found direct / indirect Syscall (likely to bypass EDR)
Source: C:\Users\user\Desktop\dropper.exeNtQueryInformationProcess: Direct from: 0x7FF71744F67FJump to behavior
Source: C:\Users\user\Desktop\dropper.exeNtClose: Direct from: 0x7FF71744BF83
Source: C:\Users\user\Desktop\dropper.exeNtClose: Direct from: 0x7FF717579691
Source: C:\Users\user\Desktop\dropper.exeNtCreateThreadEx: Direct from: 0x7FF71744D30AJump to behavior
Source: C:\Users\user\Desktop\dropper.exeNtUnmapViewOfSection: Direct from: 0x7FF71744F7E5Jump to behavior
Source: C:\Users\user\Desktop\dropper.exeNtSetValueKey: Indirect: 0x7FF717453B0CJump to behavior
Source: C:\Users\user\Desktop\dropper.exeNtProtectVirtualMemory: Direct from: 0x7FF71744DBFBJump to behavior
Source: C:\Users\user\Desktop\dropper.exeNtSetInformationThread: Direct from: 0x7FF717597937Jump to behavior
Source: C:\Users\user\Desktop\dropper.exeNtAllocateVirtualMemory: Direct from: 0x7FF717456A2FJump to behavior
Source: C:\Users\user\Desktop\dropper.exeNtProtectVirtualMemory: Direct from: 0x7FF802622651Jump to behavior
Source: C:\Users\user\Desktop\dropper.exeNtAllocateVirtualMemory: Direct from: 0x7FF71744F694Jump to behavior
Source: C:\Users\user\Desktop\dropper.exeNtUnmapViewOfSection: Direct from: 0x7FF717449D14Jump to behavior
Source: C:\Users\user\Desktop\dropper.exeNtWriteVirtualMemory: Direct from: 0x7FF71744D0BAJump to behavior
Source: C:\Users\user\Desktop\dropper.exeNtAllocateVirtualMemory: Direct from: 0x7FF71744D076Jump to behavior
Source: C:\Users\user\Desktop\dropper.exeNtCreateFile: Direct from: 0x7FF71757F485Jump to behavior
Source: C:\Users\user\Desktop\dropper.exeNtClose: Direct from: 0x7FF717449E04
Source: C:\Users\user\Desktop\dropper.exeNtWriteFile: Direct from: 0x7FF71757F617Jump to behavior
Injects code into the Windows Explorer (explorer.exe)
Source: C:\Windows\System32\cmd.exeMemory written: PID: 4904 base: 3250000 value: 43Jump to behavior
Writes to foreign memory regions
Source: C:\Users\user\Desktop\dropper.exeMemory written: C:\Windows\System32\cmd.exe base: 2A389A50000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\winlogon.exe base: 14B12FD0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\lsass.exe base: 23C49C60000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 17381780000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\fontdrvhost.exe base: 24E94960000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\fontdrvhost.exe base: 2024A8F0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 14232DF0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 18A89190000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\dwm.exe base: 1364C3F0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 2116B9A0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 28EFA9C0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 19114DF0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 1F7F97F0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 2AA81E90000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_3ea756ac68d34d21\IntelCpHDCPSvc.exe base: 1D515C00000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 1F926890000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 24C3C5D0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 1C7991A0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 284B66B0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_3ea756ac68d34d21\IntelCpHeciSvc.exe base: 1FACCCF0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\DriverStore\FileRepository\cui_dch.inf_amd64_2e49f48165b8de10\igfxCUIService.exe base: 243C69F0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 1C3B9BC0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 1A5AA5D0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 1AFB13E0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 29DAE3A0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 1B1247F0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 263CF7C0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 18B611D0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 271FA8F0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 1B7462E0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 2849D300000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 1223B7C0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 1F483540000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 1BDE13E0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 275D2960000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 1FF40050000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 277F1FA0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\spoolsv.exe base: AF0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 21DE4B60000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 1DB66FB0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 193A6FD0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 2556E3F0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 14DF0610000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 293E6CB0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 20CFAE70000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 21F959C0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 1F35B070000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\DriverStore\FileRepository\igcc_dch.inf_amd64_78ff17a5ea060c5f\OneApp.IGCC.WinService.exe base: 15B2AC10000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\DriverStore\FileRepository\dal.inf_amd64_ffc75848a6342fdf\jhi_service.exe base: 1B6A05B0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 1C349DF0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe base: 15FD7370000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 1BD0E7B0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 1CD4CB10000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 15AB2DC0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 20D01230000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 13046910000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\sihost.exe base: 145F56E0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 1843B2A0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe base: AF0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 20C343A0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 28E51F50000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 1D314BD0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\explorer.exe base: 3250000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 1E2FC150000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\ctfmon.exe base: 18E9FAE0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\DriverStore\FileRepository\cui_dch.inf_amd64_2e49f48165b8de10\igfxEM.exe base: 1D407810000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 26486790000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe base: 131EEE90000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 1A79E1F0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe base: 256252F0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 23406BB0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 13EAA7C0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe base: 22D13140000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\SettingSyncHost.exe base: 1AA7D680000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe base: 237AE3A0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\audiodg.exe base: 207007A0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 215DEF80000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\dllhost.exe base: 16A2F330000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 24A7A7E0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\smartscreen.exe base: 19769490000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe base: 720000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 270E7010000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 1A2CCD40000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\ImmersiveControlPanel\SystemSettings.exe base: 2ACEBC60000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\ApplicationFrameHost.exe base: 1D0F70F0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\oobe\UserOOBEBroker.exe base: 2415A940000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 27988FD0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 247253C0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 3E50000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 3E60000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 3E70000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 3E80000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 3E90000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 3EA0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 3EB0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 3EC0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 3ED0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 3EE0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 3EF0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 3F00000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\SysWOW64\wbem\WmiPrvSE.exe base: 3F10000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\conhost.exe base: 21B45D30000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\dllhost.exe base: 2345D7D0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\svchost.exe base: 170C7BD0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\RuntimeBroker.exe base: 20277290000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\HIaYRicsTUfNXcHRFqTKkoRDoDLvlDWoXLjNkXUxSJoCDFo\VMnHzzBmrGBRTmIKxghsYrLL.exe base: 950000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\HIaYRicsTUfNXcHRFqTKkoRDoDLvlDWoXLjNkXUxSJoCDFo\VMnHzzBmrGBRTmIKxghsYrLL.exe base: A40000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\HIaYRicsTUfNXcHRFqTKkoRDoDLvlDWoXLjNkXUxSJoCDFo\VMnHzzBmrGBRTmIKxghsYrLL.exe base: 10D0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\HIaYRicsTUfNXcHRFqTKkoRDoDLvlDWoXLjNkXUxSJoCDFo\VMnHzzBmrGBRTmIKxghsYrLL.exe base: A00000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\HIaYRicsTUfNXcHRFqTKkoRDoDLvlDWoXLjNkXUxSJoCDFo\VMnHzzBmrGBRTmIKxghsYrLL.exe base: 750000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\HIaYRicsTUfNXcHRFqTKkoRDoDLvlDWoXLjNkXUxSJoCDFo\VMnHzzBmrGBRTmIKxghsYrLL.exe base: 6D0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\HIaYRicsTUfNXcHRFqTKkoRDoDLvlDWoXLjNkXUxSJoCDFo\VMnHzzBmrGBRTmIKxghsYrLL.exe base: BA0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\HIaYRicsTUfNXcHRFqTKkoRDoDLvlDWoXLjNkXUxSJoCDFo\VMnHzzBmrGBRTmIKxghsYrLL.exe base: AA0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\HIaYRicsTUfNXcHRFqTKkoRDoDLvlDWoXLjNkXUxSJoCDFo\VMnHzzBmrGBRTmIKxghsYrLL.exe base: 13B0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\HIaYRicsTUfNXcHRFqTKkoRDoDLvlDWoXLjNkXUxSJoCDFo\VMnHzzBmrGBRTmIKxghsYrLL.exe base: D60000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\HIaYRicsTUfNXcHRFqTKkoRDoDLvlDWoXLjNkXUxSJoCDFo\VMnHzzBmrGBRTmIKxghsYrLL.exe base: 11D0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\HIaYRicsTUfNXcHRFqTKkoRDoDLvlDWoXLjNkXUxSJoCDFo\VMnHzzBmrGBRTmIKxghsYrLL.exe base: B10000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\HIaYRicsTUfNXcHRFqTKkoRDoDLvlDWoXLjNkXUxSJoCDFo\VMnHzzBmrGBRTmIKxghsYrLL.exe base: AD0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\HIaYRicsTUfNXcHRFqTKkoRDoDLvlDWoXLjNkXUxSJoCDFo\VMnHzzBmrGBRTmIKxghsYrLL.exe base: 1030000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\HIaYRicsTUfNXcHRFqTKkoRDoDLvlDWoXLjNkXUxSJoCDFo\VMnHzzBmrGBRTmIKxghsYrLL.exe base: FD0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\HIaYRicsTUfNXcHRFqTKkoRDoDLvlDWoXLjNkXUxSJoCDFo\VMnHzzBmrGBRTmIKxghsYrLL.exe base: 1200000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\HIaYRicsTUfNXcHRFqTKkoRDoDLvlDWoXLjNkXUxSJoCDFo\VMnHzzBmrGBRTmIKxghsYrLL.exe base: 12A0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\HIaYRicsTUfNXcHRFqTKkoRDoDLvlDWoXLjNkXUxSJoCDFo\VMnHzzBmrGBRTmIKxghsYrLL.exe base: 1410000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\HIaYRicsTUfNXcHRFqTKkoRDoDLvlDWoXLjNkXUxSJoCDFo\VMnHzzBmrGBRTmIKxghsYrLL.exe base: 1200000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\HIaYRicsTUfNXcHRFqTKkoRDoDLvlDWoXLjNkXUxSJoCDFo\VMnHzzBmrGBRTmIKxghsYrLL.exe base: 1080000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\HIaYRicsTUfNXcHRFqTKkoRDoDLvlDWoXLjNkXUxSJoCDFo\VMnHzzBmrGBRTmIKxghsYrLL.exe base: 1130000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\HIaYRicsTUfNXcHRFqTKkoRDoDLvlDWoXLjNkXUxSJoCDFo\VMnHzzBmrGBRTmIKxghsYrLL.exe base: 1400000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\HIaYRicsTUfNXcHRFqTKkoRDoDLvlDWoXLjNkXUxSJoCDFo\VMnHzzBmrGBRTmIKxghsYrLL.exe base: 1320000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\HIaYRicsTUfNXcHRFqTKkoRDoDLvlDWoXLjNkXUxSJoCDFo\VMnHzzBmrGBRTmIKxghsYrLL.exe base: BC0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\HIaYRicsTUfNXcHRFqTKkoRDoDLvlDWoXLjNkXUxSJoCDFo\VMnHzzBmrGBRTmIKxghsYrLL.exe base: 520000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\HIaYRicsTUfNXcHRFqTKkoRDoDLvlDWoXLjNkXUxSJoCDFo\VMnHzzBmrGBRTmIKxghsYrLL.exe base: 1020000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\HIaYRicsTUfNXcHRFqTKkoRDoDLvlDWoXLjNkXUxSJoCDFo\VMnHzzBmrGBRTmIKxghsYrLL.exe base: B80000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\HIaYRicsTUfNXcHRFqTKkoRDoDLvlDWoXLjNkXUxSJoCDFo\VMnHzzBmrGBRTmIKxghsYrLL.exe base: BB0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\HIaYRicsTUfNXcHRFqTKkoRDoDLvlDWoXLjNkXUxSJoCDFo\VMnHzzBmrGBRTmIKxghsYrLL.exe base: 11D0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\HIaYRicsTUfNXcHRFqTKkoRDoDLvlDWoXLjNkXUxSJoCDFo\VMnHzzBmrGBRTmIKxghsYrLL.exe base: 160000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\HIaYRicsTUfNXcHRFqTKkoRDoDLvlDWoXLjNkXUxSJoCDFo\VMnHzzBmrGBRTmIKxghsYrLL.exe base: C60000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\HIaYRicsTUfNXcHRFqTKkoRDoDLvlDWoXLjNkXUxSJoCDFo\VMnHzzBmrGBRTmIKxghsYrLL.exe base: C50000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\HIaYRicsTUfNXcHRFqTKkoRDoDLvlDWoXLjNkXUxSJoCDFo\VMnHzzBmrGBRTmIKxghsYrLL.exe base: B10000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\HIaYRicsTUfNXcHRFqTKkoRDoDLvlDWoXLjNkXUxSJoCDFo\VMnHzzBmrGBRTmIKxghsYrLL.exe base: 1450000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\HIaYRicsTUfNXcHRFqTKkoRDoDLvlDWoXLjNkXUxSJoCDFo\VMnHzzBmrGBRTmIKxghsYrLL.exe base: 760000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\HIaYRicsTUfNXcHRFqTKkoRDoDLvlDWoXLjNkXUxSJoCDFo\VMnHzzBmrGBRTmIKxghsYrLL.exe base: B80000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\HIaYRicsTUfNXcHRFqTKkoRDoDLvlDWoXLjNkXUxSJoCDFo\VMnHzzBmrGBRTmIKxghsYrLL.exe base: 1210000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\HIaYRicsTUfNXcHRFqTKkoRDoDLvlDWoXLjNkXUxSJoCDFo\VMnHzzBmrGBRTmIKxghsYrLL.exe base: DA0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\HIaYRicsTUfNXcHRFqTKkoRDoDLvlDWoXLjNkXUxSJoCDFo\VMnHzzBmrGBRTmIKxghsYrLL.exe base: 1C0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\HIaYRicsTUfNXcHRFqTKkoRDoDLvlDWoXLjNkXUxSJoCDFo\VMnHzzBmrGBRTmIKxghsYrLL.exe base: FC0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\HIaYRicsTUfNXcHRFqTKkoRDoDLvlDWoXLjNkXUxSJoCDFo\VMnHzzBmrGBRTmIKxghsYrLL.exe base: 750000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\HIaYRicsTUfNXcHRFqTKkoRDoDLvlDWoXLjNkXUxSJoCDFo\VMnHzzBmrGBRTmIKxghsYrLL.exe base: 6F0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\HIaYRicsTUfNXcHRFqTKkoRDoDLvlDWoXLjNkXUxSJoCDFo\VMnHzzBmrGBRTmIKxghsYrLL.exe base: 780000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\HIaYRicsTUfNXcHRFqTKkoRDoDLvlDWoXLjNkXUxSJoCDFo\VMnHzzBmrGBRTmIKxghsYrLL.exe base: 14A0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\HIaYRicsTUfNXcHRFqTKkoRDoDLvlDWoXLjNkXUxSJoCDFo\VMnHzzBmrGBRTmIKxghsYrLL.exe base: D70000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\HIaYRicsTUfNXcHRFqTKkoRDoDLvlDWoXLjNkXUxSJoCDFo\VMnHzzBmrGBRTmIKxghsYrLL.exe base: 8A0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\HIaYRicsTUfNXcHRFqTKkoRDoDLvlDWoXLjNkXUxSJoCDFo\VMnHzzBmrGBRTmIKxghsYrLL.exe base: 1060000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\HIaYRicsTUfNXcHRFqTKkoRDoDLvlDWoXLjNkXUxSJoCDFo\VMnHzzBmrGBRTmIKxghsYrLL.exe base: 400000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\HIaYRicsTUfNXcHRFqTKkoRDoDLvlDWoXLjNkXUxSJoCDFo\VMnHzzBmrGBRTmIKxghsYrLL.exe base: B10000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\HIaYRicsTUfNXcHRFqTKkoRDoDLvlDWoXLjNkXUxSJoCDFo\VMnHzzBmrGBRTmIKxghsYrLL.exe base: B90000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\HIaYRicsTUfNXcHRFqTKkoRDoDLvlDWoXLjNkXUxSJoCDFo\VMnHzzBmrGBRTmIKxghsYrLL.exe base: 1130000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\HIaYRicsTUfNXcHRFqTKkoRDoDLvlDWoXLjNkXUxSJoCDFo\VMnHzzBmrGBRTmIKxghsYrLL.exe base: 9C0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\HIaYRicsTUfNXcHRFqTKkoRDoDLvlDWoXLjNkXUxSJoCDFo\VMnHzzBmrGBRTmIKxghsYrLL.exe base: 590000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\HIaYRicsTUfNXcHRFqTKkoRDoDLvlDWoXLjNkXUxSJoCDFo\VMnHzzBmrGBRTmIKxghsYrLL.exe base: 740000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\HIaYRicsTUfNXcHRFqTKkoRDoDLvlDWoXLjNkXUxSJoCDFo\VMnHzzBmrGBRTmIKxghsYrLL.exe base: 9F0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\HIaYRicsTUfNXcHRFqTKkoRDoDLvlDWoXLjNkXUxSJoCDFo\VMnHzzBmrGBRTmIKxghsYrLL.exe base: FA0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\HIaYRicsTUfNXcHRFqTKkoRDoDLvlDWoXLjNkXUxSJoCDFo\VMnHzzBmrGBRTmIKxghsYrLL.exe base: D50000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\HIaYRicsTUfNXcHRFqTKkoRDoDLvlDWoXLjNkXUxSJoCDFo\VMnHzzBmrGBRTmIKxghsYrLL.exe base: 11A0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\HIaYRicsTUfNXcHRFqTKkoRDoDLvlDWoXLjNkXUxSJoCDFo\VMnHzzBmrGBRTmIKxghsYrLL.exe base: 11E0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\HIaYRicsTUfNXcHRFqTKkoRDoDLvlDWoXLjNkXUxSJoCDFo\VMnHzzBmrGBRTmIKxghsYrLL.exe base: 1100000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\HIaYRicsTUfNXcHRFqTKkoRDoDLvlDWoXLjNkXUxSJoCDFo\VMnHzzBmrGBRTmIKxghsYrLL.exe base: 700000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\HIaYRicsTUfNXcHRFqTKkoRDoDLvlDWoXLjNkXUxSJoCDFo\VMnHzzBmrGBRTmIKxghsYrLL.exe base: 900000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\HIaYRicsTUfNXcHRFqTKkoRDoDLvlDWoXLjNkXUxSJoCDFo\VMnHzzBmrGBRTmIKxghsYrLL.exe base: 730000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\HIaYRicsTUfNXcHRFqTKkoRDoDLvlDWoXLjNkXUxSJoCDFo\VMnHzzBmrGBRTmIKxghsYrLL.exe base: 6E0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\HIaYRicsTUfNXcHRFqTKkoRDoDLvlDWoXLjNkXUxSJoCDFo\VMnHzzBmrGBRTmIKxghsYrLL.exe base: 6F0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\HIaYRicsTUfNXcHRFqTKkoRDoDLvlDWoXLjNkXUxSJoCDFo\VMnHzzBmrGBRTmIKxghsYrLL.exe base: AF0000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\HIaYRicsTUfNXcHRFqTKkoRDoDLvlDWoXLjNkXUxSJoCDFo\VMnHzzBmrGBRTmIKxghsYrLL.exe base: 820000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\HIaYRicsTUfNXcHRFqTKkoRDoDLvlDWoXLjNkXUxSJoCDFo\VMnHzzBmrGBRTmIKxghsYrLL.exe base: F70000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\HIaYRicsTUfNXcHRFqTKkoRDoDLvlDWoXLjNkXUxSJoCDFo\VMnHzzBmrGBRTmIKxghsYrLL.exe base: 1040000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Program Files (x86)\HIaYRicsTUfNXcHRFqTKkoRDoDLvlDWoXLjNkXUxSJoCDFo\VMnHzzBmrGBRTmIKxghsYrLL.exe base: 1390000Jump to behavior
Source: C:\Windows\System32\cmd.exeMemory written: C:\Windows\System32\wbem\WmiPrvSE.exe base: 1FA55D70000Jump to behavior
Source: C:\Windows\System32\lsass.exeMemory written: C:\Windows\System32\svchost.exe base: 14233110000Jump to behavior
Source: C:\Windows\System32\lsass.exeMemory written: C:\Windows\System32\svchost.exe base: 1223B7E0000Jump to behavior
Source: C:\Windows\System32\lsass.exeMemory written: C:\Windows\System32\svchost.exe base: 142330E0000Jump to behavior
Source: dwm.exe, 0000000D.00000002.4345765447.0000013643B6F000.00000004.00000020.00020000.00000000.sdmp, dwm.exe, 0000000D.00000000.2569495552.0000013643B6F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Program Manager
Source: winlogon.exe, 00000006.00000000.2550048177.0000014B13851000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000006.00000002.4302648467.0000014B13851000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 0000000D.00000000.2570712252.0000013644281000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Shell_TrayWnd
Source: winlogon.exe, 00000006.00000000.2550048177.0000014B13851000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000006.00000002.4302648467.0000014B13851000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 0000000D.00000000.2570712252.0000013644281000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progman
Source: winlogon.exe, 00000006.00000000.2550048177.0000014B13851000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000006.00000002.4302648467.0000014B13851000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 0000000D.00000000.2570712252.0000013644281000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: Progmanlock
Source: winlogon.exe, 00000006.00000000.2550048177.0000014B13851000.00000002.00000001.00040000.00000000.sdmp, winlogon.exe, 00000006.00000002.4302648467.0000014B13851000.00000002.00000001.00040000.00000000.sdmp, dwm.exe, 0000000D.00000000.2570712252.0000013644281000.00000002.00000001.00040000.00000000.sdmpBinary or memory string: kProgram ManagerT
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\Windows\Temp\tempdll.dll VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\dropper.exeCode function: 0_2_00007FF717597C2C GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,0_2_00007FF717597C2C

Lowering of HIPS / PFW / Operating System Security Settings

barindex
Changes security center settings (notifications, updates, antivirus, firewall)
Source: C:\Windows\System32\cmd.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center FirewallOverrideJump to behavior
Disable Windows Defender real time protection (registry)
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows DefenderRegistry value created: DisableAntiSpyware 1Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows DefenderRegistry value created: DisableAntiVirus 1Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\MpEngineRegistry value created: MpEnablePus 1Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time ProtectionRegistry value created: DisableBehaviorMonitoring 1Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time ProtectionRegistry value created: DisableIOAVProtection 1Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time ProtectionRegistry value created: DisableOnAccessProtection 1Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time ProtectionRegistry value created: DisableRealtimeMonitoring 1Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time ProtectionRegistry value created: DisableScanOnRealtimeEnable 1Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\ReportingRegistry value created: DisableEnhancedNotifications 1Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNetRegistry value created: DisableBlockAtFirstSeen 1Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNetRegistry value created: SpynetReporting 1Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\SpyNetRegistry value created: SubmitSamplesConsent 1Jump to behavior
Source: Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx.22.drBinary or memory string: C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2108.7-0\MsMpEng.exe

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
Native API		1
Windows Service		1
Access Token Manipulation		1
Masquerading		OS Credential Dumping1
System Time Discovery		Remote Services1
Archive Collected Data		2
Encrypted Channel		Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault AccountsScheduled Task/Job11
Registry Run Keys / Startup Folder		1
Windows Service		13
Virtualization/Sandbox Evasion		LSASS Memory61
Security Software Discovery		Remote Desktop ProtocolData from Removable MediaJunk DataExfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAt1
LSASS Driver		42
Process Injection		31
Disable or Modify Tools		Security Account Manager13
Virtualization/Sandbox Evasion		SMB/Windows Admin SharesData from Network Shared DriveSteganographyAutomated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCron1
DLL Side-Loading		1
Abuse Elevation Control Mechanism		1
Access Token Manipulation		NTDS3
Process Discovery		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script11
Registry Run Keys / Startup Folder		42
Process Injection		LSA Secrets1
Remote System Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts1
LSASS Driver		1
Deobfuscate/Decode Files or Information		Cached Domain Credentials1
File and Directory Discovery		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup Items1
DLL Side-Loading		1
Abuse Elevation Control Mechanism		DCSync22
System Information Discovery		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/Job1
Bypass User Account Control		1
Obfuscated Files or Information		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt1
DLL Side-Loading		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron1
Bypass User Account Control		Network SniffingNetwork Service DiscoveryShared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
dropper.exe8%VirustotalBrowse

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
https://word.office.com.comory0%Avira URL Cloudsafe
https://outlook.comcom0%Avira URL Cloudsafe
https://word.office.com.com0%Avira URL Cloudsafe
https://excel.office.comSRD1%0%Avira URL Cloudsafe
https://powerpoint.office.comSRD130%Avira URL Cloudsafe
https://word.office.comSRD1#0%Avira URL Cloudsafe
https://outlook.comSRD1-0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

NameSourceMaliciousAntivirus DetectionReputation
https://word.office.comsvchost.exe, 00000028.00000002.4336314019.000001FF408E4000.00000004.00000001.00020000.00000000.sdmpfalse
    		high
    http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702lsass.exe, 00000007.00000002.4277761912.0000023C4962E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2552046187.0000023C4962E000.00000004.00000001.00020000.00000000.sdmpfalse
      		high
      https://windows.msn.com/shellsvchost.exe, 00000008.00000000.2557840708.000001738101F000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4319974116.000001738101F000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000008.00000000.2556743069.00000173806AE000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4296129717.00000173806AE000.00000004.00000001.00020000.00000000.sdmpfalse
        		high
        http://schemas.xmlsoap.org/ws/2004/09/policylsass.exe, 00000007.00000002.4277761912.0000023C4962E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2552046187.0000023C4962E000.00000004.00000001.00020000.00000000.sdmpfalse
          		high
          http://schemas.xmlsoap.org/wsdl/ertieslsass.exe, 00000007.00000002.4277761912.0000023C4962E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2552046187.0000023C4962E000.00000004.00000001.00020000.00000000.sdmpfalse
            		high
            https://wns2-ch1p.notify.windows.com/?token=AwYAAAA0qUCblRLXYIZevE%2bmLQlefqcv3h4wEzuouckPnJzjdA2VgTMicrosoft-Windows-PushNotification-Platform%4Operational.evtx.22.drfalse
              		high
              https://outlook.comcomsvchost.exe, 00000028.00000000.2678394704.000001FF40B3C000.00000004.00000001.00020000.00000000.sdmpfalse
              • Avira URL Cloud: safe
              		unknown
              https://docs.rs/getrandom#nodejs-es-module-supportdropper.exe, tempdll.dll.0.drfalse
                		high
                https://www.office.com/pwaimagessvchost.exe, 00000028.00000002.4336816715.000001FF40984000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000028.00000000.2677605092.000001FF40984000.00000004.00000001.00020000.00000000.sdmpfalse
                  		high
                  http://schemas.xmlsoap.org/ws/2005/02/trustlsass.exe, 00000007.00000002.4278914514.0000023C49650000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2552091093.0000023C49650000.00000004.00000001.00020000.00000000.sdmpfalse
                    		high
                    http://schemas.microsvchost.exe, 00000015.00000002.4295455670.0000024C3C520000.00000002.00000001.00040000.00000000.sdmpfalse
                      		high
                      https://outlook.comsvchost.exe, 00000028.00000000.2678394704.000001FF40B3C000.00000004.00000001.00020000.00000000.sdmpfalse
                        		high
                        https://word.office.com.comorysvchost.exe, 00000028.00000000.2677479128.000001FF408E4000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.4336314019.000001FF408E4000.00000004.00000001.00020000.00000000.sdmpfalse
                        • Avira URL Cloud: safe
                        		unknown
                        http://schemas.xmlsoap.org/ws/2005/07/securitypolicylsass.exe, 00000007.00000002.4278914514.0000023C49650000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000002.4277761912.0000023C4962E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2552091093.0000023C49650000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2552046187.0000023C4962E000.00000004.00000001.00020000.00000000.sdmpfalse
                          		high
                          https://word.office.com.comsvchost.exe, 00000028.00000000.2677479128.000001FF408E4000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000028.00000002.4336314019.000001FF408E4000.00000004.00000001.00020000.00000000.sdmpfalse
                          • Avira URL Cloud: safe
                          		unknown
                          https://wns2-ch1p.notify.windows.com/?token=AwYAAABGUrF%2b1sXEjJggZdLxqERBktUbt%2fKiMEYjoor2hY%2b581Microsoft-Windows-PushNotification-Platform%4Operational.evtx.22.drfalse
                            		high
                            https://excel.office.comSRD1%svchost.exe, 00000028.00000000.2679256726.000001FF40C5C000.00000004.00000001.00020000.00000000.sdmpfalse
                            • Avira URL Cloud: safe
                            		unknown
                            http://schemas.xmlsoap.org/wsdl/soap12/lsass.exe, 00000007.00000002.4277761912.0000023C4962E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2552046187.0000023C4962E000.00000004.00000001.00020000.00000000.sdmpfalse
                              		high
                              https://spclient.wg.spotify.com/v1/live-tile-xml?region=svchost.exe, 00000008.00000000.2558119838.0000017381084000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4327160465.0000017381084000.00000004.00000001.00020000.00000000.sdmpfalse
                                		high
                                http://schemas.xmlsoap.org/wsdl/lsass.exe, 00000007.00000002.4277761912.0000023C4962E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2552046187.0000023C4962E000.00000004.00000001.00020000.00000000.sdmpfalse
                                  		high
                                  https://powerpoint.office.comSRD13svchost.exe, 00000028.00000000.2679256726.000001FF40C5C000.00000004.00000001.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  http://schemas.xmlsoap.org/wsdl/soap12/Plsass.exe, 00000007.00000002.4277761912.0000023C4962E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2552046187.0000023C4962E000.00000004.00000001.00020000.00000000.sdmpfalse
                                    		high
                                    https://outlook.comSRD1-svchost.exe, 00000028.00000000.2679256726.000001FF40C5C000.00000004.00000001.00020000.00000000.sdmpfalse
                                    • Avira URL Cloud: safe
                                    		unknown
                                    https://windows.msn.cn/shellRESPsvchost.exe, 00000008.00000000.2557840708.000001738101F000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4319974116.000001738101F000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000008.00000000.2556743069.00000173806AE000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000008.00000002.4296129717.00000173806AE000.00000004.00000001.00020000.00000000.sdmpfalse
                                      		high
                                      http://www.quovadis.bm0lsass.exe, 00000007.00000003.2877090957.0000023C49EF2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2552906470.0000023C49EF3000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000002.4306518026.0000023C49EF3000.00000004.00000001.00020000.00000000.sdmp, dwm.exe, 0000000D.00000002.4355377873.0000013646269000.00000004.00000001.00020000.00000000.sdmp, dwm.exe, 0000000D.00000000.2571316086.0000013646269000.00000004.00000001.00020000.00000000.sdmpfalse
                                        		high
                                        https://word.office.comSRD1#svchost.exe, 00000028.00000000.2677049721.000001FF407D7000.00000004.00000001.00020000.00000000.sdmp, svchost.exe, 00000028.00000000.2679256726.000001FF40C5C000.00000004.00000001.00020000.00000000.sdmpfalse
                                        • Avira URL Cloud: safe
                                        		unknown
                                        http://docs.oasis-open.org/ws-sx/ws-trust/200512lsass.exe, 00000007.00000002.4278914514.0000023C49650000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2552091093.0000023C49650000.00000004.00000001.00020000.00000000.sdmpfalse
                                          		high
                                          http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdlsass.exe, 00000007.00000002.4277761912.0000023C4962E000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2552046187.0000023C4962E000.00000004.00000001.00020000.00000000.sdmpfalse
                                            		high
                                            http://ns.adobe.dropper.exefalse
                                              		high
                                              https://ocsp.quovadisoffshore.com0lsass.exe, 00000007.00000003.2877090957.0000023C49EF2000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000000.2552906470.0000023C49EF3000.00000004.00000001.00020000.00000000.sdmp, lsass.exe, 00000007.00000002.4306518026.0000023C49EF3000.00000004.00000001.00020000.00000000.sdmp, dwm.exe, 0000000D.00000002.4355377873.0000013646269000.00000004.00000001.00020000.00000000.sdmp, dwm.exe, 0000000D.00000000.2571316086.0000013646269000.00000004.00000001.00020000.00000000.sdmpfalse
                                                		high

                                                World Map of Contacted IPs

                                                • No. of IPs < 25%
                                                • 25% < No. of IPs < 50%
                                                • 50% < No. of IPs < 75%
                                                • 75% < No. of IPs

                                                Public IPs

                                                IPDomainCountryFlagASNASN NameMalicious
                                                1.1.1.1
                                                		unknownAustralia
                                                		13335CLOUDFLARENETUSfalse

                                                General Information

                                                Joe Sandbox version:41.0.0 Charoite
                                                Analysis ID:1586515
                                                Start date and time:2025-01-09 08:56:57 +01:00
                                                Joe Sandbox product:CloudBasic
                                                Overall analysis duration:0h 11m 56s
                                                Hypervisor based Inspection enabled:false
                                                Report type:full
                                                Cookbook file name:default.jbs
                                                Analysis system description:Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 128, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
                                                Run name:Run with higher sleep bypass
                                                Number of analysed new started processes analysed:6
                                                Number of new started drivers analysed:0
                                                Number of existing processes analysed:0
                                                Number of existing drivers analysed:0
                                                Number of injected processes analysed:37
                                                Technologies:
                                                • HCA enabled
                                                • EGA enabled
                                                • AMSI enabled
                                                Analysis Mode:default
                                                Analysis stop reason:Timeout
                                                Sample name:dropper.exe
                                                Detection:MAL
                                                Classification:mal66.evad.winEXE@5/60@0/1
                                                EGA Information:
                                                • Successful, ratio: 100%
                                                HCA Information:
                                                • Successful, ratio: 63%
                                                • Number of executed functions: 50
                                                • Number of non-executed functions: 66
                                                Cookbook Comments:
                                                • Found application associated with file extension: .exe
                                                • Sleeps bigger than 100000000ms are automatically reduced to 1000ms
                                                • Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

                                                Warnings

                                                • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe
                                                • Excluded domains from analysis (whitelisted): ctldl.windowsupdate.com
                                                • Not all processes where analyzed, report is missing behavior information
                                                • Report size exceeded maximum capacity and may have missing behavior information.

                                                Simulations

                                                Behavior and APIs

                                                ⊘No simulations

                                                Joe Sandbox View / Context

                                                IPs

                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                1.1.1.1watchdog.elfGet hashmaliciousXmrigBrowse
                                                • 1.1.1.1:8080/
                                                6fW0GedR6j.xlsGet hashmaliciousUnknownBrowse
                                                • 1.1.1.1/ctrl/playback.php
                                                PO-230821_pdf.exeGet hashmaliciousFormBook, NSISDropperBrowse
                                                • www.974dp.com/sn26/?kJBLpb8=qaEGeuQorcUQurUZCuE8d9pas+Z0M0brqtX248JBolEfq8j8F1R9i1jKZexhxY54UlRG&ML0tl=NZlpi
                                                AFfv8HpACF.exeGet hashmaliciousUnknownBrowse
                                                • 1.1.1.1/
                                                INVOICE_90990_PDF.exeGet hashmaliciousFormBookBrowse
                                                • www.quranvisor.com/usvr/?mN9d3vF=HHrW7cA9N4YJlebHFvlsdlDciSnnaQItEG8Ccfxp291VjnjcuwoPACt7EOqEq4SWjIf8&Pjf81=-Zdd-V5hqhM4p2S
                                                Go.exeGet hashmaliciousUnknownBrowse
                                                • 1.1.1.1/

                                                Domains

                                                ⊘No context

                                                ASNs

                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                CLOUDFLARENETUShttps://t.co/qNQo33w8wDGet hashmaliciousHTMLPhisherBrowse
                                                • 104.18.95.41
                                                chrtrome22.exeGet hashmaliciousXmrigBrowse
                                                • 172.67.144.26
                                                uU6IvUPN39.exeGet hashmaliciousLummaCBrowse
                                                • 104.21.96.1
                                                QUOTATION#050125.exeGet hashmaliciousFormBookBrowse
                                                • 104.21.64.1
                                                xCnwCctDWC.exeGet hashmaliciousLummaCBrowse
                                                • 104.21.56.70
                                                DLKs2Qeljg.exeGet hashmaliciousLummaCBrowse
                                                • 104.21.56.70
                                                fuk7RfLrD3.exeGet hashmaliciousLummaCBrowse
                                                • 104.21.80.1
                                                Ljrprfl3BH.exeGet hashmaliciousLummaCBrowse
                                                • 104.21.64.1
                                                PO1178236.scr.exeGet hashmaliciousUnknownBrowse
                                                • 188.114.96.3

                                                JA3 Fingerprints

                                                ⊘No context

                                                Dropped Files

                                                ⊘No context

                                                Created / dropped Files

                                                C:\Windows\System32\winevt\Logs\Microsoft-Client-Licensing-Platform%4Admin.evtx

                                                Download File
                                                Process:C:\Windows\System32\svchost.exe
                                                File Type:data
                                                Category:dropped
                                                Size (bytes):65536
                                                Entropy (8bit):4.318921063941224
                                                Encrypted:false
                                                SSDEEP:192:r8V7IF0RuqHQOnbgpib8AtYl+HDJ86PL+2SSD2Czp0gy16ZcC0/oUhQXzgwPtFqJ:YhkyHQOLt5jR7zpkYQ9DM/TG6OtiY
                                                MD5:107D65899D011B0312FAE3424FCFA40D
                                                SHA1:D6A65864C13C74D73A44101393ADDF63C551E952
                                                SHA-256:AA8C3875023E1B58E9A0103F192F4891EB53E7792AACD379F2B686BA00BA1C84
                                                SHA-512:E208F93AD2FDFCA7B3233DDAA9A783B7CDF31669F57CF26F25CDA5FA9B95E382F8CA1CE9B31CDE83BDAB7C54D21EABDEA8E317DDB16AFC180679252B397ECB37
                                                Malicious:false
                                                Preview:ElfChnk.u...............u............................DA.........................................................................................0.......................X...=...........................................................................................................................f...............?...........................m...................M...F...............................................................&...............................9...........................).......................**......u.........K.i........./X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx

                                                Download File
                                                Process:C:\Windows\System32\svchost.exe
                                                File Type:data
                                                Category:dropped
                                                Size (bytes):65536
                                                Entropy (8bit):1.4710575483983994
                                                Encrypted:false
                                                SSDEEP:384:hhBNimLN3UN3pNINcN3uN36ZN3fcN3dN3xzN3lN3RN3sN3YN3zN3TN3JN3xN3kNa:hAaC30SyTx57f6u5Z3/y2FpwsHT
                                                MD5:E85626445B2E7E96B13C7C11DDA5E512
                                                SHA1:3078838FD9B90141077930188CB884A656FAEAD6
                                                SHA-256:3D327253B645C287DB8E6EA8B44B5F9EDAB83930C82347ED42369D8E76581122
                                                SHA-512:D6F3A2F5D2A1D6FE5425E40054DFF4E645228690D413775DEB4499F176E3B5DFEF96E631D92A8DA9A10FCC633CC71C9A95D52A7ABF42AC9084D6A267B4D071F1
                                                Malicious:false
                                                Preview:ElfChnk._.......y......._.......y............G..xI..........................................................................yi.................,.......................T...=...........................................................................................................................f...............?...........................m...................M...F...............................................................&...................................................................................**......_..........f,........./X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx

                                                Download File
                                                Process:C:\Windows\System32\svchost.exe
                                                File Type:data
                                                Category:dropped
                                                Size (bytes):66960
                                                Entropy (8bit):4.309213670755832
                                                Encrypted:false
                                                SSDEEP:384:kVvVwhKVQV7VdVdEV/jVAVjVKV+VsV6VxVpV5mVmVoVJVsVuVSVRVLViVfV3VFV8:3fja4ltRq6
                                                MD5:7166B7988EABFFC173E12C8BC8B29A61
                                                SHA1:744456C219BCD9B4C935FD1B0C213D046B1DFF89
                                                SHA-256:5EEA61E9C5B3B1FF89EA71084BC6BCD087226C502EF0BE6BD02EAE76D0F53B06
                                                SHA-512:280CF0C757B0FF79CE58FA08D59EA60E62B1468FCF69578C5F90B8016D6FCD2D9507661DD64DDCF1A5A53D475E758722C2E144B3D889590C3820EB389AEF5C10
                                                Malicious:false
                                                Preview:ElfChnk.|(.......(......|(.......(..........hj..0l.._]=.....................................................................i+i2................0.......................X...=...........................................................................................................................f...............?...........................m...................M...F...............................................................&............................................&...............................#......**.......(........._lb......../X.P&...............................................................@.......X...a.!.....E..........@..._lb...TB.9b...hB.9b......X....(...................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.A.p.p.X.D.e.p.l.o.y.m.e.n.t...'..Y.J.R>:..=_M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.A.p.p.X.D.e.p.l.o.y.m.e.n.t./.O.p.e.r.a.t.i.o.n.a.l...f.d.........N...M.i.c.r.o.s.o.f.t...W.i.n.d.o.w.s...S.e.a.r.c.h._.c.w.5.n.1.h.2.t.x.y.e.w.y............**.......(........._lb......../X

                                                C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx

                                                Download File
                                                Process:C:\Windows\System32\svchost.exe
                                                File Type:data
                                                Category:dropped
                                                Size (bytes):65536
                                                Entropy (8bit):4.3927131434514735
                                                Encrypted:false
                                                SSDEEP:1536:J+1fni2TDyiWAZfBzB6BbB2e7uBg23KDi/OyazwNJCmikDw:kfjDy8A
                                                MD5:CFCA4EA0B400154960AADAD949233B60
                                                SHA1:4D5AF71F902FE7EB86E47AE6376C3937AA8F3273
                                                SHA-256:900358E74F9A4A4BE81A7844AC4316097FBFFC4015EB7E728FBA62E22E55B217
                                                SHA-512:4601E2FE36735D21825A428CBB9A1603647371B7B85D353467A408EF3D8ED21F8E3D5EF2B5132403B075773DC7E89B1EA2F17AF0AF714EECC26E17BC02C1C127
                                                Malicious:false
                                                Preview:ElfChnk..'.......'.......'.......(................p.......................................................................hR..................J.......................r...=...........................................................................................................................f...............?...........................m...................M...F...............................3W..#>.......................N..&........................................8...;.......@......;5...........`..........**.......'........~........./X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                C:\Windows\System32\winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx

                                                Download File
                                                Process:C:\Windows\System32\svchost.exe
                                                File Type:data
                                                Category:dropped
                                                Size (bytes):65536
                                                Entropy (8bit):2.3392387645437127
                                                Encrypted:false
                                                SSDEEP:384:Chm+iMNEi1itiXiYiAiQiCiYiXiviCiriMiKiYili+iciSiVciji/DiQisiKi7is:C8
                                                MD5:CF71EE32A9AF1DED99BB5E02A6BAA2EA
                                                SHA1:A7DE3D01680DE1B83B7968E67F461D4AB0E5B8FF
                                                SHA-256:8D51BEF8024BACFC0D24FE09FE9D1CE8FA9F797286946155B2099AB40B09945D
                                                SHA-512:199FFA8097302A64B7DA76C9B0016E07F9740CFA3B2540415F698610789ABFABC911DFAF6B7B0DDADB43CA5C478BC9FD4BB8F492CCAF68FF7040341912BD746D
                                                Malicious:false
                                                Preview:ElfChnk.........3...............3........... z..h|..x.6f....................................................................H...............................................=...........................................................................................................................f...............?...................................b...........M...F...........................................................&.......................................................................................**..X..............w............>.&.........>..'.W.U2..9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                C:\Windows\System32\winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Telemetry.evtx

                                                Download File
                                                Process:C:\Windows\System32\svchost.exe
                                                File Type:data
                                                Category:dropped
                                                Size (bytes):65536
                                                Entropy (8bit):4.451255146327751
                                                Encrypted:false
                                                SSDEEP:384:ahI3c6dh3O3Km30v3635B33H353X3g3J3N33Lv3j3j3A3730j3ue3H3T39z3IM3M:akqL+Tl5qhdWFgwc4MElvawvMLLMI
                                                MD5:1BEA6D2BABE32FB6C6DC7D6810CCA79F
                                                SHA1:87329D4966164C88981777FF45A65357D3561C31
                                                SHA-256:EBD0DE87F91FDC6468450DA97375A772A735E73C205EEB44B56ECD865F5D1944
                                                SHA-512:78C1B23C4CCE4E8A57AC0EA862A7DC4176F4AD6D213E7608A7C368274B4504BBA3055E09B59A6E39CB1AC69FE3D6073F7211567CB013BF9B6FF64FFCF6E34236
                                                Malicious:false
                                                Preview:ElfChnk.........^...............^...........`.......}.........................................................................NT............................................=...............u...........................................................................................................H...............?...............................................M...F...........................................&................9......................................................................j...............**.................*T.........B...&.......B...._.X.$.]...+........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                C:\Windows\System32\winevt\Logs\Microsoft-Windows-Audio%4Operational.evtx

                                                Download File
                                                Process:C:\Windows\System32\svchost.exe
                                                File Type:data
                                                Category:dropped
                                                Size (bytes):65536
                                                Entropy (8bit):4.225561087538903
                                                Encrypted:false
                                                SSDEEP:768:TPcpk0+d31RzsZrczv9ezTjlRLD1xzzmfgO5WJ:14PTjX
                                                MD5:FB518DEB357E6F4907F93C4466A75AF4
                                                SHA1:72592E5C3646064DD0EAB8A66BED5E53E09EAA85
                                                SHA-256:0E4548913CBDAC3F776143052F5D8F78020ACD6FBE4A6B7F0A8390F671D57A85
                                                SHA-512:6C34487B4D729DC79EFFEDB51F0E5F94982297F71136BB43FB2B12BD372457951032EF1BB95CE2464A22A4AEFE460F5741AEADEE7CA4EFB4CEAF99F2CA811385
                                                Malicious:false
                                                Preview:ElfChnk......................................&...(............................................................................3k........................................4...=...........................................................................................................................f...............?...........................m...................M...F...............................................................&...................................................................................**...............q..f........./X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                C:\Windows\System32\winevt\Logs\Microsoft-Windows-CloudStore%4Operational.evtx

                                                Download File
                                                Process:C:\Windows\System32\svchost.exe
                                                File Type:data
                                                Category:dropped
                                                Size (bytes):65536
                                                Entropy (8bit):2.9534710557659944
                                                Encrypted:false
                                                SSDEEP:768:8l/LLKiILbXvvvD7rrXuXtPPrzbvjPH7bPL:3iZX
                                                MD5:54877A5E5BFDED41A09CA249F891113C
                                                SHA1:EA6932D0C6A12222B689B00B34C0A7A2EE222A51
                                                SHA-256:96358A1D4B7DD75107FE9C256FE0A0BB2EA1E68274CC33EF26B1EF148B4E0157
                                                SHA-512:37C635ADB1ACBA60243668261AFB8B5EF37DE381C5763AC64B22538CD571BB5EE09770B8293FD152F176D68C9F434F2E74F0AA7F39E992477A43AD3D71B1A347
                                                Malicious:false
                                                Preview:ElfChnk.........................................p......l.....................................................................z./................0.......................X...=...........................................................................................................................f...............?...........................m...................M...F...............................................................&...................................................................................**.................g,........./X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                C:\Windows\System32\winevt\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx

                                                Download File
                                                Process:C:\Windows\System32\svchost.exe
                                                File Type:data
                                                Category:dropped
                                                Size (bytes):5032
                                                Entropy (8bit):3.848230858406102
                                                Encrypted:false
                                                SSDEEP:96:C90oGkvcgrSvTLoF0+Nyod9Iop2+ioMyo9:CmogAKo6ay0+oYoMyq
                                                MD5:ACC7D5A65780366F7BB5B1C6A0C70CAC
                                                SHA1:6F1CA9B4B01187DFCF6035B7CFCD957022683217
                                                SHA-256:FC17652E7813BA5D1E4567ADDBAF43379A654D3389707BE583A4430F94F4D9DC
                                                SHA-512:58CCADE6B52DAD8B5E277F8385CA33EB7370659C1395695C5289AEA3D1020B15029EE6374E757CDC26D53A2890611E8B34BC2FA14577E96DA8AF9D514FDC7A9F
                                                Malicious:false
                                                Preview:ElfChnk.........O...............O..........................................................................................M.^.................:.......................b...=...........................................................................................................................f...............?...........................m...................M...F...............................................................M...................................-...............E{..............................**.. ...N........$}mlb......../X.P................................................................>.......V.....!..o...............$}mlb...TB.9b...VB.9b..T...H...N....................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.C.o.d.e.I.n.t.e.g.r.i.t.y..k.N.<.D..97d>7.M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.C.o.d.e.I.n.t.e.g.r.i.t.y./.O.p.e.r.a.t.i.o.n.a.l...be.`-.......be.`g..^...:@.p...............:....A..3...b...%....=.......F.i.l.e.N.a.m.e.L.e.n.g.t.h.......A..3...b...%....=.......F.i.l.e.N

                                                C:\Windows\System32\winevt\Logs\Microsoft-Windows-Containers-BindFlt%4Operational.evtx

                                                Download File
                                                Process:C:\Windows\System32\svchost.exe
                                                File Type:data
                                                Category:dropped
                                                Size (bytes):65536
                                                Entropy (8bit):2.204115040977116
                                                Encrypted:false
                                                SSDEEP:384:WhNPmP1PKPvPZl5P8P7PAPt/PU+PKP1PEPNPaPQPiPqPFDPhP6PwPXPaPZ8PWPC5:WDlvUGLpF
                                                MD5:E038308F16FA584C100864D0E93F6FFC
                                                SHA1:8D992A71D51D61D969AB1E3BFEB33F2AD76D1006
                                                SHA-256:439EC09D4A309343EEE2A4BFF5FD7B685B08BBACA85E72BB9DADD1FCC7837FCD
                                                SHA-512:7F2077AEEE85989D60F1684E2B29FE5A19F8AC4C828B246EDB82F0FDD2DA9CBF62859FADCA7D4A548F37A7923B14513858C2490640C6EC8C139B0451BBC7628F
                                                Malicious:false
                                                Preview:ElfChnk.........G...............G........... t...u...O.=.......................................................................}................N...........................=...........................................................................................................................f...............?...........................m...................M...F.......................&...................................................................................................'.......................**..x...........B...S...........w.&.........w..._.|.1+O.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                C:\Windows\System32\winevt\Logs\Microsoft-Windows-Containers-Wcifs%4Operational.evtx

                                                Download File
                                                Process:C:\Windows\System32\svchost.exe
                                                File Type:data
                                                Category:dropped
                                                Size (bytes):65536
                                                Entropy (8bit):2.1774836327332303
                                                Encrypted:false
                                                SSDEEP:768:+DbHtuYYZAqRidVY4HdYWgML/chv4PzSw05Wt19M6vz73mA4+9AxNAVBBBxZvaVI:B27
                                                MD5:B2053494271C8BD501F1F6A14398ED77
                                                SHA1:B9235BD890CB64DEF09EF6B5D20BEC0B6A289E20
                                                SHA-256:D267C10947D82C426DEC6CA6A97AD5B7D1D470FBA7EFC42DA2CBC3C0CF431D90
                                                SHA-512:19C0D559ABC6F2EFDBC650753E20A9A98C551A29420AD70FF2F356D1374C89048AFC8F33C5A1DCAEC69511EC9F10419CE834FA78C388FAE569CEB3F6DB1461AA
                                                Malicious:false
                                                Preview:ElfChnk.........G...............G............q..ps..K]7X....................................................................WWc.................F...........................=...........................................................................................................................f...............?...........................m...................M...F.......................&...........................................................................................................................**..p...........!|..S...........w.&.........w..._.|.1+O.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                C:\Windows\System32\winevt\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx

                                                Download File
                                                Process:C:\Windows\System32\svchost.exe
                                                File Type:data
                                                Category:dropped
                                                Size (bytes):65536
                                                Entropy (8bit):4.726610569402241
                                                Encrypted:false
                                                SSDEEP:384:phch15hHh0hUh4hlhhhFhhNhPhLh1hthlh6hah+hFh1hVhEhUhMhFhJhKhthPFhU:pyyJ
                                                MD5:F991DD9A3072D3BC26DC230387CD159D
                                                SHA1:CDA789CE4CBB459D0B758823A6797E1737AAE68E
                                                SHA-256:B3F18558921FFB22A7574F72D8453A7242D0FC8BDABB94DA6B70ED7CBC58C190
                                                SHA-512:2BE02162BA607C9018C19E3B285005DEFE24FA105F187CBB01A88A5AB9D41D25F23B7794150CC4296A41158FBD8BA607EF8FBE20B4C4FFA95EACBE6FC5E94F64
                                                Malicious:false
                                                Preview:ElfChnk.....................................h...X...$..........................................................................................(.......................P...=...........................................................................................................................f...............?...........................m...................M...F...................................................!i..........&...................................................................................**..X........................./X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                C:\Windows\System32\winevt\Logs\Microsoft-Windows-Crypto-NCrypt%4Operational.evtx

                                                Download File
                                                Process:C:\Windows\System32\svchost.exe
                                                File Type:data
                                                Category:dropped
                                                Size (bytes):65536
                                                Entropy (8bit):0.8373595701607074
                                                Encrypted:false
                                                SSDEEP:384:AKh7YJVYV4YcYIjYkYVpYsqYVyYV3YVfYVRYV8YV6Y:TfvzDWeMR
                                                MD5:EB0CC53F91EC70CEBB78369EF8FF9AEF
                                                SHA1:E11EA4060BD86807CF9480F9612B75F4EB136ED8
                                                SHA-256:5CDB33EFFF910D4EA1FA487A07FA529A042132C7DD6BAD89941F0246A658D557
                                                SHA-512:7A6913BD31C298E88E031854A53C330763A4B5BD1FA592237364A402D14A745F27AC67E82C9618167C10EBDADEB468A91B9AEDF435FE2B3D90E304283FBFBEA2
                                                Malicious:false
                                                Preview:ElfChnk.z...............z................... #...%...j93.......................................................................................,.......................T...=...........................................................................................................................f...............?...........................m...................M...F...............................................................&...................................................................................**..h...z.........i._........./X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                C:\Windows\System32\winevt\Logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx

                                                Download File
                                                Process:C:\Windows\System32\svchost.exe
                                                File Type:data
                                                Category:dropped
                                                Size (bytes):65536
                                                Entropy (8bit):2.7002540565761817
                                                Encrypted:false
                                                SSDEEP:384:UhDCq2cCp1Cz2TCLqCM2CZCjiCsCblCnC/iCsCe5CECOwCFCkUCXCUoCjCtorCrZ:UUEJ2R
                                                MD5:6FD56FC7B2B59E6DA7B2E30887C66A8A
                                                SHA1:AF3BA58A11F265DC3BB70B8A60D870576F6CF7D1
                                                SHA-256:29C14708761C6D103808FA1A2F1BAC79B4FCA2AB5595AF53CEA41762E076FEEF
                                                SHA-512:122CF8EC017DE71C698ACF01FE60DF4F6363D5E0D05496232514F3F9682D64CEE951662257D2056C3D88375E8D691BD9F50373C0466AC4AA882012B92DF0E257
                                                Malicious:false
                                                Preview:ElfChnk.m...............m..........................x..c....................................................................'..^............................................=...........................................................................................................................f...............?...........................m...................M...F...............................................................&...................................................................................**.. ...m.........*13........./X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx

                                                Download File
                                                Process:C:\Windows\System32\svchost.exe
                                                File Type:data
                                                Category:dropped
                                                Size (bytes):65536
                                                Entropy (8bit):4.954437944090993
                                                Encrypted:false
                                                SSDEEP:768:vey39iM13dtfbSqyYcQGXrlhmQHZHm43/0YOb5CFb4/OAwuM2eWE:lSE
                                                MD5:DC77514FB64686D1EB707885478ACD2E
                                                SHA1:816E4BEA5F650203AB767ECA11A5B486C61D23CD
                                                SHA-256:ED27BC7695660048E4FCA4A542E64115AFA62422CB6B7E2D81FE3BBB002122F8
                                                SHA-512:6BD00781F6E022777ACFAD8DF59B81B30C893B9920EE11AC30EA36879CDB3AE077F740094334A84B9FE81D60DE758520C7DC04457A6E823A4AD1ACEC69FA6084
                                                Malicious:false
                                                Preview:ElfChnk.........F...............F...................=h......................................................................B.!c................,.......................T...=...........................................................................................................................f...............?...........................m...................M...F...................................................................................................................................................**..x...........&............./X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx

                                                Download File
                                                Process:C:\Windows\System32\svchost.exe
                                                File Type:data
                                                Category:dropped
                                                Size (bytes):65536
                                                Entropy (8bit):4.472202576593779
                                                Encrypted:false
                                                SSDEEP:384:8h8kbAP1gjk+Jk+yk/3Suhfmk+Adk+AkKuIk+2hk+Dk+rk+4k+ik+8k+4k+Uk+RK:8NAP1EHDzS0ZpmjmoToEEltkV48m
                                                MD5:5DC9E983350036BEEE5D780C6A524B41
                                                SHA1:6E0C1E58AB9475BB8DF8D6981A0B44AA1D27901D
                                                SHA-256:8297175C628EF1A16849FF0AC166F761E25BAACF05706F62706932A000DEE87E
                                                SHA-512:48891200E513614A546373737A767D1BD4E32100E12CCC2D1F72587D672342D5A9C66FCACD313539B327634A3084676937706FF1C982AB7CB6EB96F899D70F81
                                                Malicious:false
                                                Preview:ElfChnk......................................I...K...S9%....................................................................)^..................b...........................=...........................................................................................................................f...............?...........................m...................M...F.......................&.......................................~...................................U...............;...............................**..x............Ft.i...........w.&.........w..._.|.1+O.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                C:\Windows\System32\winevt\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx

                                                Download File
                                                Process:C:\Windows\System32\svchost.exe
                                                File Type:data
                                                Category:dropped
                                                Size (bytes):65536
                                                Entropy (8bit):4.4450554443486245
                                                Encrypted:false
                                                SSDEEP:384:xhaEdEqXAEJVvOEJSvEqEBEENEuDEaExEOEAE7EmEizEJ6ExEZEX/+EaEF5EOcE3:xVXmIBqr97fAIkQZ4V0o1pO
                                                MD5:190C329F17106202E8E3F2442FEED6E6
                                                SHA1:66822875DB45D4AD30FD96D8E090F1393715BAF0
                                                SHA-256:A89A35B52DCF175CE6B6053894AEDDD5D2AB1F1AAADDC196E01B618F6A8C3A8A
                                                SHA-512:973FCE423958B567E00C16279DE303E9BAF28EEEE2D1404BC549BDCA53305ED81209A5376AF299339C30F0F19A783294BDAF1E485767B1C8602447D34F2B828A
                                                Malicious:false
                                                Preview:ElfChnk.....................................P................................................................................{..................$.......................L...=...........................................................................................................................f...............?...........................m...................M...F....................#...............!...9..=................O...=...........A...?.......;..ME..........}....................'..........5...........**...............2...9......../X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                C:\Windows\System32\winevt\Logs\Microsoft-Windows-HelloForBusiness%4Operational.evtx

                                                Download File
                                                Process:C:\Windows\System32\svchost.exe
                                                File Type:data
                                                Category:dropped
                                                Size (bytes):65536
                                                Entropy (8bit):2.4040308529021415
                                                Encrypted:false
                                                SSDEEP:384:ohPFKlcLBKalKuDGK1GKgkKClKvQKqlKlaKu7dKrXK7CK53HKstKoIK8eKugGKIa:oz8
                                                MD5:81D5AD547BD4C7A479FDD47F7EEFB40E
                                                SHA1:990288DEEF8362DAC04ADD1CC9CDAD531BB0B743
                                                SHA-256:39D673416B52D10159169F53539A2A0FA38AF6C20099C426ED024C8E25ED6FCD
                                                SHA-512:BE44AA931E6B38A55DA9D70D4EEA20478BEDBFE5B741DDCFBE637FC9346F0EC82E4F3BC247EBB6A4FC94F56EEACA83839B96DE6EA57B274ACA2CDC42F76BDF50
                                                Malicious:false
                                                Preview:ElfChnk.=...............=....................x..0z...E!\......................................................................8{................H.......................,...=...........................................................................................................................f...............?...........................m...................M...F...............................................................&...........................................................!.......................**..x...=.......m............./X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx

                                                Download File
                                                Process:C:\Windows\System32\svchost.exe
                                                File Type:data
                                                Category:dropped
                                                Size (bytes):65536
                                                Entropy (8bit):4.101233456525166
                                                Encrypted:false
                                                SSDEEP:384:/h+DEfbDisDTDqDPD1DPDXDuDTDGD8DMDRDcDvDhDlDEJDpDmXDyDsD6DwDKDODE:/rqyaBHYPi
                                                MD5:0E2212BE5AE79A0C91C8CE26C4A08926
                                                SHA1:DAC7021CF5C1BA0440034796977B7936F6B1B80F
                                                SHA-256:8D77324411BF94BD5EDBA371EF313EA8E66FC5C1D4669A721F4E0C48648C2EE3
                                                SHA-512:3510E2B917F13B7BB17AF540B9DA08945316D07412D9B78FD547935B220B011F3706E750BDFBBE3BDDA59DE32DF49D2E4174F44E266A237AB4C6A6631896F47A
                                                Malicious:false
                                                Preview:ElfChnk.........<...............<...........8.........:^....................................................................b...................$.......................L...=...........................................................................................................................f...............?...........................m...................M...F...............................................................&...................................................................................**..............F_G.4........./X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx

                                                Download File
                                                Process:C:\Windows\System32\svchost.exe
                                                File Type:data
                                                Category:dropped
                                                Size (bytes):65536
                                                Entropy (8bit):4.19352628408908
                                                Encrypted:false
                                                SSDEEP:384:AhdzpzAzKzyzIzazrzRztzPzxaz9OzJznzfzXz4zdz/znzYx3z9zrzmzYzwzYzXQ:AK8WxvZ
                                                MD5:95B342BA233B23287457264E65675DC3
                                                SHA1:C3B7A63B599779F7B95AFBC5FB84EB6EECCB6B39
                                                SHA-256:A4CBD6516BC40439D90E20157C98BB53346FA11D79D709633BB6989C439DE52F
                                                SHA-512:77063E9A7F4454CD64EBE8750D26F7BA0CF39423A0590AC1078CEADD5E8D09B8AC07C999B7DA02A4E3343FE34B616E0B8129963B0ED2A136EF5FDEABA6D6BB22
                                                Malicious:false
                                                Preview:ElfChnk.....................................@...0...Y......................................................................q..Z................<.......................d...=...........................................................................................................................f...............?...........................m...................M...F...............................................................&...................................................................................**..............,o.{........../X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx

                                                Download File
                                                Process:C:\Windows\System32\svchost.exe
                                                File Type:data
                                                Category:dropped
                                                Size (bytes):65536
                                                Entropy (8bit):1.7375330817923607
                                                Encrypted:false
                                                SSDEEP:384:YhXIVtIqIi3jIWIPIyI4ILIYI7IuIPI7I26uO7uIxO7vILINIhIkI8IDITI0IfIk:YQlhC
                                                MD5:A789EA4B82047147B70C6A770B783A3E
                                                SHA1:FB45F9D4EE374B8075411D6072C918F6F0C03DF9
                                                SHA-256:8F965B10C880535B16CCC82C047616F6D64368B17506DF362B10F943B66EB0A0
                                                SHA-512:FA79E56A0AAD5594B0D6B669E358C17A9F340C9C3A1F564C73D54E509FD19FD87F4B44DBC8AFA71A539A50D8CB3D1DF9966F2FB563C91F8BB2FDBCCD366DDF2A
                                                Malicious:false
                                                Preview:ElfChnk................................................b....................................................................._..................$.......................L...=...........................................................................................................................f...............?...........................m...................M...F............................................................h......................................................................................**...9..............9......../X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                C:\Windows\System32\winevt\Logs\Microsoft-Windows-LiveId%4Operational.evtx

                                                Download File
                                                Process:C:\Windows\System32\svchost.exe
                                                File Type:data
                                                Category:dropped
                                                Size (bytes):1128
                                                Entropy (8bit):3.2866902904567086
                                                Encrypted:false
                                                SSDEEP:24:MTTg2Wz/ll1w78atg8prLKOt/Jlblu/cb:MlW91a57RJlb3
                                                MD5:677F8319325B0C3F0DD6071F4F308357
                                                SHA1:6338BCE078FA370BDDF18FADC97C3214F7F2617C
                                                SHA-256:1C834A52D513931969A1F452F470637F9E6A90379C8A650E8FA20A0359CC1CC3
                                                SHA-512:C4854DE07CD1D5683A1D1514B4B461E5E3873F65FF1754E26983E5844747A38BBFE1FBC52C9F48C4EFE21233AE0787B40E53E9A83EE92AFC1A4890FCEC0738EF
                                                Malicious:false
                                                Preview:ElfChnk...................................... ..x"...3E`....................................................................>.@.........................................8...=...........................................................................................................................f...............?...........................m...................M...F...............................................................&.......................!...................................................Y!......**..h...........{..ilb......../X.P&...............................................................0.......H...!.!...e............@{..ilb...TB.9b...rB.9b...............................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.L.i.v.e.I.d..%....gN.BiVz..OM.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.L.i.v.e.I.d./.O.p.e.r.a.t.i.o.n.a.l...H.y.Y!......H.y...P....<lj.....................A..)...8........=.......O.p.e.r.a.t.i.o.n.......A..%...8........=.......D.e.t.a.i.l.s.......A..#...8........=.......S.t

                                                C:\Windows\System32\winevt\Logs\Microsoft-Windows-NCSI%4Operational.evtx

                                                Download File
                                                Process:C:\Windows\System32\svchost.exe
                                                File Type:data
                                                Category:dropped
                                                Size (bytes):65536
                                                Entropy (8bit):2.107384776030851
                                                Encrypted:false
                                                SSDEEP:384:Th0QMqHM3EbMYFMOuM0cMn71MuMMxsM98M0n4MBHMovMmXMqQMrdMlOMZzMWHMB3:TZWa
                                                MD5:77470144CB1442AD0D26B9BCFE2A9B2B
                                                SHA1:EC60FEDEE162A55B6C5B925D2E74BDB56224BB27
                                                SHA-256:278F9D4DF7F65B2F6C31B5704FC8C03102BB4326E4BC4E1C032ABE0314011C07
                                                SHA-512:1348089F5ADA4DF2FE0A3F2E7AD86876E3EEA0619A2EEB71ABC038FA34B39CA1C5B80BA13663853821FDE815BF617DF09122BD4E1A9546A4BED51B24A284B195
                                                Malicious:false
                                                Preview:ElfChnk.........@...............@............l..Pn..!C/.................................................................................................................>...=...........................................................................................................................f...............?...........................m...................M...F.......................&...........................................................................................................................**..............)..S...........w.&.........w..._.|.1+O.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                C:\Windows\System32\winevt\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx

                                                Download File
                                                Process:C:\Windows\System32\svchost.exe
                                                File Type:data
                                                Category:dropped
                                                Size (bytes):65536
                                                Entropy (8bit):3.283552758644014
                                                Encrypted:false
                                                SSDEEP:384:Whb1Sh151f21Q1c161J1fA1eE1cj1/q1f+1Cz1410C1F1f81H111f210111X1fIw:W6vPCDe2v/bgrJlrxbz3t3fAQm18GIh
                                                MD5:3450525F4FC1F32C76AD2FAB3865136C
                                                SHA1:ECDFE829A24C19C8B5915D3C914A28A388FEFA6D
                                                SHA-256:CED7A7C54249FB9AAB9103B54F58CC640064A30F153CA96FBE823F837C1A926F
                                                SHA-512:2C7C4043C95588B71DA499BA504EA0419498D75C28CB17D38815DD4F37C62BE863E186F717D79BEF25B6AE6D8BDB5884E87484D4D38245D2D4788D71C0AE74B1
                                                Malicious:false
                                                Preview:ElfChnk.0...............0...................`........IL.....................................................................g...................0.......................X...=...........................................................................................................................f...............?...........................m...................M...F...........................................................................................1.......................................................**......0...........]........./X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                C:\Windows\System32\winevt\Logs\Microsoft-Windows-Ntfs%4Operational.evtx

                                                Download File
                                                Process:C:\Windows\System32\svchost.exe
                                                File Type:data
                                                Category:dropped
                                                Size (bytes):65536
                                                Entropy (8bit):4.323377286391295
                                                Encrypted:false
                                                SSDEEP:384:vhnIFwI1IcIIIEI1InI0IXInICIWIzIOILIqIhIXIJIrIPIMIiIMI/InIFIxImIY:vuxxVnRr
                                                MD5:A2B7485BFA4BE4386F29B16A528A2976
                                                SHA1:D30252B0E40054CBFEBF9F04609F92EB525DC308
                                                SHA-256:4E308CB34CDB36F7ECDD3382A8203C781E596761225CB3BA64987F48C751808A
                                                SHA-512:5F3A203DDBCB6F7EAE8A90614459FAEAEDCFBB935B03E61BC2596CA13D34975495D7210C418CCD1CC19ABA61509851E806D1FE26F2CA870D5AE633D9C1BA7003
                                                Malicious:false
                                                Preview:ElfChnk..................................... .......e.K........................................................................N........................................0...=...........................................................................................................................f...............?...........................m...................M...F...............................................................&...................................................................................**..h...........r.........../X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                C:\Windows\System32\winevt\Logs\Microsoft-Windows-Ntfs%4WHC.evtx

                                                Download File
                                                Process:C:\Windows\System32\svchost.exe
                                                File Type:data
                                                Category:dropped
                                                Size (bytes):65536
                                                Entropy (8bit):2.154283008159901
                                                Encrypted:false
                                                SSDEEP:384:iyhqILI6I6IUI+I4IZIhISCI3hUICIOIDIMIfINIEdImIDIXIjlII+I/IAIiIkIG:iyHZhxKkDBhT
                                                MD5:A83171EE7F542FC4FDC8818138A2813C
                                                SHA1:93D7F7A432F11D03A42D8BBCDC7977F4E454B8B1
                                                SHA-256:6608AB549648CFE621B1F624C5DF948DB9FD25D1A16B81A0087A819DC89616D5
                                                SHA-512:47A13383FCF109A6FC0F6DD49DCF751D08430B1879C2940C8010596C8E63CCFC59323E2AD56ACCA839C03452FB36A88273FD46691FE760994550CF8046F6EECC
                                                Malicious:false
                                                Preview:ElfChnk.........Q...............Q............o...q...|9+....................................................................bbZ.............................................=...........................................................................................................................f...............?...........................m...................M...F.......................&...........................................................................................................................**..................S...........w.&.........w..._.|.1+O.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                C:\Windows\System32\winevt\Logs\Microsoft-Windows-Partition%4Diagnostic.evtx

                                                Download File
                                                Process:C:\Windows\System32\svchost.exe
                                                File Type:data
                                                Category:dropped
                                                Size (bytes):65536
                                                Entropy (8bit):3.899883566879195
                                                Encrypted:false
                                                SSDEEP:768:641WS5OAT1rPgAT0nH15T0np15T0nQ15T0nW15T0nr15T0nB15T0nh15T0nb15TT:0ScA
                                                MD5:94878E7016CC26D1EAD72D13AB7DAF75
                                                SHA1:19DE4C702932AF76C9D6765F87D1960A1CAB24BD
                                                SHA-256:5D4D9EEC54772389463AF475786B81A3DB300B92E2B03CBB51534E20193651C9
                                                SHA-512:4C995F9B10D879F93C890CB8F7B21ED31B64EBC3C4379A618DD73D1EE9032E53DAA05050CE67C9BD93D9F9B98B3518CAA01C4FE1F0B5E50ABCF5F3FCE1ED7D38
                                                Malicious:false
                                                Preview:ElfChnk.Y.......[.......Y.......[............'.../...q......................................................................s..l........................................B...=...........................................................................................................................f...............?...........................m...................M...F...............................................................&...................................................................................**..8...Y........n_I.9......../X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                C:\Windows\System32\winevt\Logs\Microsoft-Windows-PushNotification-Platform%4Operational.evtx

                                                Download File
                                                Process:C:\Windows\System32\svchost.exe
                                                File Type:data
                                                Category:modified
                                                Size (bytes):95264
                                                Entropy (8bit):5.017217126137096
                                                Encrypted:false
                                                SSDEEP:768:TMosIbMngOjSSeO8n6+p4ovvDcuMosIbMngOjSSeO8n6V:Qo4gOmSeOUpJzMo4gOmSeOb
                                                MD5:CBEA2EB18E7310E9D4D952D6C696CCFD
                                                SHA1:DF4C2A9606CF969F957761B1696A5D3B02877BFA
                                                SHA-256:8DC1EED5C0D120BD3FFDB2C7F9F94C3D603CD1DD85B4AE29573AE47FE8EDD023
                                                SHA-512:FF8AB1892BEFB9E30CD5455BD372746046FF9A882F7496BA758CDFA36822D71B24840F3E5E925C0D0C148C0ABA953754EB77D5AC905001EBDA3E5C511351425C
                                                Malicious:false
                                                Preview:ElfChnk..*.......*.......*.......*...........h...k...,......................................................................Yk..................^...........................=...........................................................................................................................f...............?...........................m...................M...F............................................U...................P..................................................7...........gY..................**..8....*......u8..9b......../X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                C:\Windows\System32\winevt\Logs\Microsoft-Windows-ReadyBoost%4Operational.evtx

                                                Download File
                                                Process:C:\Windows\System32\svchost.exe
                                                File Type:DIY-Thermocam raw data (Lepton 2.x), scale 4-8, spot sensor temperature 0.000000, unit celsius, color scheme 0, calibration: offset 0.000000, slope 10384593717069655257060992658440192.000000
                                                Category:dropped
                                                Size (bytes):65536
                                                Entropy (8bit):2.0539308659017284
                                                Encrypted:false
                                                SSDEEP:384:mho8N8M8p8d8I8K8t8v681o8t8K8aI848s8D828P8N8285818n8U858w8v8yt8+4:mj31lT
                                                MD5:FB88F2EC7DB667B3C46672FBA14EF7B5
                                                SHA1:D1C999C94F0A2961186DDB15A5CC6071EF161034
                                                SHA-256:DF721044D186D92106FF14CFF701466AE247AA2B6BFFF3EC3900B019D6D01264
                                                SHA-512:B43AA70211392D30CF5791427E41A7E0BC56957FE0E03ABA761D1C7A587A5CC26ED0E8027D392B3AF615276A170653939B175995D55337B70A1B61DAA49397DA
                                                Malicious:false
                                                Preview:ElfChnk.........@...............@...........8f...g...V......................................................................\.L........................................V...=...........................................................................................................................f...............?...........................m...................M...F.......................&...........................................................................................................................**..(...........e...S...........w.&.........w..._.|.1+O.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                C:\Windows\System32\winevt\Logs\Microsoft-Windows-Resource-Exhaustion-Detector%4Operational.evtx

                                                Download File
                                                Process:C:\Windows\System32\svchost.exe
                                                File Type:data
                                                Category:dropped
                                                Size (bytes):65536
                                                Entropy (8bit):4.222559586826547
                                                Encrypted:false
                                                SSDEEP:384:PhuvnvmvJvBvdvrvwvSvovl+v4v6vvvmvcMvOyv4vCvAvTvGvP+v5vRvH8vUv5vY:PNzTEejRRTn2
                                                MD5:B38B9E849EC6835DCA8A6EA72E4DA306
                                                SHA1:3C954C744C946A95ED60EE9FA27EAD46980F618B
                                                SHA-256:17F63070CC19C23AC60D274DE6AA70512E103C88A2E0576A4D343DA0BED49FDF
                                                SHA-512:7C0D53902B4901FE50342E89AE15956FBBBF9E2D91622DFB558FAAC75E7D0BEDD1502CC0540A9E662EA92A11B515F301109079956F2ACEC7C040B890F92968AF
                                                Malicious:false
                                                Preview:ElfChnk.........................................P...yU.-....................................................................N..T................v...........................=...........................................................................................................................f...............?...........................m...................M...F.......................&.......................................f ..........................................................O.......................**..............l..-T...........w.&.........w..._.|.1+O.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                C:\Windows\System32\winevt\Logs\Microsoft-Windows-SMBServer%4Operational.evtx

                                                Download File
                                                Process:C:\Windows\System32\svchost.exe
                                                File Type:data
                                                Category:dropped
                                                Size (bytes):65536
                                                Entropy (8bit):3.0924701732989552
                                                Encrypted:false
                                                SSDEEP:768:KS/Bp+UdTU8UqOUyGUwaUpcuUvKUruU6DUZ5UtaUKOUpSUv2UwLiUIeU7bUhCUrt:v7rw
                                                MD5:7351188FC55AA83A40650BF6669AE3BB
                                                SHA1:E0417EB33C99FA62CE05F7AA8C55C0C25F180C52
                                                SHA-256:8E92938565715C5F5D73490FEF059E5723A5810BEB0A9A959CCFB3C6A0BBD45A
                                                SHA-512:1C0F8D5515BD9B9850519CB3BF8ED8FDA7E5C36550D581FB2DFF4BE1520C05A6CEA25A7AE9772B693021287DEEB8EA68555AC2AF2A74BDC5505DA49BF5BC12C8
                                                Malicious:false
                                                Preview:ElfChnk.....................................8...h...;_..........................................................................................C...........................=...................................}.......................<...............................................................f...............?...............................................M...F...........................................................&.......................................................................................**..h.............h............>.&.........>..'.W.U2..9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                C:\Windows\System32\winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx

                                                Download File
                                                Process:C:\Windows\System32\svchost.exe
                                                File Type:MS Windows Vista Event Log, 1 chunks (no. 0 in use), next record no. 27, DIRTY
                                                Category:dropped
                                                Size (bytes):69632
                                                Entropy (8bit):4.175122964833277
                                                Encrypted:false
                                                SSDEEP:768:T3MEYS9jvhCeqi4hqQ4D/OX+/14e/8Njil8QVQzo:LMEYwxl1VYo
                                                MD5:2631ABFF12FFFC1DEEBCE745BA849B89
                                                SHA1:EB9BEDFD1AF93391768E47F6A18B809AA0A1FAB5
                                                SHA-256:81BCE0307D2D88FE237625E12049AF0C0841C3C918EA326FE197B65AD3A05CBC
                                                SHA-512:70C4B3BB99F0CA6AAF0625003595B0373AA70CDD1D1F1387B93798AD4AF840DF58EB1D85993C178F60EB832571E144A1874ACD39E4FAF626B067EDF6F7F6D23F
                                                Malicious:false
                                                Preview:ElfFile.....................................................................................................................|.~2........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                C:\Windows\System32\winevt\Logs\Microsoft-Windows-SettingSync%4Debug.evtx

                                                Download File
                                                Process:C:\Windows\System32\svchost.exe
                                                File Type:data
                                                Category:dropped
                                                Size (bytes):112240
                                                Entropy (8bit):4.296082035953723
                                                Encrypted:false
                                                SSDEEP:768:cGCf9BCvj7jHGbPc6isrzhoGCf9BCvj7jHG1V:lXvj7jmbPnzzXvj7jm1V
                                                MD5:74A5AA765DF3989920748854A5575C25
                                                SHA1:42335431CA2316D4F4ABC8F3D0EA890BF085434E
                                                SHA-256:694A6D95E2D41877C20815FCBE1D11F5BE26A96EA4C49B4D2DDBC1CD47A41D2E
                                                SHA-512:E77FCE1C97D7FC11FDEDC448E2FFEACB850BD8F1EFDE01253F87CB7095D041640764077D28BB5BC7FEC6C8B3A581231D5795C6EF32AA96640D848BF21A6517ED
                                                Malicious:false
                                                Preview:ElfChnk.<.......s.......P...................h...p...%x.).....................................................................:8M................(.......................P...=...........................................................................................................................f...............?...........................m...................M...F...........................!b..................................&............................................................;......................**.. ...P........v...9......../X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                C:\Windows\System32\winevt\Logs\Microsoft-Windows-Shell-Core%4AppDefaults.evtx

                                                Download File
                                                Process:C:\Windows\System32\svchost.exe
                                                File Type:data
                                                Category:dropped
                                                Size (bytes):65536
                                                Entropy (8bit):3.416478115477148
                                                Encrypted:false
                                                SSDEEP:1536:4tJTcmXTfu/hD9ouzDZx+DWQeD8yiM4C0BYEeKee6lFY99PXg95RA2IektFNEfJf:cJTcmXTfu/hD9ouzDZx+DWQeD8yiM4CB
                                                MD5:EC9B4720655DCF351E31FD483AB463E5
                                                SHA1:2051758DA8328BBE021CE9A39AA7719D648FA46C
                                                SHA-256:69DD1291D53DCF5AF684D34124303AA2FB3C9CE9289892E89E690E696F8AE883
                                                SHA-512:6FF713BE535DF2CCAE499294A071B84DB895F67609CB8E1B829700E0B327918D9FD87CAA969432FC64FF1ADA7D9E027D2D59948DE35A119D97E9CB1853F9EB6D
                                                Malicious:false
                                                Preview:ElfChnk.~...............~.......................x.....4.........................................................................................0.......................X...=...........................................................................................................................f...............?...........................m...................M...F...............................................................&...................................................................................**......~.......=............./X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                C:\Windows\System32\winevt\Logs\Microsoft-Windows-Shell-Core%4Operational.evtx

                                                Download File
                                                Process:C:\Windows\System32\svchost.exe
                                                File Type:data
                                                Category:dropped
                                                Size (bytes):65536
                                                Entropy (8bit):4.5027267589813915
                                                Encrypted:false
                                                SSDEEP:1536:u/z2iOZw1l4l9+DQEKuX0l7iVhKGzHjAJ42AMQLjfjbk/kttlotdB6lXbeTN29zc:u/z2iOZw1l4l9+DQEKuX0l7iVhKGzDAT
                                                MD5:DE1D08DE17F1D14FFD89134D886AA68D
                                                SHA1:5F34F4E9253D32894024D8F08B031CE59922E885
                                                SHA-256:946084B5DF45FC57397368725BECEE29F53A840E69BF4964988AAF2EA6650972
                                                SHA-512:C64DCD0258E4C1D25E7C4A3BF352CDA755B2B89871A96D62D5BBBC9AB8A1E14924924C45AAAC122B3D2582B23CE4BE3C3D7BFCD657301D2DB3FCBF86B828A7BA
                                                Malicious:false
                                                Preview:ElfChnk.0&.......&......0&.......&...................N......................................................................+$a.................0.......................X...=...........................................................................................................................f...............?...........................m...................M...F......................................................................................................................a~...y......................**......0&......J...9b......../X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                C:\Windows\System32\winevt\Logs\Microsoft-Windows-ShellCommon-StartLayoutPopulation%4Operational.evtx

                                                Download File
                                                Process:C:\Windows\System32\svchost.exe
                                                File Type:data
                                                Category:dropped
                                                Size (bytes):65536
                                                Entropy (8bit):1.9549867816582354
                                                Encrypted:false
                                                SSDEEP:384:Dhq7v7l7UZ7r7B7c7li7x/7Z7Z747A7rK7Rx7fy7P7C7I7F7W7DX7z7C7B7Z7f7X:DGzb
                                                MD5:C96287A57DD9264B2730DCF0590E3700
                                                SHA1:2DB229A860EB18F2CCE8D114621BC9E5DB2CB79A
                                                SHA-256:4B7A38065FE09CFAA132FBB6D261B622ABF6C57331B6D32B56A6D32FB50517C0
                                                SHA-512:C588413856202F28F7592F6F494D53F513BF7A8E25D67459448E542E7584A8A0E1256A88F3A69C74C9EEFB824F52838F01EF78B224A902AAB87D3324BC73BF98
                                                Malicious:false
                                                Preview:ElfChnk.........2...............4............\...^..)...................................................................................................................0...=...........................................................................................................................f...............?...........................m...................M...F...........................................m!..................&...........................................................e.......................**............................/X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                C:\Windows\System32\winevt\Logs\Microsoft-Windows-SmbClient%4Connectivity.evtx

                                                Download File
                                                Process:C:\Windows\System32\svchost.exe
                                                File Type:data
                                                Category:dropped
                                                Size (bytes):65536
                                                Entropy (8bit):4.258420154361351
                                                Encrypted:false
                                                SSDEEP:384:zhwuTDFbuJuuDu/uVuuvu7uu6uOuU/ueuu/uFuuVuauUmuPuuAutuu2kuzjuUaue:zHawuFBoRW3L463zLKxW4Jmu16S
                                                MD5:96EEF0FF9D9B371E9E47CBD3DEF5F326
                                                SHA1:FAAD353DE07E31490C73F8056E304F9423F7D81D
                                                SHA-256:93DF16AADA714CAFD01FC5B53DC1B249951D486E21C8395115D446035D0EBB54
                                                SHA-512:0190F8E185873B6B8130F7EFE710C9202189053032014A2A6E9F620A216FB664764A115BCDE6E3749E36E89C90E2E447F54ED0C2A176D549BABE9EE3475C760E
                                                Malicious:false
                                                Preview:ElfChnk.6...............=...................8........(......................................................................D..........................................F...=...........................................................................................................................f...............?...........................m...................M...F...............................................................&...................................................o...............................**......=........*............/X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                C:\Windows\System32\winevt\Logs\Microsoft-Windows-SmbClient%4Security.evtx

                                                Download File
                                                Process:C:\Windows\System32\svchost.exe
                                                File Type:data
                                                Category:dropped
                                                Size (bytes):65536
                                                Entropy (8bit):2.344985293100609
                                                Encrypted:false
                                                SSDEEP:384:4heu/uSuWugu5uGuFu5ut1u7su+uPudu3uxuIuTuxufvuIUubuMuBuquZu/uKu9Z:4P6ZDGl
                                                MD5:B1FFB2C4146E1A210E3127932734D402
                                                SHA1:4598DAA0D86B8F57250975EA1A8E9047178FEF63
                                                SHA-256:DD33DC035D8C73757F00C34AAD97C4FFA13F684CE21EEC820296EB1EB2F9E3CE
                                                SHA-512:38DE1FDA9131E9A6CB27DF145D2EB80EE35D8E006FF55555663D46889A792B10639983C36802222EAF439B5DAF396CA005B86B9E4DC7866C4507D2FE39F7B907
                                                Malicious:false
                                                Preview:ElfChnk.........H...............H............z.. |..........................................................................o.P`................$.......................L...=...........................................................................................................................f...............?...........................m...................M...F.......................&...........................................................................................................................**..............%,H(T...........w.&.........w..._.|.1+O.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                C:\Windows\System32\winevt\Logs\Microsoft-Windows-StateRepository%4Operational.evtx

                                                Download File
                                                Process:C:\Windows\System32\svchost.exe
                                                File Type:data
                                                Category:dropped
                                                Size (bytes):65536
                                                Entropy (8bit):3.291378783947392
                                                Encrypted:false
                                                SSDEEP:384:EahPAodANA9APA7SjAkxArIvjA2UlA/A3AnA7ATAnALAlAfMAYQAgiA/ABAxAsAM:Ea9SNmIvvfek9kOKW
                                                MD5:73E92E570CDC478103B7B1486BAC395D
                                                SHA1:051FBCF4E936AF4350E651F1F43D0F4F4BB949E1
                                                SHA-256:D82DD7D6CEB6D15D42A25AC9EE20B9C4EAEAC798B10BE72AA34F92074B3FF505
                                                SHA-512:BB053ECC8B075AA4ED6021BD6081CB24F5896970D5105F9B92F3024D559D0AD084E752DDECB292851627B1A5C9F0E56D7BF4560C4EC183F89FAF82CC70C879F9
                                                Malicious:false
                                                Preview:ElfChnk.........r...............r...........8.......$E".........................................................................................4.......................\...=...........................................................................................................................f...............?...........................m...................M...F...........................M........................%..........&...................................................................................**..............}y.._........./X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storage-Storport%4Health.evtx

                                                Download File
                                                Process:C:\Windows\System32\svchost.exe
                                                File Type:data
                                                Category:dropped
                                                Size (bytes):65536
                                                Entropy (8bit):2.4251298037223368
                                                Encrypted:false
                                                SSDEEP:384:fhk+pUYnpdo4pd+pdnpdwpdVpd+pdrpd4pdRpd/pdqpd9pdopdKpdXpd8pddpddd:fI
                                                MD5:E199E6E22D83B905EAEC1E55D1E468FB
                                                SHA1:B4E7E2C815DBD3104F63F683CA425A1D63844755
                                                SHA-256:0141080A57C0C5E4462633BBCD36070172198234FBCC0078CCB0CFBA83075B26
                                                SHA-512:4F01F613C0D45CD7C1F7A48AD5BC572A678CC490B8E7A625B792251EA14FB0A313A5BF79E1E0CA55E73B2974FD0BDDA9A435120061270852ED5CFE059AA026C1
                                                Malicious:false
                                                Preview:ElfChnk.&.......L.......&.......L............... ...71......................................................................zZsS........................................:...=...........................................................................................................................f...............?...........................m...................M...F...............................................................&...................................................................................**......&.......yN..^........./X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storage-Storport%4Operational.evtx

                                                Download File
                                                Process:C:\Windows\System32\svchost.exe
                                                File Type:data
                                                Category:dropped
                                                Size (bytes):65536
                                                Entropy (8bit):4.11935561779521
                                                Encrypted:false
                                                SSDEEP:384:HhmCpaKpmpL6pAsUpfwpAbdpABApAGQpTVp2LMpIJpAbWpW8pAWWpAJap8kpAE0W:Hz
                                                MD5:49F4FC0218B30CB8DD00D0E7ACA1C699
                                                SHA1:9B0ED02AE4C3EBF43D5BD9C5EFE9AC725ACC6CC3
                                                SHA-256:5C266469EA42D031B25E7733FE7426B05CF79E607BB426290EB3F1AF6316641C
                                                SHA-512:82BD198219829ECC14AEFB124DC0FC23A8AA0AD2B06C106E821D46173E4CBD1BCD5BBCEF72606B183FDB3D3D192BC2A66B2A27C45F3B6733D7A35007EFCCEBB0
                                                Malicious:false
                                                Preview:ElfChnk.........Q...............Q...........P.........d....................................................................8...........................................D...=...........................................................................................................................f...............?...........................m...................M...F...............................................................&...............................i'..E...............................................**..............a...f........./X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                C:\Windows\System32\winevt\Logs\Microsoft-Windows-StorageSpaces-Driver%4Operational.evtx

                                                Download File
                                                Process:C:\Windows\System32\svchost.exe
                                                File Type:data
                                                Category:dropped
                                                Size (bytes):65536
                                                Entropy (8bit):4.235972079961172
                                                Encrypted:false
                                                SSDEEP:384:ShoCKCQC8CUCLCYC7CFCuC2C+CxC1Cl0Ct4CCC2C7CLCtCeCeCiCmjC0zCpDCMCJ:S+fNJCRxkjZHIUL
                                                MD5:19BCDE9D6E5B7FC428FCB3752FFD39D1
                                                SHA1:3391AE1F68164A8443170B32023AF992CD9E1BE0
                                                SHA-256:6C62AE9667CE47986973478AA6CF97BD83AE7FABF1A21C392CD28E77E391DF5A
                                                SHA-512:80ABEE70139EF0872DD7D109168B2E0A7DC174AC6FA44D9CFB829774988A2535DB8E249ECCBE7342FDA6540A3B3EFBBE9F50BA4D53EC7F2F6510748ED0F6A14A
                                                Malicious:false
                                                Preview:ElfChnk.........P...............P....................d.a.....................................................................9.................V.......................~...=...........................................................................................................................f...............?...........................m...................M...F.......................&........................................%............................................................................../...**..@.............1.S...........w.&.........w..._.|.1+O.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                C:\Windows\System32\winevt\Logs\Microsoft-Windows-Store%4Operational.evtx

                                                Download File
                                                Process:C:\Windows\System32\svchost.exe
                                                File Type:data
                                                Category:dropped
                                                Size (bytes):77176
                                                Entropy (8bit):4.664176286633638
                                                Encrypted:false
                                                SSDEEP:384:FhKMjAM7MXAMjAMLMLMFEM6DMXrMZJME+I5MvM6MqhKMjAM7MXAMjAMLMLMFEM6u:Fqt7dI+qt7dIpTbyMyf3by7byFfIabyM
                                                MD5:C0FAE677D1E5F940DD28CBA00DAAF4AF
                                                SHA1:EFE86771A1EB6F74FCD094CB78448A712C380F5D
                                                SHA-256:D3D958CA7A99BCACF541AE40B2F826F0D7CC8983A56BE94307B69667EB4670AB
                                                SHA-512:8BB2743A44635166F7FE6077E203E48CBB8A913427A14F2123742D5735C4C0F3211753A18B453C7FF527C25F858F69B270E0C08A1ABD1959667861ACB5478FDF
                                                Malicious:false
                                                Preview:ElfChnk.M.......Z.......M.......Z...........@+..x-....#......................................................................t..........................................4...=...........................................................................................................................f...............?...........................m...................M...F...............................................................&...................................................................................**..p...M........:.elb......../X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storsvc%4Diagnostic.evtx

                                                Download File
                                                Process:C:\Windows\System32\svchost.exe
                                                File Type:data
                                                Category:dropped
                                                Size (bytes):65536
                                                Entropy (8bit):3.122993632214217
                                                Encrypted:false
                                                SSDEEP:768:TvgffnPNm/2sY3pLwIkJ2jLHbj9fr7w2imMFopTMFw3grHUP98:cGaY
                                                MD5:BB74846B74D405CA30253B16CDE5397E
                                                SHA1:3B9DA1FD89180165C5AD79EAF404B5094E224FEC
                                                SHA-256:F5BAF71DDA6CC3CB646E2BF780FC44E693B1E58E5C22E15255C43542D9EB47CA
                                                SHA-512:11FB854EF1D217307ECA17DC41D293EF21CF97F2D80BD941244091D13B659912BC44D8BB4E15534C12D585CD777CEA5AE7AF6093BBB20755723415AAFEC7249F
                                                Malicious:false
                                                Preview:ElfChnk.........@...............@...........................................................................................[.................. .......................H...=...........................................................................................................................f...............?...........................m...................M...F.......................&.......................................fC...................................................................1..............**................8.S...........w.&.........w..._.|.1+O.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                C:\Windows\System32\winevt\Logs\Microsoft-Windows-TZUtil%4Operational.evtx

                                                Download File
                                                Process:C:\Windows\System32\svchost.exe
                                                File Type:data
                                                Category:dropped
                                                Size (bytes):65536
                                                Entropy (8bit):0.2036552307549175
                                                Encrypted:false
                                                SSDEEP:48:MuW4nrP+MZQNRBEZWTENO4bpBdosi/6FgVt:7pKNVaO8toF/6Fg
                                                MD5:8820E359BB9E19DD1A902710AFDCCDEF
                                                SHA1:79ECF5105CD551A54EA28E64FDDE475D8EABE156
                                                SHA-256:105FD994267BDA51A2E756AB3B1DB1D258612D08B7552ADA4748461B71F34322
                                                SHA-512:75025A57380BA14AB4D6D6F1E1E23AA657117724F67C0EF55CD1B40D782B9A5F027A998E83D06395180BA7F72CC5AB319FDA9E18956AC806FCE9E18B80045E52
                                                Malicious:false
                                                Preview:ElfChnk................................................).......................................................................$................ .......................H...=...........................................................................................................................f...............?...........................m...................M...F...............................................................&...................................................................................**..............]...:b......../X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                C:\Windows\System32\winevt\Logs\Microsoft-Windows-TaskScheduler%4Maintenance.evtx

                                                Download File
                                                Process:C:\Windows\System32\svchost.exe
                                                File Type:data
                                                Category:dropped
                                                Size (bytes):65536
                                                Entropy (8bit):4.299168401495497
                                                Encrypted:false
                                                SSDEEP:1536:OKoKKK3KOKbKrK7KAKqKpK0KXKAK8KTK+KfKvKYKqK4KGKkKhKjK9KyKeKhK1KK0:OKoKKK3KOKbKrK7KAKqKpK0KXKAK8KTb
                                                MD5:F8F3D7A8199C291C82DCAD93E7D9903D
                                                SHA1:68D5F360B5206A1210954CEBBA59C6221E366817
                                                SHA-256:077F2BB7DEB254C9B04F6C49C5C54BE90BA092CC0A2D4C93E4E66AD43FCC2869
                                                SHA-512:67643EB2EF55CBCDF17294D814A179AC4C40F642384731935AE2F941F53614828358E8586503B78973DD6FB18F50A285914F18027ED90C03E078697408AACD03
                                                Malicious:false
                                                Preview:ElfChnk.....................................X}.........V.....................................................................h?.................,...........................=...........................................................................................................................f...............?...........................m...................M...F...............................................................&...................................................................................**..H...........N..)........../X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                C:\Windows\System32\winevt\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx

                                                Download File
                                                Process:C:\Windows\System32\svchost.exe
                                                File Type:data
                                                Category:dropped
                                                Size (bytes):65536
                                                Entropy (8bit):4.095471526341791
                                                Encrypted:false
                                                SSDEEP:384:kh8i4i/yi6iDiDi5iwiliM1iNiUiXKbieifiGiOiOiIiIiBigi1iVinixiEiVcit:kp6xKodKN
                                                MD5:F3590E43C52EA0942FAC8572B6CBC849
                                                SHA1:DC78F711F4AC6C74FF8B332A555389EA7488FC4A
                                                SHA-256:731D02B13E77704281F452303ADBFDE5BDFB633726CF4497A1F3F0BF946A385F
                                                SHA-512:23C9899F71B89D6FB43CED90E7E0F8F0736CDFAAD3055492AACB6D6ADE0279A01F80E3592BBA0D2D25948D9192CCA6305CEEE497A4EFADD0DD779D1A4FF9AFB8
                                                Malicious:false
                                                Preview:ElfChnk.....................................hQ..pS..Se.......................................................................?@}............................................=...........................................................................................................................f...............?...............9.......B.......................M...F...........................................................&...............................................................q.......................**..................f...........>.&.........>..'.W.U2..9.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                C:\Windows\System32\winevt\Logs\Microsoft-Windows-UAC-FileVirtualization%4Operational.evtx

                                                Download File
                                                Process:C:\Windows\System32\svchost.exe
                                                File Type:data
                                                Category:dropped
                                                Size (bytes):65536
                                                Entropy (8bit):4.31499047228018
                                                Encrypted:false
                                                SSDEEP:768:PxSaa8NlaranavazaZa5agCadadaZadacaRaZasasaUaUaMacaIaYaEakaAagakb:3NV
                                                MD5:A7EEFA692FEBD3F35CDC7C81908ABE93
                                                SHA1:011CFF20CB6CC2828F29D6F44D8033A71F9D1AA7
                                                SHA-256:3BE6AAD5584E8562B815D02280581E5CBE4F8A6859E8594C0A2DA5B999E49D83
                                                SHA-512:A567AD8F14EE9E531D97544B64A581B53B74D73AC89A9A5E23152E72742FB6595CB03AC44D8DB5A17C6A3B1C6086E18546F4BAA613D1E59314018DDEA784CE2C
                                                Malicious:false
                                                Preview:ElfChnk./.......x.......E.......................P.....MK.......................................................................F................`...........................=...........................................................................................................................f...............?...........................m...................M...F...............................................................&...............................................9...................................**..H...E.......3..Y.9......../X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                C:\Windows\System32\winevt\Logs\Microsoft-Windows-User Device Registration%4Admin.evtx

                                                Download File
                                                Process:C:\Windows\System32\svchost.exe
                                                File Type:data
                                                Category:dropped
                                                Size (bytes):65536
                                                Entropy (8bit):3.9303697118433907
                                                Encrypted:false
                                                SSDEEP:384:hhNXDcXxzXZXeX/XOXMXauXLiXCXVX1XYXZXeX+XiXfXuXFXRX9XsX5XLXzXgXyH:hyAg2HqOT
                                                MD5:A2DC4B4270A7E19F945786BABEA27641
                                                SHA1:4801A219673252192B4BC0C89724E9FCC791940E
                                                SHA-256:4080A430FD8AB868850435FB1253AA443ADA30C8EA055EEEF704E2235B1EC4CB
                                                SHA-512:138D38B9B360B225C548BAB46F4554B1B4F3F377DAD439CA47BE8E9629705C38E0CD932B9FFA51F673AA2481160D369095F5A43FD247FAC4C23458BE9043EAB9
                                                Malicious:false
                                                Preview:ElfChnk.........J...............J...........8.......=.......................................................................AW..................j...........................=...........................................................................................................................f...............?...........................m...................M...F.......................&...........................................................C...............................................................**..............C..?T...........w.&.........w..._.|.1+O.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                C:\Windows\System32\winevt\Logs\Microsoft-Windows-User Profile Service%4Operational.evtx

                                                Download File
                                                Process:C:\Windows\System32\svchost.exe
                                                File Type:data
                                                Category:dropped
                                                Size (bytes):65536
                                                Entropy (8bit):4.333725891511218
                                                Encrypted:false
                                                SSDEEP:384:1h2LmImemomHmOmamCm2m2m3mnBmGqmFmJmFmKmrm2mOmsmSmmmVmghmRmBmBSXC:1/fw
                                                MD5:8006544AF7261DE8FF55224A34E8C7E6
                                                SHA1:20EE13C50FAC8E687DCA80C32B84417CF138F1AC
                                                SHA-256:CAD95544CA9D00C7D2EAB2F097E14988900923C290156182913BAB6DC0091951
                                                SHA-512:C4DB049607F2393FE828FDAD5C24AF04F05737CD0FD993E66581E535455EE38B6EC998F1FF0ACFBCA26937A292E004BA2C8FD435AE00345BD59C26E3E252AAFF
                                                Malicious:false
                                                Preview:ElfChnk.........................................P....T..........................................................................................Z...........................=...........................................................................................................................f...............?...........................m...................M...F...............................................................&...............3...................................................................**................y........../X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                C:\Windows\System32\winevt\Logs\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx

                                                Download File
                                                Process:C:\Windows\System32\svchost.exe
                                                File Type:data
                                                Category:dropped
                                                Size (bytes):65536
                                                Entropy (8bit):1.9841905982793637
                                                Encrypted:false
                                                SSDEEP:384:vh0h21c2kS27W2VP2en32x2U2x2V2d2N26A2q242R2V2Y2w25vb2C2k2o2g2s2IJ:v2C5
                                                MD5:ABFC0BBBAAF8BC686ABA49CD9614DDA3
                                                SHA1:A36ECBA1C2A68A62C78D04F718FEEC36D154A6B3
                                                SHA-256:F851B72876DDEC9E70906061DF791E37C071319B46677822018AFEDAD2ADC4CE
                                                SHA-512:A3CE9881E4F8FE5DD1EA0EF8652EDC7AA7A9B0303888C2456DA09B506566DCCCA8E7771103D08700C051C3BEFC75F4A94E1BED44B7B8F31FEB8C375928B8507C
                                                Malicious:false
                                                Preview:ElfChnk......................................]..._..,.t.....................................................................D...................L.......................t...=...........................................................................................................................f...............?...........................m...................M...F...............................%...............................&...................................................................................**................+.g........./X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                C:\Windows\System32\winevt\Logs\Microsoft-Windows-WMI-Activity%4Operational.evtx

                                                Download File
                                                Process:C:\Windows\System32\svchost.exe
                                                File Type:data
                                                Category:dropped
                                                Size (bytes):66560
                                                Entropy (8bit):4.286512497337173
                                                Encrypted:false
                                                SSDEEP:384:HwRhVhpR+daRsRjRQRPRZX8R6R/aRXRsRqRbR2R7RoR/RlR9R/RlRlRaRMR0lbRl:+LlK
                                                MD5:CD07342339550419ECD3FBA85B2A30EB
                                                SHA1:A62E8027A542D605393D8FEFF5021FE468712461
                                                SHA-256:FDF61244EFF008CAB5F7648DAA2759557347EE90BAD1830829D5D535CB3AEC2A
                                                SHA-512:B45ECAA094E620BBEBA816DA342B0E8071E4EB0DA1E11144FDB4CDFFE8E78D7DD6ED3FD3DE4E6CC3D833A665CFBDFD060323F46A122739735E7E0095E0116902
                                                Malicious:false
                                                Preview:ElfChnk.Z...............Z...........................h........................................................................c.....................2.......@..............=..........................................S.......................%...........................J...........................f...Z...........?......................................?.......M...F...a...........}...................................y.......&.....................................................................................**..............S.$blb..........>.&...............................................................<.......T.....!................@S.$blb..^k..a..@..g...8.............................M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.W.M.I.-.A.c.t.i.v.i.t.y.......#F.~.J.{..M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.W.M.I.-.A.c.t.i.v.i.t.y./.O.p.e.r.a.t.i.o.n.a.l......y.......................N...W.M.I.P.r.o.v.......w.m.i.p.r.v.s.e...e.x.e.......%.s.y.s.t.e.m.r.o.o.t.%.\.s.y.s.t.e.m.3.2.\.w.b.e.m.\.w.m.i.p

                                                C:\Windows\System32\winevt\Logs\Microsoft-Windows-Wcmsvc%4Operational.evtx

                                                Download File
                                                Process:C:\Windows\System32\svchost.exe
                                                File Type:data
                                                Category:dropped
                                                Size (bytes):65536
                                                Entropy (8bit):4.387999369647672
                                                Encrypted:false
                                                SSDEEP:384:QhCh7whqhvh4h/hMNhihhiVqhXhPh5Vh+hth0qhPdh4zshS3hi9uhiZhhpYhATh0:QkMfO1mlGH4
                                                MD5:7DE58C9526C9AB3869193F1AAB81AD83
                                                SHA1:AFC2BA75470457F940F335C665937E76F5B446D5
                                                SHA-256:1D1F506F1B0BAFF42AB7754C033471B2A7004A8141754D064FB5AC9F526E5121
                                                SHA-512:FAAD8E019D8F08E5F91A5CEB56C2CED327A1D35185AE92C8A02B150593D6BDAC1C00BDE18ED443B9BE35BBB011CF251A9506987F4F6157F158BEAA906D8658C9
                                                Malicious:false
                                                Preview:ElfChnk.........6...............6...........X.......U+87.....................................................................*..........................................l...=...........................................................................................................................f...............?...........................m...................M...F...........................................A...................&...................................................................9...............**..@...............,........./X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                C:\Windows\System32\winevt\Logs\Microsoft-Windows-WebAuthN%4Operational.evtx

                                                Download File
                                                Process:C:\Windows\System32\svchost.exe
                                                File Type:data
                                                Category:dropped
                                                Size (bytes):65536
                                                Entropy (8bit):3.547501745208529
                                                Encrypted:false
                                                SSDEEP:384:Vh2VaVYVtVbVwVoVTVJVgVZVrVdVfVKVHVl/V+VnkVkgVOVEVRVtVsVCVFVhfV5b:VWIreU7U7enh
                                                MD5:C75C76EB861BCAA8D691D91421BD4ED9
                                                SHA1:1B534396FEFAB357194D6F138B949C915760DAAC
                                                SHA-256:83C2D836F526DC88B54F803D5B00C480F1613EAB3071EB426AD3FB5241221482
                                                SHA-512:2B7164567DE1AC327272E057D1D931280414BB035D669EC0459028854B08B14D8E670FBBC37E2B00C4E5478B4D61EDC9AB877164E471BEE74E9D8EE623E9B0E7
                                                Malicious:false
                                                Preview:ElfChnk................................................[....................................................................b.J.................&...........................=...........................................................................................................................f...............?...........................m...................M...F.......................&...........................................................................................................................**..P...........F~..S...........w.&.........w..._.|.1+O.........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                C:\Windows\System32\winevt\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx

                                                Download File
                                                Process:C:\Windows\System32\svchost.exe
                                                File Type:data
                                                Category:dropped
                                                Size (bytes):65536
                                                Entropy (8bit):4.287155208132981
                                                Encrypted:false
                                                SSDEEP:384:VhuZBwBQ/lrBwB7/FBwBK8bV5BwB5dYBwBkBwBHBwB/BwBGBwBkBwBd5BwBJ+BwW:V58bSYun99
                                                MD5:2DFCF24B99273025B100CDCEC6AA33B2
                                                SHA1:3010640306F7835E6678B8763B71C26CA7BB4E38
                                                SHA-256:D33D1995D6A72AB8E17D5EF5160C1BADCB477FF4CAE36D3592FF1A70344BE798
                                                SHA-512:1A8E20BA16F353BB54CBFEC86A96BF22758FC30A25B24EA83445D027E0D5811B95B7EF6BBB06266303DA871F8465FF9CD398D1391F68F6C2E39C33A780D33086
                                                Malicious:false
                                                Preview:ElfChnk......................................................................................................................>.9............................................=...........................................................................................................................f...............?...........................m...................M...F...........................W...................................&................................*..................................................**..............6\. ^........./X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                C:\Windows\System32\winevt\Logs\Microsoft-Windows-Winlogon%4Operational.evtx

                                                Download File
                                                Process:C:\Windows\System32\svchost.exe
                                                File Type:data
                                                Category:dropped
                                                Size (bytes):65536
                                                Entropy (8bit):4.395818609462735
                                                Encrypted:false
                                                SSDEEP:384:Hh1wUEFUEmUEMUEgUENUEqUEqUEWUEvUESUE4UE4UE3UEbUEpUEpUE9UEgUExUEZ:HL2WRqXJQe
                                                MD5:34F4BDCF0139997BF108919A17FEE706
                                                SHA1:6EF83A9F47EFE8FED886256832BF3437DBD53E98
                                                SHA-256:F7F35A6CF0B530EF6B2B489E6B5AE119CF190FC73C99F2245F7D67DD665255F2
                                                SHA-512:925A5F014985C611F6093C157A98D51799F0B9128C10FA29AB9C7A4DBE4A3EB3375060E5FB75E89637021EFF392ADBAFA1F88C82D834B1FCC554668CF9E587A7
                                                Malicious:false
                                                Preview:ElfChnk.........+...............+...........x}.......4.......................................................................8Q.................(.......................P...=...........................................................................................................................f...............?...........................m...................M...F...............................................................&....5.......................................................3......................**.............. 2^O.9......../X.P&......./X.P...P&.C..:.v........A..|...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..Y............{..P.r.o.v.i.d.e.r...6...F=.......K...N.a.m.e........X.......)...G.u.i.d........A..M...z........a..E.v.e.n.t.I.D...'........X...)...Q.u.a.l.i.f.i.e.r.s................"...............V.e.r.s.i.o.n.....

                                                C:\Windows\System32\winevt\Logs\OneApp_IGCC.evtx

                                                Download File
                                                Process:C:\Windows\System32\svchost.exe
                                                File Type:data
                                                Category:dropped
                                                Size (bytes):65536
                                                Entropy (8bit):3.4416001231213045
                                                Encrypted:false
                                                SSDEEP:384:kw0+VsWZttC95UZhVhRoSxHJUBvv3R2ipHl7odz6L7RPLfVXYgXcIycjd52T42Si:k3sfo/05Qhxf27SVSVTuziNpBg12U
                                                MD5:3E4CBE2F30231E70F4A290A70608A4C0
                                                SHA1:202412C96A74FB5257ACAAD3DAEF5618B0B41A65
                                                SHA-256:CBF55EBD3EFEE586E77D5D5000E8A2FF29495E567032EE827C5DD6E6507D9548
                                                SHA-512:0F453FEF2388FACF0B64363AB2C09ED271EECC8CF95145D0674D95BB90102B1EADB3515816DFD533923893F05EF3F386ED9A0F1E6ABE852F30F8B657BA25C96A
                                                Malicious:false
                                                Preview:ElfChnk.........+...............+............Y...Z..........................................................................z/.............................................=...........................................................................................................................w...............P...........................~...................M...m...........................x...............................................................&.......................................................**..x............Bo.,.........|.=O&.......|.=O.s.Q...W.E........A......M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.................oT..S.y.s.t.e.m....A..j............{..P.r.o.v.i.d.e.r...G....=.......K...N.a.m.e.......O.n.e.A.p.p._.I.G.C.C._.W.i.n.S.e.r.v.i.c.e..A..M............a..E.v.e.n.t.I.D...'............)...Q.u.a.l.i.f.i.e.r.s................"...............V

                                                C:\Windows\System32\winevt\Logs\Security.evtx

                                                Download File
                                                Process:C:\Windows\System32\svchost.exe
                                                File Type:data
                                                Category:dropped
                                                Size (bytes):65536
                                                Entropy (8bit):4.357123271780644
                                                Encrypted:false
                                                SSDEEP:384:MIvFRmBtotxCoZ9ojIo5Z4o5ZdHZo5Zco5ZIo5ZwoZToj4o5Zuo5ZSoZ5ojFo5Zd:rNujHfRF6zw
                                                MD5:E8CF0E80E8A1E23B2588BFF34E14A889
                                                SHA1:411E061ADAF75A87C17FE0DD18F6EA4C9F4D6DEA
                                                SHA-256:CEEAAD95BA18B9CA80BEB391C97A329E230D927C5CA29E9BEC3C43AB14B64C1B
                                                SHA-512:078DF1767D955AA30A5552BA44C0CB39F559F53B33FF4DC0FAC5B77C722DAB41615C618AC55E23B080CA993B7FDFC1B512C6B42C9F4CB820B04B96708B39B93C
                                                Malicious:false
                                                Preview:ElfChnk..................~.......~...................O........................................................................................Z...s...h...................=...................................................N...............................................w.......4.......................-...................................[...........).......M...R...:...........................&...............................>.......................3...........................................................**.......~......"..Ulb............&...........0.P\...3.Du?.......A..3...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.....\...........oT..S.y.s.t.e.m....A...............{..P.r.o.v.i.d.e.r.......F=.......K...N.a.m.e.......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.E.v.e.n.t.l.o.g..........)...G.u.i.d.....&.{.f.c.6.5.d.d.d.8.-.d.6.e.f.-.4.9.6.2.-.8.3.d.5.-.6.e.5.c.f.e.9.c.e.1.

                                                C:\Windows\System32\winevt\Logs\System.evtx

                                                Download File
                                                Process:C:\Windows\System32\svchost.exe
                                                File Type:data
                                                Category:dropped
                                                Size (bytes):65536
                                                Entropy (8bit):4.428642222117906
                                                Encrypted:false
                                                SSDEEP:384:PFRxHsw2SwXwFwfwI6wawSwfwLwZw3wEh2HJ9bPDda/8yQ9+9s9NvisQDyMY9U9G:tYKhR8XwKiYI/fNbuvpvMfPKl9W4j
                                                MD5:274A4D4025580640C3A1B7CBF4D69E77
                                                SHA1:425B6ACE715D0196DADBF95073FDCB9751E41E24
                                                SHA-256:1E8B919AF978DE5A9CCA4374F852FD2F3F5B81C55CDE7DFC396A3B7F2D03E60B
                                                SHA-512:02CFBB0F8EFE62955E826D4F7A55BD4F0EB360DC9321E5B039FC26070252530E197A09BCAA109B67677C9759A2297ED07F572974BB54DB2B56EC6BD6FB14576C
                                                Malicious:false
                                                Preview:ElfChnk..................0.......0..................N.p.....................................................................0i.-....................s...h...............N...=...................................................N...............................................w.......0.......................E...................................W...........).......M...3...:...................................................................&...........................................................................**..@....0......"..Ulb.........}.T&........}.TA.P[J.......;.......A../...M...........E.v.e.n.t........j...........x.m.l.n.s.....5.h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.n./.2.0.0.4./.0.8./.e.v.e.n.t.s./.e.v.e.n.t.....X...........oT..S.y.s.t.e.m....A...............{..P.r.o.v.i.d.e.r.......F=.......K...N.a.m.e.......M.i.c.r.o.s.o.f.t.-.W.i.n.d.o.w.s.-.E.v.e.n.t.l.o.g..........)...G.u.i.d.....&.{.f.c.6.5.d.d.d.8.-.d.6.e.f.-.4.9.6.2.-.8.3.d.5.-.6.e.5.c.f.e.9.c.e.1.

                                                C:\Windows\Temp\tempdll.dll

                                                Download File
                                                Process:C:\Users\user\Desktop\dropper.exe
                                                File Type:PE32+ executable (DLL) (GUI) x86-64, for MS Windows
                                                Category:dropped
                                                Size (bytes):344064
                                                Entropy (8bit):6.323956595460371
                                                Encrypted:false
                                                SSDEEP:6144:jtOaldxmJnTjSniNw9+cu3AtSabwyOUUB7By5Er9oX0mP9agsgXFtHVgsA57v4jT:j0aldxmJnTjSiM+/QtSabRwbrJmVNVgc
                                                MD5:4B02044C5A5742E6076842090C98A045
                                                SHA1:060CD64808FE445043BC0E0EE4313267A594B8BA
                                                SHA-256:2FD9A74BB8FB5D7BFFAECAD78066F9D52A54DA138653B3CEE562216AE9572EB6
                                                SHA-512:DBE633B3DEF7FB07240EA6266B78B795A2723F4ECBB70E79F82882CD896449EB2A93192C9F03F4B6BF59E675D84BBB5DE996BB5398E15A77C4FBF8FDDA82752C
                                                Malicious:false
                                                Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........vS....................R.......R.......R.......R..........d............R.......R......Rich............................PE..d....y.g.........." ...&.....x...............................................p............`.............................................D....................@...............`......@...T.......................(.......@...............h............................text............................... ..`.rdata...K.......L..................@..@.data........0......................@....pdata.......@... ..................@..@.reloc.......`.......8..............@..B................................................................................................................................................................................................................................................................................................

                                                Static File Info

                                                General

                                                File type:PE32+ executable (console) x86-64, for MS Windows
                                                Entropy (8bit):7.103866110138709
                                                TrID:
                                                • Win64 Executable Console (202006/5) 92.65%
                                                • Win64 Executable (generic) (12005/4) 5.51%
                                                • Generic Win/DOS Executable (2004/3) 0.92%
                                                • DOS Executable Generic (2002/1) 0.92%
                                                • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                File name:dropper.exe
                                                File size:3'272'192 bytes
                                                MD5:8841148d7d1186d5e5087b672de0de05
                                                SHA1:6a41bb74c3f451c322c642f80f147ac78bf6d0cb
                                                SHA256:a39f3ede27a0b06104e10e50b42a526b83bb7131b21ca21f799c4629caeb131c
                                                SHA512:6a282bab68e3e16909e7ee4c8b5f226dd1e47eedffce3688d08f2d42b3e1b1756f2e9f70731140300744c90b278926cb7292c3ee9099fad38b626491b21aeceb
                                                SSDEEP:49152:7mjO3FXEAZVrk3wceGM/M5E1d4D7asBsm0B39PIR+VhDkIvrSeVNFXy:QoMs4Pz/gu9ex
                                                TLSH:5AE5AD12BA4659ECD15AC078834A4A73AA3574CE0B35B9FF05D486393FA9EE41F3C718
                                                File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......l.F/(.(|(.(|(.(|!..|$.(|..)}*.(|..-}?.(|..,}!.(|..+}+.(|Z.)}-.(|(.)|..(|(.(|..(|E..|).(|E.*}).(|Rich(.(|................PE..d..

                                                File Icon

                                                Icon Hash:f0ecd6ce8d8e878b

                                                Static PE Info

                                                General

                                                Entrypoint:0x140157940
                                                Entrypoint Section:.text
                                                Digitally signed:false
                                                Imagebase:0x140000000
                                                Subsystem:windows cui
                                                Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
                                                DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                                                Time Stamp:0x677F7926 [Thu Jan 9 07:22:14 2025 UTC]
                                                TLS Callbacks:0x40141ac0, 0x1
                                                CLR (.Net) Version:
                                                OS Version Major:6
                                                OS Version Minor:0
                                                File Version Major:6
                                                File Version Minor:0
                                                Subsystem Version Major:6
                                                Subsystem Version Minor:0
                                                Import Hash:0f026d0bef75c6cbd3ab3d29123202f8

                                                Entrypoint Preview

                                                Instruction
                                                dec eax
                                                sub esp, 28h
                                                call 00007F48046AF0C8h
                                                dec eax
                                                add esp, 28h
                                                jmp 00007F48046AEC57h
                                                int3
                                                int3
                                                int3
                                                int3
                                                int3
                                                int3
                                                int3
                                                int3
                                                int3
                                                int3
                                                int3
                                                int3
                                                int3
                                                int3
                                                int3
                                                int3
                                                int3
                                                int3
                                                int3
                                                int3
                                                nop word ptr [eax+eax+00000000h]
                                                dec eax
                                                sub esp, 10h
                                                dec esp
                                                mov dword ptr [esp], edx
                                                dec esp
                                                mov dword ptr [esp+08h], ebx
                                                dec ebp
                                                xor ebx, ebx
                                                dec esp
                                                lea edx, dword ptr [esp+18h]
                                                dec esp
                                                sub edx, eax
                                                dec ebp
                                                cmovb edx, ebx
                                                dec esp
                                                mov ebx, dword ptr [00000010h]
                                                dec ebp
                                                cmp edx, ebx
                                                jnc 00007F48046AEDF8h
                                                inc cx
                                                and edx, 8D4DF000h
                                                wait
                                                add al, dh

                                                Rich Headers

                                                Programming Language:
                                                • [IMP] VS2008 SP1 build 30729

                                                Data Directories

                                                NameVirtual AddressVirtual Size Is in Section
                                                IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                IMAGE_DIRECTORY_ENTRY_IMPORT0x3118f40x140.rdata
                                                IMAGE_DIRECTORY_ENTRY_RESOURCE0x31f0000xc00.rsrc
                                                IMAGE_DIRECTORY_ENTRY_EXCEPTION0x3140000xa614.pdata
                                                IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                IMAGE_DIRECTORY_ENTRY_BASERELOC0x3200000x211c.reloc
                                                IMAGE_DIRECTORY_ENTRY_DEBUG0x2f08400x54.rdata
                                                IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                IMAGE_DIRECTORY_ENTRY_TLS0x2f09000x28.rdata
                                                IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x2f07000x140.rdata
                                                IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                IMAGE_DIRECTORY_ENTRY_IAT0x1600000x400.rdata
                                                IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                Sections

                                                NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                .text0x10000x15e61f0x15e80037d1ba7cb17c11952eb14ba08390e777False0.4542443551622682data6.334020022501005IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                .rdata0x1600000x1b28260x1b2a001e35dc0f6804763282557c47e9b0a1b8False0.7727465757118205data7.375832708680067IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                .data0x3130000x4a80x200ef744485f4213ee83bc056a6050bc643False0.349609375data2.8066221483586262IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                .pdata0x3140000xa6140xa8008b099baaa630e929887e4038b11ecff5False0.5122535342261905data6.076417940654896IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                .rsrc0x31f0000xc000xc0099cb4f54180e8ca55c87941565cd8e59False0.7421875data6.01074092852454IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                .reloc0x3200000x211c0x2200de20adeadf81341613c773d2cace82d8False0.4840303308823529data5.4176880353278785IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                Resources

                                                NameRVASizeTypeLanguageCountryZLIB Complexity
                                                RT_ICON0x31f0c00xb28Device independent bitmap graphic, 21 x 64 x 32, image size 2688, resolution 3779 x 3779 px/mEnglishUnited States0.7629551820728291
                                                RT_GROUP_ICON0x31fbe80x14dataEnglishUnited States1.1

                                                Imports

                                                DLLImport
                                                api-ms-win-core-synch-l1-2-0.dllWaitOnAddress, WakeByAddressAll, WakeByAddressSingle
                                                bcryptprimitives.dllProcessPrng
                                                bcrypt.dllBCryptGenRandom
                                                ADVAPI32.dllLsaAddAccountRights, SystemFunction036, AdjustTokenPrivileges, LookupPrivilegeValueW, LsaClose, GetTokenInformation, OpenProcessToken, LsaOpenPolicy
                                                kernel32.dllGetEnvironmentVariableW, GetStdHandle, GetCurrentProcessId, GetCurrentDirectoryW, QueryPerformanceFrequency, SetLastError, HeapReAlloc, lstrlenW, ReleaseMutex, RtlVirtualUnwind, CreateFileW, RtlLookupFunctionEntry, GetConsoleMode, RtlCaptureContext, GetSystemInfo, GetFullPathNameW, MultiByteToWideChar, WriteConsoleW, WideCharToMultiByte, CreateThread, GetProcAddress, QueryPerformanceCounter, WaitForSingleObject, WaitForSingleObjectEx, LoadLibraryA, CreateMutexA, SwitchToThread, GetCurrentThread, SetThreadStackGuarantee, AddVectoredExceptionHandler, GetCurrentThreadId, GetSystemTimeAsFileTime, FormatMessageW, LoadLibraryExA, InitializeSListHead, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, HeapAlloc, HeapFree, GetProcessHeap, GetModuleFileNameW, Module32NextW, Module32FirstW, CreateToolhelp32Snapshot, GetProcessId, CloseHandle, GetLastError, GetCurrentProcess, GetModuleHandleA, VirtualQuery, GetModuleHandleW, OutputDebugStringW, SetFileInformationByHandle, IsProcessorFeaturePresent
                                                oleaut32.dllSysFreeString, GetErrorInfo, SysStringLen
                                                api-ms-win-core-winrt-error-l1-1-0.dllRoOriginateErrorW
                                                ntdll.dllNtWriteFile, RtlNtStatusToDosError
                                                VCRUNTIME140.dllmemcmp, memcpy, __C_specific_handler, __CxxFrameHandler3, __current_exception, memset, __current_exception_context, memmove, _CxxThrowException
                                                api-ms-win-crt-string-l1-1-0.dllwcslen, strlen
                                                api-ms-win-crt-math-l1-1-0.dllroundf, truncf, exp2f, ceil, __setusermatherr
                                                api-ms-win-crt-runtime-l1-1-0.dll_initterm_e, exit, _exit, __p___argc, __p___argv, _cexit, _c_exit, _register_thread_local_exe_atexit_callback, _initterm, _get_initial_narrow_environment, _initialize_narrow_environment, _initialize_onexit_table, _register_onexit_function, _crt_atexit, terminate, _set_app_type, _seh_filter_exe, _configure_narrow_argv
                                                api-ms-win-crt-stdio-l1-1-0.dll__p__commode, _set_fmode
                                                api-ms-win-crt-locale-l1-1-0.dll_configthreadlocale
                                                api-ms-win-crt-heap-l1-1-0.dllfree, _set_new_mode

                                                Possible Origin

                                                Language of compilation systemCountry where language is spokenMap
                                                EnglishUnited States

                                                Network Behavior

                                                ⊘No network behavior found

                                                Statistics

                                                CPU Usage

                                                Click to jump to process

                                                Memory Usage

                                                Click to jump to process

                                                High Level Behavior Distribution

                                                Click to dive into process behavior distribution

                                                Behavior

                                                Click to jump to process

                                                System Behavior

                                                General

                                                Target ID:0
                                                Start time:02:59:04
                                                Start date:09/01/2025
                                                Path:C:\Users\user\Desktop\dropper.exe
                                                Wow64 process (32bit):false
                                                Commandline:"C:\Users\user\Desktop\dropper.exe"
                                                Imagebase:0x7ff717440000
                                                File size:3'272'192 bytes
                                                MD5 hash:8841148D7D1186D5E5087B672DE0DE05
                                                Has elevated privileges:true
                                                Has administrator privileges:true
                                                Programmed in:C, C++ or other language
                                                Reputation:low
                                                Has exited:true

                                                General

                                                Target ID:1
                                                Start time:02:59:04
                                                Start date:09/01/2025
                                                Path:C:\Windows\System32\conhost.exe
                                                Wow64 process (32bit):false
                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                Imagebase:0x7ff675580000
                                                File size:875'008 bytes
                                                MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                Has elevated privileges:true
                                                Has administrator privileges:true
                                                Programmed in:C, C++ or other language
                                                Reputation:high
                                                Has exited:true

                                                General

                                                Target ID:2
                                                Start time:02:59:04
                                                Start date:09/01/2025
                                                Path:C:\Windows\System32\cmd.exe
                                                Wow64 process (32bit):false
                                                Commandline:"C:\Windows\System32\cmd.exe"
                                                Imagebase:0x7ff64ab40000
                                                File size:289'792 bytes
                                                MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                Has elevated privileges:true
                                                Has administrator privileges:true
                                                Programmed in:C, C++ or other language
                                                Reputation:high
                                                Has exited:false

                                                General

                                                Target ID:3
                                                Start time:02:59:04
                                                Start date:09/01/2025
                                                Path:C:\Windows\System32\conhost.exe
                                                Wow64 process (32bit):false
                                                Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                Imagebase:0x7ff675580000
                                                File size:875'008 bytes
                                                MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                Has elevated privileges:true
                                                Has administrator privileges:true
                                                Programmed in:C, C++ or other language
                                                Reputation:high
                                                Has exited:false

                                                General

                                                Target ID:6
                                                Start time:02:59:22
                                                Start date:09/01/2025
                                                Path:C:\Windows\System32\winlogon.exe
                                                Wow64 process (32bit):false
                                                Commandline:winlogon.exe
                                                Imagebase:0x7ff701be0000
                                                File size:944'128 bytes
                                                MD5 hash:A987B43E6A8E8F894B98A3DF022DB518
                                                Has elevated privileges:true
                                                Has administrator privileges:true
                                                Programmed in:C, C++ or other language
                                                Reputation:moderate
                                                Has exited:false

                                                General

                                                Target ID:7
                                                Start time:02:59:22
                                                Start date:09/01/2025
                                                Path:C:\Windows\System32\lsass.exe
                                                Wow64 process (32bit):false
                                                Commandline:C:\Windows\system32\lsass.exe
                                                Imagebase:0x7ff6d99c0000
                                                File size:59'448 bytes
                                                MD5 hash:15A556DEF233F112D127025AB51AC2D3
                                                Has elevated privileges:true
                                                Has administrator privileges:true
                                                Programmed in:C, C++ or other language
                                                Reputation:moderate
                                                Has exited:false

                                                General

                                                Target ID:8
                                                Start time:02:59:23
                                                Start date:09/01/2025
                                                Path:C:\Windows\System32\svchost.exe
                                                Wow64 process (32bit):false
                                                Commandline:C:\Windows\system32\svchost.exe -k DcomLaunch -p
                                                Imagebase:0x7ff7c69c0000
                                                File size:57'360 bytes
                                                MD5 hash:F586835082F632DC8D9404D83BC16316
                                                Has elevated privileges:true
                                                Has administrator privileges:true
                                                Programmed in:C, C++ or other language
                                                Reputation:moderate
                                                Has exited:false

                                                General

                                                Target ID:9
                                                Start time:02:59:23
                                                Start date:09/01/2025
                                                Path:C:\Windows\System32\fontdrvhost.exe
                                                Wow64 process (32bit):false
                                                Commandline:"fontdrvhost.exe"
                                                Imagebase:0x7ff6103a0000
                                                File size:830'520 bytes
                                                MD5 hash:AB7AB4CF816D091EEE234C1D9BC4FD13
                                                Has elevated privileges:false
                                                Has administrator privileges:false
                                                Programmed in:C, C++ or other language
                                                Reputation:moderate
                                                Has exited:false

                                                General

                                                Target ID:10
                                                Start time:02:59:23
                                                Start date:09/01/2025
                                                Path:C:\Windows\System32\fontdrvhost.exe
                                                Wow64 process (32bit):false
                                                Commandline:"fontdrvhost.exe"
                                                Imagebase:0x7ff6103a0000
                                                File size:830'520 bytes
                                                MD5 hash:AB7AB4CF816D091EEE234C1D9BC4FD13
                                                Has elevated privileges:false
                                                Has administrator privileges:false
                                                Programmed in:C, C++ or other language
                                                Reputation:moderate
                                                Has exited:false

                                                General

                                                Target ID:11
                                                Start time:02:59:23
                                                Start date:09/01/2025
                                                Path:C:\Windows\System32\svchost.exe
                                                Wow64 process (32bit):false
                                                Commandline:C:\Windows\system32\svchost.exe -k RPCSS -p
                                                Imagebase:0x7ff7c69c0000
                                                File size:57'360 bytes
                                                MD5 hash:F586835082F632DC8D9404D83BC16316
                                                Has elevated privileges:true
                                                Has administrator privileges:false
                                                Programmed in:C, C++ or other language
                                                Reputation:moderate
                                                Has exited:false

                                                General

                                                Target ID:12
                                                Start time:02:59:24
                                                Start date:09/01/2025
                                                Path:C:\Windows\System32\svchost.exe
                                                Wow64 process (32bit):false
                                                Commandline:C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
                                                Imagebase:0x7ff7c69c0000
                                                File size:57'360 bytes
                                                MD5 hash:F586835082F632DC8D9404D83BC16316
                                                Has elevated privileges:true
                                                Has administrator privileges:true
                                                Programmed in:C, C++ or other language
                                                Reputation:moderate
                                                Has exited:false

                                                General

                                                Target ID:13
                                                Start time:02:59:24
                                                Start date:09/01/2025
                                                Path:C:\Windows\System32\dwm.exe
                                                Wow64 process (32bit):false
                                                Commandline:"dwm.exe"
                                                Imagebase:0x7ff670e90000
                                                File size:94'720 bytes
                                                MD5 hash:5C27608411832C5B39BA04E33D53536C
                                                Has elevated privileges:false
                                                Has administrator privileges:false
                                                Programmed in:C, C++ or other language
                                                Has exited:false

                                                General

                                                Target ID:14
                                                Start time:02:59:27
                                                Start date:09/01/2025
                                                Path:C:\Windows\System32\svchost.exe
                                                Wow64 process (32bit):false
                                                Commandline:C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
                                                Imagebase:0x7ff7c69c0000
                                                File size:57'360 bytes
                                                MD5 hash:F586835082F632DC8D9404D83BC16316
                                                Has elevated privileges:true
                                                Has administrator privileges:true
                                                Programmed in:C, C++ or other language
                                                Has exited:false

                                                General

                                                Target ID:15
                                                Start time:02:59:27
                                                Start date:09/01/2025
                                                Path:C:\Windows\System32\svchost.exe
                                                Wow64 process (32bit):false
                                                Commandline:C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
                                                Imagebase:0x7ff7c69c0000
                                                File size:57'360 bytes
                                                MD5 hash:F586835082F632DC8D9404D83BC16316
                                                Has elevated privileges:true
                                                Has administrator privileges:true
                                                Programmed in:C, C++ or other language
                                                Has exited:false

                                                General

                                                Target ID:16
                                                Start time:02:59:27
                                                Start date:09/01/2025
                                                Path:C:\Windows\System32\svchost.exe
                                                Wow64 process (32bit):false
                                                Commandline:C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
                                                Imagebase:0x7ff7c69c0000
                                                File size:57'360 bytes
                                                MD5 hash:F586835082F632DC8D9404D83BC16316
                                                Has elevated privileges:true
                                                Has administrator privileges:true
                                                Programmed in:C, C++ or other language
                                                Has exited:false

                                                General

                                                Target ID:17
                                                Start time:02:59:28
                                                Start date:09/01/2025
                                                Path:C:\Windows\System32\svchost.exe
                                                Wow64 process (32bit):false
                                                Commandline:C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
                                                Imagebase:0x7ff7c69c0000
                                                File size:57'360 bytes
                                                MD5 hash:F586835082F632DC8D9404D83BC16316
                                                Has elevated privileges:true
                                                Has administrator privileges:true
                                                Programmed in:C, C++ or other language
                                                Has exited:false

                                                General

                                                Target ID:18
                                                Start time:02:59:28
                                                Start date:09/01/2025
                                                Path:C:\Windows\System32\svchost.exe
                                                Wow64 process (32bit):false
                                                Commandline:C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
                                                Imagebase:0x7ff7c69c0000
                                                File size:57'360 bytes
                                                MD5 hash:F586835082F632DC8D9404D83BC16316
                                                Has elevated privileges:false
                                                Has administrator privileges:false
                                                Programmed in:C, C++ or other language
                                                Has exited:false

                                                General

                                                Target ID:19
                                                Start time:02:59:28
                                                Start date:09/01/2025
                                                Path:C:\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_3ea756ac68d34d21\IntelCpHDCPSvc.exe
                                                Wow64 process (32bit):false
                                                Commandline:C:\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_3ea756ac68d34d21\IntelCpHDCPSvc.exe
                                                Imagebase:0x7ff692790000
                                                File size:365'360 bytes
                                                MD5 hash:B6BAD2BD8596D9101874E9042B8E2D63
                                                Has elevated privileges:true
                                                Has administrator privileges:true
                                                Programmed in:C, C++ or other language
                                                Has exited:false

                                                General

                                                Target ID:20
                                                Start time:02:59:28
                                                Start date:09/01/2025
                                                Path:C:\Windows\System32\svchost.exe
                                                Wow64 process (32bit):false
                                                Commandline:C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
                                                Imagebase:0x7ff7c69c0000
                                                File size:57'360 bytes
                                                MD5 hash:F586835082F632DC8D9404D83BC16316
                                                Has elevated privileges:true
                                                Has administrator privileges:false
                                                Programmed in:C, C++ or other language
                                                Has exited:false

                                                General

                                                Target ID:21
                                                Start time:02:59:29
                                                Start date:09/01/2025
                                                Path:C:\Windows\System32\svchost.exe
                                                Wow64 process (32bit):false
                                                Commandline:C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
                                                Imagebase:0x7ff7c69c0000
                                                File size:57'360 bytes
                                                MD5 hash:F586835082F632DC8D9404D83BC16316
                                                Has elevated privileges:true
                                                Has administrator privileges:true
                                                Programmed in:C, C++ or other language
                                                Has exited:false

                                                General

                                                Target ID:22
                                                Start time:02:59:29
                                                Start date:09/01/2025
                                                Path:C:\Windows\System32\svchost.exe
                                                Wow64 process (32bit):false
                                                Commandline:C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
                                                Imagebase:0x7ff7c69c0000
                                                File size:57'360 bytes
                                                MD5 hash:F586835082F632DC8D9404D83BC16316
                                                Has elevated privileges:true
                                                Has administrator privileges:false
                                                Programmed in:C, C++ or other language
                                                Has exited:false

                                                General

                                                Target ID:23
                                                Start time:02:59:30
                                                Start date:09/01/2025
                                                Path:C:\Windows\System32\svchost.exe
                                                Wow64 process (32bit):false
                                                Commandline:C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
                                                Imagebase:0x7ff7c69c0000
                                                File size:57'360 bytes
                                                MD5 hash:F586835082F632DC8D9404D83BC16316
                                                Has elevated privileges:true
                                                Has administrator privileges:true
                                                Programmed in:C, C++ or other language
                                                Has exited:false

                                                General

                                                Target ID:24
                                                Start time:02:59:30
                                                Start date:09/01/2025
                                                Path:C:\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_3ea756ac68d34d21\IntelCpHeciSvc.exe
                                                Wow64 process (32bit):false
                                                Commandline:C:\Windows\System32\DriverStore\FileRepository\iigd_dch.inf_amd64_3ea756ac68d34d21\IntelCpHeciSvc.exe
                                                Imagebase:0x7ff6d1840000
                                                File size:521'536 bytes
                                                MD5 hash:3B0DF35583675DE5A08E8D4C1271CEC0
                                                Has elevated privileges:true
                                                Has administrator privileges:true
                                                Programmed in:C, C++ or other language
                                                Has exited:false

                                                General

                                                Target ID:25
                                                Start time:02:59:30
                                                Start date:09/01/2025
                                                Path:C:\Windows\System32\DriverStore\FileRepository\cui_dch.inf_amd64_2e49f48165b8de10\igfxCUIService.exe
                                                Wow64 process (32bit):false
                                                Commandline:C:\Windows\System32\DriverStore\FileRepository\cui_dch.inf_amd64_2e49f48165b8de10\igfxCUIService.exe
                                                Imagebase:0x7ff76c650000
                                                File size:399'664 bytes
                                                MD5 hash:91038D45A86B5465E8B7E5CD63187150
                                                Has elevated privileges:true
                                                Has administrator privileges:true
                                                Programmed in:C, C++ or other language
                                                Has exited:false

                                                General

                                                Target ID:26
                                                Start time:02:59:31
                                                Start date:09/01/2025
                                                Path:C:\Windows\System32\svchost.exe
                                                Wow64 process (32bit):false
                                                Commandline:C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
                                                Imagebase:0x7ff7c69c0000
                                                File size:57'360 bytes
                                                MD5 hash:F586835082F632DC8D9404D83BC16316
                                                Has elevated privileges:true
                                                Has administrator privileges:false
                                                Programmed in:C, C++ or other language
                                                Has exited:false

                                                General

                                                Target ID:27
                                                Start time:02:59:31
                                                Start date:09/01/2025
                                                Path:C:\Windows\System32\svchost.exe
                                                Wow64 process (32bit):false
                                                Commandline:C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
                                                Imagebase:0x7ff7c69c0000
                                                File size:57'360 bytes
                                                MD5 hash:F586835082F632DC8D9404D83BC16316
                                                Has elevated privileges:true
                                                Has administrator privileges:false
                                                Programmed in:C, C++ or other language
                                                Has exited:false

                                                General

                                                Target ID:28
                                                Start time:02:59:31
                                                Start date:09/01/2025
                                                Path:C:\Windows\System32\svchost.exe
                                                Wow64 process (32bit):false
                                                Commandline:C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
                                                Imagebase:0x7ff7c69c0000
                                                File size:57'360 bytes
                                                MD5 hash:F586835082F632DC8D9404D83BC16316
                                                Has elevated privileges:true
                                                Has administrator privileges:false
                                                Programmed in:C, C++ or other language
                                                Has exited:false

                                                General

                                                Target ID:29
                                                Start time:02:59:31
                                                Start date:09/01/2025
                                                Path:C:\Windows\System32\svchost.exe
                                                Wow64 process (32bit):false
                                                Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
                                                Imagebase:0x7ff7c69c0000
                                                File size:57'360 bytes
                                                MD5 hash:F586835082F632DC8D9404D83BC16316
                                                Has elevated privileges:true
                                                Has administrator privileges:true
                                                Programmed in:C, C++ or other language
                                                Has exited:false

                                                General

                                                Target ID:30
                                                Start time:02:59:31
                                                Start date:09/01/2025
                                                Path:C:\Windows\System32\svchost.exe
                                                Wow64 process (32bit):false
                                                Commandline:C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
                                                Imagebase:0x7ff7c69c0000
                                                File size:57'360 bytes
                                                MD5 hash:F586835082F632DC8D9404D83BC16316
                                                Has elevated privileges:true
                                                Has administrator privileges:true
                                                Programmed in:C, C++ or other language
                                                Has exited:false

                                                General

                                                Target ID:31
                                                Start time:02:59:32
                                                Start date:09/01/2025
                                                Path:C:\Windows\System32\svchost.exe
                                                Wow64 process (32bit):false
                                                Commandline:C:\Windows\system32\svchost.exe -k LocalService -p -s FontCache
                                                Imagebase:0x7ff7c69c0000
                                                File size:57'360 bytes
                                                MD5 hash:F586835082F632DC8D9404D83BC16316
                                                Has elevated privileges:true
                                                Has administrator privileges:false
                                                Programmed in:C, C++ or other language
                                                Has exited:false

                                                General

                                                Target ID:32
                                                Start time:02:59:32
                                                Start date:09/01/2025
                                                Path:C:\Windows\System32\svchost.exe
                                                Wow64 process (32bit):false
                                                Commandline:C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
                                                Imagebase:0x7ff7c69c0000
                                                File size:57'360 bytes
                                                MD5 hash:F586835082F632DC8D9404D83BC16316
                                                Has elevated privileges:true
                                                Has administrator privileges:false
                                                Programmed in:C, C++ or other language
                                                Has exited:false

                                                General

                                                Target ID:33
                                                Start time:02:59:32
                                                Start date:09/01/2025
                                                Path:C:\Windows\System32\svchost.exe
                                                Wow64 process (32bit):false
                                                Commandline:C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
                                                Imagebase:0x7ff7c69c0000
                                                File size:57'360 bytes
                                                MD5 hash:F586835082F632DC8D9404D83BC16316
                                                Has elevated privileges:true
                                                Has administrator privileges:false
                                                Programmed in:C, C++ or other language
                                                Has exited:false

                                                General

                                                Target ID:34
                                                Start time:02:59:33
                                                Start date:09/01/2025
                                                Path:C:\Windows\System32\svchost.exe
                                                Wow64 process (32bit):false
                                                Commandline:C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
                                                Imagebase:0x7ff7c69c0000
                                                File size:57'360 bytes
                                                MD5 hash:F586835082F632DC8D9404D83BC16316
                                                Has elevated privileges:true
                                                Has administrator privileges:false
                                                Programmed in:C, C++ or other language
                                                Has exited:false

                                                General

                                                Target ID:35
                                                Start time:02:59:33
                                                Start date:09/01/2025
                                                Path:C:\Windows\System32\svchost.exe
                                                Wow64 process (32bit):false
                                                Commandline:C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
                                                Imagebase:0x7ff7c69c0000
                                                File size:57'360 bytes
                                                MD5 hash:F586835082F632DC8D9404D83BC16316
                                                Has elevated privileges:true
                                                Has administrator privileges:false
                                                Programmed in:C, C++ or other language
                                                Has exited:true

                                                General

                                                Target ID:36
                                                Start time:02:59:33
                                                Start date:09/01/2025
                                                Path:C:\Windows\System32\svchost.exe
                                                Wow64 process (32bit):false
                                                Commandline:C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
                                                Imagebase:0x7ff7c69c0000
                                                File size:57'360 bytes
                                                MD5 hash:F586835082F632DC8D9404D83BC16316
                                                Has elevated privileges:false
                                                Has administrator privileges:false
                                                Programmed in:C, C++ or other language
                                                Has exited:false

                                                General

                                                Target ID:37
                                                Start time:02:59:33
                                                Start date:09/01/2025
                                                Path:C:\Windows\System32\svchost.exe
                                                Wow64 process (32bit):false
                                                Commandline:C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                Imagebase:0x7ff7c69c0000
                                                File size:57'360 bytes
                                                MD5 hash:F586835082F632DC8D9404D83BC16316
                                                Has elevated privileges:true
                                                Has administrator privileges:false
                                                Programmed in:C, C++ or other language
                                                Has exited:false

                                                General

                                                Target ID:38
                                                Start time:02:59:34
                                                Start date:09/01/2025
                                                Path:C:\Windows\System32\svchost.exe
                                                Wow64 process (32bit):false
                                                Commandline:C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                Imagebase:0x7ff7c69c0000
                                                File size:57'360 bytes
                                                MD5 hash:F586835082F632DC8D9404D83BC16316
                                                Has elevated privileges:true
                                                Has administrator privileges:false
                                                Programmed in:C, C++ or other language
                                                Has exited:false

                                                General

                                                Target ID:39
                                                Start time:02:59:34
                                                Start date:09/01/2025
                                                Path:C:\Windows\System32\svchost.exe
                                                Wow64 process (32bit):false
                                                Commandline:C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
                                                Imagebase:0x7ff7c69c0000
                                                File size:57'360 bytes
                                                MD5 hash:F586835082F632DC8D9404D83BC16316
                                                Has elevated privileges:true
                                                Has administrator privileges:false
                                                Programmed in:C, C++ or other language
                                                Has exited:false

                                                General

                                                Target ID:40
                                                Start time:02:59:34
                                                Start date:09/01/2025
                                                Path:C:\Windows\System32\svchost.exe
                                                Wow64 process (32bit):false
                                                Commandline:C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
                                                Imagebase:0x7ff7c69c0000
                                                File size:57'360 bytes
                                                MD5 hash:F586835082F632DC8D9404D83BC16316
                                                Has elevated privileges:true
                                                Has administrator privileges:true
                                                Programmed in:C, C++ or other language
                                                Has exited:false

                                                General

                                                Target ID:41
                                                Start time:02:59:35
                                                Start date:09/01/2025
                                                Path:C:\Windows\System32\svchost.exe
                                                Wow64 process (32bit):false
                                                Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
                                                Imagebase:0x7ff7c69c0000
                                                File size:57'360 bytes
                                                MD5 hash:F586835082F632DC8D9404D83BC16316
                                                Has elevated privileges:true
                                                Has administrator privileges:true
                                                Programmed in:C, C++ or other language
                                                Has exited:false

                                                General

                                                Target ID:42
                                                Start time:02:59:35
                                                Start date:09/01/2025
                                                Path:C:\Windows\System32\spoolsv.exe
                                                Wow64 process (32bit):false
                                                Commandline:C:\Windows\System32\spoolsv.exe
                                                Imagebase:0x7ff6acc10000
                                                File size:803'328 bytes
                                                MD5 hash:001E4317FC877B5C0DB731694CCED48D
                                                Has elevated privileges:true
                                                Has administrator privileges:true
                                                Programmed in:C, C++ or other language
                                                Has exited:false

                                                Disassembly

                                                Reset < >

                                                  Execution Graph

                                                  Execution Coverage:18.7%
                                                  Dynamic/Decrypted Code Coverage:0%
                                                  Signature Coverage:49.9%
                                                  Total number of Nodes:1222
                                                  Total number of Limit Nodes:126
                                                  execution_graph 6733 7ff717597940 6736 7ff717597c2c 6733->6736 6737 7ff717597c4f GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter 6736->6737 6738 7ff717597949 6736->6738 6737->6738 5422 7ff717447cb0 memset OutputDebugStringW 5550 7ff717451d80 5422->5550 5424 7ff717447d68 5565 7ff7175899d0 5424->5565 5426 7ff717447da5 5598 7ff717589810 5426->5598 5428 7ff717447e16 memset 5429 7ff717447efa OutputDebugStringW 5428->5429 5432 7ff717447e55 5428->5432 5430 7ff717447f10 5429->5430 5605 7ff7174429a0 5430->5605 5432->5429 5433 7ff717447f42 5617 7ff717442db0 5433->5617 5435 7ff717447f68 5436 7ff717447f83 5435->5436 5964 7ff717573d00 GetLastError 5435->5964 5438 7ff7174429a0 29 API calls 5436->5438 5540 7ff7174483fd 5436->5540 5439 7ff717447fb1 5438->5439 5440 7ff717442db0 107 API calls 5439->5440 5441 7ff717447fd7 5440->5441 5442 7ff717447ff2 5441->5442 5965 7ff717573d00 GetLastError 5441->5965 5444 7ff7174429a0 29 API calls 5442->5444 5442->5540 5445 7ff717448020 5444->5445 5446 7ff717442db0 107 API calls 5445->5446 5447 7ff717448046 5446->5447 5448 7ff71744806a 5447->5448 5966 7ff717573d00 GetLastError 5447->5966 5450 7ff7174429a0 29 API calls 5448->5450 5448->5540 5451 7ff71744809c 5450->5451 5715 7ff7174452d0 5451->5715 5453 7ff7174480b1 5458 7ff7174480c9 5453->5458 5967 7ff717573d00 GetLastError 5453->5967 5454 7ff7174480e3 memset OutputDebugStringW CreateToolhelp32Snapshot 5456 7ff717448389 memset OutputDebugStringW 5454->5456 5457 7ff71744814f memset OutputDebugStringW 5454->5457 5968 7ff717573d00 GetLastError 5456->5968 5782 7ff717573bb0 memset 5457->5782 5458->5454 5458->5540 5461 7ff7174481af Module32FirstW 5462 7ff7174481c8 5461->5462 5463 7ff717448402 memset OutputDebugStringW 5461->5463 5464 7ff717589810 16 API calls 5462->5464 5465 7ff71744849e 5463->5465 5466 7ff71744827b 5464->5466 5969 7ff717573d00 GetLastError 5465->5969 5468 7ff7175899d0 34 API calls 5466->5468 5469 7ff7174482a6 5468->5469 5470 7ff717589810 16 API calls 5469->5470 5471 7ff717448322 memset 5470->5471 5472 7ff71744853a OutputDebugStringW 5471->5472 5476 7ff717448364 5471->5476 5473 7ff717448556 5472->5473 5783 7ff71744a5a0 5473->5783 5475 7ff717448593 5477 7ff71744868d 5475->5477 5478 7ff7174485a7 5475->5478 5476->5472 5480 7ff717589810 16 API calls 5477->5480 5479 7ff717589810 16 API calls 5478->5479 5481 7ff717448626 memset 5479->5481 5482 7ff717448728 memset 5480->5482 5483 7ff71744882a OutputDebugStringW 5481->5483 5487 7ff717448668 5481->5487 5484 7ff71744890a OutputDebugStringW 5482->5484 5489 7ff71744876a 5482->5489 5483->5540 5485 7ff717448926 5484->5485 5915 7ff7174469b0 5485->5915 5487->5483 5488 7ff717448949 5490 7ff717589810 16 API calls 5488->5490 5489->5484 5491 7ff7174489fc 5490->5491 5492 7ff7175899d0 34 API calls 5491->5492 5493 7ff717448a20 5492->5493 5494 7ff717589810 16 API calls 5493->5494 5495 7ff717448a9c memset 5494->5495 5496 7ff717448b8a OutputDebugStringW 5495->5496 5499 7ff717448ade 5495->5499 5497 7ff717448ba6 5496->5497 5498 7ff71744a5a0 139 API calls 5497->5498 5500 7ff717448be3 5498->5500 5499->5496 5501 7ff717448cdd 5500->5501 5502 7ff717448bf7 5500->5502 5504 7ff717589810 16 API calls 5501->5504 5503 7ff717589810 16 API calls 5502->5503 5506 7ff717448c76 memset 5503->5506 5505 7ff717448d78 memset 5504->5505 5507 7ff717448fea OutputDebugStringW 5505->5507 5513 7ff717448dc1 5505->5513 5508 7ff717448e7a OutputDebugStringW 5506->5508 5512 7ff717448cb8 5506->5512 5509 7ff717449010 5507->5509 5508->5540 5510 7ff7174469b0 29 API calls 5509->5510 5511 7ff717449030 memset OutputDebugStringW 5510->5511 5535 7ff7174490e0 5511->5535 5512->5508 5513->5507 5516 7ff717589810 16 API calls 5517 7ff717449289 memset 5516->5517 5518 7ff7174492c7 5517->5518 5519 7ff71744937a OutputDebugStringW 5517->5519 5518->5519 5521 7ff7175899d0 34 API calls 5518->5521 5522 7ff717589810 16 API calls 5518->5522 5953 7ff71744a440 5518->5953 5519->5518 5521->5518 5523 7ff717449460 memset 5522->5523 5524 7ff71744954a OutputDebugStringW 5523->5524 5529 7ff71744949e 5523->5529 5524->5529 5525 7ff71744958a memcmp 5525->5529 5526 7ff7174495ad memcmp 5528 7ff717449d00 Module32NextW 5526->5528 5526->5529 5527 7ff717589810 16 API calls 5532 7ff71744971d memset 5527->5532 5533 7ff717449d5d memset OutputDebugStringW 5528->5533 5528->5535 5529->5524 5529->5525 5529->5526 5529->5527 5530 7ff7174495d0 memcmp 5529->5530 5531 7ff717589810 16 API calls 5529->5531 5530->5528 5530->5529 5534 7ff717449652 memset 5531->5534 5532->5535 5536 7ff717449cca OutputDebugStringW 5532->5536 5539 7ff717449dcb 5533->5539 5537 7ff71744980a OutputDebugStringW 5534->5537 5542 7ff717449690 5534->5542 5535->5516 5535->5528 5535->5536 5547 7ff717449b1a OutputDebugStringW 5535->5547 5548 7ff717449bfa OutputDebugStringW 5535->5548 5549 7ff7174469b0 29 API calls 5535->5549 5947 7ff717452ae0 5535->5947 5970 7ff717598c00 5535->5970 5536->5528 5536->5535 5537->5542 5538 7ff717449dfb NtClose memset OutputDebugStringW 5538->5540 5539->5538 5541 7ff71744a5a0 139 API calls 5541->5542 5542->5537 5542->5541 5543 7ff717589810 16 API calls 5542->5543 5544 7ff717589810 16 API calls 5542->5544 5545 7ff717449911 memset 5543->5545 5546 7ff717449a24 memset 5544->5546 5545->5535 5545->5547 5546->5535 5546->5548 5547->5535 5548->5535 5549->5535 5551 7ff717451dae 5550->5551 5552 7ff717451db7 GetModuleFileNameW 5551->5552 5553 7ff717451ea4 5551->5553 5555 7ff717451dd3 5552->5555 5560 7ff717451e43 5552->5560 5996 7ff71759ed93 5553->5996 5556 7ff717451e8e 5555->5556 5557 7ff717451de4 5555->5557 5993 7ff71759f450 5556->5993 5559 7ff717598c00 19 API calls 5557->5559 5562 7ff717451e24 5559->5562 5560->5424 5564 7ff717452ae0 20 API calls 5562->5564 5564->5560 5566 7ff7175899ff 5565->5566 5567 7ff71758a539 5565->5567 5566->5567 5570 7ff717589a2e 5566->5570 5568 7ff71759ed93 16 API calls 5567->5568 5597 7ff717589fad 5568->5597 5569 7ff71759f510 16 API calls 5571 7ff71758a537 5569->5571 5573 7ff717589c3c 5570->5573 5575 7ff717589590 16 API calls 5570->5575 5578 7ff71758a271 memcpy 5570->5578 5579 7ff71758a451 5570->5579 5580 7ff71758a028 memcpy 5570->5580 5581 7ff71758a4b4 5570->5581 5583 7ff717597100 16 API calls 5570->5583 5585 7ff71758a120 memcpy 5570->5585 5586 7ff71758a460 5570->5586 5587 7ff717589b6f memcpy 5570->5587 5588 7ff71758a4cc 5570->5588 5589 7ff717597280 16 API calls 5570->5589 5592 7ff71758a1c0 memcpy 5570->5592 5593 7ff71758a47c 5570->5593 5594 7ff71758a4e4 5570->5594 5596 7ff71758a494 5570->5596 5570->5597 6178 7ff717597580 5570->6178 6194 7ff71759ecf0 5570->6194 5571->5426 6204 7ff71759f510 5573->6204 5575->5570 5577 7ff71759ecf0 16 API calls 5577->5581 5578->5570 5584 7ff71759ecf0 16 API calls 5579->5584 5580->5570 5582 7ff71759ecf0 16 API calls 5581->5582 5582->5588 5583->5570 5584->5586 5585->5570 5591 7ff71759ecf0 16 API calls 5586->5591 5587->5570 5590 7ff71759ecf0 16 API calls 5588->5590 5589->5570 5590->5594 5591->5593 5592->5570 5595 7ff71759ecf0 16 API calls 5593->5595 5594->5426 5595->5596 5596->5577 5597->5569 5599 7ff71758983a 5598->5599 5600 7ff717589929 5599->5600 5601 7ff71759f370 16 API calls 5599->5601 5602 7ff7175898f9 5599->5602 5600->5428 5601->5602 5603 7ff71759ed93 16 API calls 5602->5603 5604 7ff717589985 5603->5604 5604->5428 6245 7ff717450350 5605->6245 5607 7ff7174429f5 5608 7ff717442ce8 5607->5608 5609 7ff7174429ff 5607->5609 5611 7ff71759f370 16 API calls 5608->5611 5610 7ff717589810 16 API calls 5609->5610 5612 7ff717442af4 memset 5610->5612 5613 7ff717442d29 5611->5613 5614 7ff717442bda OutputDebugStringW 5612->5614 5615 7ff717442b33 5612->5615 5613->5433 5616 7ff717442bf0 5614->5616 5615->5614 5616->5433 5618 7ff717589810 16 API calls 5617->5618 5619 7ff717442ef3 memset 5618->5619 5620 7ff717442fda OutputDebugStringW 5619->5620 5624 7ff717442f2e 5619->5624 5621 7ff717442ffd 5620->5621 5622 7ff71744a440 17 API calls 5621->5622 5623 7ff717443028 5622->5623 5625 7ff717589810 16 API calls 5623->5625 5624->5620 5626 7ff717443086 memset 5625->5626 5627 7ff71744317a OutputDebugStringW 5626->5627 5631 7ff7174430c8 5626->5631 5628 7ff717443196 5627->5628 6278 7ff7174467d0 5628->6278 5630 7ff7174431ba 5632 7ff717589810 16 API calls 5630->5632 5631->5627 5633 7ff71744323a memset 5632->5633 5634 7ff71744332a OutputDebugStringW 5633->5634 5637 7ff71744327c 5633->5637 5635 7ff717443346 5634->5635 6287 7ff7174421c0 5635->6287 5637->5634 5638 7ff717443369 5645 7ff717443378 5638->5645 6317 7ff717450ae0 5638->6317 5640 7ff7174433ce 5641 7ff7174433db 5640->5641 5648 7ff7174434cc 5640->5648 5642 7ff717589810 16 API calls 5641->5642 5643 7ff71744345e memset 5642->5643 5644 7ff71744374a OutputDebugStringW 5643->5644 5647 7ff7174434a7 5643->5647 5644->5645 5645->5435 5646 7ff717589810 16 API calls 5649 7ff71744364a memset 5646->5649 5647->5644 5648->5646 5650 7ff71744386a OutputDebugStringW 5649->5650 5652 7ff71744368c 5649->5652 5651 7ff717443886 5650->5651 5653 7ff717443a53 5651->5653 5660 7ff717443972 5651->5660 5652->5650 6343 7ff717447340 5653->6343 5656 7ff717443ee8 5659 7ff717589810 16 API calls 5656->5659 5657 7ff717443a68 5658 7ff717589810 16 API calls 5657->5658 5661 7ff717443ae9 memset 5658->5661 5662 7ff717443f4a memset 5659->5662 5663 7ff717589810 16 API calls 5660->5663 5664 7ff71744403a OutputDebugStringW 5661->5664 5674 7ff717443b2b 5661->5674 5665 7ff71744410a OutputDebugStringW 5662->5665 5673 7ff717443f86 5662->5673 5666 7ff7174439ec memset 5663->5666 5698 7ff717443ea6 5664->5698 5667 7ff717444126 5665->5667 5668 7ff717443c1a OutputDebugStringW 5666->5668 5676 7ff717443a2e 5666->5676 5670 7ff717454910 19 API calls 5667->5670 5669 7ff717443c36 5668->5669 6369 7ff717454910 5669->6369 5675 7ff717444174 GetModuleHandleW 5670->5675 5671 7ff717589810 16 API calls 5677 7ff7174443f5 memset 5671->5677 5673->5665 5674->5664 5679 7ff71744426c 5675->5679 5680 7ff717444191 5675->5680 5676->5668 5682 7ff7174444da OutputDebugStringW 5677->5682 5694 7ff71744442e 5677->5694 5678 7ff717443c84 GetModuleHandleW 5683 7ff717443ca1 5678->5683 5684 7ff717443d8f 5678->5684 6398 7ff717573d00 GetLastError 5679->6398 5680->5645 5685 7ff717589810 16 API calls 5680->5685 5686 7ff7174444f6 5682->5686 5683->5645 5690 7ff717589810 16 API calls 5683->5690 6397 7ff717573d00 GetLastError 5684->6397 5688 7ff717444212 memset 5685->5688 6377 7ff717444d10 5686->6377 5691 7ff71744433a OutputDebugStringW 5688->5691 5701 7ff71744424b 5688->5701 5693 7ff717443d2c memset 5690->5693 5691->5698 5692 7ff717444521 5695 7ff71744452b 5692->5695 5696 7ff717444642 5692->5696 5697 7ff717443e8a OutputDebugStringW 5693->5697 5704 7ff717443d6e 5693->5704 5694->5682 5700 7ff717444541 VirtualQuery 5695->5700 5699 7ff717589810 16 API calls 5696->5699 5697->5698 5698->5671 5702 7ff7174446ab memset 5699->5702 5705 7ff717444710 5700->5705 5706 7ff717444560 5700->5706 5701->5691 5703 7ff71744491a OutputDebugStringW 5702->5703 5711 7ff7174446eb 5702->5711 5703->5645 5704->5697 5707 7ff717589810 16 API calls 5705->5707 5706->5705 5708 7ff71744456d 5706->5708 5709 7ff717444787 memset 5707->5709 5710 7ff717589810 16 API calls 5708->5710 5709->5703 5709->5711 5712 7ff7174445e4 memset 5710->5712 5711->5703 5713 7ff717444a4a OutputDebugStringW 5712->5713 5714 7ff71744461d 5712->5714 5713->5645 5714->5713 5716 7ff717589810 16 API calls 5715->5716 5717 7ff7174453bb memset 5716->5717 5718 7ff7174454aa OutputDebugStringW 5717->5718 5722 7ff7174453f6 5717->5722 5719 7ff7174454cd 5718->5719 5720 7ff7174421c0 27 API calls 5719->5720 5721 7ff7174454ed 5720->5721 5723 7ff717450ae0 25 API calls 5721->5723 5773 7ff7174454fc 5721->5773 5722->5718 5724 7ff717445544 5723->5724 5725 7ff717445551 5724->5725 5729 7ff71744562f 5724->5729 5726 7ff717589810 16 API calls 5725->5726 5727 7ff7174455ca memset 5726->5727 5728 7ff71744580a OutputDebugStringW 5727->5728 5731 7ff71744560a 5727->5731 5728->5773 5730 7ff717589810 16 API calls 5729->5730 5732 7ff717445715 memset 5730->5732 5731->5728 5733 7ff71744592a OutputDebugStringW 5732->5733 5737 7ff71744574e 5732->5737 5734 7ff717445946 5733->5734 5735 7ff717589810 16 API calls 5734->5735 5736 7ff717445a03 5735->5736 5738 7ff7175899d0 34 API calls 5736->5738 5737->5733 5739 7ff717445a27 5738->5739 5740 7ff717589810 16 API calls 5739->5740 5741 7ff717445a99 memset 5740->5741 5742 7ff717445b8a OutputDebugStringW 5741->5742 5745 7ff717445ad5 5741->5745 5743 7ff717445ba6 5742->5743 5744 7ff7174467d0 35 API calls 5743->5744 5746 7ff717445bca 5744->5746 5745->5742 5747 7ff717589810 16 API calls 5746->5747 5748 7ff717445c43 memset 5747->5748 5749 7ff717445d2a OutputDebugStringW 5748->5749 5753 7ff717445c7c 5748->5753 5750 7ff717445d46 5749->5750 5751 7ff717447340 26 API calls 5750->5751 5752 7ff717445d62 5751->5752 5754 7ff717445d6c 5752->5754 5755 7ff717445e41 memset OutputDebugStringW GetModuleHandleA 5752->5755 5753->5749 5756 7ff717589810 16 API calls 5754->5756 5757 7ff717445f3a 5755->5757 5763 7ff717445efb 5755->5763 5759 7ff717445de3 memset 5756->5759 6432 7ff717573d00 GetLastError 5757->6432 5761 7ff71744600a OutputDebugStringW 5759->5761 5766 7ff717445e1c 5759->5766 5760 7ff717444d10 26 API calls 5762 7ff717446051 5760->5762 5761->5763 5764 7ff71744616b 5762->5764 5765 7ff71744605b 5762->5765 5763->5760 5763->5773 5767 7ff717589810 16 API calls 5764->5767 5769 7ff717446071 VirtualQuery 5765->5769 5766->5761 5768 7ff7174461bf memset 5767->5768 5770 7ff71744641a OutputDebugStringW 5768->5770 5778 7ff7174461ff 5768->5778 5771 7ff717446090 5769->5771 5772 7ff717446224 5769->5772 5770->5773 5771->5772 5775 7ff71744609d 5771->5775 5774 7ff717589810 16 API calls 5772->5774 5773->5453 5776 7ff717446286 memset 5774->5776 5777 7ff717589810 16 API calls 5775->5777 5776->5770 5776->5778 5779 7ff71744610d memset 5777->5779 5778->5770 5780 7ff71744653a OutputDebugStringW 5779->5780 5781 7ff717446146 5779->5781 5780->5773 5781->5780 5782->5461 5784 7ff717589810 16 API calls 5783->5784 5785 7ff71744a64a memset 5784->5785 5786 7ff71744a73a OutputDebugStringW 5785->5786 5790 7ff71744a685 5785->5790 5787 7ff71744a75d 5786->5787 5788 7ff717589810 16 API calls 5787->5788 5789 7ff71744a7d4 5788->5789 5791 7ff717589810 16 API calls 5789->5791 5790->5786 5792 7ff71744a851 memset 5791->5792 5793 7ff71744a94a OutputDebugStringW 5792->5793 5796 7ff71744a893 5792->5796 5794 7ff71744a97b 5793->5794 5795 7ff7174429a0 29 API calls 5794->5795 5797 7ff71744a9ad 5795->5797 5796->5793 5798 7ff7174452d0 94 API calls 5797->5798 5799 7ff71744a9c2 5798->5799 5800 7ff71744ab70 5799->5800 5801 7ff717589810 16 API calls 5799->5801 5802 7ff7174429a0 29 API calls 5800->5802 5914 7ff71744ab77 5800->5914 5803 7ff71744aa48 memset 5801->5803 5804 7ff71744aba8 5802->5804 5805 7ff71744ab3a OutputDebugStringW 5803->5805 5812 7ff71744aa83 5803->5812 5806 7ff7174452d0 94 API calls 5804->5806 5808 7ff71744ab5d 5805->5808 5807 7ff71744abbd 5806->5807 5810 7ff71744ad70 5807->5810 5811 7ff717589810 16 API calls 5807->5811 6444 7ff717573d00 GetLastError 5808->6444 5813 7ff7174429a0 29 API calls 5810->5813 5810->5914 5814 7ff71744ac4c memset 5811->5814 5812->5805 5815 7ff71744adb3 5813->5815 5816 7ff71744ad3a OutputDebugStringW 5814->5816 5822 7ff71744ac87 5814->5822 5817 7ff7174452d0 94 API calls 5815->5817 5818 7ff71744ad5d 5816->5818 5819 7ff71744adc8 5817->5819 6445 7ff717573d00 GetLastError 5818->6445 5821 7ff71744af70 5819->5821 5824 7ff717589810 16 API calls 5819->5824 5823 7ff7174429a0 29 API calls 5821->5823 5821->5914 5822->5816 5826 7ff71744afa8 5823->5826 5825 7ff71744ae4e memset 5824->5825 5827 7ff71744af3a OutputDebugStringW 5825->5827 5834 7ff71744ae89 5825->5834 5828 7ff7174452d0 94 API calls 5826->5828 5830 7ff71744af5d 5827->5830 5829 7ff71744afbd 5828->5829 5831 7ff71744b160 5829->5831 5833 7ff717589810 16 API calls 5829->5833 6446 7ff717573d00 GetLastError 5830->6446 5831->5914 6433 7ff717454560 5831->6433 5836 7ff71744b043 memset 5833->5836 5834->5827 5838 7ff71744b12a OutputDebugStringW 5836->5838 5842 7ff71744b07e 5836->5842 5837 7ff71744b1f1 5843 7ff71744b214 5837->5843 6448 7ff7175772f0 5837->6448 5840 7ff71744b14d 5838->5840 6447 7ff717573d00 GetLastError 5840->6447 5842->5838 5844 7ff717589810 16 API calls 5843->5844 5845 7ff71744b30d memset 5844->5845 5846 7ff71744b3fa OutputDebugStringW 5845->5846 5853 7ff71744b34f 5845->5853 5847 7ff71744b419 5846->5847 5848 7ff71744b42a NtOpenFile 5846->5848 5847->5848 5849 7ff71744b5c7 5848->5849 5850 7ff71744b462 5848->5850 5852 7ff717589810 16 API calls 5849->5852 5851 7ff717589810 16 API calls 5850->5851 5854 7ff71744b560 memset 5851->5854 5855 7ff71744b633 memset 5852->5855 5853->5846 5856 7ff71744b72a OutputDebugStringW 5854->5856 5861 7ff71744b5a2 5854->5861 5857 7ff71744b8ea OutputDebugStringW 5855->5857 5862 7ff71744b675 5855->5862 5858 7ff71744b746 5856->5858 5860 7ff71744b909 5857->5860 5859 7ff717589810 16 API calls 5858->5859 5863 7ff71744b7c2 5859->5863 5864 7ff71744b91f NtCreateSection 5860->5864 5861->5856 5862->5857 5863->5914 6458 7ff717574300 5863->6458 5865 7ff71744b96b 5864->5865 5866 7ff71744bacd 5864->5866 5869 7ff717589810 16 API calls 5865->5869 5867 7ff717589810 16 API calls 5866->5867 5871 7ff71744bb4b memset 5867->5871 5870 7ff71744ba66 memset 5869->5870 5873 7ff71744bc4a OutputDebugStringW 5870->5873 5884 7ff71744baa8 5870->5884 5874 7ff71744bd5a OutputDebugStringW 5871->5874 5885 7ff71744bb8a 5871->5885 5876 7ff71744bc66 5873->5876 5877 7ff71744bd7c 5874->5877 5878 7ff71744bd8d GetCurrentProcess NtMapViewOfSection 5874->5878 5886 7ff717574300 18 API calls 5876->5886 5877->5878 5879 7ff71744bf92 5878->5879 5880 7ff71744be02 5878->5880 5883 7ff717589810 16 API calls 5879->5883 5881 7ff71744be0d 5880->5881 5882 7ff71744c183 5880->5882 5887 7ff717589810 16 API calls 5881->5887 5889 7ff717589810 16 API calls 5882->5889 5888 7ff71744bffe 5883->5888 5884->5873 5885->5874 5890 7ff71744bc9b 5886->5890 5891 7ff71744be6f 5887->5891 5892 7ff717451f30 2 API calls 5888->5892 5893 7ff71744c27b 5889->5893 6463 7ff717573fc0 GetErrorInfo 5890->6463 6441 7ff717451f30 memset 5891->6441 5900 7ff71744c01d 5892->5900 5894 7ff717451f30 2 API calls 5893->5894 5903 7ff71744c29a 5894->5903 5897 7ff71744be8e 5898 7ff7174467d0 35 API calls 5897->5898 5899 7ff71744bebf 5898->5899 5901 7ff717589810 16 API calls 5899->5901 5902 7ff7174467d0 35 API calls 5900->5902 5904 7ff71744bf3c 5901->5904 5905 7ff71744c062 5902->5905 6464 7ff717454260 5903->6464 5907 7ff717451f30 2 API calls 5904->5907 5908 7ff717589810 16 API calls 5905->5908 5910 7ff71744bf5b 5907->5910 5912 7ff71744c0fa 5908->5912 5909 7ff71744c2e4 5909->5909 5911 7ff71744bf79 NtClose 5910->5911 5911->5914 5913 7ff717451f30 2 API calls 5912->5913 5913->5914 5914->5475 5916 7ff717446c01 5915->5916 5917 7ff7174469e6 5915->5917 5918 7ff717589810 16 API calls 5916->5918 5919 7ff7174470c2 5917->5919 5922 7ff71759dfc0 2 API calls 5917->5922 5926 7ff717446a18 5917->5926 5920 7ff717446c5b memset 5918->5920 5921 7ff71759e090 3 API calls 5919->5921 5923 7ff717446dfa OutputDebugStringW 5920->5923 5931 7ff717446c93 5920->5931 5921->5926 5922->5919 5925 7ff717446e1b 5923->5925 5924 7ff717447123 5928 7ff717589810 16 API calls 5924->5928 5925->5488 5926->5924 5932 7ff717446a44 5926->5932 5927 7ff717446ed7 6494 7ff7174533b0 5927->6494 5929 7ff717447190 5928->5929 5933 7ff717451f30 2 API calls 5929->5933 5931->5923 5932->5927 5938 7ff717589810 16 API calls 5932->5938 5935 7ff7174471b8 5933->5935 5941 7ff71759efa0 16 API calls 5935->5941 5936 7ff717589810 16 API calls 5937 7ff717446f74 memset 5936->5937 5939 7ff71744705a OutputDebugStringW 5937->5939 5940 7ff717446fb3 5937->5940 5942 7ff717446d12 memset 5938->5942 5945 7ff717447070 5939->5945 5940->5939 5941->5945 5943 7ff717446eba OutputDebugStringW 5942->5943 5944 7ff717446d51 5942->5944 5943->5927 5944->5943 5945->5925 6498 7ff71759e080 WakeByAddressSingle 5945->6498 5949 7ff717452b13 5947->5949 5948 7ff717452dde 5948->5535 5949->5948 5951 7ff717452d97 memcpy 5949->5951 5952 7ff717598c00 19 API calls 5949->5952 6518 7ff717589590 5949->6518 5951->5949 5952->5949 5954 7ff71744a47c 5953->5954 5957 7ff71744a49e 5954->5957 5962 7ff71744a4b3 5954->5962 5955 7ff717589810 16 API calls 5956 7ff71744a550 5955->5956 5956->5518 5957->5955 5958 7ff71744a580 5961 7ff71759ed93 16 API calls 5958->5961 5959 7ff71744a4e5 memcpy 5959->5956 5963 7ff71744a595 5961->5963 5962->5958 5962->5959 5964->5436 5965->5442 5966->5448 5967->5458 5968->5540 5969->5540 5971 7ff717598cd4 5970->5971 5972 7ff717598c17 5970->5972 5973 7ff71759ed93 16 API calls 5971->5973 5972->5971 5977 7ff717598c6d 5972->5977 5974 7ff717598cba 5973->5974 5975 7ff71759ed93 16 API calls 5974->5975 5983 7ff717598cc1 5974->5983 5976 7ff717598cf8 5975->5976 6534 7ff71745afd0 5976->6534 5977->5974 5979 7ff717598b90 RtlReAllocateHeap 5977->5979 5979->5974 5980 7ff717598d3b 5981 7ff717598d44 5980->5981 5982 7ff717598f16 5980->5982 6541 7ff71745ad10 5981->6541 5985 7ff71759efa0 16 API calls 5982->5985 5983->5535 5987 7ff717598f67 5985->5987 5986 7ff717598d6e 5986->5987 5989 7ff717598da5 5986->5989 5988 7ff71759edb0 16 API calls 5987->5988 5991 7ff717598f78 5988->5991 5992 7ff717598eae 5989->5992 6548 7ff717581950 5989->6548 5991->5535 5992->5535 6002 7ff717596fb0 5993->6002 5997 7ff71759eda2 5996->5997 5998 7ff71759edaa 5996->5998 6175 7ff717589550 5997->6175 6000 7ff71759edb0 16 API calls 5998->6000 6001 7ff71759edaf 6000->6001 6005 7ff71759efa0 6002->6005 6008 7ff71757e010 6005->6008 6014 7ff71757d1a0 6008->6014 6041 7ff71757e380 6014->6041 6016 7ff71757d1af 6047 7ff71757e530 6016->6047 6042 7ff71757e3a3 6041->6042 6043 7ff71757e3f2 6042->6043 6050 7ff71757e5e6 6042->6050 6044 7ff71757e5e6 16 API calls 6043->6044 6046 7ff71757e429 6044->6046 6046->6016 6048 7ff71757e5e6 16 API calls 6047->6048 6049 7ff71757e55d 6048->6049 6052 7ff71757e621 6050->6052 6051 7ff71757e70b 6053 7ff71757e795 6051->6053 6057 7ff71757e713 6051->6057 6052->6051 6056 7ff71757e64f 6052->6056 6069 7ff71759e2a0 6052->6069 6055 7ff71757ab50 16 API calls 6053->6055 6059 7ff71757e78f 6055->6059 6061 7ff71757e693 6056->6061 6077 7ff71757db24 6056->6077 6120 7ff71757ab50 6057->6120 6063 7ff71757ab50 16 API calls 6059->6063 6095 7ff717576310 6061->6095 6065 7ff71757e83d 6063->6065 6064 7ff71757e6de 6064->6059 6108 7ff71757e890 6064->6108 6067 7ff717576310 16 API calls 6065->6067 6068 7ff71757e874 6067->6068 6068->6043 6071 7ff71759e2bc 6069->6071 6070 7ff71759e440 6070->6056 6071->6070 6072 7ff71759e44b 6071->6072 6074 7ff71759e3e2 WaitOnAddress 6071->6074 6073 7ff71759efa0 14 API calls 6072->6073 6075 7ff71759e47d 6073->6075 6074->6071 6076 7ff71759e404 GetLastError 6074->6076 6076->6071 6078 7ff71757db4e 6077->6078 6080 7ff71757db48 6077->6080 6078->6080 6125 7ff71757b0a0 6078->6125 6081 7ff71757dd64 6080->6081 6129 7ff71757a2c0 6080->6129 6081->6061 6083 7ff71757dc41 6084 7ff71757dcd9 6083->6084 6085 7ff71757dc65 6083->6085 6086 7ff71757de35 2 API calls 6084->6086 6089 7ff71757dc7c 6085->6089 6136 7ff71759dfc0 6085->6136 6091 7ff71757dcca 6086->6091 6133 7ff71757de35 6089->6133 6091->6061 6096 7ff71757632c 6095->6096 6097 7ff71757632a 6095->6097 6098 7ff71759e659 6096->6098 6099 7ff71759e5c7 6096->6099 6097->6064 6141 7ff71759f040 6098->6141 6101 7ff71759e5ef 6099->6101 6102 7ff71759e5da WakeByAddressSingle 6099->6102 6104 7ff71759e5f9 6101->6104 6105 7ff71759e620 WakeByAddressSingle 6101->6105 6106 7ff71759e60e 6101->6106 6104->6106 6107 7ff71759e644 WakeByAddressAll 6104->6107 6105->6106 6105->6107 6106->6064 6107->6106 6144 7ff7175827c0 6108->6144 6110 7ff71757e8a5 6111 7ff71757ab50 16 API calls 6110->6111 6112 7ff71757e8fe 6111->6112 6115 7ff71757e93d 6112->6115 6116 7ff71757e9b2 6112->6116 6113 7ff71757e9b0 6113->6051 6114 7ff71758933e 6114->6051 6115->6113 6167 7ff71759f440 6115->6167 6116->6114 6170 7ff71759f370 6116->6170 6121 7ff71757ab87 6120->6121 6122 7ff71757ab96 6121->6122 6123 7ff71759efa0 16 API calls 6121->6123 6122->6059 6124 7ff71757ac3a 6123->6124 6124->6059 6126 7ff71757b0bc 6125->6126 6128 7ff71757b0d2 6125->6128 6127 7ff717578fa0 16 API calls 6126->6127 6127->6128 6128->6080 6130 7ff71757a2d7 6129->6130 6131 7ff71759e680 16 API calls 6130->6131 6132 7ff71757a314 6130->6132 6131->6132 6132->6083 6134 7ff71757c7f0 WaitOnAddress GetLastError 6133->6134 6135 7ff71757de5e 6134->6135 6140 7ff71759dfd9 6136->6140 6137 7ff71759e000 6137->6089 6138 7ff71759e02c WaitOnAddress 6139 7ff71759e049 GetLastError 6138->6139 6138->6140 6139->6140 6140->6137 6140->6138 6142 7ff71759efa0 16 API calls 6141->6142 6143 7ff71759f07d 6142->6143 6146 7ff7175827cd 6144->6146 6145 7ff71758286e 6145->6110 6146->6145 6147 7ff71757da10 16 API calls 6146->6147 6148 7ff717582882 6147->6148 6149 7ff71759f18c 16 API calls 6148->6149 6150 7ff7175828a3 6149->6150 6151 7ff71759efa0 16 API calls 6150->6151 6152 7ff7175828ec 6151->6152 6153 7ff7175829c9 6152->6153 6154 7ff71759f040 16 API calls 6152->6154 6156 7ff717582933 6152->6156 6153->6110 6154->6156 6155 7ff71759ef20 16 API calls 6157 7ff71758298f 6155->6157 6156->6153 6156->6155 6156->6157 6157->6153 6158 7ff71759efa0 16 API calls 6157->6158 6159 7ff717582ceb 6158->6159 6160 7ff71758f2e0 16 API calls 6159->6160 6162 7ff7175935b2 6159->6162 6163 7ff7175936f0 6159->6163 6164 7ff7175934bf 6159->6164 6160->6159 6161 7ff71759f510 16 API calls 6161->6163 6165 7ff71759f510 16 API calls 6162->6165 6163->6110 6164->6161 6164->6163 6166 7ff717593793 6165->6166 6168 7ff717596f40 16 API calls 6167->6168 6169 7ff71759f44f 6168->6169 6171 7ff71759efa0 16 API calls 6170->6171 6172 7ff71759f3f0 6171->6172 6173 7ff71759efa0 16 API calls 6172->6173 6174 7ff71759f43c 6173->6174 6176 7ff71759efa0 16 API calls 6175->6176 6177 7ff717589588 6176->6177 6179 7ff7175975ae 6178->6179 6180 7ff717597592 6178->6180 6179->6180 6206 7ff71759f128 6179->6206 6180->5570 6195 7ff71759ed70 6194->6195 6196 7ff71759ed01 6194->6196 6197 7ff71759ed93 16 API calls 6195->6197 6196->6195 6198 7ff71759ed24 6196->6198 6199 7ff71759ed57 6197->6199 6209 7ff71759d9f0 6198->6209 6200 7ff71759ed93 16 API calls 6199->6200 6203 7ff71759ed5d 6199->6203 6201 7ff71759ed92 6200->6201 6203->5570 6213 7ff717594bd0 6204->6213 6207 7ff71759efa0 16 API calls 6206->6207 6208 7ff71759f18b 6207->6208 6210 7ff71759da0d 6209->6210 6211 7ff71759da26 6209->6211 6210->6211 6212 7ff71759da24 RtlReAllocateHeap 6210->6212 6211->6199 6212->6211 6214 7ff717594bf9 6213->6214 6224 7ff717594c3b 6213->6224 6216 7ff71759f510 16 API calls 6214->6216 6214->6224 6215 7ff717594ed8 6217 7ff71759efa0 16 API calls 6215->6217 6216->6224 6218 7ff717594f4c 6217->6218 6219 7ff71759efa0 16 API calls 6218->6219 6220 7ff717594fc1 6219->6220 6233 7ff71759f460 6220->6233 6224->6215 6224->6218 6224->6220 6225 7ff717594d7f 6224->6225 6226 7ff71759f510 16 API calls 6224->6226 6228 7ff71759ef20 6224->6228 6227 7ff71759efa0 16 API calls 6225->6227 6226->6224 6227->6215 6229 7ff71759f040 16 API calls 6228->6229 6230 7ff71759ef3e 6229->6230 6231 7ff71759efa0 16 API calls 6230->6231 6232 7ff71759ef9c 6231->6232 6242 7ff717597020 6233->6242 6243 7ff71759efa0 16 API calls 6242->6243 6244 7ff71759708e 6243->6244 6248 7ff7174503d3 6245->6248 6249 7ff717450394 6245->6249 6246 7ff7174503bf 6272 7ff717570110 memset 6246->6272 6250 7ff71759ed93 16 API calls 6248->6250 6270 7ff7174503f2 6248->6270 6249->6246 6252 7ff71745044d 6249->6252 6253 7ff717450905 6250->6253 6251 7ff7174503ce 6254 7ff71745049b memcpy 6251->6254 6255 7ff71745046e memcpy memcpy 6252->6255 6257 7ff71759ed93 16 API calls 6253->6257 6254->6253 6258 7ff7174504cc 6254->6258 6255->6254 6256 7ff717450922 6259 7ff71759f450 16 API calls 6256->6259 6262 7ff717450920 6257->6262 6258->6253 6258->6256 6260 7ff7174504fb 6258->6260 6259->6262 6260->6256 6261 7ff71745050b memcpy memcpy 6260->6261 6263 7ff717450558 6261->6263 6264 7ff717450562 memcpy memset 6261->6264 6262->5607 6265 7ff717589810 16 API calls 6263->6265 6263->6270 6264->6263 6266 7ff717450709 memset 6265->6266 6267 7ff7174507fa OutputDebugStringW 6266->6267 6268 7ff71745074b 6266->6268 6269 7ff717450816 6267->6269 6268->6267 6269->6270 6271 7ff71759f370 16 API calls 6269->6271 6270->5607 6271->6262 6275 7ff717570177 6272->6275 6273 7ff71757029f memcpy 6273->6251 6274 7ff7175726b0 16 API calls 6274->6275 6275->6273 6275->6274 6277 7ff717571c10 16 API calls 6275->6277 6277->6275 6279 7ff7175899d0 34 API calls 6278->6279 6284 7ff7174467f6 6279->6284 6280 7ff717446956 6283 7ff71759ed93 16 API calls 6280->6283 6281 7ff71744683e memcpy 6286 7ff71744685f 6281->6286 6285 7ff71744696b 6283->6285 6284->6280 6284->6281 6285->5630 6286->5630 6288 7ff71744220a 6287->6288 6289 7ff717442820 6287->6289 6291 7ff71759e2a0 16 API calls 6288->6291 6292 7ff71744222d 6288->6292 6399 7ff71759e090 6289->6399 6291->6292 6293 7ff717442888 6292->6293 6298 7ff71744223a 6292->6298 6295 7ff71759f370 16 API calls 6293->6295 6294 7ff7174423fb 6297 7ff717589810 16 API calls 6294->6297 6296 7ff7174428bc 6295->6296 6302 7ff717442924 6296->6302 6305 7ff71759e5b0 19 API calls 6296->6305 6299 7ff717442455 memset 6297->6299 6298->6294 6300 7ff7174424c0 6298->6300 6301 7ff7174426aa OutputDebugStringW 6299->6301 6307 7ff71744249b 6299->6307 6304 7ff717589810 16 API calls 6300->6304 6303 7ff7174426c0 6301->6303 6302->5638 6308 7ff71744280e 6303->6308 6407 7ff71759e5b0 6303->6407 6306 7ff7174425b7 memset 6304->6306 6305->6302 6309 7ff71744276a OutputDebugStringW 6306->6309 6313 7ff7174425fd 6306->6313 6307->6301 6308->5638 6314 7ff717442780 6309->6314 6311 7ff7174428cb 6316 7ff71759ed93 16 API calls 6311->6316 6312 7ff7174427ce memcpy 6312->6303 6313->6309 6314->6311 6314->6312 6316->6296 6319 7ff717450b63 6317->6319 6320 7ff717450b24 6317->6320 6318 7ff717450b4f 6321 7ff717570110 18 API calls 6318->6321 6323 7ff71759ed93 16 API calls 6319->6323 6342 7ff717450b82 6319->6342 6320->6318 6324 7ff717450bc8 6320->6324 6322 7ff717450b5e 6321->6322 6325 7ff717450c16 memcpy 6322->6325 6326 7ff717450fed 6323->6326 6327 7ff717450be9 memcpy memcpy 6324->6327 6325->6326 6332 7ff717450c42 6325->6332 6328 7ff71759ed93 16 API calls 6326->6328 6327->6325 6331 7ff717451008 6328->6331 6329 7ff717450c66 memcpy memcpy 6333 7ff717450cb2 6329->6333 6338 7ff717450ca8 6329->6338 6331->5640 6332->6326 6332->6329 6418 7ff717455190 6333->6418 6335 7ff717589810 16 API calls 6336 7ff717450dc2 memset 6335->6336 6337 7ff717450eba OutputDebugStringW 6336->6337 6339 7ff717450e04 6336->6339 6340 7ff717450ed6 6337->6340 6338->6335 6338->6342 6339->6337 6341 7ff71759f370 16 API calls 6340->6341 6340->6342 6341->6331 6342->5640 6344 7ff717447391 6343->6344 6345 7ff717447b4e 6343->6345 6347 7ff71759dfc0 2 API calls 6344->6347 6350 7ff7174473a7 6344->6350 6346 7ff71759e090 3 API calls 6345->6346 6346->6350 6347->6345 6348 7ff717447baa 6351 7ff71759f370 16 API calls 6348->6351 6349 7ff71744759b 6352 7ff717589810 16 API calls 6349->6352 6350->6348 6354 7ff7174473cc 6350->6354 6353 7ff717447a2d 6351->6353 6355 7ff7174475f5 memset 6352->6355 6359 7ff717443a5e 6353->6359 6431 7ff71759e080 WakeByAddressSingle 6353->6431 6354->6349 6356 7ff717447660 6354->6356 6357 7ff7174477ea OutputDebugStringW 6355->6357 6363 7ff71744763b 6355->6363 6360 7ff717589810 16 API calls 6356->6360 6368 7ff717447800 6357->6368 6359->5656 6359->5657 6361 7ff7174476ec memset 6360->6361 6362 7ff717447aca OutputDebugStringW 6361->6362 6365 7ff717447739 6361->6365 6362->6353 6363->6357 6364 7ff717589810 16 API calls 6366 7ff717447921 memset 6364->6366 6365->6362 6367 7ff7174479fa OutputDebugStringW 6366->6367 6366->6368 6367->6368 6368->6353 6368->6364 6368->6367 6371 7ff71745493c 6369->6371 6370 7ff717454cdc 6372 7ff71759ed93 16 API calls 6370->6372 6371->6370 6374 7ff717454ad9 6371->6374 6376 7ff717454a1a 6371->6376 6373 7ff717454cee 6372->6373 6373->5678 6375 7ff717598c00 19 API calls 6374->6375 6374->6376 6375->6374 6376->5678 6378 7ff717444dd1 memset 6377->6378 6379 7ff717444d33 6377->6379 6381 7ff7174451cc OutputDebugStringW 6378->6381 6380 7ff717444e1f 6379->6380 6382 7ff717444d5f memset 6379->6382 6383 7ff717589810 16 API calls 6380->6383 6395 7ff7174451da 6381->6395 6382->6381 6384 7ff717444ead memset 6383->6384 6385 7ff717444f9a OutputDebugStringW 6384->6385 6387 7ff717444ee5 6384->6387 6389 7ff717444fbc 6385->6389 6386 7ff717445168 memset 6386->6381 6387->6385 6388 7ff71744500c strlen 6388->6389 6389->6386 6389->6388 6390 7ff717445064 memcmp 6389->6390 6390->6389 6391 7ff717445075 6390->6391 6392 7ff717589810 16 API calls 6391->6392 6393 7ff71744510b memset 6392->6393 6394 7ff71744528a OutputDebugStringW 6393->6394 6396 7ff717445143 6393->6396 6394->6395 6395->5692 6396->6394 6397->5683 6398->5680 6400 7ff71759e184 6399->6400 6405 7ff71759e0bd 6399->6405 6401 7ff71759e13e 6402 7ff71759e172 6401->6402 6406 7ff71759e16c WakeByAddressAll 6401->6406 6402->6288 6403 7ff71759e115 WaitOnAddress 6404 7ff71759e132 GetLastError 6403->6404 6403->6405 6404->6405 6405->6401 6405->6402 6405->6403 6406->6402 6408 7ff71759e5c7 6407->6408 6409 7ff71759e659 6407->6409 6410 7ff71759e5ef 6408->6410 6412 7ff71759e5da WakeByAddressSingle 6408->6412 6411 7ff71759f040 16 API calls 6409->6411 6414 7ff71759e620 WakeByAddressSingle 6410->6414 6415 7ff71759e60e 6410->6415 6416 7ff71759e5f9 6410->6416 6413 7ff71759e671 6411->6413 6414->6415 6417 7ff71759e644 WakeByAddressAll 6414->6417 6415->6308 6416->6415 6416->6417 6417->6415 6419 7ff7174551c4 6418->6419 6422 7ff7174551ef 6418->6422 6419->6338 6420 7ff717455265 6420->6338 6422->6420 6423 7ff717570a60 6422->6423 6425 7ff717570ac1 6423->6425 6424 7ff717570f21 6424->6422 6425->6424 6426 7ff717570f8c 6425->6426 6429 7ff717570f0b 6425->6429 6427 7ff71759f460 16 API calls 6426->6427 6428 7ff717570f9b 6427->6428 6430 7ff71759f460 16 API calls 6429->6430 6430->6424 6432->5763 6434 7ff71745458a 6433->6434 6435 7ff7174548a5 6434->6435 6438 7ff717454795 6434->6438 6439 7ff717454613 6434->6439 6436 7ff71759ed93 16 API calls 6435->6436 6437 7ff7174548bd 6436->6437 6437->5837 6438->5837 6439->6438 6440 7ff717598c00 19 API calls 6439->6440 6440->6439 6442 7ff71745200a OutputDebugStringW 6441->6442 6443 7ff717451f6a 6441->6443 6442->5897 6443->6442 6444->5800 6445->5810 6446->5821 6447->5831 6449 7ff71757730d 6448->6449 6450 7ff717577390 6448->6450 6449->6450 6454 7ff717577333 6449->6454 6452 7ff71759ed93 16 API calls 6450->6452 6451 7ff717577376 6453 7ff71759ed93 16 API calls 6451->6453 6457 7ff71757737c 6451->6457 6452->6451 6455 7ff7175773aa 6453->6455 6454->6451 6456 7ff71759d9f0 RtlReAllocateHeap 6454->6456 6456->6451 6457->5843 6471 7ff717574970 6458->6471 6460 7ff717574332 RoOriginateErrorW 6461 7ff71744b7e3 6460->6461 6462 7ff717573fc0 GetErrorInfo 6461->6462 6462->5914 6463->5914 6465 7ff71745426a 6464->6465 6466 7ff71745427f 6464->6466 6467 7ff717574300 18 API calls 6465->6467 6466->5909 6468 7ff717454271 6467->6468 6493 7ff717573fc0 GetErrorInfo 6468->6493 6470 7ff717454278 6470->5909 6475 7ff71757499a 6471->6475 6472 7ff717574bb5 6472->6460 6473 7ff717574cc5 6474 7ff71759ed93 16 API calls 6473->6474 6476 7ff717574cdd 6474->6476 6475->6472 6475->6473 6477 7ff717574a23 6475->6477 6476->6460 6477->6472 6479 7ff71759d7a0 6477->6479 6480 7ff71759d7b2 6479->6480 6481 7ff71759d861 6479->6481 6480->6481 6485 7ff71759d7fa 6480->6485 6482 7ff71759ed93 16 API calls 6481->6482 6483 7ff71759d847 6482->6483 6484 7ff71759ed93 16 API calls 6483->6484 6487 7ff71759d84e 6483->6487 6488 7ff71759d885 6484->6488 6485->6483 6489 7ff717598b90 6485->6489 6487->6477 6488->6477 6490 7ff717598ba7 6489->6490 6491 7ff717598bc0 6489->6491 6490->6491 6492 7ff717598bbe RtlReAllocateHeap 6490->6492 6491->6483 6492->6491 6493->6470 6495 7ff7174535ef 6494->6495 6497 7ff717446efe 6494->6497 6499 7ff717598730 6495->6499 6497->5936 6500 7ff717598853 6499->6500 6502 7ff71759875c 6499->6502 6508 7ff717589470 6500->6508 6502->6500 6503 7ff71759885f 6502->6503 6507 7ff7175987ab 6502->6507 6504 7ff717598b06 6503->6504 6505 7ff717598889 memset 6503->6505 6513 7ff7175894c0 6504->6513 6505->6507 6507->6497 6507->6507 6509 7ff717589486 6508->6509 6510 7ff71758947e 6508->6510 6511 7ff71759efa0 16 API calls 6509->6511 6510->6507 6512 7ff7175894b8 6511->6512 6514 7ff7175894da 6513->6514 6515 7ff7175894ce 6513->6515 6516 7ff71759edb0 16 API calls 6514->6516 6515->6507 6517 7ff7175894e5 6516->6517 6519 7ff7175895a9 6518->6519 6520 7ff71758961a 6518->6520 6519->6520 6522 7ff7175895cd 6519->6522 6521 7ff71759ed93 16 API calls 6520->6521 6523 7ff717589600 6521->6523 6525 7ff71759d9f0 RtlReAllocateHeap 6522->6525 6524 7ff71759ed93 16 API calls 6523->6524 6526 7ff717589606 6523->6526 6527 7ff717589634 6524->6527 6525->6523 6526->5949 6528 7ff71758966d 6527->6528 6531 7ff7175896bc 6527->6531 6532 7ff71759d9f0 RtlReAllocateHeap 6527->6532 6530 7ff7175896c1 6528->6530 6528->6531 6533 7ff71759edb0 16 API calls 6528->6533 6529 7ff71759ed93 16 API calls 6529->6531 6530->5949 6531->6529 6532->6528 6533->6531 6535 7ff71745b006 6534->6535 6536 7ff71745afda 6534->6536 6535->5980 6555 7ff71745b240 6536->6555 6538 7ff71745afe5 6538->6535 6539 7ff71759edb0 16 API calls 6538->6539 6540 7ff71745b028 6539->6540 6540->5980 6543 7ff71745ad28 6541->6543 6542 7ff71745ad35 6542->5986 6543->6542 6544 7ff71745ad92 6543->6544 6545 7ff71759f460 16 API calls 6543->6545 6544->6542 6546 7ff71759f450 16 API calls 6544->6546 6545->6544 6547 7ff71745adf4 6546->6547 6549 7ff717581a2b 6548->6549 6550 7ff717581989 6548->6550 6552 7ff71757ab50 16 API calls 6549->6552 6551 7ff7175819e7 6550->6551 6560 7ff717577220 6550->6560 6551->5992 6554 7ff717581a65 6552->6554 6554->5992 6558 7ff71745b253 6555->6558 6559 7ff71745b2aa 6555->6559 6556 7ff71745b278 BCryptGenRandom 6557 7ff71745b29c SystemFunction036 6556->6557 6556->6558 6557->6558 6557->6559 6558->6556 6558->6559 6559->6538 6561 7ff71757723d 6560->6561 6562 7ff7175772c8 6560->6562 6561->6562 6567 7ff717577264 6561->6567 6564 7ff71759ed93 16 API calls 6562->6564 6563 7ff7175772ae 6565 7ff71759ed93 16 API calls 6563->6565 6569 7ff7175772b4 6563->6569 6564->6563 6566 7ff7175772e2 6565->6566 6567->6563 6568 7ff71759d9f0 RtlReAllocateHeap 6567->6568 6568->6563 6569->6551 6570 7ff717441350 6571 7ff717441f68 6570->6571 6572 7ff7174413b7 6570->6572 6573 7ff71759e090 3 API calls 6571->6573 6574 7ff717441f54 6572->6574 6578 7ff7174413cf 6572->6578 6573->6578 6600 7ff71759e480 6574->6600 6576 7ff717441fbe 6579 7ff71759f370 16 API calls 6576->6579 6577 7ff7174413f3 6581 7ff717442053 6577->6581 6595 7ff71744141f 6577->6595 6578->6576 6578->6577 6580 7ff717441fed 6579->6580 6605 7ff717453010 6580->6605 6584 7ff71759edb0 16 API calls 6581->6584 6582 7ff71759e5b0 19 API calls 6583 7ff717441f39 6582->6583 6584->6580 6586 7ff71744209e 6587 7ff717450350 27 API calls 6587->6595 6588 7ff717441ee9 6588->6582 6588->6583 6589 7ff71744200b 6590 7ff71759f370 16 API calls 6589->6590 6590->6580 6592 7ff717589810 16 API calls 6593 7ff717441dda memset 6592->6593 6594 7ff717441eba OutputDebugStringW 6593->6594 6593->6595 6594->6595 6595->6587 6595->6588 6595->6589 6595->6592 6595->6594 6596 7ff717453070 6595->6596 6597 7ff717453321 6596->6597 6599 7ff7174530a8 6596->6599 6618 7ff7175982d0 6597->6618 6599->6595 6601 7ff71759e4a9 6600->6601 6602 7ff71759e59d 6601->6602 6603 7ff71759e536 WaitOnAddress 6601->6603 6602->6588 6603->6601 6604 7ff71759e553 GetLastError 6603->6604 6604->6601 6606 7ff717453021 6605->6606 6607 7ff71745304a 6606->6607 6608 7ff71759e5c7 6606->6608 6609 7ff71759e659 6606->6609 6607->6586 6610 7ff71759e5ef 6608->6610 6612 7ff71759e5da WakeByAddressSingle 6608->6612 6611 7ff71759f040 16 API calls 6609->6611 6614 7ff71759e5f9 6610->6614 6615 7ff71759e620 WakeByAddressSingle 6610->6615 6616 7ff71759e60e 6610->6616 6613 7ff71759e671 6611->6613 6614->6616 6617 7ff71759e644 WakeByAddressAll 6614->6617 6615->6616 6615->6617 6616->6586 6617->6616 6619 7ff7175983f6 6618->6619 6620 7ff7175982fc 6618->6620 6621 7ff717589470 16 API calls 6619->6621 6620->6619 6622 7ff717598402 6620->6622 6626 7ff71759834b 6620->6626 6621->6626 6623 7ff7175986b1 6622->6623 6624 7ff71759842c memset 6622->6624 6625 7ff7175894c0 16 API calls 6623->6625 6624->6626 6625->6626 6626->6599 6626->6626 6708 7ff717447c10 6711 7ff717441190 6708->6711 6714 7ff71744119a 6711->6714 6712 7ff7174411b4 6713 7ff71759e080 WakeByAddressSingle 6714->6712 6714->6713 6739 7ff717441230 6740 7ff71759e5b0 6739->6740 6741 7ff71744124e 6739->6741 6742 7ff71759e5c7 6740->6742 6743 7ff71759e659 6740->6743 6744 7ff71759e5ef 6742->6744 6746 7ff71759e5da WakeByAddressSingle 6742->6746 6745 7ff71759f040 16 API calls 6743->6745 6748 7ff71759e5f9 6744->6748 6749 7ff71759e620 WakeByAddressSingle 6744->6749 6751 7ff71759e60e 6744->6751 6747 7ff71759e671 6745->6747 6750 7ff71759e644 WakeByAddressAll 6748->6750 6748->6751 6749->6750 6749->6751 6750->6751 6770 7ff717441250 6771 7ff717441261 6770->6771 6772 7ff71744128a 6771->6772 6773 7ff71759e659 6771->6773 6775 7ff71759e5c7 6771->6775 6776 7ff71759f040 16 API calls 6773->6776 6774 7ff71759e5ef 6779 7ff71759e5f9 6774->6779 6780 7ff71759e620 WakeByAddressSingle 6774->6780 6781 7ff71759e60e 6774->6781 6775->6774 6777 7ff71759e5da WakeByAddressSingle 6775->6777 6778 7ff71759e671 6776->6778 6779->6781 6782 7ff71759e644 WakeByAddressAll 6779->6782 6780->6781 6780->6782 6782->6781 6783 7ff7174412d0 6785 7ff717593410 6783->6785 6787 7ff7175936f0 6785->6787 6788 7ff7175934bf 6785->6788 6790 7ff7175935b2 6785->6790 6792 7ff71758f2e0 6785->6792 6786 7ff71759f510 16 API calls 6786->6787 6788->6786 6788->6787 6789 7ff71759f510 16 API calls 6791 7ff717593793 6789->6791 6790->6789 6793 7ff71758f2f3 6792->6793 6794 7ff71758f33a 6793->6794 6797 7ff71758f314 6793->6797 6798 7ff717597400 6793->6798 6794->6797 6805 7ff717595130 6794->6805 6797->6785 6799 7ff7175974ab 6798->6799 6800 7ff71759755d 6798->6800 6803 7ff71759f128 16 API calls 6799->6803 6804 7ff71759751d 6799->6804 6801 7ff71759f128 16 API calls 6800->6801 6802 7ff717597571 6801->6802 6803->6800 6804->6794 6806 7ff717595147 6805->6806 6807 7ff71759513f 6805->6807 6806->6807 6810 7ff717595000 6806->6810 6807->6797 6809 7ff7175951c9 6809->6797 6811 7ff71759508a 6810->6811 6816 7ff717595014 6810->6816 6814 7ff71759ef20 16 API calls 6811->6814 6817 7ff717595072 6811->6817 6812 7ff71759510c 6815 7ff71759f450 16 API calls 6812->6815 6813 7ff71759f460 16 API calls 6813->6812 6818 7ff717595127 6814->6818 6815->6811 6816->6811 6816->6812 6816->6813 6816->6817 6817->6809 6819 7ff71759513f 6818->6819 6820 7ff717595000 16 API calls 6818->6820 6819->6809 6821 7ff7175951c9 6820->6821 6821->6809 6752 7ff71744c6b0 6753 7ff71744c6ce 6752->6753 6754 7ff71744c6d3 6753->6754 6755 7ff71759ed93 16 API calls 6753->6755 6756 7ff71744c725 6755->6756 6757 7ff71758a850 6758 7ff71758aad0 6757->6758 6760 7ff71758a879 6757->6760 6759 7ff71759ed93 16 API calls 6758->6759 6761 7ff71758aae5 6759->6761 6760->6758 6762 7ff71758a8a4 6760->6762 6763 7ff71758aa64 6762->6763 6764 7ff717589590 16 API calls 6762->6764 6765 7ff71758aa44 memcpy 6762->6765 6766 7ff71759ecf0 16 API calls 6762->6766 6764->6762 6765->6762 6765->6763 6766->6762 6715 7ff717447300 6716 7ff717441190 WakeByAddressSingle 6715->6716 6717 7ff717447328 6716->6717 6718 7ff717441000 6719 7ff7174410a2 6718->6719 6723 7ff71744101c 6718->6723 6720 7ff71759ef20 16 API calls 6719->6720 6721 7ff7174410ae 6720->6721 6722 7ff717441158 6721->6722 6727 7ff7174410cc 6721->6727 6725 7ff71759ef20 16 API calls 6722->6725 6724 7ff71744102c 6723->6724 6731 7ff71757d3c0 ProcessPrng 6723->6731 6730 7ff717441164 6725->6730 6728 7ff7174410dc 6727->6728 6732 7ff71757d3c0 ProcessPrng 6727->6732 6731->6724 6732->6728 6767 7ff717442120 6768 7ff717453010 19 API calls 6767->6768 6769 7ff71744214b 6768->6769 6822 7ff717447240 6823 7ff717447266 6822->6823 6824 7ff717447280 6823->6824 6826 7ff71759e080 WakeByAddressSingle 6823->6826 6827 7ff717442940 6828 7ff717442977 6827->6828 6829 7ff717442986 6827->6829 6830 7ff71759e5b0 19 API calls 6829->6830 6830->6828 6627 7ff71757f310 6640 7ff717580740 6627->6640 6629 7ff71757f339 6631 7ff71757f349 6629->6631 6648 7ff717581100 6629->6648 6632 7ff71757f450 CreateFileW 6633 7ff71757f537 GetLastError 6632->6633 6635 7ff71757f48f 6632->6635 6633->6631 6634 7ff71757f373 6634->6631 6634->6632 6635->6631 6636 7ff71757f49e GetLastError 6635->6636 6636->6631 6637 7ff71757f4ab SetFileInformationByHandle 6636->6637 6637->6631 6638 7ff71757f554 GetLastError CloseHandle 6637->6638 6639 7ff71757f573 6638->6639 6639->6631 6643 7ff71758076b 6640->6643 6641 7ff71759ed93 16 API calls 6642 7ff7175807b9 6641->6642 6679 7ff7175774f0 6642->6679 6643->6641 6643->6642 6646 7ff7175772f0 16 API calls 6647 7ff717580871 6646->6647 6647->6629 6659 7ff717581134 6648->6659 6649 7ff7175812a8 SetLastError GetFullPathNameW 6650 7ff7175812d3 GetLastError 6649->6650 6649->6659 6651 7ff7175813aa GetLastError 6650->6651 6650->6659 6666 7ff71758117b 6651->6666 6652 7ff7175812ed GetLastError 6654 7ff71758173e 6652->6654 6652->6659 6653 7ff71759da70 16 API calls 6653->6659 6656 7ff71759f040 16 API calls 6654->6656 6655 7ff71758172a 6657 7ff71759f450 16 API calls 6655->6657 6662 7ff71758173c 6656->6662 6657->6662 6658 7ff7175814d0 6660 7ff7175814f3 memcpy 6658->6660 6665 7ff71759da70 16 API calls 6658->6665 6659->6649 6659->6652 6659->6653 6659->6655 6661 7ff71758138a 6659->6661 6663 7ff7175814d5 6659->6663 6659->6666 6664 7ff717581517 6660->6664 6660->6666 6668 7ff7175814ae memcpy 6661->6668 6669 7ff7175815fd 6661->6669 6662->6634 6663->6658 6671 7ff71759d9f0 RtlReAllocateHeap 6663->6671 6670 7ff7175772f0 16 API calls 6664->6670 6667 7ff71758171e 6665->6667 6666->6634 6667->6660 6668->6658 6668->6660 6674 7ff71759d9f0 RtlReAllocateHeap 6669->6674 6670->6666 6672 7ff7175816d1 6671->6672 6672->6658 6673 7ff717581774 6672->6673 6675 7ff71759ed93 16 API calls 6673->6675 6676 7ff717581649 6674->6676 6675->6662 6676->6663 6677 7ff717581758 6676->6677 6678 7ff71759ed93 16 API calls 6677->6678 6678->6662 6680 7ff717577519 6679->6680 6682 7ff717577673 6680->6682 6683 7ff71759da70 6680->6683 6682->6646 6682->6647 6684 7ff71759da88 6683->6684 6685 7ff71759db2d 6683->6685 6684->6685 6689 7ff71759dacc 6684->6689 6686 7ff71759ed93 16 API calls 6685->6686 6687 7ff71759db14 6686->6687 6688 7ff71759ed93 16 API calls 6687->6688 6694 7ff71759db1a 6687->6694 6690 7ff71759db4f 6688->6690 6689->6687 6691 7ff71759d9f0 RtlReAllocateHeap 6689->6691 6697 7ff717577b80 6690->6697 6691->6687 6694->6682 6695 7ff71759efa0 16 API calls 6696 7ff71759db93 6695->6696 6698 7ff717577b88 6697->6698 6699 7ff717577ba9 6698->6699 6700 7ff717577bab WakeByAddressSingle 6698->6700 6699->6695

                                                  Executed Functions

                                                  Function 00007FF717447CB0 Relevance: 94.5, APIs: 49, Strings: 4, Instructions: 1723processCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2374661962.00007FF717441000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF717440000, based on PE: true
                                                  • Associated: 00000000.00000002.2374638529.00007FF717440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF7175A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF717714000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375347125.00007FF717753000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375370339.00007FF717754000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_7ff717440000_dropper.jbxd
                                                  Similarity
                                                  • API ID: DebugOutputStringmemset$CreateErrorFileFirstLastModuleModule32NameSnapshotToolhelp32memcpy
                                                  • String ID: C:\Windows\System32\Resolved full path for module: $kernel32.dll$kernel32.dllNtOpenProcessNtCreateSectionNtMapViewOfSectionNtOpenFileZwOpenKeyZwCreateKeyZwSetValueKeyZwCloseVirtualAllocExCloseHandleWriteProcessMemoryCreateToolhelp32SnapshotModule32FirstWModule32NextWResumeThreadCreateProcessWNtCloseC:\Users\Harrison\.rustup$ntdll.dllNormalized full path for ntdll.dll:
                                                  • API String ID: 2813801548-1707444892
                                                  • Opcode ID: 47019e9380e39f4326fa1204cf62b5cdc0e9d8cec85392f9c49d07f6233f1e5d
                                                  • Instruction ID: 6372ec953da3fb90bfa16553f42aeaca71210bb21b1a6588dc5dd3e8afcf4e4a
                                                  • Opcode Fuzzy Hash: 47019e9380e39f4326fa1204cf62b5cdc0e9d8cec85392f9c49d07f6233f1e5d
                                                  • Instruction Fuzzy Hash: 8D13B472A18FC188EB719F24D8017E9A3A0FB45798F805135CE4D5BB9AEF3C925AC750
                                                  Function 00007FF71744A5A0 Relevance: 62.7, APIs: 27, Strings: 8, Instructions: 1430nativefileCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  • NtMapViewOfSection failedSTATUS_IMAGE_NOT_AT_BASE detected. Module mapped at address: , xrefs: 00007FF71744C2D2
                                                  • , xrefs: 00007FF71744BDC6
                                                  • KO_S, xrefs: 00007FF71744B839
                                                  • NtCreateSection failedNtOpenFile failed for , xrefs: 00007FF71744BC87
                                                  • NtCreateSectionNtMapViewOfSectionNtOpenFileZwOpenKeyZwCreateKeyZwSetValueKeyZwCloseVirtualAllocExCloseHandleWriteProcessMemoryCreateToolhelp32SnapshotModule32FirstWModule32NextWResumeThreadCreateProcessWNtCloseC:\Users\Harrison\.rustup\toolchains\nightly-x86_6, xrefs: 00007FF71744AB91
                                                  • `, xrefs: 00007FF71744B42A
                                                  • , xrefs: 00007FF71744B93A
                                                  • NtOpenFileZwOpenKeyZwCreateKeyZwSetValueKeyZwCloseVirtualAllocExCloseHandleWriteProcessMemoryCreateToolhelp32SnapshotModule32FirstWModule32NextWResumeThreadCreateProcessWNtCloseC:\Users\Harrison\.rustup\toolchains\nightly-x86_64-pc-windows-msvc\lib/rustlib/src, xrefs: 00007FF71744A996
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2374661962.00007FF717441000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF717440000, based on PE: true
                                                  • Associated: 00000000.00000002.2374638529.00007FF717440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF7175A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF717714000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375347125.00007FF717753000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375370339.00007FF717754000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_7ff717440000_dropper.jbxd
                                                  Similarity
                                                  • API ID: DebugOutputStringmemset$Section$CloseCreateCurrentFileOpenProcessView
                                                  • String ID: $ $KO_S$NtCreateSection failedNtOpenFile failed for $NtCreateSectionNtMapViewOfSectionNtOpenFileZwOpenKeyZwCreateKeyZwSetValueKeyZwCloseVirtualAllocExCloseHandleWriteProcessMemoryCreateToolhelp32SnapshotModule32FirstWModule32NextWResumeThreadCreateProcessWNtCloseC:\Users\Harrison\.rustup\toolchains\nightly-x86_6$NtMapViewOfSection failedSTATUS_IMAGE_NOT_AT_BASE detected. Module mapped at address: $NtOpenFileZwOpenKeyZwCreateKeyZwSetValueKeyZwCloseVirtualAllocExCloseHandleWriteProcessMemoryCreateToolhelp32SnapshotModule32FirstWModule32NextWResumeThreadCreateProcessWNtCloseC:\Users\Harrison\.rustup\toolchains\nightly-x86_64-pc-windows-msvc\lib/rustlib/src$`
                                                  • API String ID: 2718610588-4026475428
                                                  • Opcode ID: 27554362d97ea3740ca9744b7d20054d1827fe1813010d7316dba69e8f5df418
                                                  • Instruction ID: 99e0f2a5787d3f7adec71929fb00f37153432be600bae505dc24a5c0c9c2a756
                                                  • Opcode Fuzzy Hash: 27554362d97ea3740ca9744b7d20054d1827fe1813010d7316dba69e8f5df418
                                                  • Instruction Fuzzy Hash: B1F29D72A14FC189EB329F20D8453E973A4FB45B98F804136DA4D4BB5ADF79835AC350
                                                  Function 00007FF717442DB0 Relevance: 46.5, APIs: 30, Instructions: 1475COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2374661962.00007FF717441000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF717440000, based on PE: true
                                                  • Associated: 00000000.00000002.2374638529.00007FF717440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF7175A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF717714000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375347125.00007FF717753000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375370339.00007FF717754000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_7ff717440000_dropper.jbxd
                                                  Similarity
                                                  • API ID: memset$DebugOutputString$memcpy
                                                  • String ID:
                                                  • API String ID: 170145970-0
                                                  • Opcode ID: 20cc0c46516abf39ebd7c3b2d1745b80bc62b9e0a688cea6be47283b33fe8639
                                                  • Instruction ID: 7089d5025ea530ad142c3e0604106c170007a61bc45d3fbbc6a9e163326ebb8f
                                                  • Opcode Fuzzy Hash: 20cc0c46516abf39ebd7c3b2d1745b80bc62b9e0a688cea6be47283b33fe8639
                                                  • Instruction Fuzzy Hash: 45F2C332A18FC189EB329F60D8557E97364FB45B88F804136DA4E5BB8ADF399359C310
                                                  Function 00007FF7174452D0 Relevance: 43.0, APIs: 21, Strings: 3, Instructions: 967COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2374661962.00007FF717441000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF717440000, based on PE: true
                                                  • Associated: 00000000.00000002.2374638529.00007FF717440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF7175A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF717714000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375347125.00007FF717753000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375370339.00007FF717754000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_7ff717440000_dropper.jbxd
                                                  Similarity
                                                  • API ID: memset$DebugOutputString$HandleModuleQueryVirtual
                                                  • String ID: C:\Windows\System32\Resolved full path for module: $ntdll.dll$ntdll.dllNormalized full path for ntdll.dll:
                                                  • API String ID: 3283594973-2956908514
                                                  • Opcode ID: 60d54f2ed92f5f6328711bd7b263bbd4bc22559cd3147c5d274c849009ba7efc
                                                  • Instruction ID: 71836f9879872aa3696f809d7c05c41182a1ff915b3e968026a2b0cfee28b67a
                                                  • Opcode Fuzzy Hash: 60d54f2ed92f5f6328711bd7b263bbd4bc22559cd3147c5d274c849009ba7efc
                                                  • Instruction Fuzzy Hash: 57A29E32A18BC189EB319F30D8557E8A365FB45B98F804136DE4D4BB9BEF389259C350
                                                  Function 00007FF717447340 Relevance: 19.8, APIs: 6, Strings: 5, Instructions: 512COMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 1080 7ff717447340-7ff71744738b 1081 7ff717447391-7ff7174473a1 1080->1081 1082 7ff717447b53-7ff717447b91 call 7ff71759e090 1080->1082 1084 7ff7174473a7-7ff7174473b7 1081->1084 1085 7ff717447b46-7ff717447b4e call 7ff71759dfc0 1081->1085 1089 7ff717447b96-7ff717447ba4 call 7ff71759df20 1082->1089 1088 7ff7174473bd-7ff7174473c6 1084->1088 1084->1089 1085->1082 1090 7ff717447baa-7ff717447bd9 call 7ff71759f370 1088->1090 1091 7ff7174473cc-7ff7174473de 1088->1091 1089->1090 1089->1091 1104 7ff717447bdb-7ff717447be9 call 7ff71759e080 1090->1104 1094 7ff71744759b-7ff717447635 call 7ff717589810 memset 1091->1094 1095 7ff7174473e4-7ff717447529 1091->1095 1108 7ff7174477ea-7ff7174477fe OutputDebugStringW 1094->1108 1109 7ff71744763b-7ff71744764d 1094->1109 1098 7ff71744752d-7ff717447545 1095->1098 1101 7ff717447547-7ff717447562 1098->1101 1102 7ff717447580-7ff71744758c 1098->1102 1105 7ff717447568-7ff717447573 1101->1105 1106 7ff717447660-7ff717447733 call 7ff717589810 memset 1101->1106 1102->1094 1107 7ff71744758e-7ff717447599 1102->1107 1122 7ff717447b28-7ff717447b45 1104->1122 1105->1101 1111 7ff717447575 1105->1111 1124 7ff717447aca-7ff717447ade OutputDebugStringW 1106->1124 1125 7ff717447739-7ff71744774b 1106->1125 1107->1098 1112 7ff717447811-7ff717447832 1108->1112 1113 7ff717447800-7ff71744780c call 7ff717457e80 1108->1113 1114 7ff71744775e-7ff71744778e 1109->1114 1115 7ff717447653-7ff71744765b 1109->1115 1111->1102 1120 7ff717447842-7ff717447846 1112->1120 1113->1112 1118 7ff717447790-7ff7174477ba 1114->1118 1121 7ff7174477bc-7ff7174477cd 1115->1121 1118->1118 1118->1121 1127 7ff717447a2d-7ff717447a40 1120->1127 1128 7ff71744784c-7ff71744784f 1120->1128 1126 7ff7174477d0-7ff7174477d7 1121->1126 1134 7ff717447af1-7ff717447b03 1124->1134 1135 7ff717447ae0-7ff717447aec call 7ff717457e80 1124->1135 1131 7ff717447a4b-7ff717447a6e 1125->1131 1132 7ff717447751-7ff717447759 1125->1132 1126->1108 1133 7ff7174477d9-7ff7174477e8 1126->1133 1129 7ff717447a46 1127->1129 1130 7ff717447b05-7ff717447b15 1127->1130 1136 7ff717447851-7ff717447856 1128->1136 1137 7ff717447860-7ff71744787a 1128->1137 1139 7ff717447b1b-7ff717447b22 1129->1139 1130->1139 1143 7ff717447bee-7ff717447bfb call 7ff71759df20 1130->1143 1140 7ff717447a70-7ff717447a9a 1131->1140 1141 7ff717447a9c-7ff717447aad 1132->1141 1133->1108 1133->1126 1134->1130 1134->1139 1135->1134 1144 7ff717447889-7ff717447959 call 7ff717589810 memset 1136->1144 1137->1137 1138 7ff71744787c-7ff717447887 1137->1138 1138->1144 1139->1104 1139->1122 1140->1140 1140->1141 1146 7ff717447ab0-7ff717447ab7 1141->1146 1143->1139 1151 7ff717447c01-7ff717447c06 1143->1151 1152 7ff7174479fa-7ff717447a11 OutputDebugStringW 1144->1152 1153 7ff71744795f-7ff717447971 1144->1153 1146->1124 1150 7ff717447ab9-7ff717447ac8 1146->1150 1150->1124 1150->1146 1151->1139 1156 7ff717447a17-7ff717447a28 call 7ff717457e80 1152->1156 1157 7ff717447840 1152->1157 1154 7ff717447980-7ff71744799f 1153->1154 1155 7ff717447973-7ff71744797b 1153->1155 1159 7ff7174479a0-7ff7174479ca 1154->1159 1158 7ff7174479cc-7ff7174479dd 1155->1158 1156->1157 1157->1120 1161 7ff7174479e0-7ff7174479e7 1158->1161 1159->1158 1159->1159 1161->1152 1163 7ff7174479e9-7ff7174479f8 1161->1163 1163->1152 1163->1161
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2374661962.00007FF717441000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF717440000, based on PE: true
                                                  • Associated: 00000000.00000002.2374638529.00007FF717440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF7175A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF717714000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375347125.00007FF717753000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375370339.00007FF717754000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_7ff717440000_dropper.jbxd
                                                  Similarity
                                                  • API ID: DebugOutputStringmemset
                                                  • String ID: arenegyl$called `Result::unwrap()` on an `Err` value$modnarod$setybdet$uespemos
                                                  • API String ID: 1084755268-2410307170
                                                  • Opcode ID: 2089aedb72979f3a2e5d3d44b969772a105c2de44419ec78a924fec57207aff0
                                                  • Instruction ID: d2d7160cd25e21e4dc830171c3f980c56439bc8a1cb1e276ea0c968d6b3cbeec
                                                  • Opcode Fuzzy Hash: 2089aedb72979f3a2e5d3d44b969772a105c2de44419ec78a924fec57207aff0
                                                  • Instruction Fuzzy Hash: 7422E472A14F8145FB21DF60D8557E96361FB057A8F808232DE0E5BB96EF38D25AC310
                                                  Function 00007FF717444D10 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 295stringCOMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 1164 7ff717444d10-7ff717444d2d 1165 7ff717444dd1-7ff717444e1a memset 1164->1165 1166 7ff717444d33-7ff717444d48 1164->1166 1169 7ff7174451cc-7ff7174451d4 OutputDebugStringW 1165->1169 1167 7ff717444d4e-7ff717444d59 1166->1167 1168 7ff717444e1f 1166->1168 1171 7ff717444d5f-7ff717444dcc memset 1167->1171 1172 7ff717444e24-7ff717444edf call 7ff717589810 memset 1167->1172 1168->1172 1170 7ff7174451da-7ff7174451f3 1169->1170 1171->1169 1175 7ff717444f9a-7ff717444fba OutputDebugStringW 1172->1175 1176 7ff717444ee5-7ff717444ef7 1172->1176 1177 7ff717444fca-7ff717444fd1 1175->1177 1178 7ff717444fbc-7ff717444fc5 call 7ff717457e80 1175->1178 1179 7ff717444ef9-7ff717444f01 1176->1179 1180 7ff717444f03-7ff717444f26 1176->1180 1182 7ff717445168-7ff7174451c3 memset 1177->1182 1183 7ff717444fd7-7ff717444ff8 1177->1183 1178->1177 1184 7ff717444f62-7ff717444f7e 1179->1184 1185 7ff717444f30-7ff717444f60 1180->1185 1182->1169 1187 7ff71744500c-7ff717445062 strlen call 7ff71758f580 1183->1187 1186 7ff717444f80-7ff717444f87 1184->1186 1185->1184 1185->1185 1186->1175 1188 7ff717444f89-7ff717444f98 1186->1188 1191 7ff717445000-7ff717445006 1187->1191 1192 7ff717445064-7ff717445073 memcmp 1187->1192 1188->1175 1188->1186 1191->1182 1191->1187 1192->1191 1193 7ff717445075-7ff71744513d call 7ff717589810 memset 1192->1193 1196 7ff71744528a-7ff7174452aa OutputDebugStringW 1193->1196 1197 7ff717445143-7ff717445155 1193->1197 1200 7ff7174452ba-7ff7174452c6 1196->1200 1201 7ff7174452ac-7ff7174452b5 call 7ff717457e80 1196->1201 1198 7ff71744515b-7ff717445163 1197->1198 1199 7ff7174451f4-7ff717445217 1197->1199 1202 7ff717445252-7ff71744526e 1198->1202 1203 7ff717445220-7ff717445250 1199->1203 1200->1170 1201->1200 1205 7ff717445270-7ff717445277 1202->1205 1203->1202 1203->1203 1205->1196 1206 7ff717445279-7ff717445288 1205->1206 1206->1196 1206->1205
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2374661962.00007FF717441000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF717440000, based on PE: true
                                                  • Associated: 00000000.00000002.2374638529.00007FF717440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF7175A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF717714000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375347125.00007FF717753000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375370339.00007FF717754000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_7ff717440000_dropper.jbxd
                                                  Similarity
                                                  • API ID: DebugOutputStringmemset$memcmpstrlen
                                                  • String ID: c
                                                  • API String ID: 2294051181-112844655
                                                  • Opcode ID: dce34d2c4ccefbdc59403cbc7d9b9b1511611d9606645910d17a03172241af59
                                                  • Instruction ID: ec3c7a639ff1409c0a8a65116a0b1d0ba439c75bbc77827cc0d1c2a1ca3ae57c
                                                  • Opcode Fuzzy Hash: dce34d2c4ccefbdc59403cbc7d9b9b1511611d9606645910d17a03172241af59
                                                  • Instruction Fuzzy Hash: C9E1A132A18BC585EB219B14E4413EAF3A1FB85794F904235DE8E43B56EF3CD19ACB50
                                                  Function 00007FF7174469B0 Relevance: 18.0, APIs: 6, Strings: 4, Instructions: 479COMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 1207 7ff7174469b0-7ff7174469e0 1208 7ff717446c01-7ff717446c8d call 7ff717589810 memset 1207->1208 1209 7ff7174469e6-7ff7174469fd 1207->1209 1220 7ff717446dfa-7ff717446e15 OutputDebugStringW 1208->1220 1221 7ff717446c93-7ff717446ca5 1208->1221 1211 7ff7174470c7-7ff717447105 call 7ff71759e090 1209->1211 1212 7ff717446a03-7ff717446a12 1209->1212 1217 7ff71744710a-7ff71744711d call 7ff71759df20 1211->1217 1215 7ff7174470ba-7ff7174470c2 call 7ff71759dfc0 1212->1215 1216 7ff717446a18-7ff717446a28 1212->1216 1215->1211 1216->1217 1218 7ff717446a2e-7ff717446a3e 1216->1218 1223 7ff717446a44-7ff717446a50 1217->1223 1224 7ff717447123-7ff7174471c0 call 7ff717589810 call 7ff717451f30 1217->1224 1218->1223 1218->1224 1226 7ff7174470ac-7ff7174470b9 1220->1226 1227 7ff717446e1b-7ff717446e29 call 7ff717457e80 1220->1227 1228 7ff717446cab-7ff717446cb3 1221->1228 1229 7ff717446d76-7ff717446d99 1221->1229 1232 7ff717446ee8-7ff717446fad call 7ff7174533b0 call 7ff717589810 memset 1223->1232 1233 7ff717446a56-7ff717446b9a 1223->1233 1253 7ff7174471db-7ff71744720d call 7ff71759efa0 1224->1253 1254 7ff7174471c2-7ff7174471d6 call 7ff717457e80 1224->1254 1227->1226 1237 7ff717446dcc-7ff717446ddd 1228->1237 1235 7ff717446da0-7ff717446dca 1229->1235 1258 7ff71744705a-7ff71744706e OutputDebugStringW 1232->1258 1259 7ff717446fb3-7ff717446fc5 1232->1259 1238 7ff717446b9e-7ff717446bb6 1233->1238 1235->1235 1235->1237 1241 7ff717446de0-7ff717446de7 1237->1241 1243 7ff717446bb8-7ff717446bcf 1238->1243 1244 7ff717446be2-7ff717446bee 1238->1244 1241->1220 1247 7ff717446de9-7ff717446df8 1241->1247 1248 7ff717446cb8-7ff717446d4b call 7ff717589810 memset 1243->1248 1249 7ff717446bd5-7ff717446be0 1243->1249 1244->1232 1252 7ff717446bf4-7ff717446bff 1244->1252 1247->1220 1247->1241 1264 7ff717446eba-7ff717446ed5 OutputDebugStringW 1248->1264 1265 7ff717446d51-7ff717446d63 1248->1265 1249->1243 1249->1244 1252->1238 1277 7ff71744720f-7ff717447217 call 7ff71759e080 1253->1277 1254->1253 1262 7ff717447081-7ff71744708f 1258->1262 1263 7ff717447070-7ff71744707c call 7ff717457e80 1258->1263 1266 7ff717446fc7-7ff717446fcf 1259->1266 1267 7ff717446fd1-7ff717446fff 1259->1267 1273 7ff717447091-7ff71744709a 1262->1273 1274 7ff7174470a0-7ff7174470a6 1262->1274 1263->1262 1264->1232 1270 7ff717446ed7-7ff717446ee3 call 7ff717457e80 1264->1270 1271 7ff717446d69-7ff717446d71 1265->1271 1272 7ff717446e2e-7ff717446e5e 1265->1272 1275 7ff71744702c-7ff71744703d 1266->1275 1276 7ff717447000-7ff71744702a 1267->1276 1270->1232 1279 7ff717446e8c-7ff717446e9d 1271->1279 1281 7ff717446e60-7ff717446e8a 1272->1281 1273->1274 1280 7ff71744721c-7ff717447223 call 7ff71759df20 1273->1280 1274->1226 1274->1277 1283 7ff717447040-7ff717447047 1275->1283 1276->1275 1276->1276 1277->1226 1285 7ff717446ea0-7ff717446ea7 1279->1285 1280->1274 1290 7ff717447229-7ff71744722d 1280->1290 1281->1279 1281->1281 1283->1258 1286 7ff717447049-7ff717447058 1283->1286 1285->1264 1289 7ff717446ea9-7ff717446eb8 1285->1289 1286->1258 1286->1283 1289->1264 1289->1285 1290->1274
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2374661962.00007FF717441000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF717440000, based on PE: true
                                                  • Associated: 00000000.00000002.2374638529.00007FF717440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF7175A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF717714000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375347125.00007FF717753000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375370339.00007FF717754000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_7ff717440000_dropper.jbxd
                                                  Similarity
                                                  • API ID: DebugOutputStringmemset
                                                  • String ID: arenegyl$modnarod$setybdet$uespemos
                                                  • API String ID: 1084755268-66988881
                                                  • Opcode ID: 7c74dfb76f536c89dd652218c276df7d57efbb377dfe372e097b8e4dbdf67d4d
                                                  • Instruction ID: 62424da924657171670e1763354e6bbdc3fe25b5a508b7c0a454fb3d1e6214e9
                                                  • Opcode Fuzzy Hash: 7c74dfb76f536c89dd652218c276df7d57efbb377dfe372e097b8e4dbdf67d4d
                                                  • Instruction Fuzzy Hash: 6322C272A15FC189FB21DF60D8553E873A1EB05798F808236DE4D5BB5AEF38925AC310
                                                  Function 00007FF7174421C0 Relevance: 17.9, APIs: 5, Strings: 5, Instructions: 438COMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 1291 7ff7174421c0-7ff717442204 1292 7ff71744220a-7ff717442219 1291->1292 1293 7ff717442820-7ff71744286d call 7ff71759e090 1291->1293 1294 7ff71744221f-7ff717442227 1292->1294 1295 7ff717442873-7ff717442882 call 7ff71759e2a0 1292->1295 1293->1294 1293->1295 1294->1295 1298 7ff71744222d-7ff717442234 1294->1298 1301 7ff71744223a-7ff717442246 1295->1301 1302 7ff717442888-7ff7174428bc call 7ff71759f370 1295->1302 1298->1301 1298->1302 1303 7ff71744224c-7ff717442390 1301->1303 1304 7ff7174423fb-7ff717442495 call 7ff717589810 memset 1301->1304 1311 7ff7174428e0-7ff717442922 1302->1311 1306 7ff717442394-7ff7174423ac 1303->1306 1316 7ff7174426aa-7ff7174426be OutputDebugStringW 1304->1316 1317 7ff71744249b-7ff7174424ad 1304->1317 1309 7ff7174423ae-7ff7174423c9 1306->1309 1310 7ff7174423e0-7ff7174423ec 1306->1310 1313 7ff7174424c0-7ff7174425f7 call 7ff717589810 memset 1309->1313 1314 7ff7174423cf-7ff7174423da 1309->1314 1310->1304 1315 7ff7174423ee-7ff7174423f9 1310->1315 1318 7ff717442924-7ff717442932 1311->1318 1319 7ff717442933-7ff717442938 call 7ff71759e5b0 1311->1319 1336 7ff71744276a-7ff71744277e OutputDebugStringW 1313->1336 1337 7ff7174425fd-7ff71744260f 1313->1337 1314->1309 1320 7ff7174423dc 1314->1320 1315->1306 1321 7ff7174426d1-7ff7174426de 1316->1321 1322 7ff7174426c0-7ff7174426cc call 7ff717457e80 1316->1322 1323 7ff717442622-7ff717442645 1317->1323 1324 7ff7174424b3-7ff7174424bb 1317->1324 1319->1318 1320->1310 1329 7ff7174427f2-7ff717442808 1321->1329 1322->1321 1327 7ff717442650-7ff71744267a 1323->1327 1330 7ff71744267c-7ff71744268d 1324->1330 1327->1327 1327->1330 1334 7ff7174428be-7ff7174428c6 call 7ff71759e5b0 1329->1334 1335 7ff71744280e-7ff71744281f 1329->1335 1333 7ff717442690-7ff717442697 1330->1333 1333->1316 1342 7ff717442699-7ff7174426a8 1333->1342 1334->1335 1338 7ff717442791-7ff71744279f 1336->1338 1339 7ff717442780-7ff71744278c call 7ff717457e80 1336->1339 1340 7ff717442615-7ff71744261d 1337->1340 1341 7ff7174426e3-7ff717442706 1337->1341 1346 7ff7174428cb 1338->1346 1347 7ff7174427a5-7ff7174427a9 1338->1347 1339->1338 1345 7ff71744273c-7ff71744274d 1340->1345 1349 7ff717442710-7ff71744273a 1341->1349 1342->1316 1342->1333 1353 7ff717442750-7ff717442757 1345->1353 1352 7ff7174428ce-7ff7174428db call 7ff71759ed93 1346->1352 1350 7ff7174427ab-7ff7174427c8 call 7ff717457e70 1347->1350 1351 7ff7174427d3 1347->1351 1349->1345 1349->1349 1350->1352 1359 7ff7174427ce-7ff7174427d1 1350->1359 1355 7ff7174427d9-7ff7174427ee memcpy 1351->1355 1352->1311 1353->1336 1357 7ff717442759-7ff717442768 1353->1357 1355->1329 1357->1336 1357->1353 1359->1355
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2374661962.00007FF717441000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF717440000, based on PE: true
                                                  • Associated: 00000000.00000002.2374638529.00007FF717440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF7175A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF717714000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375347125.00007FF717753000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375370339.00007FF717754000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_7ff717440000_dropper.jbxd
                                                  Similarity
                                                  • API ID: DebugOutputStringmemset$memcpy
                                                  • String ID: arenegyl$called `Result::unwrap()` on an `Err` value$modnarod$setybdet$uespemos
                                                  • API String ID: 293864031-2410307170
                                                  • Opcode ID: a98f9f651eff772e25efcc42bb288e534873556c87b5d351d10b40a0bfd220fb
                                                  • Instruction ID: 9bcf77d25e7740006de25a2038396d1abd887d0ac2868e6a309f53459a5d4def
                                                  • Opcode Fuzzy Hash: a98f9f651eff772e25efcc42bb288e534873556c87b5d351d10b40a0bfd220fb
                                                  • Instruction Fuzzy Hash: 1702F472A19F8185EB20DF60D8557EDB360FB057A8F808236DE1D57B96EF38825AC350
                                                  Function 00007FF717441350 Relevance: 14.6, APIs: 2, Strings: 6, Instructions: 570COMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 1360 7ff717441350-7ff7174413b1 1361 7ff717441f68-7ff717441fa6 call 7ff71759e090 1360->1361 1362 7ff7174413b7-7ff7174413c9 1360->1362 1368 7ff717441fab-7ff717441fb8 call 7ff71759df20 1361->1368 1364 7ff7174413cf-7ff7174413df 1362->1364 1365 7ff717441f54-7ff717441f5c call 7ff71759e480 1362->1365 1364->1368 1369 7ff7174413e5-7ff7174413ed 1364->1369 1379 7ff717441f61-7ff717441f66 call 7ff71759e5b0 1365->1379 1370 7ff717441fbe-7ff717441fed call 7ff71759f370 1368->1370 1371 7ff7174413f3-7ff717441419 call 7ff717457e70 1368->1371 1369->1370 1369->1371 1382 7ff717442062-7ff7174420b3 call 7ff717453010 1370->1382 1380 7ff71744141f-7ff717441be4 1371->1380 1381 7ff717442053-7ff71744205d call 7ff71759edb0 1371->1381 1388 7ff717441f39-7ff717441f53 1379->1388 1386 7ff717441bfb-7ff717441c02 1380->1386 1381->1382 1389 7ff717441ee9-7ff717441f0a call 7ff717457e80 1386->1389 1390 7ff717441c08-7ff717441c56 call 7ff717450350 1386->1390 1396 7ff717441f0c-7ff717441f1c 1389->1396 1397 7ff717441f22-7ff717441f37 1389->1397 1398 7ff717441c5c-7ff717441c6a 1390->1398 1399 7ff71744200b-7ff717442051 call 7ff71759f370 1390->1399 1396->1397 1401 7ff717441fef-7ff717441ffc call 7ff71759df20 1396->1401 1397->1379 1397->1388 1402 7ff717441c70-7ff717441c77 1398->1402 1403 7ff717441d24-7ff717441d56 call 7ff717453070 1398->1403 1399->1382 1401->1397 1415 7ff717442002-7ff717442006 1401->1415 1406 7ff717441cf9-7ff717441d00 1402->1406 1407 7ff717441c7d-7ff717441c8a 1402->1407 1413 7ff717441d58 1403->1413 1414 7ff717441d6c-7ff717441e12 call 7ff717589810 memset 1403->1414 1406->1403 1412 7ff717441d02-7ff717441d05 1406->1412 1410 7ff717441c90-7ff717441cf7 1407->1410 1410->1406 1410->1410 1416 7ff717441d10-7ff717441d22 1412->1416 1413->1414 1417 7ff717441d5a-7ff717441d67 call 7ff717457e80 1413->1417 1421 7ff717441eba-7ff717441ecd OutputDebugStringW 1414->1421 1422 7ff717441e18-7ff717441e2a 1414->1422 1415->1397 1416->1403 1416->1416 1417->1414 1423 7ff717441bf0-7ff717441bf4 1421->1423 1424 7ff717441ed3-7ff717441ee4 call 7ff717457e80 1421->1424 1425 7ff717441e2c-7ff717441e34 1422->1425 1426 7ff717441e40-7ff717441e5f 1422->1426 1423->1386 1424->1423 1428 7ff717441e8c-7ff717441e9d 1425->1428 1429 7ff717441e60-7ff717441e8a 1426->1429 1431 7ff717441ea0-7ff717441ea7 1428->1431 1429->1428 1429->1429 1431->1421 1432 7ff717441ea9-7ff717441eb8 1431->1432 1432->1421 1432->1431
                                                  APIs
                                                  Strings
                                                  • Thread32NextVirtualFreeWaitForSingleObjectTerminateThreadSuspendThreadResumeThreadIsWow64ProcessModule32FirstWModule32NextWGetCurrentProcessIdProcess32FirstWProcess32NextWZwOpenKeyZwCreateKeyZwSetValueKeyZwCloseCreateRemoteThreadNtQuerySystemInformationEnumPro, xrefs: 00007FF717441787
                                                  • NtProtectVirtualMemoryNtAllocateVirtualMemoryNtMapViewOfSectionNtUnmapViewOfSectionNtOpenFileLdrLoadDllEtwEventWriteFullEtwEventWriteEtwEventWriteTransferWDEnableMpWDEnableMpScanStartMpSampleSubmitMpAmsiNotifyMpSampleQueryMpAmsiScanMpThreatActionNtResumeThread, xrefs: 00007FF717441434
                                                  • RtlCaptureStackBackTraceLoadLibraryAGetProcAddressLdrGetDllHandleByMappingLdrRegisterDllNotificationVirtualAllocExVirtualFreeExNtCreateSectionFailed to encrypt function name, xrefs: 00007FF717441B0B
                                                  • FindFirstFileWFindNextFileWNtQueryDirectoryFileRegQueryValueExWNtEnumerateKeyGetAsyncKeyStateSetWindowsHookExWLogonUserWCredEnumerateWCreateProcessWNtQueryInformationProcessVirtualQueryExGetProcessIdNtOpenProcessNtWriteVirtualMemoryNtReadVirtualMemoryLoadLibra, xrefs: 00007FF717441962
                                                  • NtGetContextThreadNtSetContextThreadNtCloseNtCreateThreadExNtCreateProcessExNtQueryInformationThreadGetProcessIdOfThreadWriteProcessMemoryReadProcessMemoryOpenProcessVirtualProtectExCloseHandleVirtualAllocVirtualProtectOpenThreadCreateToolhelp32SnapshotThread3, xrefs: 00007FF7174415CC
                                                  • called `Result::unwrap()` on an `Err` value, xrefs: 00007FF717441FD1
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2374661962.00007FF717441000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF717440000, based on PE: true
                                                  • Associated: 00000000.00000002.2374638529.00007FF717440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF7175A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF717714000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375347125.00007FF717753000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375370339.00007FF717754000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_7ff717440000_dropper.jbxd
                                                  Similarity
                                                  • API ID: memcpy$memset$DebugOutputString
                                                  • String ID: FindFirstFileWFindNextFileWNtQueryDirectoryFileRegQueryValueExWNtEnumerateKeyGetAsyncKeyStateSetWindowsHookExWLogonUserWCredEnumerateWCreateProcessWNtQueryInformationProcessVirtualQueryExGetProcessIdNtOpenProcessNtWriteVirtualMemoryNtReadVirtualMemoryLoadLibra$NtGetContextThreadNtSetContextThreadNtCloseNtCreateThreadExNtCreateProcessExNtQueryInformationThreadGetProcessIdOfThreadWriteProcessMemoryReadProcessMemoryOpenProcessVirtualProtectExCloseHandleVirtualAllocVirtualProtectOpenThreadCreateToolhelp32SnapshotThread3$NtProtectVirtualMemoryNtAllocateVirtualMemoryNtMapViewOfSectionNtUnmapViewOfSectionNtOpenFileLdrLoadDllEtwEventWriteFullEtwEventWriteEtwEventWriteTransferWDEnableMpWDEnableMpScanStartMpSampleSubmitMpAmsiNotifyMpSampleQueryMpAmsiScanMpThreatActionNtResumeThread$RtlCaptureStackBackTraceLoadLibraryAGetProcAddressLdrGetDllHandleByMappingLdrRegisterDllNotificationVirtualAllocExVirtualFreeExNtCreateSectionFailed to encrypt function name$Thread32NextVirtualFreeWaitForSingleObjectTerminateThreadSuspendThreadResumeThreadIsWow64ProcessModule32FirstWModule32NextWGetCurrentProcessIdProcess32FirstWProcess32NextWZwOpenKeyZwCreateKeyZwSetValueKeyZwCloseCreateRemoteThreadNtQuerySystemInformationEnumPro$called `Result::unwrap()` on an `Err` value
                                                  • API String ID: 4266836622-765071994
                                                  • Opcode ID: 933b51a09c7be772aab073c097bf27dea6c3fcf0eb194787110a1a6a3f5c5389
                                                  • Instruction ID: cb4dcf09e3bc2c712538399dee4213a8802a121b0ceb8d5c93613a49f8900d38
                                                  • Opcode Fuzzy Hash: 933b51a09c7be772aab073c097bf27dea6c3fcf0eb194787110a1a6a3f5c5389
                                                  • Instruction Fuzzy Hash: 23722D37615F959AE790DB10E8843E973E4F708758F904239CA8C437A2EF7C926AD352
                                                  Function 00007FF7175982D0 Relevance: 7.8, APIs: 1, Strings: 4, Instructions: 294COMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 1487 7ff7175982d0-7ff7175982f6 1488 7ff7175983f6-7ff7175983fd call 7ff717589470 1487->1488 1489 7ff7175982fc-7ff717598323 1487->1489 1500 7ff71759871f-7ff71759872f 1488->1500 1490 7ff717598325-7ff717598333 1489->1490 1491 7ff71759834b-7ff717598378 call 7ff717452110 1489->1491 1493 7ff717598335-7ff717598346 1490->1493 1494 7ff71759837d-7ff717598384 1490->1494 1491->1500 1497 7ff7175983d4-7ff7175983e5 1493->1497 1494->1488 1499 7ff717598386-7ff7175983cc 1494->1499 1497->1488 1502 7ff7175983e7-7ff7175983f4 1497->1502 1499->1488 1501 7ff7175983ce-7ff7175983d1 1499->1501 1501->1497 1502->1488 1503 7ff717598402-7ff71759841e call 7ff717457e70 1502->1503 1505 7ff717598423-7ff717598426 1503->1505 1506 7ff7175986b1-7ff7175986c0 call 7ff7175894c0 1505->1506 1507 7ff71759842c-7ff717598469 memset 1505->1507 1506->1500 1509 7ff71759846f-7ff71759849b 1507->1509 1510 7ff7175986c2-7ff7175986c5 1507->1510 1512 7ff7175984a0-7ff7175984a4 1509->1512 1513 7ff7175986c9-7ff7175986f2 1510->1513 1514 7ff7175984a6 1512->1514 1515 7ff7175984ce-7ff717598612 1512->1515 1513->1500 1516 7ff7175986f4-7ff717598702 1513->1516 1517 7ff7175984b0-7ff7175984c9 1514->1517 1519 7ff717598614-7ff717598619 1515->1519 1520 7ff717598637-7ff717598645 1515->1520 1516->1500 1518 7ff717598704-7ff71759871c call 7ff717457e80 1516->1518 1517->1517 1521 7ff7175984cb 1517->1521 1518->1500 1523 7ff717598620-7ff717598635 1519->1523 1524 7ff717598697-7ff7175986a3 1520->1524 1525 7ff717598647-7ff71759868f 1520->1525 1521->1515 1523->1520 1523->1523 1524->1525 1525->1512 1527 7ff717598695-7ff7175986af 1525->1527 1527->1513
                                                  APIs
                                                  • memset.VCRUNTIME140(?,?,?,?,00000023,?,00000000,?,00000023,0000000B,?,?,00007FF717453335), ref: 00007FF71759845C
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2374661962.00007FF717441000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF717440000, based on PE: true
                                                  • Associated: 00000000.00000002.2374638529.00007FF717440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF7175A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF717714000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375347125.00007FF717753000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375370339.00007FF717754000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_7ff717440000_dropper.jbxd
                                                  Similarity
                                                  • API ID: memset
                                                  • String ID: arenegyl$modnarod$setybdet$uespemos
                                                  • API String ID: 2221118986-66988881
                                                  • Opcode ID: 5e144516e57fd8fca0c6565848de72249e67752de4e4f32e128d69b3e45a1cae
                                                  • Instruction ID: e6361407390945d3ce3c152abfc83348e4210d9a0eabe3964901781b6dc40d0c
                                                  • Opcode Fuzzy Hash: 5e144516e57fd8fca0c6565848de72249e67752de4e4f32e128d69b3e45a1cae
                                                  • Instruction Fuzzy Hash: 88A18E62F59B9586EE50AF19A8013ABA651FB04BF4F885731DE6D177C2EF3CE146C200
                                                  Function 00007FF717453070 Relevance: 5.2, Strings: 4, Instructions: 197COMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 1564 7ff717453070-7ff7174530a2 1565 7ff7174530a8-7ff7174531de 1564->1565 1566 7ff717453321-7ff717453330 call 7ff7175982d0 1564->1566 1568 7ff7174531e0-7ff7174531f9 1565->1568 1569 7ff717453335 1566->1569 1570 7ff7174531fb-7ff717453214 1568->1570 1571 7ff717453230-7ff717453239 1568->1571 1580 7ff71745333d-7ff717453350 1569->1580 1572 7ff717453216-7ff717453221 1570->1572 1573 7ff717453271-7ff717453295 1570->1573 1574 7ff71745323b-7ff717453250 1571->1574 1575 7ff717453253-7ff71745325f 1571->1575 1572->1570 1576 7ff717453223 1572->1576 1579 7ff71745330f-7ff717453320 1573->1579 1574->1575 1577 7ff717453297-7ff71745329f 1575->1577 1578 7ff717453261-7ff71745326c 1575->1578 1576->1571 1577->1580 1581 7ff7174532a5-7ff71745330c 1577->1581 1578->1568 1580->1581 1581->1579
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2374661962.00007FF717441000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF717440000, based on PE: true
                                                  • Associated: 00000000.00000002.2374638529.00007FF717440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF7175A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF717714000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375347125.00007FF717753000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375370339.00007FF717754000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_7ff717440000_dropper.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: arenegyl$modnarod$setybdep$uespemos
                                                  • API String ID: 0-169184043
                                                  • Opcode ID: 41e41b3e5bf85884944af84c50470beff421076fe93f83052b09c5bd714c4b6a
                                                  • Instruction ID: bd09f1f9721fafa41509a0f5de0256e0e5c3cfbbc1e1f67aec8e2a183bb76a19
                                                  • Opcode Fuzzy Hash: 41e41b3e5bf85884944af84c50470beff421076fe93f83052b09c5bd714c4b6a
                                                  • Instruction Fuzzy Hash: 0D6138A2F14B9542FB119FB96411BF96B70A716B54F80A236DF5E27742EF3892D2C200
                                                  Function 00007FF71745B240 Relevance: 3.0, APIs: 2, Instructions: 48COMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 1591 7ff71745b240-7ff71745b251 1592 7ff71745b253-7ff71745b26d 1591->1592 1593 7ff71745b2b2 1591->1593 1594 7ff71745b278-7ff71745b29a BCryptGenRandom 1592->1594 1595 7ff71745b2b4-7ff71745b2c4 1593->1595 1596 7ff71745b29c-7ff71745b2a8 SystemFunction036 1594->1596 1597 7ff71745b270-7ff71745b276 1594->1597 1596->1597 1598 7ff71745b2aa-7ff71745b2b0 1596->1598 1597->1593 1597->1594 1598->1595
                                                  APIs
                                                  • BCryptGenRandom.BCRYPT(?,00000000,?,00007FF71745AFE5,?,?,?,00007FF717598D3B), ref: 00007FF71745B292
                                                  • SystemFunction036.ADVAPI32(?,?,?,00007FF717598D3B), ref: 00007FF71745B2A3
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2374661962.00007FF717441000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF717440000, based on PE: true
                                                  • Associated: 00000000.00000002.2374638529.00007FF717440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF7175A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF717714000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375347125.00007FF717753000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375370339.00007FF717754000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_7ff717440000_dropper.jbxd
                                                  Similarity
                                                  • API ID: CryptFunction036RandomSystem
                                                  • String ID:
                                                  • API String ID: 1232939966-0
                                                  • Opcode ID: 7e5db19c811421e7a1f6f9ad99314db73b2ca63ffc2781fa5743b06b543232d8
                                                  • Instruction ID: d7a762a9d6d56f09695e92b9ef8709fd9d5d648c9f5b1055f516d5f3e5066fd8
                                                  • Opcode Fuzzy Hash: 7e5db19c811421e7a1f6f9ad99314db73b2ca63ffc2781fa5743b06b543232d8
                                                  • Instruction Fuzzy Hash: C7F0F412F1999550FD616A672D08439E5602F15BF0EE84331FC3C87BD6EC3C988B9620
                                                  Function 00007FF71757F310 Relevance: 9.2, APIs: 6, Instructions: 180COMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 1433 7ff71757f310-7ff71757f347 call 7ff717580740 1436 7ff71757f349-7ff71757f34e 1433->1436 1437 7ff71757f353-7ff71757f386 call 7ff717581100 1433->1437 1438 7ff71757f527-7ff71757f536 1436->1438 1441 7ff71757f388-7ff71757f38b 1437->1441 1442 7ff71757f390-7ff71757f39a 1437->1442 1441->1438 1443 7ff71757f39c-7ff71757f39e 1442->1443 1444 7ff71757f3a2-7ff71757f3a4 1442->1444 1445 7ff71757f3a6-7ff71757f3aa 1443->1445 1446 7ff71757f3a0 1443->1446 1444->1445 1447 7ff71757f401-7ff71757f405 1444->1447 1448 7ff71757f3ac-7ff71757f3b0 1445->1448 1449 7ff71757f3b6-7ff71757f3bf 1445->1449 1446->1449 1450 7ff71757f40b-7ff71757f40f 1447->1450 1451 7ff71757f4f9-7ff71757f506 1447->1451 1448->1449 1448->1451 1452 7ff71757f3d6-7ff71757f3d9 1449->1452 1453 7ff71757f3c1-7ff71757f3ca 1449->1453 1450->1451 1454 7ff71757f415-7ff71757f419 1450->1454 1451->1438 1455 7ff71757f508-7ff71757f522 call 7ff717457e80 1451->1455 1458 7ff71757f3db-7ff71757f3e4 1452->1458 1459 7ff71757f420-7ff71757f430 1452->1459 1457 7ff71757f3cc-7ff71757f3cf 1453->1457 1453->1458 1454->1449 1460 7ff71757f41b 1454->1460 1455->1438 1462 7ff71757f3e6-7ff71757f3ea 1457->1462 1463 7ff71757f3d1-7ff71757f3d4 1457->1463 1458->1462 1458->1463 1459->1463 1464 7ff71757f432 1459->1464 1460->1451 1466 7ff71757f3ec-7ff71757f3ff 1462->1466 1467 7ff71757f434-7ff71757f436 1462->1467 1465 7ff71757f450-7ff71757f489 CreateFileW 1463->1465 1464->1462 1470 7ff71757f537-7ff71757f550 GetLastError 1465->1470 1471 7ff71757f48f-7ff71757f496 1465->1471 1466->1465 1468 7ff71757f438-7ff71757f43f 1467->1468 1469 7ff71757f443-7ff71757f445 1467->1469 1472 7ff71757f44b 1468->1472 1473 7ff71757f441 1468->1473 1469->1451 1469->1472 1474 7ff71757f4da-7ff71757f4f1 call 7ff717457e80 1470->1474 1475 7ff71757f552 1470->1475 1476 7ff71757f498-7ff71757f49c 1471->1476 1477 7ff71757f4d3-7ff71757f4d8 1471->1477 1472->1465 1473->1465 1478 7ff71757f4f4-7ff71757f4f7 1474->1478 1475->1478 1476->1477 1479 7ff71757f49e-7ff71757f4a9 GetLastError 1476->1479 1477->1474 1477->1478 1478->1438 1479->1477 1481 7ff71757f4ab-7ff71757f4cd SetFileInformationByHandle 1479->1481 1481->1477 1483 7ff71757f554-7ff71757f571 GetLastError CloseHandle 1481->1483 1484 7ff71757f587-7ff71757f58f 1483->1484 1485 7ff71757f573-7ff71757f582 call 7ff717457e80 1483->1485 1484->1438 1485->1484
                                                  APIs
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2374661962.00007FF717441000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF717440000, based on PE: true
                                                  • Associated: 00000000.00000002.2374638529.00007FF717440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF7175A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF717714000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375347125.00007FF717753000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375370339.00007FF717754000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_7ff717440000_dropper.jbxd
                                                  Similarity
                                                  • API ID: ErrorLast$CloseHandle
                                                  • String ID:
                                                  • API String ID: 3463825546-0
                                                  • Opcode ID: beabdb71fb03b1a03c44a8c5631ac27ec4971ec5ea5a3f25793032079559be3b
                                                  • Instruction ID: 45bee2f87bd3414e67386412557a057b75175105af99f307c1bdd60f77733704
                                                  • Opcode Fuzzy Hash: beabdb71fb03b1a03c44a8c5631ac27ec4971ec5ea5a3f25793032079559be3b
                                                  • Instruction Fuzzy Hash: 5D71B191E0CA5646FB61EB21990577DA6A16F04BA8FD44131CD4D0B7CADF7CEA4F8320
                                                  Function 00007FF7174429A0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 218COMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 1529 7ff7174429a0-7ff7174429f9 call 7ff717450350 1532 7ff717442ce8-7ff717442d4e call 7ff71759f370 1529->1532 1533 7ff7174429ff-7ff717442b2d call 7ff717589810 memset 1529->1533 1540 7ff717442d62-7ff717442d6b 1532->1540 1541 7ff717442d50-7ff717442d5d call 7ff717457e80 1532->1541 1538 7ff717442bda-7ff717442bee OutputDebugStringW 1533->1538 1539 7ff717442b33-7ff717442b45 1533->1539 1544 7ff717442c01-7ff717442c12 1538->1544 1545 7ff717442bf0-7ff717442bfc call 7ff717457e80 1538->1545 1542 7ff717442b47-7ff717442b4f 1539->1542 1543 7ff717442b51-7ff717442b74 1539->1543 1541->1540 1547 7ff717442bac-7ff717442bbd 1542->1547 1548 7ff717442b80-7ff717442baa 1543->1548 1550 7ff717442c27-7ff717442c29 1544->1550 1551 7ff717442c14-7ff717442c1e 1544->1551 1545->1544 1555 7ff717442bc0-7ff717442bc7 1547->1555 1548->1547 1548->1548 1554 7ff717442cc3-7ff717442ccd 1550->1554 1552 7ff717442c2e-7ff717442c37 1551->1552 1553 7ff717442c20-7ff717442c25 1551->1553 1557 7ff717442c40-7ff717442c9f 1552->1557 1556 7ff717442ca1-7ff717442ca4 1553->1556 1558 7ff717442cda-7ff717442ce7 1554->1558 1559 7ff717442ccf-7ff717442cd5 call 7ff717457e80 1554->1559 1555->1538 1560 7ff717442bc9-7ff717442bd8 1555->1560 1556->1554 1561 7ff717442ca6-7ff717442ca9 1556->1561 1557->1556 1557->1557 1559->1558 1560->1538 1560->1555 1563 7ff717442cb0-7ff717442cc1 1561->1563 1563->1554 1563->1563
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2374661962.00007FF717441000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF717440000, based on PE: true
                                                  • Associated: 00000000.00000002.2374638529.00007FF717440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF7175A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF717714000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375347125.00007FF717753000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375370339.00007FF717754000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_7ff717440000_dropper.jbxd
                                                  Similarity
                                                  • API ID: memcpy$memset$DebugOutputString
                                                  • String ID: Failed to encrypt function name
                                                  • API String ID: 4266836622-2980051713
                                                  • Opcode ID: d70633ca993efb089c735d36fcf7b1343c330c61044f740375886587277469cd
                                                  • Instruction ID: e6100af0c550185d2211b35e3db03ca7c9c1d493ac124ca0602d1a6e201df87b
                                                  • Opcode Fuzzy Hash: d70633ca993efb089c735d36fcf7b1343c330c61044f740375886587277469cd
                                                  • Instruction Fuzzy Hash: 39A1E172E18BD188EB319F24E8457E8B760FB45768F844239CE5C17B96DF3882A5C350
                                                  Function 00007FF717451F30 Relevance: 3.1, APIs: 2, Instructions: 65COMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 1582 7ff717451f30-7ff717451f64 memset 1583 7ff71745200a-7ff717452026 OutputDebugStringW 1582->1583 1584 7ff717451f6a-7ff717451f7c 1582->1584 1585 7ff717451f7e-7ff717451f86 1584->1585 1586 7ff717451f88-7ff717451fab 1584->1586 1587 7ff717451fdc-7ff717451fea 1585->1587 1588 7ff717451fb0-7ff717451fda 1586->1588 1589 7ff717451ff0-7ff717451ff7 1587->1589 1588->1587 1588->1588 1589->1583 1590 7ff717451ff9-7ff717452008 1589->1590 1590->1583 1590->1589
                                                  APIs
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2374661962.00007FF717441000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF717440000, based on PE: true
                                                  • Associated: 00000000.00000002.2374638529.00007FF717440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF7175A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF717714000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375347125.00007FF717753000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375370339.00007FF717754000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_7ff717440000_dropper.jbxd
                                                  Similarity
                                                  • API ID: DebugOutputStringmemset
                                                  • String ID:
                                                  • API String ID: 1084755268-0
                                                  • Opcode ID: dbe8b314e803bdf58eb38950bb7c846acb6e651d970314a15dd942edcc0ba3a8
                                                  • Instruction ID: c23d912a835299bd03633be42de1b1187fee3339c237d0a68d7547960821046c
                                                  • Opcode Fuzzy Hash: dbe8b314e803bdf58eb38950bb7c846acb6e651d970314a15dd942edcc0ba3a8
                                                  • Instruction Fuzzy Hash: CE210613F29A9551EB209764E1147B9D231DB96BD4FD08331DF4E53A87EF2CC2968300

                                                  Non-executed Functions

                                                  Function 00007FF717597D54 Relevance: 13.6, APIs: 9, Instructions: 71COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2374661962.00007FF717441000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF717440000, based on PE: true
                                                  • Associated: 00000000.00000002.2374638529.00007FF717440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF7175A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF717714000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375347125.00007FF717753000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375370339.00007FF717754000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_7ff717440000_dropper.jbxd
                                                  Similarity
                                                  • API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                  • String ID:
                                                  • API String ID: 313767242-0
                                                  • Opcode ID: 8bbd5aa1730cd332274f21e033dfa46fe5b836ac888b46510952249dd751b1d7
                                                  • Instruction ID: 890d2a409f6b812445ce54b72774d1ae4c805ca342b6ca80e14d1386154afa1a
                                                  • Opcode Fuzzy Hash: 8bbd5aa1730cd332274f21e033dfa46fe5b836ac888b46510952249dd751b1d7
                                                  • Instruction Fuzzy Hash: 50312D72619F8186EB60AF60E8803E9B360FB84754F84443ADA4D47B9AEF38D54DC720
                                                  Function 00007FF717598730 Relevance: 7.8, APIs: 1, Strings: 4, Instructions: 296COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • memset.VCRUNTIME140(?,?,?,?,7065646279746573,?,6C7967656E657261,646F72616E646F6D,?,?,?,?,00007FF717453608,?,00007FF717753360), ref: 00007FF7175988B9
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2374661962.00007FF717441000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF717440000, based on PE: true
                                                  • Associated: 00000000.00000002.2374638529.00007FF717440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF7175A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF717714000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375347125.00007FF717753000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375370339.00007FF717754000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_7ff717440000_dropper.jbxd
                                                  Similarity
                                                  • API ID: memset
                                                  • String ID: arenegyl$modnarod$setybdet$uespemos
                                                  • API String ID: 2221118986-66988881
                                                  • Opcode ID: 0b73bdf6d1e9c850985cac41669ebc9fde1b53cfa636dfb9082e609276dceff6
                                                  • Instruction ID: 77b6ca63eded05102d01c1a8c94f5a17fcf6634721335079302f6eef02b7aa09
                                                  • Opcode Fuzzy Hash: 0b73bdf6d1e9c850985cac41669ebc9fde1b53cfa636dfb9082e609276dceff6
                                                  • Instruction Fuzzy Hash: B4A19B62F58B9586FE50AF1968013AAA651BB01BF4F8C5731DEAD177C2DE3CE14AC300
                                                  Function 00007FF7175899D0 Relevance: 7.1, APIs: 5, Instructions: 807COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2374661962.00007FF717441000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF717440000, based on PE: true
                                                  • Associated: 00000000.00000002.2374638529.00007FF717440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF7175A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF717714000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375347125.00007FF717753000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375370339.00007FF717754000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_7ff717440000_dropper.jbxd
                                                  Similarity
                                                  • API ID: memcpy
                                                  • String ID:
                                                  • API String ID: 3510742995-0
                                                  • Opcode ID: c4b5cee76ded1d8e5623bd4d19962c85a15949ebf6b3dd13a14ee58e756753dc
                                                  • Instruction ID: 92a5a2a1a6615be3afc84eaf61be65f5f7b3808ab355eee3846d0d4c44631f31
                                                  • Opcode Fuzzy Hash: c4b5cee76ded1d8e5623bd4d19962c85a15949ebf6b3dd13a14ee58e756753dc
                                                  • Instruction Fuzzy Hash: E5621713A18A919EFB009B6684022FD6B20F7153B4F848535DA5E5BBCADF38D74BD360
                                                  Function 00007FF717597C2C Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2374661962.00007FF717441000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF717440000, based on PE: true
                                                  • Associated: 00000000.00000002.2374638529.00007FF717440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF7175A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF717714000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375347125.00007FF717753000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375370339.00007FF717754000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_7ff717440000_dropper.jbxd
                                                  Similarity
                                                  • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                  • String ID:
                                                  • API String ID: 2933794660-0
                                                  • Opcode ID: c596656461ae3f3076c1521dd9a9436d70232416d0a161f68c67e46cb5c13d68
                                                  • Instruction ID: a37bc414d39052015da52c653bded99c6417382c4763e3b34cdcecd2f0841448
                                                  • Opcode Fuzzy Hash: c596656461ae3f3076c1521dd9a9436d70232416d0a161f68c67e46cb5c13d68
                                                  • Instruction Fuzzy Hash: A8113C22B14F058AEB00EF70E8552B873B4FB19B68F840E35EE6D467A5EF78D1598350
                                                  Function 00007FF7174533B0 Relevance: 5.2, Strings: 4, Instructions: 179COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2374661962.00007FF717441000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF717440000, based on PE: true
                                                  • Associated: 00000000.00000002.2374638529.00007FF717440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF7175A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF717714000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375347125.00007FF717753000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375370339.00007FF717754000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_7ff717440000_dropper.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: arenegyl$modnarod$setybdep$uespemos
                                                  • API String ID: 0-169184043
                                                  • Opcode ID: d9d2f6c5d41ea510d0770bcf6189b2222fcec3b4f1e8b317cb7508ed310dc3e6
                                                  • Instruction ID: 9187022ee0052662149c005701b6d011b0b59218899d8c74feb763ed302ba2ab
                                                  • Opcode Fuzzy Hash: d9d2f6c5d41ea510d0770bcf6189b2222fcec3b4f1e8b317cb7508ed310dc3e6
                                                  • Instruction Fuzzy Hash: 6151DE42F6477602F2506FBA2801FE56D616B517E4FD6A332ED2C633C2E634DE478200
                                                  Function 00007FF71759E770 Relevance: 4.1, Strings: 3, Instructions: 376COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2374661962.00007FF717441000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF717440000, based on PE: true
                                                  • Associated: 00000000.00000002.2374638529.00007FF717440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF7175A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF717714000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375347125.00007FF717753000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375370339.00007FF717754000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_7ff717440000_dropper.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: Authenti$GenuineI$HygonGen
                                                  • API String ID: 0-696657513
                                                  • Opcode ID: f2e61712f0c5d9f69d27e50b952c7d1e10019fb747e75d8b3847ba665d39cf31
                                                  • Instruction ID: 931007619a7974f7ad69ba0a4a6f7bdd9dee0c7a63b615d0edfd3b7111c31cb4
                                                  • Opcode Fuzzy Hash: f2e61712f0c5d9f69d27e50b952c7d1e10019fb747e75d8b3847ba665d39cf31
                                                  • Instruction Fuzzy Hash: 77B188A3B349A103FB198A56BD22BB94991B358BD8F48B43CED1F57BC1CD7CDA119201
                                                  Function 00007FF717570110 Relevance: 3.0, APIs: 2, Instructions: 467COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2374661962.00007FF717441000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF717440000, based on PE: true
                                                  • Associated: 00000000.00000002.2374638529.00007FF717440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF7175A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF717714000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375347125.00007FF717753000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375370339.00007FF717754000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_7ff717440000_dropper.jbxd
                                                  Similarity
                                                  • API ID: memcpymemset
                                                  • String ID:
                                                  • API String ID: 1297977491-0
                                                  • Opcode ID: 25b5068a9a1db7c9942569100e3b28caeafde2c73725c3a1ff454f1de202b71a
                                                  • Instruction ID: e99a5c04c9468de0800370f2dc6503cd74cfc37ac4096733c98bb4efd435a49a
                                                  • Opcode Fuzzy Hash: 25b5068a9a1db7c9942569100e3b28caeafde2c73725c3a1ff454f1de202b71a
                                                  • Instruction Fuzzy Hash: C3126166C28FD941E223973968027BBAB10AFFB348F51D317FED831E45DB1CA241A650
                                                  Function 00007FF717571F10 Relevance: 2.8, Strings: 2, Instructions: 284COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2374661962.00007FF717441000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF717440000, based on PE: true
                                                  • Associated: 00000000.00000002.2374638529.00007FF717440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF7175A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF717714000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375347125.00007FF717753000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375370339.00007FF717754000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_7ff717440000_dropper.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: 33333333$UUUUUUUU
                                                  • API String ID: 0-3483174168
                                                  • Opcode ID: cff9d24c3fc3692150ad18937845d9fa878edfc3b39f359c130e8016678a4c49
                                                  • Instruction ID: 3a81f71bb059842e67eaceedc94535e03550869ade922beb697c2acde78d5c9a
                                                  • Opcode Fuzzy Hash: cff9d24c3fc3692150ad18937845d9fa878edfc3b39f359c130e8016678a4c49
                                                  • Instruction Fuzzy Hash: 0591E843B681F003F7624B7D1D66566EFA25545BD370DF152EEE423A86C038CC2AE3A5
                                                  Function 00007FF717572320 Relevance: 2.8, Strings: 2, Instructions: 273COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2374661962.00007FF717441000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF717440000, based on PE: true
                                                  • Associated: 00000000.00000002.2374638529.00007FF717440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF7175A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF717714000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375347125.00007FF717753000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375370339.00007FF717754000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_7ff717440000_dropper.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: 33333333$UUUUUUUU
                                                  • API String ID: 0-3483174168
                                                  • Opcode ID: 14b31b35ad291ddad897dd1f2a0e82a6c76d055b51b98b879fc08f69398a6c0a
                                                  • Instruction ID: 0f8bec32a5713e29220c994287e2471ec9503f957c585ffdc4d845ef937708d5
                                                  • Opcode Fuzzy Hash: 14b31b35ad291ddad897dd1f2a0e82a6c76d055b51b98b879fc08f69398a6c0a
                                                  • Instruction Fuzzy Hash: 6691DA4375A3D48FAB52CB7E194498A6E90E12AFC835CF069CE8D27322D436D557C392
                                                  Function 00007FF71758A850 Relevance: 1.5, APIs: 1, Instructions: 205COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2374661962.00007FF717441000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF717440000, based on PE: true
                                                  • Associated: 00000000.00000002.2374638529.00007FF717440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF7175A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF717714000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375347125.00007FF717753000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375370339.00007FF717754000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_7ff717440000_dropper.jbxd
                                                  Similarity
                                                  • API ID: memcpy
                                                  • String ID:
                                                  • API String ID: 3510742995-0
                                                  • Opcode ID: 2e0d94b50dbfcb4bf7ad67966e6ab2d03216f6a9f7021f3c57b0be95d36079e7
                                                  • Instruction ID: e2718e677ae1e039a1dfc589e2172f9929ff25682d634293c444db5afdc2fc45
                                                  • Opcode Fuzzy Hash: 2e0d94b50dbfcb4bf7ad67966e6ab2d03216f6a9f7021f3c57b0be95d36079e7
                                                  • Instruction Fuzzy Hash: 8B712A22B05A459AFB119A66C9013BD6770BB047A8F844935CE5D17B87DE3CD38AD360
                                                  Function 00007FF717452AE0 Relevance: 1.4, APIs: 1, Instructions: 194COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2374661962.00007FF717441000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF717440000, based on PE: true
                                                  • Associated: 00000000.00000002.2374638529.00007FF717440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF7175A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF717714000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375347125.00007FF717753000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375370339.00007FF717754000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_7ff717440000_dropper.jbxd
                                                  Similarity
                                                  • API ID: memcpy
                                                  • String ID:
                                                  • API String ID: 3510742995-0
                                                  • Opcode ID: ca91c1696f31f3c353b851b5073992e3c773c50cf787151c495bd234e09a70db
                                                  • Instruction ID: 0c85e1cf0502e96b3d760c1ca7a6f787ee3491fd6d26883d6dfb53fdc5dff2d8
                                                  • Opcode Fuzzy Hash: ca91c1696f31f3c353b851b5073992e3c773c50cf787151c495bd234e09a70db
                                                  • Instruction Fuzzy Hash: 91614793B1DD1246FB649A55D41137AA6A0EB407A4FC04437FEAE0B7C6DE7CE09AC320
                                                  Function 00007FF71758F2E0 Relevance: 1.4, Strings: 1, Instructions: 134COMMON
                                                  Download Yara Rule
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2374661962.00007FF717441000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF717440000, based on PE: true
                                                  • Associated: 00000000.00000002.2374638529.00007FF717440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF7175A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF717714000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375347125.00007FF717753000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375370339.00007FF717754000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_7ff717440000_dropper.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID: 0123456789abcdefBorrowMutErroralready borrowed:
                                                  • API String ID: 0-1320686809
                                                  • Opcode ID: 41d177af72eeddb10c22de4c3264fd25b0561db59cdec1d9bd2e9693263e96c7
                                                  • Instruction ID: 3ede2bfbcfa08c31d0fc55869eb3ae300c6e2854a37237c4ad27164b1b308080
                                                  • Opcode Fuzzy Hash: 41d177af72eeddb10c22de4c3264fd25b0561db59cdec1d9bd2e9693263e96c7
                                                  • Instruction Fuzzy Hash: 1A513C63F196E09FE32197789400EAC7FA19B15B48F494095CFD81BFC7C626C22AE761
                                                  Function 00007FF717570FA0 Relevance: .4, Instructions: 391COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2374661962.00007FF717441000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF717440000, based on PE: true
                                                  • Associated: 00000000.00000002.2374638529.00007FF717440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF7175A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF717714000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375347125.00007FF717753000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375370339.00007FF717754000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_7ff717440000_dropper.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 26b839506847f24fc4f5c51154a888ab0d611c7331cf839320317adbb1efd074
                                                  • Instruction ID: d9dda179bd21554b4db7713cdadd5046999552ae305878eb736161be410d8fe6
                                                  • Opcode Fuzzy Hash: 26b839506847f24fc4f5c51154a888ab0d611c7331cf839320317adbb1efd074
                                                  • Instruction Fuzzy Hash: 48F1D362718B8481E6128B6AB4556A7E760FFDD7E4F45A212FFCC67B18DF38D2818700
                                                  Function 00007FF717593D10 Relevance: .4, Instructions: 390COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2374661962.00007FF717441000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF717440000, based on PE: true
                                                  • Associated: 00000000.00000002.2374638529.00007FF717440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF7175A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF717714000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375347125.00007FF717753000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375370339.00007FF717754000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_7ff717440000_dropper.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: f11c5b38006027b9234eaea3e496288aefec6e0257f4ec47831e89d5fe555790
                                                  • Instruction ID: 4a530342c43b672ac888a9fc6e21b12e8576838172ebb6383b2b606992ca3dd8
                                                  • Opcode Fuzzy Hash: f11c5b38006027b9234eaea3e496288aefec6e0257f4ec47831e89d5fe555790
                                                  • Instruction Fuzzy Hash: A5E19B96E29F9641F723433954022B496106FA37F4B40E336FDA971ED3EB39A6879210
                                                  Function 00007FF717580C70 Relevance: .4, Instructions: 351COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2374661962.00007FF717441000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF717440000, based on PE: true
                                                  • Associated: 00000000.00000002.2374638529.00007FF717440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF7175A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF717714000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375347125.00007FF717753000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375370339.00007FF717754000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_7ff717440000_dropper.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 124e3dff0220a8f33751b539735703e061cd71da1860fc3e864cc36a0d137c22
                                                  • Instruction ID: 8000cb2fa8b04086d1aacc0cd8d6248862f3cbb540af4909d995f25cfa446e96
                                                  • Opcode Fuzzy Hash: 124e3dff0220a8f33751b539735703e061cd71da1860fc3e864cc36a0d137c22
                                                  • Instruction Fuzzy Hash: 60C19A52E0CED647FB719A26944277AEA819701770FD49335CA7E171D3CB3CA99B8320
                                                  Function 00007FF717570A60 Relevance: .3, Instructions: 305COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2374661962.00007FF717441000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF717440000, based on PE: true
                                                  • Associated: 00000000.00000002.2374638529.00007FF717440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF7175A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF717714000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375347125.00007FF717753000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375370339.00007FF717754000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_7ff717440000_dropper.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: d47f3e9b11dc4a54e4f11e78fefacc45221f5563bb6d7024a26e78833e66dd3c
                                                  • Instruction ID: 4dbdd82b97c42a4d86ba945b94be470e4fb4b53e31eaa476f20d5578ea59f6fa
                                                  • Opcode Fuzzy Hash: d47f3e9b11dc4a54e4f11e78fefacc45221f5563bb6d7024a26e78833e66dd3c
                                                  • Instruction Fuzzy Hash: B4D1B412518BD482F2129B7DA4466EBE361FFD93A4F54A311FFC926A15EF38E1C68700
                                                  Function 00007FF717454910 Relevance: .3, Instructions: 287COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2374661962.00007FF717441000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF717440000, based on PE: true
                                                  • Associated: 00000000.00000002.2374638529.00007FF717440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF7175A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF717714000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375347125.00007FF717753000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375370339.00007FF717754000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_7ff717440000_dropper.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: d0e5fdb1ab86427edaadb1d6f7b06ad51f7814e95596d1477b7ecce125c38b14
                                                  • Instruction ID: 79b66a18b3fc2231cea166344797a7c4cbbd2d9da979ede05cc7f5cbfca1293e
                                                  • Opcode Fuzzy Hash: d0e5fdb1ab86427edaadb1d6f7b06ad51f7814e95596d1477b7ecce125c38b14
                                                  • Instruction Fuzzy Hash: 6DA13473F08AA145F7549B59984077EAAB0FB443A4F808131CE6D0BAC6DF7C99A69320
                                                  Function 00007FF717573560 Relevance: .2, Instructions: 249COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2374661962.00007FF717441000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF717440000, based on PE: true
                                                  • Associated: 00000000.00000002.2374638529.00007FF717440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF7175A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF717714000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375347125.00007FF717753000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375370339.00007FF717754000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_7ff717440000_dropper.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: a7129c2044a4066c2b7ac891e204a05a9f8a1a369dd49303d74f275ccfacac7a
                                                  • Instruction ID: 7ce053b7667fb2a2291cc509017a5f77b63b439f44d8baf5125a0789e8b8ad36
                                                  • Opcode Fuzzy Hash: a7129c2044a4066c2b7ac891e204a05a9f8a1a369dd49303d74f275ccfacac7a
                                                  • Instruction Fuzzy Hash: E1C13D62D19FC542E723A739A4032F6E310FFEA394F40D312EEC47595AEB69E3469610
                                                  Function 00007FF717571640 Relevance: .2, Instructions: 235COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2374661962.00007FF717441000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF717440000, based on PE: true
                                                  • Associated: 00000000.00000002.2374638529.00007FF717440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF7175A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF717714000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375347125.00007FF717753000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375370339.00007FF717754000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_7ff717440000_dropper.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: b20f7bc080719c1c1f3ae5b196f2442c1df25a9a2f5e432d3dc0e4515f377300
                                                  • Instruction ID: 2542ae72c4ccfa20196c65beb1892f13c0bd88adc0b991ce806802190909264d
                                                  • Opcode Fuzzy Hash: b20f7bc080719c1c1f3ae5b196f2442c1df25a9a2f5e432d3dc0e4515f377300
                                                  • Instruction Fuzzy Hash: 6971A3A3754B64867A04CFF2A830897E7A5F359FC4B19B425AF8D27F18CA3CC552D640
                                                  Function 00007FF717571C10 Relevance: .2, Instructions: 216COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2374661962.00007FF717441000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF717440000, based on PE: true
                                                  • Associated: 00000000.00000002.2374638529.00007FF717440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF7175A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF717714000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375347125.00007FF717753000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375370339.00007FF717754000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_7ff717440000_dropper.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 5c7b83c72bfdaeea47df758e94a65eedecb787c00f8c8408b0aba7e0cdd93293
                                                  • Instruction ID: 95eeda5a8520525edee91d2276770ec0df47ad32154e9a2eda219738453eafe2
                                                  • Opcode Fuzzy Hash: 5c7b83c72bfdaeea47df758e94a65eedecb787c00f8c8408b0aba7e0cdd93293
                                                  • Instruction Fuzzy Hash: 4B6101A2F718B293B682DEB28513DA82E11B7A4BD2343A532DD1A23741CD74DE4FC215
                                                  Function 00007FF717572A70 Relevance: .2, Instructions: 210COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2374661962.00007FF717441000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF717440000, based on PE: true
                                                  • Associated: 00000000.00000002.2374638529.00007FF717440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF7175A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF717714000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375347125.00007FF717753000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375370339.00007FF717754000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_7ff717440000_dropper.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 63f73319fad2da576f3d5b9983d65f57c7789e905c01965cd88b4a1bca77e753
                                                  • Instruction ID: ac863f4bedc9bddaddae5922fc041a548a0128ccda551c0194af9db404a13d21
                                                  • Opcode Fuzzy Hash: 63f73319fad2da576f3d5b9983d65f57c7789e905c01965cd88b4a1bca77e753
                                                  • Instruction Fuzzy Hash: 35511963725B24456A40DFF2BD609AB6650B76CFD4F49B422FE8CA7705CE3CCB869240
                                                  Function 00007FF717571950 Relevance: .2, Instructions: 210COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2374661962.00007FF717441000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF717440000, based on PE: true
                                                  • Associated: 00000000.00000002.2374638529.00007FF717440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF7175A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF717714000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375347125.00007FF717753000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375370339.00007FF717754000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_7ff717440000_dropper.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: e49d64f606b30b5e613b7687bc14d59ee01eaa8d31e2a8703c4f9323d8549704
                                                  • Instruction ID: d416797be00467981505a8bf5a77a3e2a1a5905893b636c8e13afd6d057c9589
                                                  • Opcode Fuzzy Hash: e49d64f606b30b5e613b7687bc14d59ee01eaa8d31e2a8703c4f9323d8549704
                                                  • Instruction Fuzzy Hash: 176173A3315BA4427A04CFF2BD3199BABA5F649BD8B00F435EE8D57B1CDA3CC4518640
                                                  Function 00007FF717573210 Relevance: .2, Instructions: 210COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2374661962.00007FF717441000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF717440000, based on PE: true
                                                  • Associated: 00000000.00000002.2374638529.00007FF717440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF7175A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF717714000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375347125.00007FF717753000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375370339.00007FF717754000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_7ff717440000_dropper.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 516913f712a79e31602e76090d16c532121ebdbc7cbb616029c414f36c94abab
                                                  • Instruction ID: 457270f5b50bb61aa528683f3fab3dfe895481d90fd9d043ceb4ef80d636bc9e
                                                  • Opcode Fuzzy Hash: 516913f712a79e31602e76090d16c532121ebdbc7cbb616029c414f36c94abab
                                                  • Instruction Fuzzy Hash: 0C51EB63729B14456A40CFE2BD609AB6690B758BD4F49B436FE4DA7709CE3CCB829240
                                                  Function 00007FF717572F80 Relevance: .2, Instructions: 190COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2374661962.00007FF717441000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF717440000, based on PE: true
                                                  • Associated: 00000000.00000002.2374638529.00007FF717440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF7175A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF717714000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375347125.00007FF717753000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375370339.00007FF717754000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_7ff717440000_dropper.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 7bcd44aacf1be6df8b683f518df340d7f83a1aa97022882a5af4655f99829e9a
                                                  • Instruction ID: 031cdd25f8197c5c57da5a8c2ab3e41862ac2129b1330e0fbd5ef58862bbe5cf
                                                  • Opcode Fuzzy Hash: 7bcd44aacf1be6df8b683f518df340d7f83a1aa97022882a5af4655f99829e9a
                                                  • Instruction Fuzzy Hash: 6751DAF3726A10425E45CFA2BC249B69652FA1CBD4F40D431DF1D97B09CE3CCA529340
                                                  Function 00007FF7175727E0 Relevance: .2, Instructions: 190COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2374661962.00007FF717441000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF717440000, based on PE: true
                                                  • Associated: 00000000.00000002.2374638529.00007FF717440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF7175A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF717714000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375347125.00007FF717753000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375370339.00007FF717754000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_7ff717440000_dropper.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: 4a5052886ae8791df3e3aade1c897a77a9afdf7e8fe609916b5f9302e4dbc497
                                                  • Instruction ID: c06ad373f088eac6773fd2505e3dcc1f82ea758196c565d403a05ddc2eec12b5
                                                  • Opcode Fuzzy Hash: 4a5052886ae8791df3e3aade1c897a77a9afdf7e8fe609916b5f9302e4dbc497
                                                  • Instruction Fuzzy Hash: 2951D6F3725A10526E45CFA3BC24AB69652BB1CFD4F40E421DE0D9BB1ACE3CCA569340
                                                  Function 00007FF717572D40 Relevance: .2, Instructions: 170COMMON
                                                  Download Yara Rule
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2374661962.00007FF717441000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF717440000, based on PE: true
                                                  • Associated: 00000000.00000002.2374638529.00007FF717440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF7175A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF717714000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375347125.00007FF717753000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375370339.00007FF717754000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_7ff717440000_dropper.jbxd
                                                  Similarity
                                                  • API ID:
                                                  • String ID:
                                                  • API String ID:
                                                  • Opcode ID: dbee0296d68a45a4e5011e14e78ef7d3f61107bd3d503f6abe85d47c4473e09a
                                                  • Instruction ID: 483b6cafddcb58c2d63febc22e83b766fe4bb801c7eb542a8cf0cfa7ab332378
                                                  • Opcode Fuzzy Hash: dbee0296d68a45a4e5011e14e78ef7d3f61107bd3d503f6abe85d47c4473e09a
                                                  • Instruction Fuzzy Hash: FB41F163719A24827E58EFE2BE71877A651B75CBD0F48B436EE4E97704CE3CC5828240
                                                  Function 00007FF717581100 Relevance: 17.9, APIs: 7, Strings: 3, Instructions: 409COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2374661962.00007FF717441000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF717440000, based on PE: true
                                                  • Associated: 00000000.00000002.2374638529.00007FF717440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF7175A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF717714000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375347125.00007FF717753000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375370339.00007FF717754000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_7ff717440000_dropper.jbxd
                                                  Similarity
                                                  • API ID: ErrorLast$FullNamePathmemcpy
                                                  • String ID: \\?\$\\?\UNC\$internal error: entered unreachable code/rustc/a4cb3c831823d9baa56c3d90514b75b2660116fa\library\alloc\src\vec\mod.rs
                                                  • API String ID: 674145353-264738257
                                                  • Opcode ID: d7fc4ba5ba4ef77c397d2e9dcbc81c70837a4435e016c4d2ba40b298a9f61b5c
                                                  • Instruction ID: 5e337e48a17fe193c9c5cf3c22dd5972fa4b82d5ccd801fb1a72cb8665f68ce5
                                                  • Opcode Fuzzy Hash: d7fc4ba5ba4ef77c397d2e9dcbc81c70837a4435e016c4d2ba40b298a9f61b5c
                                                  • Instruction Fuzzy Hash: 6802D762E08F8286EB70AF16D4453B8B395FB04BB4F84453ACA5D47796DF3CD58A8360
                                                  Function 00007FF717450350 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 340COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  • a Display implementation returned an error unexpectedlyC:\Users\Harrison\.rustup\toolchains\nightly-x86_64-pc-windows-msvc\lib/rustlib/src/rust\library\alloc\src\string.rs, xrefs: 00007FF71745095A
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2374661962.00007FF717441000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF717440000, based on PE: true
                                                  • Associated: 00000000.00000002.2374638529.00007FF717440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF7175A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF717714000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375347125.00007FF717753000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375370339.00007FF717754000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_7ff717440000_dropper.jbxd
                                                  Similarity
                                                  • API ID: memcpy$memset$DebugOutputString
                                                  • String ID: a Display implementation returned an error unexpectedlyC:\Users\Harrison\.rustup\toolchains\nightly-x86_64-pc-windows-msvc\lib/rustlib/src/rust\library\alloc\src\string.rs
                                                  • API String ID: 4266836622-2517649730
                                                  • Opcode ID: dc72e5d723b904c31d1bfee4d7511b1ea578d9cb444f89ab8cfe3db1e79aa3a9
                                                  • Instruction ID: 5cb5577bd97ba4958ee565ffa678af7a98a32f1dffdf11d0bf1f6c8717e729d5
                                                  • Opcode Fuzzy Hash: dc72e5d723b904c31d1bfee4d7511b1ea578d9cb444f89ab8cfe3db1e79aa3a9
                                                  • Instruction Fuzzy Hash: D0F18322A09FC289E7719F21D8407E9A364FB457A8F804235DE9D0AB9BDF7C9359C350
                                                  Function 00007FF717450AE0 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 307COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  • a Display implementation returned an error unexpectedlyC:\Users\Harrison\.rustup\toolchains\nightly-x86_64-pc-windows-msvc\lib/rustlib/src/rust\library\alloc\src\string.rs, xrefs: 00007FF717451016
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2374661962.00007FF717441000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF717440000, based on PE: true
                                                  • Associated: 00000000.00000002.2374638529.00007FF717440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF7175A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF717714000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375347125.00007FF717753000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375370339.00007FF717754000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_7ff717440000_dropper.jbxd
                                                  Similarity
                                                  • API ID: memcpy$memset$DebugOutputString
                                                  • String ID: a Display implementation returned an error unexpectedlyC:\Users\Harrison\.rustup\toolchains\nightly-x86_64-pc-windows-msvc\lib/rustlib/src/rust\library\alloc\src\string.rs
                                                  • API String ID: 4266836622-2517649730
                                                  • Opcode ID: d66ce00a19a55cc6a474b157e59032c2da2f1603b6997617f002821071de5ef0
                                                  • Instruction ID: f7316dc807896c5b6551f130df80dc30161d6d9728cb4e2d40b8c8d1e57a880d
                                                  • Opcode Fuzzy Hash: d66ce00a19a55cc6a474b157e59032c2da2f1603b6997617f002821071de5ef0
                                                  • Instruction Fuzzy Hash: 26E1AE22A08FC289EB65AF21D8507E9A365FB44798FC44131DE4D0BB97DF7CA25AC350
                                                  Function 00007FF717578FA0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 243COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  • internal error: entered unreachable code/rustc/a4cb3c831823d9baa56c3d90514b75b2660116fa\library\alloc\src\vec\mod.rs, xrefs: 00007FF717579350
                                                  Memory Dump Source
                                                  • Source File: 00000000.00000002.2374661962.00007FF717441000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF717440000, based on PE: true
                                                  • Associated: 00000000.00000002.2374638529.00007FF717440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF7175A0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2374987425.00007FF717714000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375347125.00007FF717753000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                  • Associated: 00000000.00000002.2375370339.00007FF717754000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_0_2_7ff717440000_dropper.jbxd
                                                  Similarity
                                                  • API ID: ErrorLast$EnvironmentVariable
                                                  • String ID: internal error: entered unreachable code/rustc/a4cb3c831823d9baa56c3d90514b75b2660116fa\library\alloc\src\vec\mod.rs
                                                  • API String ID: 2691138088-1438511490
                                                  • Opcode ID: a04294cbb469c8f01ab9a6d10a21ca46b0f64d25ee0d3bbad3c5c81085b7aaf5
                                                  • Instruction ID: 7858de11a071ca2e1a2a1f35f688116c3fbf7ab8a8ee7c4e23d31049b86ac57c
                                                  • Opcode Fuzzy Hash: a04294cbb469c8f01ab9a6d10a21ca46b0f64d25ee0d3bbad3c5c81085b7aaf5
                                                  • Instruction Fuzzy Hash: 71A1A362B04FC585EB71AF25D8443E9A365FB44BA8F808135DE1C5B786DF38D78A8360

                                                  Execution Graph

                                                  Execution Coverage:8.9%
                                                  Dynamic/Decrypted Code Coverage:0%
                                                  Signature Coverage:4.4%
                                                  Total number of Nodes:1314
                                                  Total number of Limit Nodes:53
                                                  execution_graph 20897 7fffe33d6937 memset OutputDebugStringW 20909 7fffe33cf480 20897->20909 20900 7fffe33d69bb memset OutputDebugStringW 20902 7fffe33d6bd6 memset OutputDebugStringW 20900->20902 20901 7fffe33d6a31 20984 7fffe33f4070 20901->20984 20908 7fffe33d6873 20902->20908 20905 7fffe33d6b8a OutputDebugStringW 20906 7fffe33d6ba7 20905->20906 20906->20902 20907 7fffe33d6ae5 20907->20905 20993 7fffe33c29d0 20909->20993 20911 7fffe33cf4e2 21005 7fffe33c2de0 20911->21005 20913 7fffe33cf508 20914 7fffe33c29d0 44 API calls 20913->20914 20917 7fffe33cf518 20913->20917 20915 7fffe33cf595 20914->20915 20918 7fffe33c2de0 108 API calls 20915->20918 20916 7fffe33cf537 20916->20900 20916->20901 20917->20916 21244 7fffe33fcfa3 27 API calls 20917->21244 20920 7fffe33cf5bb 20918->20920 20921 7fffe33cf5cb 20920->20921 20922 7fffe33c29d0 44 API calls 20920->20922 20921->20916 21245 7fffe33fcfa3 27 API calls 20921->21245 20924 7fffe33cf63d 20922->20924 20925 7fffe33c2de0 108 API calls 20924->20925 20927 7fffe33cf663 20925->20927 20929 7fffe33cf673 20927->20929 20930 7fffe33c29d0 44 API calls 20927->20930 20929->20916 21246 7fffe33fcfa3 27 API calls 20929->21246 20932 7fffe33cf6e6 20930->20932 20934 7fffe33c2de0 108 API calls 20932->20934 20933 7fffe33d0270 21249 7fffe33fd3f0 27 API calls 20933->21249 20936 7fffe33cf70c 20934->20936 20938 7fffe33cf71c 20936->20938 20939 7fffe33c29d0 44 API calls 20936->20939 20938->20916 21247 7fffe33fcfa3 27 API calls 20938->21247 20940 7fffe33cf78f 20939->20940 20941 7fffe33c2de0 108 API calls 20940->20941 20942 7fffe33cf7b5 20941->20942 20943 7fffe33cf7c5 20942->20943 20944 7fffe33c29d0 44 API calls 20942->20944 20943->20916 21248 7fffe33fcfa3 27 API calls 20943->21248 20945 7fffe33cf851 20944->20945 20946 7fffe33c2de0 108 API calls 20945->20946 20948 7fffe33cf877 20946->20948 20947 7fffe33c29d0 44 API calls 20949 7fffe33cf8e3 20947->20949 20948->20921 20948->20947 20950 7fffe33c2de0 108 API calls 20949->20950 20953 7fffe33cf909 20950->20953 20951 7fffe33c29d0 44 API calls 20952 7fffe33cf975 20951->20952 20954 7fffe33c2de0 108 API calls 20952->20954 20953->20929 20953->20951 20955 7fffe33cf99b 20954->20955 20956 7fffe33cf9be CreateToolhelp32Snapshot 20955->20956 20957 7fffe33cf9af 20955->20957 20956->20957 20958 7fffe33cf9ee Thread32First 20956->20958 21230 7fffe33cc760 28 API calls 20957->21230 20958->20917 20970 7fffe33cfa1c 20958->20970 20960 7fffe33cf9e9 20960->20958 20961 7fffe33cfa29 GetLastError 21231 7fffe33e52a0 32 API calls 20961->21231 20963 7fffe33cfa9e Thread32Next 20963->20917 20963->20970 20964 7fffe33cfad5 CloseHandle 20964->20970 20967 7fffe33d01ac 21243 7fffe33fd3f0 27 API calls 20967->21243 20969 7fffe33c1190 WakeByAddressSingle 20969->20970 20970->20917 20970->20933 20970->20961 20970->20963 20970->20964 20970->20967 20970->20969 20971 7fffe33cfd2a GetLastError 20970->20971 20972 7fffe33cfe2f SuspendThread 20970->20972 20976 7fffe33e52a0 32 API calls 20970->20976 20978 7fffe33d007e ResumeThread 20970->20978 21103 7fffe33cc860 20970->21103 21233 7fffe33d2180 WaitOnAddress GetLastError WakeByAddressAll 20970->21233 21234 7fffe33d5b80 WaitOnAddress GetLastError 20970->21234 21235 7fffe33d9790 29 API calls 20970->21235 21236 7fffe33c1190 20970->21236 21241 7fffe33fc1d0 WaitOnAddress GetLastError 20970->21241 21242 7fffe33fc2a0 WaitOnAddress GetLastError WakeByAddressAll 20970->21242 20971->20970 20972->20970 20973 7fffe33cff1b GetLastError 20972->20973 21232 7fffe33e52a0 32 API calls 20973->21232 20976->20970 20978->20970 20980 7fffe33d0089 GetLastError 20978->20980 21240 7fffe33e52a0 32 API calls 20980->21240 20987 7fffe33f409a 20984->20987 20990 7fffe33f4159 20987->20990 21896 7fffe33f5ef0 20987->21896 20988 7fffe33d6a9f memset 20988->20905 20988->20907 21901 7fffe33fcfa3 27 API calls 20990->21901 21250 7fffe33d2e40 20993->21250 20995 7fffe33c2a25 20996 7fffe33c2d18 20995->20996 20997 7fffe33c2a2f 20995->20997 21288 7fffe33fd3f0 27 API calls 20996->21288 20999 7fffe33f4070 27 API calls 20997->20999 21001 7fffe33c2b24 memset 20999->21001 21002 7fffe33c2c0a OutputDebugStringW 21001->21002 21003 7fffe33c2b63 21001->21003 21004 7fffe33c2c20 21002->21004 21003->21002 21004->20911 21006 7fffe33f4070 27 API calls 21005->21006 21007 7fffe33c2f23 memset 21006->21007 21008 7fffe33c300a OutputDebugStringW 21007->21008 21012 7fffe33c2f5e 21007->21012 21009 7fffe33c302d 21008->21009 21294 7fffe33ca380 21009->21294 21012->21008 21013 7fffe33f4070 27 API calls 21014 7fffe33c30b6 memset 21013->21014 21015 7fffe33c31aa OutputDebugStringW 21014->21015 21019 7fffe33c30f8 21014->21019 21016 7fffe33c31c6 21015->21016 21305 7fffe33c6800 21016->21305 21018 7fffe33c31ea 21020 7fffe33f4070 27 API calls 21018->21020 21019->21015 21021 7fffe33c326a memset 21020->21021 21022 7fffe33c335a OutputDebugStringW 21021->21022 21026 7fffe33c32ac 21021->21026 21023 7fffe33c3376 21022->21023 21314 7fffe33c21f0 21023->21314 21026->21022 21028 7fffe33c33fe 21029 7fffe33c340b 21028->21029 21035 7fffe33c34fc 21028->21035 21030 7fffe33f4070 27 API calls 21029->21030 21031 7fffe33c348e memset 21030->21031 21032 7fffe33c377a OutputDebugStringW 21031->21032 21034 7fffe33c34d7 21031->21034 21094 7fffe33c33a8 21032->21094 21033 7fffe33f4070 27 API calls 21036 7fffe33c367a memset 21033->21036 21034->21032 21035->21033 21037 7fffe33c389a OutputDebugStringW 21036->21037 21038 7fffe33c36bc 21036->21038 21044 7fffe33c38b6 21037->21044 21038->21037 21039 7fffe33c3a83 21390 7fffe33c7370 21039->21390 21042 7fffe33c3f18 21046 7fffe33f4070 27 API calls 21042->21046 21043 7fffe33c3a98 21045 7fffe33f4070 27 API calls 21043->21045 21044->21039 21047 7fffe33c39a2 21044->21047 21048 7fffe33c3b19 memset 21045->21048 21049 7fffe33c3f7a memset 21046->21049 21050 7fffe33f4070 27 API calls 21047->21050 21052 7fffe33c406a OutputDebugStringW 21048->21052 21061 7fffe33c3b5b 21048->21061 21053 7fffe33c413a OutputDebugStringW 21049->21053 21060 7fffe33c3fb6 21049->21060 21051 7fffe33c3a1c memset 21050->21051 21054 7fffe33c3c4a OutputDebugStringW 21051->21054 21065 7fffe33c3a5e 21051->21065 21086 7fffe33c3ed6 21052->21086 21055 7fffe33c4156 21053->21055 21056 7fffe33c3c66 21054->21056 21057 7fffe33d7650 27 API calls 21055->21057 21416 7fffe33d7650 21056->21416 21062 7fffe33c41a4 GetModuleHandleW 21057->21062 21058 7fffe33f4070 27 API calls 21066 7fffe33c4425 memset 21058->21066 21060->21053 21061->21052 21063 7fffe33c429c 21062->21063 21064 7fffe33c41c1 21062->21064 21445 7fffe33d9f20 GetLastError 21063->21445 21074 7fffe33f4070 27 API calls 21064->21074 21064->21094 21065->21054 21069 7fffe33c450a OutputDebugStringW 21066->21069 21081 7fffe33c445e 21066->21081 21072 7fffe33c4526 21069->21072 21070 7fffe33c3cd1 21077 7fffe33f4070 27 API calls 21070->21077 21070->21094 21071 7fffe33c3dbf 21444 7fffe33d9f20 GetLastError 21071->21444 21424 7fffe33c4d40 21072->21424 21075 7fffe33c4242 memset 21074->21075 21078 7fffe33c436a OutputDebugStringW 21075->21078 21088 7fffe33c427b 21075->21088 21080 7fffe33c3d5c memset 21077->21080 21078->21086 21079 7fffe33c4551 21082 7fffe33c455b 21079->21082 21083 7fffe33c4672 21079->21083 21084 7fffe33c3eba OutputDebugStringW 21080->21084 21093 7fffe33c3d9e 21080->21093 21081->21069 21087 7fffe33c4571 VirtualQuery 21082->21087 21085 7fffe33f4070 27 API calls 21083->21085 21084->21086 21089 7fffe33c46db memset 21085->21089 21086->21058 21090 7fffe33c4740 21087->21090 21091 7fffe33c4590 21087->21091 21088->21078 21092 7fffe33c494a OutputDebugStringW 21089->21092 21100 7fffe33c471b 21089->21100 21096 7fffe33f4070 27 API calls 21090->21096 21091->21090 21095 7fffe33c459d 21091->21095 21092->21094 21093->21084 21094->20913 21097 7fffe33f4070 27 API calls 21095->21097 21098 7fffe33c47b7 memset 21096->21098 21099 7fffe33c4614 memset 21097->21099 21098->21092 21098->21100 21101 7fffe33c4a7a OutputDebugStringW 21099->21101 21102 7fffe33c464d 21099->21102 21100->21092 21101->21094 21102->21101 21104 7fffe33c29d0 44 API calls 21103->21104 21105 7fffe33cc912 21104->21105 21106 7fffe33c2de0 108 API calls 21105->21106 21107 7fffe33cc938 21106->21107 21108 7fffe33cc9a4 21107->21108 21109 7fffe33cc948 21107->21109 21110 7fffe33cc9b7 21108->21110 21113 7fffe33cca71 21108->21113 21212 7fffe33cc967 21109->21212 21692 7fffe33fcfa3 27 API calls 21109->21692 21112 7fffe33c29d0 44 API calls 21110->21112 21114 7fffe33cc9db 21112->21114 21113->21212 21693 7fffe33fcfa3 27 API calls 21113->21693 21116 7fffe33c2de0 108 API calls 21114->21116 21117 7fffe33cca01 21116->21117 21118 7fffe33cca15 21117->21118 21119 7fffe33ccabf 21117->21119 21118->21212 21694 7fffe33fcfa3 27 API calls 21118->21694 21123 7fffe33ccaca 21119->21123 21124 7fffe33ccb81 21119->21124 21121 7fffe33ccd37 21121->21212 21695 7fffe33fcfa3 27 API calls 21121->21695 21127 7fffe33f4070 27 API calls 21123->21127 21125 7fffe33c29d0 44 API calls 21124->21125 21128 7fffe33ccba2 21125->21128 21129 7fffe33ccb24 memset 21127->21129 21130 7fffe33c2de0 108 API calls 21128->21130 21132 7fffe33ccd1a OutputDebugStringW 21129->21132 21137 7fffe33ccb5c 21129->21137 21133 7fffe33ccbc8 21130->21133 21132->21121 21134 7fffe33ccbd8 21133->21134 21135 7fffe33ccc26 21133->21135 21134->21212 21696 7fffe33fcfa3 27 API calls 21134->21696 21139 7fffe33ccdfb 21135->21139 21140 7fffe33ccc46 21135->21140 21137->21132 21143 7fffe33c29d0 44 API calls 21139->21143 21140->21212 21697 7fffe33fcfa3 27 API calls 21140->21697 21141 7fffe33ce826 21700 7fffe33fd1e4 27 API calls 21141->21700 21144 7fffe33cce1c 21143->21144 21515 7fffe33c5300 21144->21515 21146 7fffe33cce31 21147 7fffe33cce8d 21146->21147 21148 7fffe33cce41 21146->21148 21150 7fffe33c29d0 44 API calls 21147->21150 21148->21212 21698 7fffe33fcfa3 27 API calls 21148->21698 21151 7fffe33cceb1 21150->21151 21152 7fffe33c2de0 108 API calls 21151->21152 21153 7fffe33cced7 21152->21153 21154 7fffe33ccee7 21153->21154 21155 7fffe33ccf59 NtQueryInformationProcess 21153->21155 21154->21212 21699 7fffe33fcfa3 27 API calls 21154->21699 21156 7fffe33cd01e memset 21155->21156 21157 7fffe33ccfb1 21155->21157 21159 7fffe33cd059 21156->21159 21158 7fffe33f4070 27 API calls 21157->21158 21219 7fffe33cd00b 21158->21219 21160 7fffe33ce26a 21159->21160 21161 7fffe33cd061 21159->21161 21167 7fffe33ce86d 21160->21167 21160->21219 21166 7fffe33ce2c4 21161->21166 21223 7fffe33cd0a5 21161->21223 21162 7fffe33ce43b 21164 7fffe33d49b0 2 API calls 21162->21164 21163 7fffe33ce466 21165 7fffe33f4070 27 API calls 21163->21165 21168 7fffe33ce44c 21164->21168 21169 7fffe33ce4d9 21165->21169 21176 7fffe33ce8da 21166->21176 21166->21219 21703 7fffe33fcfa3 27 API calls 21167->21703 21689 7fffe33cc760 28 API calls 21168->21689 21592 7fffe33d49b0 memset 21169->21592 21171 7fffe33cd107 21172 7fffe33ce333 memset OutputDebugStringW 21171->21172 21172->21163 21175 7fffe33ce883 21704 7fffe33fd1e4 27 API calls 21175->21704 21708 7fffe33fcfa3 27 API calls 21176->21708 21177 7fffe33ce4f3 21595 7fffe33e40d0 21177->21595 21180 7fffe33ce322 21183 7fffe33d49b0 2 API calls 21180->21183 21181 7fffe33ce8f0 21709 7fffe33fd1e4 27 API calls 21181->21709 21183->21172 21184 7fffe33f4070 27 API calls 21189 7fffe33cd223 memset 21184->21189 21187 7fffe33ce55c 21191 7fffe33f4070 27 API calls 21187->21191 21188 7fffe33ce530 21690 7fffe33cf100 29 API calls 21188->21690 21192 7fffe33cd307 OutputDebugStringW 21189->21192 21189->21223 21193 7fffe33ce5ea 21191->21193 21192->21223 21195 7fffe33d49b0 2 API calls 21193->21195 21194 7fffe33cd383 memset OutputDebugStringW 21194->21223 21196 7fffe33ce612 21195->21196 21197 7fffe33d49b0 2 API calls 21196->21197 21199 7fffe33ce641 21197->21199 21198 7fffe33ce841 21701 7fffe33fcfa3 27 API calls 21198->21701 21604 7fffe33d0470 memset OutputDebugStringW memset OutputDebugStringW 21199->21604 21201 7fffe33cd64d memset OutputDebugStringW 21201->21223 21203 7fffe33ce855 21702 7fffe33fd1e4 27 API calls 21203->21702 21205 7fffe33ce669 21207 7fffe33ce67d 21205->21207 21691 7fffe33cf410 27 API calls 21205->21691 21209 7fffe33f4070 27 API calls 21207->21209 21207->21212 21210 7fffe33ce6ed 21209->21210 21211 7fffe33d49b0 2 API calls 21210->21211 21211->21212 21212->20970 21213 7fffe33f4070 27 API calls 21214 7fffe33cd5df memset 21213->21214 21215 7fffe33cd73d OutputDebugStringW 21214->21215 21214->21223 21215->21223 21216 7fffe33f4230 32 API calls 21216->21223 21217 7fffe33cd816 memcmp 21217->21223 21219->21162 21219->21163 21219->21212 21220 7fffe33cd908 memcmp 21220->21223 21221 7fffe33cda96 21707 7fffe33fd4f0 27 API calls 21221->21707 21223->21141 21223->21171 21223->21172 21223->21175 21223->21180 21223->21181 21223->21184 21223->21192 21223->21194 21223->21198 21223->21201 21223->21203 21223->21213 21223->21215 21223->21216 21223->21217 21223->21219 21223->21220 21223->21221 21224 7fffe33ce24f 21223->21224 21225 7fffe33ce8a2 21223->21225 21227 7fffe33ce8b3 21223->21227 21582 7fffe33d5d90 21223->21582 21687 7fffe33f8010 28 API calls 21223->21687 21688 7fffe33fd1e4 27 API calls 21224->21688 21705 7fffe33fd1e4 27 API calls 21225->21705 21706 7fffe33fd1e4 27 API calls 21227->21706 21230->20960 21231->20963 21232->20970 21233->20970 21234->20970 21235->20970 21239 7fffe33c119a 21236->21239 21237 7fffe33c11b4 21237->20978 21238 7fffe33fc290 WakeByAddressSingle 21239->21237 21239->21238 21240->20970 21241->20970 21242->20970 21251 7fffe33f4070 27 API calls 21250->21251 21252 7fffe33d2f8b memset 21251->21252 21253 7fffe33d307a OutputDebugStringW 21252->21253 21255 7fffe33d2fc6 21252->21255 21254 7fffe33d309d 21253->21254 21256 7fffe33d30fa 21254->21256 21258 7fffe33d30bf 21254->21258 21255->21253 21286 7fffe33d3119 21256->21286 21290 7fffe33fcfa3 27 API calls 21256->21290 21257 7fffe33d30e9 21289 7fffe33de410 29 API calls 21257->21289 21258->21257 21261 7fffe33d3172 21258->21261 21265 7fffe33d3190 memcpy memcpy 21261->21265 21262 7fffe33d3801 21291 7fffe33fcfa3 27 API calls 21262->21291 21263 7fffe33d30f5 21264 7fffe33d31bd memcpy 21263->21264 21264->21262 21268 7fffe33d31ee 21264->21268 21265->21264 21267 7fffe33d381e 21292 7fffe33fd490 27 API calls 21267->21292 21268->21262 21268->21267 21270 7fffe33d3216 21268->21270 21270->21267 21272 7fffe33d323c memcpy memcpy 21270->21272 21273 7fffe33d3283 21272->21273 21274 7fffe33d3292 memcpy memset 21272->21274 21275 7fffe33f4070 27 API calls 21273->21275 21278 7fffe33d3333 21274->21278 21276 7fffe33d3522 memset 21275->21276 21277 7fffe33d361a OutputDebugStringW 21276->21277 21280 7fffe33d3564 21276->21280 21282 7fffe33d3636 21277->21282 21278->21273 21279 7fffe33d338e 21278->21279 21281 7fffe33f4070 27 API calls 21279->21281 21280->21277 21283 7fffe33d3448 memset 21281->21283 21282->21286 21293 7fffe33fd3f0 27 API calls 21282->21293 21285 7fffe33d378a OutputDebugStringW 21283->21285 21287 7fffe33d348a 21283->21287 21285->21286 21286->20995 21287->21285 21289->21263 21295 7fffe33ca3bc 21294->21295 21296 7fffe33ca3de 21295->21296 21298 7fffe33ca3f3 21295->21298 21297 7fffe33f4070 27 API calls 21296->21297 21299 7fffe33c3058 21297->21299 21300 7fffe33ca4c0 21298->21300 21304 7fffe33ca425 memcpy 21298->21304 21299->21013 21446 7fffe33fcfa3 27 API calls 21300->21446 21304->21299 21447 7fffe33f4230 21305->21447 21307 7fffe33c6986 21480 7fffe33fcfa3 27 API calls 21307->21480 21308 7fffe33c686e memcpy 21313 7fffe33c688f 21308->21313 21312 7fffe33c6826 21312->21307 21312->21308 21313->21018 21315 7fffe33c223a 21314->21315 21316 7fffe33c2850 21314->21316 21318 7fffe33c225d 21315->21318 21493 7fffe33fc4b0 27 API calls 21315->21493 21492 7fffe33fc2a0 WaitOnAddress GetLastError WakeByAddressAll 21316->21492 21320 7fffe33c28b8 21318->21320 21326 7fffe33c226a 21318->21326 21494 7fffe33fd3f0 27 API calls 21320->21494 21321 7fffe33c242b 21323 7fffe33f4070 27 API calls 21321->21323 21325 7fffe33c2485 memset 21323->21325 21327 7fffe33c26da OutputDebugStringW 21325->21327 21328 7fffe33c24cb 21325->21328 21326->21321 21330 7fffe33c24f0 21326->21330 21333 7fffe33c26f0 21327->21333 21328->21327 21331 7fffe33f4070 27 API calls 21330->21331 21334 7fffe33c25e7 memset 21331->21334 21338 7fffe33c283e 21333->21338 21495 7fffe33fc7c0 30 API calls 21333->21495 21335 7fffe33c279a OutputDebugStringW 21334->21335 21343 7fffe33c262d 21334->21343 21339 7fffe33c27b0 21335->21339 21337 7fffe33c28fb 21496 7fffe33fcfa3 27 API calls 21337->21496 21338->21094 21344 7fffe33d39d0 21338->21344 21339->21337 21340 7fffe33c27fe memcpy 21339->21340 21340->21333 21343->21335 21345 7fffe33f4070 27 API calls 21344->21345 21346 7fffe33d3b11 memset 21345->21346 21347 7fffe33d3bfa OutputDebugStringW 21346->21347 21349 7fffe33d3b4c 21346->21349 21348 7fffe33d3c1d 21347->21348 21350 7fffe33d3c47 21348->21350 21352 7fffe33d3d3f 21348->21352 21349->21347 21351 7fffe33f4070 27 API calls 21350->21351 21353 7fffe33d3cdc memset 21351->21353 21388 7fffe33d3d5e 21352->21388 21505 7fffe33fcfa3 27 API calls 21352->21505 21355 7fffe33d3e2a OutputDebugStringW 21353->21355 21361 7fffe33d3d1e 21353->21361 21358 7fffe33d3e46 21355->21358 21356 7fffe33d452f 21506 7fffe33fcfa3 27 API calls 21356->21506 21357 7fffe33d3e6b 21366 7fffe33d3e86 21357->21366 21504 7fffe33fd262 27 API calls 21357->21504 21358->21357 21503 7fffe33fd262 27 API calls 21358->21503 21361->21355 21364 7fffe33d3ea9 21502 7fffe33de410 29 API calls 21364->21502 21366->21364 21368 7fffe33d3f33 21366->21368 21367 7fffe33d3eb5 21369 7fffe33d3f7e memcpy 21367->21369 21370 7fffe33d3f51 memcpy memcpy 21368->21370 21369->21356 21373 7fffe33d3fb0 21369->21373 21370->21369 21371 7fffe33d3fdc memcpy memcpy 21374 7fffe33d4029 21371->21374 21375 7fffe33d40b2 21371->21375 21373->21356 21373->21371 21497 7fffe33d7ed0 21374->21497 21377 7fffe33f4070 27 API calls 21375->21377 21378 7fffe33d4121 memset 21377->21378 21379 7fffe33d421a OutputDebugStringW 21378->21379 21381 7fffe33d4163 21378->21381 21383 7fffe33d4236 21379->21383 21380 7fffe33d4069 21380->21375 21382 7fffe33d430a 21380->21382 21381->21379 21384 7fffe33f4070 27 API calls 21382->21384 21383->21388 21507 7fffe33fd3f0 27 API calls 21383->21507 21386 7fffe33d43d4 memset 21384->21386 21387 7fffe33d44ca OutputDebugStringW 21386->21387 21389 7fffe33d4416 21386->21389 21387->21388 21388->21028 21389->21387 21391 7fffe33c73c1 21390->21391 21392 7fffe33c7b7e 21390->21392 21397 7fffe33c73d7 21391->21397 21509 7fffe33fc1d0 WaitOnAddress GetLastError 21391->21509 21510 7fffe33fc2a0 WaitOnAddress GetLastError WakeByAddressAll 21392->21510 21395 7fffe33c7bda 21511 7fffe33fd3f0 27 API calls 21395->21511 21396 7fffe33c75cb 21399 7fffe33f4070 27 API calls 21396->21399 21397->21395 21400 7fffe33c73fc 21397->21400 21401 7fffe33c7625 memset 21399->21401 21400->21396 21402 7fffe33c7690 21400->21402 21403 7fffe33c781a OutputDebugStringW 21401->21403 21409 7fffe33c766b 21401->21409 21406 7fffe33f4070 27 API calls 21402->21406 21410 7fffe33c7830 21403->21410 21405 7fffe33c3a8e 21405->21042 21405->21043 21407 7fffe33c771c memset 21406->21407 21408 7fffe33c7afa OutputDebugStringW 21407->21408 21413 7fffe33c7769 21407->21413 21411 7fffe33c7a5d 21408->21411 21409->21403 21410->21411 21412 7fffe33f4070 27 API calls 21410->21412 21415 7fffe33c7a2a OutputDebugStringW 21410->21415 21411->21405 21512 7fffe33fc290 WakeByAddressSingle 21411->21512 21414 7fffe33c7951 memset 21412->21414 21413->21408 21414->21410 21414->21415 21415->21410 21418 7fffe33d767c 21416->21418 21417 7fffe33d7a1c 21514 7fffe33fcfa3 27 API calls 21417->21514 21418->21417 21421 7fffe33d7819 21418->21421 21422 7fffe33c3cb4 GetModuleHandleW 21418->21422 21421->21422 21513 7fffe33fb8c0 27 API calls 21421->21513 21422->21070 21422->21071 21425 7fffe33c4e01 memset 21424->21425 21426 7fffe33c4d63 21424->21426 21427 7fffe33c51fc OutputDebugStringW 21425->21427 21428 7fffe33c4e4f 21426->21428 21429 7fffe33c4d8f memset 21426->21429 21442 7fffe33c520a 21427->21442 21430 7fffe33f4070 27 API calls 21428->21430 21429->21427 21431 7fffe33c4edd memset 21430->21431 21432 7fffe33c4fca OutputDebugStringW 21431->21432 21434 7fffe33c4f15 21431->21434 21436 7fffe33c4fec 21432->21436 21433 7fffe33c5198 memset 21433->21427 21434->21432 21435 7fffe33c503c strlen 21435->21436 21436->21433 21436->21435 21437 7fffe33c5094 memcmp 21436->21437 21437->21436 21438 7fffe33c50a5 21437->21438 21439 7fffe33f4070 27 API calls 21438->21439 21440 7fffe33c513b memset 21439->21440 21441 7fffe33c52ba OutputDebugStringW 21440->21441 21443 7fffe33c5173 21440->21443 21441->21442 21442->21079 21443->21441 21444->21070 21445->21064 21448 7fffe33f4d99 21447->21448 21450 7fffe33f425f 21447->21450 21490 7fffe33fcfa3 27 API calls 21448->21490 21450->21448 21456 7fffe33f428e 21450->21456 21454 7fffe33f449c 21489 7fffe33fd4f0 27 API calls 21454->21489 21456->21454 21459 7fffe33f4ad1 memcpy 21456->21459 21460 7fffe33f4888 memcpy 21456->21460 21461 7fffe33f4cb1 21456->21461 21462 7fffe33f4d14 21456->21462 21465 7fffe33f4cc0 21456->21465 21466 7fffe33f4980 memcpy 21456->21466 21467 7fffe33f4d2c 21456->21467 21468 7fffe33f43cf memcpy 21456->21468 21469 7fffe33f3fc0 27 API calls 21456->21469 21472 7fffe33f4cdc 21456->21472 21473 7fffe33f4a20 memcpy 21456->21473 21474 7fffe33f4d44 21456->21474 21476 7fffe33f4cf4 21456->21476 21477 7fffe33f480d 21456->21477 21478 7fffe33f9800 27 API calls 21456->21478 21479 7fffe33f9980 27 API calls 21456->21479 21481 7fffe33f9c80 27 API calls 21456->21481 21482 7fffe33fcf00 27 API calls 21456->21482 21459->21456 21460->21456 21483 7fffe33fcf00 27 API calls 21461->21483 21487 7fffe33fcf00 27 API calls 21462->21487 21484 7fffe33fcf00 27 API calls 21465->21484 21466->21456 21488 7fffe33fcf00 27 API calls 21467->21488 21468->21456 21469->21456 21485 7fffe33fcf00 27 API calls 21472->21485 21473->21456 21474->21312 21486 7fffe33fcf00 27 API calls 21476->21486 21491 7fffe33fd4f0 27 API calls 21477->21491 21478->21456 21479->21456 21481->21456 21482->21456 21483->21465 21484->21472 21485->21476 21486->21462 21487->21467 21488->21474 21492->21315 21493->21318 21495->21338 21498 7fffe33d7f2f 21497->21498 21501 7fffe33d7f04 21497->21501 21499 7fffe33d7fa5 21498->21499 21508 7fffe33ded60 27 API calls 21498->21508 21499->21380 21501->21380 21501->21501 21502->21367 21508->21498 21509->21392 21510->21397 21513->21421 21516 7fffe33f4070 27 API calls 21515->21516 21517 7fffe33c53eb memset 21516->21517 21518 7fffe33c54da OutputDebugStringW 21517->21518 21521 7fffe33c5426 21517->21521 21519 7fffe33c54fd 21518->21519 21520 7fffe33c21f0 38 API calls 21519->21520 21522 7fffe33c551d 21520->21522 21521->21518 21523 7fffe33d39d0 42 API calls 21522->21523 21574 7fffe33c552c 21522->21574 21524 7fffe33c5574 21523->21524 21525 7fffe33c5581 21524->21525 21530 7fffe33c565f 21524->21530 21526 7fffe33f4070 27 API calls 21525->21526 21527 7fffe33c55fa memset 21526->21527 21528 7fffe33c583a OutputDebugStringW 21527->21528 21529 7fffe33c563a 21527->21529 21528->21574 21529->21528 21531 7fffe33f4070 27 API calls 21530->21531 21532 7fffe33c5745 memset 21531->21532 21533 7fffe33c595a OutputDebugStringW 21532->21533 21536 7fffe33c577e 21532->21536 21534 7fffe33c5976 21533->21534 21535 7fffe33f4070 27 API calls 21534->21535 21537 7fffe33c5a33 21535->21537 21536->21533 21538 7fffe33f4230 32 API calls 21537->21538 21539 7fffe33c5a57 21538->21539 21540 7fffe33f4070 27 API calls 21539->21540 21541 7fffe33c5ac9 memset 21540->21541 21542 7fffe33c5bba OutputDebugStringW 21541->21542 21545 7fffe33c5b05 21541->21545 21543 7fffe33c5bd6 21542->21543 21544 7fffe33c6800 33 API calls 21543->21544 21546 7fffe33c5bfa 21544->21546 21545->21542 21547 7fffe33f4070 27 API calls 21546->21547 21548 7fffe33c5c73 memset 21547->21548 21549 7fffe33c5d5a OutputDebugStringW 21548->21549 21552 7fffe33c5cac 21548->21552 21550 7fffe33c5d76 21549->21550 21551 7fffe33c7370 37 API calls 21550->21551 21553 7fffe33c5d92 21551->21553 21552->21549 21554 7fffe33c5d9c 21553->21554 21555 7fffe33c5e71 memset OutputDebugStringW GetModuleHandleA 21553->21555 21557 7fffe33f4070 27 API calls 21554->21557 21556 7fffe33c5f6a 21555->21556 21562 7fffe33c5f2b 21555->21562 21710 7fffe33d9f20 GetLastError 21556->21710 21558 7fffe33c5e13 memset 21557->21558 21560 7fffe33c603a OutputDebugStringW 21558->21560 21566 7fffe33c5e4c 21558->21566 21560->21562 21561 7fffe33c4d40 37 API calls 21563 7fffe33c6081 21561->21563 21562->21561 21562->21574 21564 7fffe33c619b 21563->21564 21565 7fffe33c608b 21563->21565 21567 7fffe33f4070 27 API calls 21564->21567 21569 7fffe33c60a1 VirtualQuery 21565->21569 21566->21560 21568 7fffe33c61ef memset 21567->21568 21570 7fffe33c644a OutputDebugStringW 21568->21570 21579 7fffe33c622f 21568->21579 21571 7fffe33c60c0 21569->21571 21572 7fffe33c6254 21569->21572 21570->21574 21571->21572 21573 7fffe33c60cd 21571->21573 21575 7fffe33f4070 27 API calls 21572->21575 21576 7fffe33f4070 27 API calls 21573->21576 21574->21146 21577 7fffe33c62b6 memset 21575->21577 21578 7fffe33c613d memset 21576->21578 21577->21570 21577->21579 21580 7fffe33c656a OutputDebugStringW 21578->21580 21581 7fffe33c6176 21578->21581 21579->21570 21580->21574 21581->21580 21583 7fffe33d5dde 21582->21583 21584 7fffe33d6035 21583->21584 21591 7fffe33d5e19 21583->21591 21713 7fffe33fb8c0 27 API calls 21584->21713 21586 7fffe33d604f 21586->21586 21587 7fffe33d6011 21587->21223 21589 7fffe33d5f95 memcpy 21589->21591 21591->21587 21591->21589 21711 7fffe33f3fc0 27 API calls 21591->21711 21712 7fffe33fb8c0 27 API calls 21591->21712 21593 7fffe33d4a8a OutputDebugStringW 21592->21593 21594 7fffe33d49ea 21592->21594 21593->21177 21594->21593 21714 7fffe33e9dc0 21595->21714 21597 7fffe33e4126 21598 7fffe33ce528 21597->21598 21727 7fffe33ea050 GetFileInformationByHandle 21597->21727 21598->21187 21598->21188 21600 7fffe33e414e 21603 7fffe33e41fa 21600->21603 21732 7fffe33e53b0 21600->21732 21601 7fffe33e426e CloseHandle 21601->21598 21603->21601 21605 7fffe33d063c 21604->21605 21606 7fffe33d0594 memset OutputDebugStringW 21604->21606 21607 7fffe33d0833 memset OutputDebugStringW 21605->21607 21608 7fffe33d0645 21605->21608 21606->21205 21611 7fffe33d0888 21607->21611 21820 7fffe33ea160 21608->21820 21610 7fffe33d066d 21610->21611 21612 7fffe33d067f 21610->21612 21614 7fffe33f4070 27 API calls 21611->21614 21613 7fffe33d06f2 memset OutputDebugStringW 21612->21613 21617 7fffe33d06d2 21612->21617 21860 7fffe33e4390 44 API calls 21613->21860 21618 7fffe33d08e7 memset 21614->21618 21616 7fffe33d0771 21619 7fffe33d077a 21616->21619 21620 7fffe33d0940 memset OutputDebugStringW 21616->21620 21617->21613 21621 7fffe33d0a1a OutputDebugStringW 21618->21621 21626 7fffe33d091f 21618->21626 21623 7fffe33f4070 27 API calls 21619->21623 21622 7fffe33d0a37 21620->21622 21621->21622 21625 7fffe33c29d0 44 API calls 21622->21625 21624 7fffe33d07d8 memset 21623->21624 21627 7fffe33d0c2a OutputDebugStringW 21624->21627 21630 7fffe33d080e 21624->21630 21628 7fffe33d0a7b 21625->21628 21626->21621 21636 7fffe33d0c40 21627->21636 21629 7fffe33c2de0 108 API calls 21628->21629 21631 7fffe33d0aa1 21629->21631 21630->21627 21647 7fffe33d0b7e 21630->21647 21632 7fffe33c29d0 44 API calls 21631->21632 21634 7fffe33d0ae6 21632->21634 21633 7fffe33d0cdc 21635 7fffe33c29d0 44 API calls 21633->21635 21637 7fffe33c2de0 108 API calls 21634->21637 21638 7fffe33d0d04 21635->21638 21636->21633 21639 7fffe33d0b0c 21637->21639 21640 7fffe33c2de0 108 API calls 21638->21640 21643 7fffe33c29d0 44 API calls 21639->21643 21641 7fffe33d0d2a memset OutputDebugStringW memset OutputDebugStringW 21640->21641 21645 7fffe33d0e31 21641->21645 21644 7fffe33d0b58 21643->21644 21646 7fffe33c2de0 108 API calls 21644->21646 21649 7fffe33d49b0 2 API calls 21645->21649 21686 7fffe33d11e4 21645->21686 21646->21647 21647->21630 21647->21633 21648 7fffe33d49b0 2 API calls 21650 7fffe33d1224 21648->21650 21651 7fffe33d0e4e WriteProcessMemory 21649->21651 21656 7fffe33d49b0 2 API calls 21650->21656 21651->21650 21652 7fffe33d0e80 21651->21652 21653 7fffe33f4070 27 API calls 21652->21653 21654 7fffe33d0ee1 21653->21654 21655 7fffe33d49b0 2 API calls 21654->21655 21657 7fffe33d0efb 21655->21657 21662 7fffe33d1260 21656->21662 21658 7fffe33d49b0 2 API calls 21657->21658 21659 7fffe33d0f2a 21658->21659 21825 7fffe33d16e0 memset OutputDebugStringW GetProcessId 21659->21825 21661 7fffe33d0f32 21661->21662 21664 7fffe33f4070 27 API calls 21661->21664 21663 7fffe33f4070 27 API calls 21662->21663 21665 7fffe33d12df 21663->21665 21666 7fffe33d0f95 21664->21666 21667 7fffe33d49b0 2 API calls 21665->21667 21668 7fffe33d49b0 2 API calls 21666->21668 21669 7fffe33d12f9 21667->21669 21670 7fffe33d0faf 21668->21670 21672 7fffe33d49b0 2 API calls 21669->21672 21671 7fffe33c4d40 37 API calls 21670->21671 21673 7fffe33d0fe6 21671->21673 21674 7fffe33d1328 21672->21674 21673->21662 21675 7fffe33f4070 27 API calls 21673->21675 21676 7fffe33d104c 21675->21676 21677 7fffe33d49b0 2 API calls 21676->21677 21678 7fffe33d1066 21677->21678 21679 7fffe33d49b0 2 API calls 21678->21679 21680 7fffe33d109c 21679->21680 21681 7fffe33d10a1 CreateRemoteThread 21680->21681 21681->21662 21682 7fffe33d10ec GetLastError 21681->21682 21683 7fffe33f4070 27 API calls 21682->21683 21684 7fffe33d11ca 21683->21684 21685 7fffe33d49b0 2 API calls 21684->21685 21685->21686 21686->21648 21687->21223 21689->21212 21690->21212 21691->21207 21710->21562 21711->21591 21712->21591 21713->21586 21744 7fffe33eb570 21714->21744 21716 7fffe33e9de9 21721 7fffe33e9df9 21716->21721 21752 7fffe33ebc40 21716->21752 21718 7fffe33e9f00 CreateFileW 21719 7fffe33e9fe7 GetLastError 21718->21719 21720 7fffe33e9f3f 21718->21720 21719->21721 21720->21721 21723 7fffe33e9f4e GetLastError 21720->21723 21721->21597 21722 7fffe33e9e23 21722->21718 21722->21721 21723->21721 21724 7fffe33e9f5b SetFileInformationByHandle 21723->21724 21724->21721 21725 7fffe33ea004 GetLastError CloseHandle 21724->21725 21726 7fffe33ea023 21725->21726 21726->21721 21728 7fffe33ea08d 21727->21728 21729 7fffe33ea134 GetLastError 21727->21729 21730 7fffe33ea09a GetFileInformationByHandleEx 21728->21730 21731 7fffe33ea0be 21728->21731 21729->21731 21730->21729 21730->21731 21731->21600 21733 7fffe33e53eb 21732->21733 21734 7fffe33e5750 31 API calls 21733->21734 21738 7fffe33e543f 21733->21738 21734->21738 21736 7fffe33e5532 NtReadFile 21737 7fffe33e5564 WaitForSingleObject 21736->21737 21736->21738 21737->21738 21738->21736 21739 7fffe33e56f2 21738->21739 21741 7fffe33e56a2 RtlNtStatusToDosError 21738->21741 21743 7fffe33e544b 21738->21743 21793 7fffe33e5750 21738->21793 21804 7fffe33e5e00 27 API calls 21739->21804 21741->21743 21742 7fffe33e572c 21743->21603 21747 7fffe33eb59b 21744->21747 21746 7fffe33eb5e9 21779 7fffe33e3560 21746->21779 21747->21746 21783 7fffe33fcfa3 27 API calls 21747->21783 21751 7fffe33eb6a1 21751->21716 21763 7fffe33ebc74 21752->21763 21753 7fffe33ebde8 SetLastError GetFullPathNameW 21754 7fffe33ebe13 GetLastError 21753->21754 21753->21763 21755 7fffe33ebeea GetLastError 21754->21755 21754->21763 21770 7fffe33ebcbb 21755->21770 21756 7fffe33ebe2d GetLastError 21758 7fffe33ec27e 21756->21758 21756->21763 21790 7fffe33fd160 27 API calls 21758->21790 21759 7fffe33ec26a 21789 7fffe33fd490 27 API calls 21759->21789 21762 7fffe33ec010 21764 7fffe33ec033 memcpy 21762->21764 21788 7fffe33fbf80 27 API calls 21762->21788 21763->21753 21763->21756 21763->21759 21766 7fffe33ebeca 21763->21766 21768 7fffe33ec015 21763->21768 21763->21770 21786 7fffe33fbf80 27 API calls 21763->21786 21769 7fffe33ec057 21764->21769 21764->21770 21772 7fffe33ebfee memcpy 21766->21772 21776 7fffe33ec13d 21766->21776 21768->21762 21774 7fffe33ec2b4 21768->21774 21787 7fffe33e33c0 27 API calls 21769->21787 21770->21722 21771 7fffe33ec25e 21771->21764 21772->21762 21772->21764 21792 7fffe33fcfa3 27 API calls 21774->21792 21776->21768 21777 7fffe33ec298 21776->21777 21791 7fffe33fcfa3 27 API calls 21777->21791 21781 7fffe33e3589 21779->21781 21780 7fffe33e36e3 21780->21751 21784 7fffe33e33c0 27 API calls 21780->21784 21781->21780 21785 7fffe33fbf80 27 API calls 21781->21785 21784->21751 21785->21780 21786->21763 21787->21770 21788->21771 21805 7fffe33ea610 21793->21805 21795 7fffe33e5787 21796 7fffe33e5852 21795->21796 21800 7fffe33e5850 21795->21800 21803 7fffe33ea610 30 API calls 21795->21803 21797 7fffe33e5858 21796->21797 21808 7fffe33fd490 27 API calls 21796->21808 21798 7fffe33e586d memcpy 21797->21798 21809 7fffe33fbf80 27 API calls 21797->21809 21798->21800 21800->21738 21802 7fffe33e58c9 21802->21798 21803->21795 21804->21742 21810 7fffe33ea7a0 NtReadFile 21805->21810 21809->21802 21811 7fffe33ea81e WaitForSingleObject 21810->21811 21812 7fffe33ea82f 21810->21812 21811->21812 21813 7fffe33ea634 21812->21813 21814 7fffe33ea843 21812->21814 21815 7fffe33ea870 21812->21815 21813->21795 21814->21813 21816 7fffe33ea84f RtlNtStatusToDosError 21814->21816 21819 7fffe33e5e00 27 API calls 21815->21819 21816->21813 21818 7fffe33ea8aa 21819->21818 21861 7fffe33ea380 21820->21861 21822 7fffe33ea192 21823 7fffe33ea380 47 API calls 21822->21823 21824 7fffe33ea1d8 21822->21824 21823->21824 21824->21610 21826 7fffe33d188d memset 21825->21826 21827 7fffe33d17c7 CreateToolhelp32Snapshot 21825->21827 21830 7fffe33d18ea OutputDebugStringW 21826->21830 21828 7fffe33d17e4 21827->21828 21829 7fffe33d18f5 21827->21829 21880 7fffe33d9f20 GetLastError 21828->21880 21875 7fffe33d9e00 memset 21829->21875 21832 7fffe33d187d 21830->21832 21832->21661 21833 7fffe33d17e9 21833->21829 21835 7fffe33d1801 memset OutputDebugStringW 21833->21835 21835->21832 21836 7fffe33d1912 Module32FirstW 21837 7fffe33d1e26 21836->21837 21849 7fffe33d192d 21836->21849 21882 7fffe33d9f20 GetLastError 21837->21882 21840 7fffe33d1e2b 21841 7fffe33d1e40 21840->21841 21840->21849 21843 7fffe33d1e51 memset 21841->21843 21842 7fffe33d199b memset OutputDebugStringW 21844 7fffe33d1c28 Module32NextW 21842->21844 21843->21830 21844->21849 21845 7fffe33f4070 27 API calls 21846 7fffe33d1a79 memset 21845->21846 21847 7fffe33d1b6a OutputDebugStringW 21846->21847 21846->21849 21847->21849 21849->21842 21849->21844 21849->21845 21849->21847 21850 7fffe33d1c56 21849->21850 21852 7fffe33d1d3a 21849->21852 21876 7fffe33d9e30 21849->21876 21881 7fffe33d9f20 GetLastError 21849->21881 21851 7fffe33f4070 27 API calls 21850->21851 21853 7fffe33d1cd3 memset 21851->21853 21854 7fffe33f4070 27 API calls 21852->21854 21855 7fffe33d20aa OutputDebugStringW 21853->21855 21858 7fffe33d1d15 21853->21858 21856 7fffe33d1dbf memset 21854->21856 21855->21832 21857 7fffe33d1f7a OutputDebugStringW 21856->21857 21859 7fffe33d1e01 21856->21859 21857->21832 21858->21855 21859->21857 21860->21616 21862 7fffe33e9dc0 40 API calls 21861->21862 21863 7fffe33ea40b 21862->21863 21864 7fffe33ea4b9 21863->21864 21865 7fffe33ea417 21863->21865 21866 7fffe33ea050 3 API calls 21864->21866 21867 7fffe33ea49f 21865->21867 21869 7fffe33eb570 27 API calls 21865->21869 21868 7fffe33ea4c4 CloseHandle 21866->21868 21867->21822 21868->21867 21870 7fffe33ea44d 21869->21870 21870->21867 21871 7fffe33ebc40 34 API calls 21870->21871 21872 7fffe33ea489 21871->21872 21872->21867 21873 7fffe33ea4e0 memset FindFirstFileExW 21872->21873 21873->21867 21874 7fffe33ea51f FindClose 21873->21874 21874->21867 21875->21836 21877 7fffe33d9e44 21876->21877 21883 7fffe33f4e20 21877->21883 21879 7fffe33d9e52 21879->21849 21880->21833 21881->21849 21882->21840 21884 7fffe33f50a0 21883->21884 21887 7fffe33f4e49 21883->21887 21895 7fffe33fcfa3 27 API calls 21884->21895 21885 7fffe33f4e74 21889 7fffe33f5034 21885->21889 21891 7fffe33f5014 memcpy 21885->21891 21893 7fffe33f3fc0 27 API calls 21885->21893 21894 7fffe33fcf00 27 API calls 21885->21894 21887->21884 21887->21885 21889->21879 21891->21885 21891->21889 21893->21885 21894->21885 21897 7fffe33f6039 21896->21897 21898 7fffe33f4185 21896->21898 21897->21898 21902 7fffe33da330 21897->21902 21898->20988 21900 7fffe33fd3f0 27 API calls 21898->21900 21912 7fffe33d9f50 21902->21912 21905 7fffe33da368 21908 7fffe33d9f50 27 API calls 21905->21908 21906 7fffe33da425 21907 7fffe33f5ef0 27 API calls 21906->21907 21911 7fffe33da3e5 21907->21911 21909 7fffe33da377 21908->21909 21910 7fffe33f5ef0 27 API calls 21909->21910 21910->21911 21911->21897 21916 7fffe33d9f81 21912->21916 21933 7fffe33da134 21912->21933 21914 7fffe33da04a SysStringLen 21915 7fffe33da054 21914->21915 21917 7fffe33da081 SysStringLen 21915->21917 21924 7fffe33da063 21915->21924 21918 7fffe33d9ff7 21916->21918 21919 7fffe33d9ff1 SysFreeString 21916->21919 21925 7fffe33da01b 21916->21925 21921 7fffe33da08e SysStringLen 21917->21921 21917->21924 21920 7fffe33da000 SysStringLen 21918->21920 21918->21925 21919->21918 21922 7fffe33da00a 21920->21922 21923 7fffe33da021 21920->21923 21921->21924 21922->21925 21926 7fffe33da013 SysFreeString 21922->21926 21923->21925 21927 7fffe33da02e SysFreeString 21923->21927 21928 7fffe33da0f7 21924->21928 21947 7fffe33fb9c0 27 API calls 21924->21947 21925->21914 21925->21915 21926->21925 21927->21925 21946 7fffe33da870 27 API calls 21928->21946 21931 7fffe33da116 21932 7fffe33da12e SysFreeString 21931->21932 21931->21933 21932->21933 21934 7fffe33da151 21933->21934 21935 7fffe33da590 21933->21935 21934->21905 21934->21906 21936 7fffe33da5ba 21935->21936 21937 7fffe33da5c3 LoadLibraryExA 21935->21937 21938 7fffe33da5e6 FormatMessageW 21936->21938 21937->21938 21940 7fffe33da61f 21938->21940 21944 7fffe33da649 21938->21944 21939 7fffe33da665 GetProcessHeap HeapFree 21945 7fffe33da679 21939->21945 21941 7fffe33da6b1 21940->21941 21949 7fffe33fb9c0 27 API calls 21940->21949 21948 7fffe33da870 27 API calls 21941->21948 21944->21939 21944->21945 21945->21934 21946->21931 21947->21928 21948->21944 21949->21941 21950 7fffe33d6610 memset 21951 7fffe33d6662 21950->21951 21955 7fffe33c1350 21951->21955 21953 7fffe33d667b 21954 7fffe33c1350 57 API calls 21953->21954 21954->21953 21956 7fffe33c1f98 21955->21956 21957 7fffe33c13b7 21955->21957 21984 7fffe33fc2a0 WaitOnAddress GetLastError WakeByAddressAll 21956->21984 21958 7fffe33c1f84 21957->21958 21963 7fffe33c13cf 21957->21963 21982 7fffe33fc690 WaitOnAddress GetLastError 21958->21982 21961 7fffe33c1f19 21967 7fffe33c1f69 21961->21967 21983 7fffe33fc7c0 30 API calls 21961->21983 21962 7fffe33c1fee 21985 7fffe33fd3f0 27 API calls 21962->21985 21963->21962 21977 7fffe33c13f3 21963->21977 21967->21953 21968 7fffe33c20ce 21968->21953 21969 7fffe33d2e40 42 API calls 21969->21977 21970 7fffe33c203b 21986 7fffe33fd3f0 27 API calls 21970->21986 21973 7fffe33c201d 21987 7fffe33d5d30 30 API calls 21973->21987 21974 7fffe33f4070 27 API calls 21975 7fffe33c1e0a memset 21974->21975 21976 7fffe33c1eea OutputDebugStringW 21975->21976 21975->21977 21976->21977 21977->21961 21977->21969 21977->21970 21977->21973 21977->21974 21977->21976 21978 7fffe33d99e0 21977->21978 21979 7fffe33d9c91 21978->21979 21981 7fffe33d9a18 21978->21981 21988 7fffe33fafb0 29 API calls 21979->21988 21981->21977 21982->21961 21983->21967 21984->21963 21987->21968 21988->21981 21989 7fffe33d63c0 memset 21990 7fffe33d63f1 21989->21990 22000 7fffe33d4d50 21990->22000 21992 7fffe33d640a 21998 7fffe33d647b memset 21992->21998 22030 7fffe33e3740 21992->22030 22040 7fffe33d8630 21992->22040 21995 7fffe33d67e8 memset OutputDebugStringW 21997 7fffe33d6873 21995->21997 21996 7fffe33d6435 memset OutputDebugStringW 21996->21992 21998->21992 22014 7fffe33d4da0 22000->22014 22001 7fffe33d589a 22001->21992 22002 7fffe33d58b5 22079 7fffe33fd060 27 API calls 22002->22079 22004 7fffe33d58cd 22080 7fffe33fd060 27 API calls 22004->22080 22005 7fffe33c29d0 44 API calls 22005->22014 22007 7fffe33d58e5 22081 7fffe33fd060 27 API calls 22007->22081 22009 7fffe33d58fd 22082 7fffe33fd060 27 API calls 22009->22082 22012 7fffe33c5300 98 API calls 22012->22014 22013 7fffe33d7650 27 API calls 22013->22014 22014->22001 22014->22002 22014->22004 22014->22005 22014->22007 22014->22009 22014->22012 22014->22013 22015 7fffe33d5051 NtCreateKey 22014->22015 22016 7fffe33d7650 27 API calls 22014->22016 22017 7fffe33f4070 27 API calls 22014->22017 22020 7fffe33f4070 27 API calls 22014->22020 22023 7fffe33d5740 OutputDebugStringW 22014->22023 22028 7fffe33d5810 OutputDebugStringW 22014->22028 22029 7fffe33d583b NtClose 22014->22029 22015->22014 22018 7fffe33d520c NtSetValueKey 22016->22018 22019 7fffe33d543d memset 22017->22019 22021 7fffe33d528f 22018->22021 22019->22014 22019->22023 22024 7fffe33d514e memset 22020->22024 22022 7fffe33f4070 27 API calls 22021->22022 22025 7fffe33f4070 27 API calls 22021->22025 22026 7fffe33d532c memset 22022->22026 22023->22014 22024->22014 22024->22023 22027 7fffe33d552b memset 22025->22027 22026->22014 22026->22028 22027->22014 22027->22028 22028->22014 22028->22029 22029->22014 22031 7fffe33e376c CreateWaitableTimerExW 22030->22031 22035 7fffe33e37f7 22030->22035 22031->22035 22037 7fffe33e3787 22031->22037 22032 7fffe33e3844 Sleep 22033 7fffe33d6418 MessageBoxW 22032->22033 22033->21995 22033->21996 22034 7fffe33e37f9 CloseHandle 22034->22035 22035->22032 22036 7fffe33e3838 22035->22036 22036->22032 22037->22034 22038 7fffe33e37a9 SetWaitableTimer 22037->22038 22038->22034 22039 7fffe33e37d7 WaitForSingleObject CloseHandle 22038->22039 22039->22033 22039->22035 22078 7fffe33d8680 22040->22078 22041 7fffe33d92b8 22041->21992 22042 7fffe33d86b4 LsaOpenPolicy 22042->22078 22043 7fffe33d8705 GetCurrentProcess OpenProcessToken 22043->22078 22044 7fffe33d9f20 GetLastError 22044->22078 22045 7fffe33da1e0 GetErrorInfo 22045->22078 22046 7fffe33d874e GetTokenInformation 22046->22078 22047 7fffe33d92d3 22092 7fffe33fcfa3 27 API calls 22047->22092 22048 7fffe33d88b5 LsaClose 22048->22078 22049 7fffe33f4070 27 API calls 22052 7fffe33d89e0 memset 22049->22052 22051 7fffe33d7650 27 API calls 22056 7fffe33d87d2 LsaAddAccountRights LsaClose 22051->22056 22057 7fffe33d8aba OutputDebugStringW 22052->22057 22052->22078 22054 7fffe33f4070 27 API calls 22055 7fffe33d8b99 memset 22054->22055 22058 7fffe33d8c7a OutputDebugStringW 22055->22058 22075 7fffe33d8bd7 22055->22075 22056->22078 22057->22078 22058->22075 22059 7fffe33da520 28 API calls 22059->22078 22060 7fffe33d8908 LsaClose 22091 7fffe33da520 28 API calls 22060->22091 22062 7fffe33d8cb3 GetCurrentProcess OpenProcessToken 22062->22075 22063 7fffe33d9f20 GetLastError 22063->22075 22065 7fffe33d8d20 LookupPrivilegeValueW 22067 7fffe33d8d4d AdjustTokenPrivileges 22065->22067 22065->22075 22066 7fffe33f4070 27 API calls 22068 7fffe33d9019 memset 22066->22068 22069 7fffe33d8d96 GetLastError 22067->22069 22067->22075 22070 7fffe33d91ba OutputDebugStringW 22068->22070 22068->22078 22069->22075 22070->22078 22071 7fffe33f4070 27 API calls 22073 7fffe33d8e03 memset 22071->22073 22072 7fffe33f4070 27 API calls 22076 7fffe33d90d5 memset 22072->22076 22074 7fffe33d8f3a OutputDebugStringW 22073->22074 22073->22075 22074->22075 22075->22058 22075->22062 22075->22063 22075->22065 22075->22066 22075->22069 22075->22071 22075->22072 22075->22074 22083 7fffe33d7a80 22075->22083 22077 7fffe33d928a OutputDebugStringW 22076->22077 22076->22078 22077->22078 22078->22041 22078->22042 22078->22043 22078->22044 22078->22045 22078->22046 22078->22047 22078->22048 22078->22049 22078->22051 22078->22054 22078->22057 22078->22059 22078->22060 22078->22070 22078->22077 22086 7fffe33d7aac 22083->22086 22084 7fffe33d7e62 22094 7fffe33fcfa3 27 API calls 22084->22094 22086->22084 22088 7fffe33d7c5d 22086->22088 22090 7fffe33d7b9c 22086->22090 22088->22090 22093 7fffe33fb8c0 27 API calls 22088->22093 22090->22075 22091->22078 22093->22088 22095 7fffe33d64d0 memset 22096 7fffe33d650a 22095->22096 22111 7fffe33c7ce0 memset OutputDebugStringW 22096->22111 22098 7fffe33d6523 22099 7fffe33d6538 22098->22099 22100 7fffe33d6680 memset 22098->22100 22101 7fffe33f4070 27 API calls 22099->22101 22103 7fffe33d640a 22100->22103 22102 7fffe33d65a1 memset 22101->22102 22102->22103 22104 7fffe33e3740 6 API calls 22103->22104 22109 7fffe33d647b memset 22103->22109 22110 7fffe33d8630 53 API calls 22103->22110 22105 7fffe33d6418 MessageBoxW 22104->22105 22106 7fffe33d67e8 memset OutputDebugStringW 22105->22106 22107 7fffe33d6435 memset OutputDebugStringW 22105->22107 22108 7fffe33d6873 22106->22108 22107->22103 22109->22103 22110->22103 22238 7fffe33d4890 22111->22238 22113 7fffe33c7d98 22114 7fffe33f4230 32 API calls 22113->22114 22115 7fffe33c7dd5 22114->22115 22116 7fffe33f4070 27 API calls 22115->22116 22117 7fffe33c7e46 memset 22116->22117 22118 7fffe33c7f2a OutputDebugStringW 22117->22118 22121 7fffe33c7e85 22117->22121 22119 7fffe33c7f40 22118->22119 22120 7fffe33c29d0 44 API calls 22119->22120 22122 7fffe33c7f72 22120->22122 22121->22118 22123 7fffe33c2de0 108 API calls 22122->22123 22124 7fffe33c7f98 22123->22124 22125 7fffe33c7fb3 22124->22125 22416 7fffe33d9f20 GetLastError 22124->22416 22126 7fffe33c29d0 44 API calls 22125->22126 22231 7fffe33c8437 22125->22231 22128 7fffe33c7fe2 22126->22128 22129 7fffe33c2de0 108 API calls 22128->22129 22130 7fffe33c8008 22129->22130 22131 7fffe33c8023 22130->22131 22417 7fffe33d9f20 GetLastError 22130->22417 22133 7fffe33c29d0 44 API calls 22131->22133 22131->22231 22134 7fffe33c8052 22133->22134 22135 7fffe33c2de0 108 API calls 22134->22135 22136 7fffe33c8078 22135->22136 22137 7fffe33c809c 22136->22137 22418 7fffe33d9f20 GetLastError 22136->22418 22139 7fffe33c29d0 44 API calls 22137->22139 22137->22231 22140 7fffe33c80cf 22139->22140 22141 7fffe33c5300 98 API calls 22140->22141 22142 7fffe33c80e4 22141->22142 22145 7fffe33c80fc 22142->22145 22419 7fffe33d9f20 GetLastError 22142->22419 22144 7fffe33c8117 memset OutputDebugStringW CreateToolhelp32Snapshot 22146 7fffe33c83c3 memset OutputDebugStringW 22144->22146 22147 7fffe33c8183 memset OutputDebugStringW 22144->22147 22145->22144 22145->22231 22420 7fffe33d9f20 GetLastError 22146->22420 22251 7fffe33d9e00 memset 22147->22251 22150 7fffe33c81e3 Module32FirstW 22151 7fffe33c81fb 22150->22151 22152 7fffe33c843c memset OutputDebugStringW 22150->22152 22153 7fffe33f4070 27 API calls 22151->22153 22154 7fffe33c84d5 22152->22154 22155 7fffe33c82ae 22153->22155 22421 7fffe33d9f20 GetLastError 22154->22421 22157 7fffe33f4230 32 API calls 22155->22157 22158 7fffe33c82d2 22157->22158 22159 7fffe33f4070 27 API calls 22158->22159 22160 7fffe33c835c memset 22159->22160 22161 7fffe33c839e 22160->22161 22162 7fffe33c857a OutputDebugStringW 22160->22162 22161->22162 22163 7fffe33c8596 22162->22163 22252 7fffe33ca4e0 22163->22252 22165 7fffe33c85d3 22166 7fffe33c85e7 22165->22166 22167 7fffe33c86d4 22165->22167 22168 7fffe33f4070 27 API calls 22166->22168 22169 7fffe33f4070 27 API calls 22167->22169 22170 7fffe33c866d memset 22168->22170 22171 7fffe33c8776 memset 22169->22171 22172 7fffe33c886a OutputDebugStringW 22170->22172 22177 7fffe33c86af 22170->22177 22173 7fffe33c894a OutputDebugStringW 22171->22173 22176 7fffe33c87b8 22171->22176 22172->22231 22174 7fffe33c8966 22173->22174 22384 7fffe33c69e0 22174->22384 22176->22173 22177->22172 22178 7fffe33c8989 22179 7fffe33f4070 27 API calls 22178->22179 22180 7fffe33c8a3c 22179->22180 22181 7fffe33f4230 32 API calls 22180->22181 22182 7fffe33c8a60 22181->22182 22183 7fffe33f4070 27 API calls 22182->22183 22184 7fffe33c8ae3 memset 22183->22184 22185 7fffe33c8bda OutputDebugStringW 22184->22185 22189 7fffe33c8b25 22184->22189 22186 7fffe33c8bf6 22185->22186 22187 7fffe33ca4e0 144 API calls 22186->22187 22188 7fffe33c8c33 22187->22188 22190 7fffe33c8d34 22188->22190 22191 7fffe33c8c40 22188->22191 22189->22185 22193 7fffe33f4070 27 API calls 22190->22193 22192 7fffe33f4070 27 API calls 22191->22192 22194 7fffe33c8cc6 memset 22192->22194 22195 7fffe33c8dd6 memset 22193->22195 22196 7fffe33c8eca OutputDebugStringW 22194->22196 22201 7fffe33c8d0f 22194->22201 22197 7fffe33c903a OutputDebugStringW 22195->22197 22202 7fffe33c8e18 22195->22202 22196->22231 22198 7fffe33c9059 22197->22198 22199 7fffe33c69e0 41 API calls 22198->22199 22200 7fffe33c907c memset OutputDebugStringW 22199->22200 22223 7fffe33c9120 22200->22223 22201->22196 22202->22197 22203 7fffe33d5d90 28 API calls 22203->22223 22204 7fffe33f4070 27 API calls 22205 7fffe33c921e memset 22204->22205 22206 7fffe33c925c 22205->22206 22207 7fffe33c930a OutputDebugStringW 22205->22207 22206->22207 22208 7fffe33ca380 28 API calls 22206->22208 22209 7fffe33f4230 32 API calls 22206->22209 22210 7fffe33f4070 27 API calls 22206->22210 22207->22206 22208->22206 22209->22206 22211 7fffe33c93f0 memset 22210->22211 22212 7fffe33c94da OutputDebugStringW 22211->22212 22216 7fffe33c942e 22211->22216 22212->22216 22213 7fffe33c951a memcmp 22213->22216 22214 7fffe33c953d memcmp 22215 7fffe33c9c90 Module32NextW 22214->22215 22214->22216 22219 7fffe33c9cea memset OutputDebugStringW 22215->22219 22215->22223 22216->22212 22216->22213 22216->22214 22217 7fffe33c9560 memcmp 22216->22217 22218 7fffe33f4070 27 API calls 22216->22218 22220 7fffe33f4070 27 API calls 22216->22220 22217->22215 22217->22216 22221 7fffe33c96ad memset 22218->22221 22225 7fffe33c9d58 22219->22225 22222 7fffe33c95e2 memset 22220->22222 22221->22223 22224 7fffe33c9c5a OutputDebugStringW 22221->22224 22226 7fffe33c979a OutputDebugStringW 22222->22226 22229 7fffe33c9620 22222->22229 22223->22203 22223->22204 22223->22215 22223->22224 22235 7fffe33c9b8a OutputDebugStringW 22223->22235 22236 7fffe33c9aaa OutputDebugStringW 22223->22236 22237 7fffe33c69e0 41 API calls 22223->22237 22224->22215 22224->22223 22227 7fffe33c9d98 memset OutputDebugStringW 22225->22227 22226->22229 22227->22231 22228 7fffe33ca4e0 144 API calls 22228->22229 22229->22226 22229->22228 22230 7fffe33f4070 27 API calls 22229->22230 22232 7fffe33f4070 27 API calls 22229->22232 22233 7fffe33c99bb memset 22230->22233 22231->22098 22234 7fffe33c98a1 memset 22232->22234 22233->22223 22233->22235 22234->22223 22234->22236 22235->22223 22236->22223 22237->22223 22239 7fffe33d48bd 22238->22239 22240 7fffe33d495d 22239->22240 22241 7fffe33d48c6 GetModuleFileNameW 22239->22241 22423 7fffe33fcfa3 27 API calls 22240->22423 22243 7fffe33d48de 22241->22243 22246 7fffe33d490a 22241->22246 22244 7fffe33d48eb 22243->22244 22245 7fffe33d494a 22243->22245 22248 7fffe33d5d90 28 API calls 22244->22248 22422 7fffe33fd490 27 API calls 22245->22422 22246->22113 22248->22246 22251->22150 22253 7fffe33f4070 27 API calls 22252->22253 22254 7fffe33ca58a memset 22253->22254 22255 7fffe33ca67a OutputDebugStringW 22254->22255 22259 7fffe33ca5c5 22254->22259 22256 7fffe33ca69d 22255->22256 22257 7fffe33f4070 27 API calls 22256->22257 22258 7fffe33ca714 22257->22258 22260 7fffe33f4070 27 API calls 22258->22260 22259->22255 22261 7fffe33ca791 memset 22260->22261 22262 7fffe33ca88a OutputDebugStringW 22261->22262 22266 7fffe33ca7d3 22261->22266 22263 7fffe33ca8bb 22262->22263 22264 7fffe33c29d0 44 API calls 22263->22264 22265 7fffe33ca8ed 22264->22265 22267 7fffe33c5300 98 API calls 22265->22267 22266->22262 22268 7fffe33ca902 22267->22268 22269 7fffe33caab0 22268->22269 22270 7fffe33f4070 27 API calls 22268->22270 22271 7fffe33c29d0 44 API calls 22269->22271 22336 7fffe33caab7 22269->22336 22272 7fffe33ca988 memset 22270->22272 22273 7fffe33caae8 22271->22273 22274 7fffe33caa7a OutputDebugStringW 22272->22274 22281 7fffe33ca9c3 22272->22281 22275 7fffe33c5300 98 API calls 22273->22275 22276 7fffe33caa9d 22274->22276 22277 7fffe33caafd 22275->22277 22432 7fffe33d9f20 GetLastError 22276->22432 22279 7fffe33cacb0 22277->22279 22280 7fffe33f4070 27 API calls 22277->22280 22282 7fffe33c29d0 44 API calls 22279->22282 22279->22336 22283 7fffe33cab8c memset 22280->22283 22281->22274 22284 7fffe33cacf3 22282->22284 22286 7fffe33cac7a OutputDebugStringW 22283->22286 22292 7fffe33cabc7 22283->22292 22285 7fffe33c5300 98 API calls 22284->22285 22287 7fffe33cad08 22285->22287 22288 7fffe33cac9d 22286->22288 22289 7fffe33caeb0 22287->22289 22291 7fffe33f4070 27 API calls 22287->22291 22433 7fffe33d9f20 GetLastError 22288->22433 22293 7fffe33c29d0 44 API calls 22289->22293 22289->22336 22294 7fffe33cad8e memset 22291->22294 22292->22286 22295 7fffe33caee8 22293->22295 22296 7fffe33cae7a OutputDebugStringW 22294->22296 22303 7fffe33cadc9 22294->22303 22297 7fffe33c5300 98 API calls 22295->22297 22299 7fffe33cae9d 22296->22299 22298 7fffe33caefd 22297->22298 22301 7fffe33cb0a0 22298->22301 22302 7fffe33f4070 27 API calls 22298->22302 22434 7fffe33d9f20 GetLastError 22299->22434 22301->22336 22424 7fffe33d72a0 22301->22424 22306 7fffe33caf83 memset 22302->22306 22303->22296 22307 7fffe33cb06a OutputDebugStringW 22306->22307 22311 7fffe33cafbe 22306->22311 22309 7fffe33cb08d 22307->22309 22435 7fffe33d9f20 GetLastError 22309->22435 22311->22307 22312 7fffe33cb154 22313 7fffe33f4070 27 API calls 22312->22313 22314 7fffe33cb24d memset 22313->22314 22315 7fffe33cb33a OutputDebugStringW 22314->22315 22320 7fffe33cb28f 22314->22320 22316 7fffe33cb359 22315->22316 22317 7fffe33cb36a NtOpenFile 22315->22317 22316->22317 22318 7fffe33cb507 22317->22318 22319 7fffe33cb3a2 22317->22319 22322 7fffe33f4070 27 API calls 22318->22322 22321 7fffe33f4070 27 API calls 22319->22321 22320->22315 22323 7fffe33cb4a0 memset 22321->22323 22324 7fffe33cb573 memset 22322->22324 22325 7fffe33cb66a OutputDebugStringW 22323->22325 22331 7fffe33cb4e2 22323->22331 22326 7fffe33cb82a OutputDebugStringW 22324->22326 22332 7fffe33cb5b5 22324->22332 22327 7fffe33cb686 22325->22327 22328 7fffe33cb849 22326->22328 22329 7fffe33f4070 27 API calls 22327->22329 22330 7fffe33cb85f NtCreateSection 22328->22330 22333 7fffe33cb702 22329->22333 22334 7fffe33cb8ab 22330->22334 22335 7fffe33cba0d 22330->22335 22331->22325 22332->22326 22333->22336 22437 7fffe33da520 28 API calls 22333->22437 22337 7fffe33f4070 27 API calls 22334->22337 22338 7fffe33f4070 27 API calls 22335->22338 22336->22165 22340 7fffe33cb9a6 memset 22337->22340 22341 7fffe33cba8b memset 22338->22341 22343 7fffe33cbb8a OutputDebugStringW 22340->22343 22354 7fffe33cb9e8 22340->22354 22344 7fffe33cbc9a OutputDebugStringW 22341->22344 22355 7fffe33cbaca 22341->22355 22342 7fffe33cb723 22438 7fffe33da1e0 GetErrorInfo 22342->22438 22346 7fffe33cbba6 22343->22346 22347 7fffe33cbcbc 22344->22347 22348 7fffe33cbccd GetCurrentProcess NtMapViewOfSection 22344->22348 22439 7fffe33da520 28 API calls 22346->22439 22347->22348 22349 7fffe33cbed2 22348->22349 22350 7fffe33cbd42 22348->22350 22353 7fffe33f4070 27 API calls 22349->22353 22351 7fffe33cbd4d 22350->22351 22352 7fffe33cc0c3 22350->22352 22358 7fffe33f4070 27 API calls 22351->22358 22356 7fffe33f4070 27 API calls 22352->22356 22359 7fffe33cbf3e 22353->22359 22354->22343 22355->22344 22360 7fffe33cc1bb 22356->22360 22362 7fffe33cbdaf 22358->22362 22363 7fffe33d49b0 2 API calls 22359->22363 22364 7fffe33d49b0 2 API calls 22360->22364 22361 7fffe33cbbdb 22440 7fffe33da1e0 GetErrorInfo 22361->22440 22366 7fffe33d49b0 2 API calls 22362->22366 22369 7fffe33cbf5d 22363->22369 22367 7fffe33cc1da 22364->22367 22368 7fffe33cbdce 22366->22368 22441 7fffe33d5b40 29 API calls 22367->22441 22370 7fffe33c6800 33 API calls 22368->22370 22374 7fffe33c6800 33 API calls 22369->22374 22371 7fffe33cbdff 22370->22371 22372 7fffe33f4070 27 API calls 22371->22372 22373 7fffe33cbe7c 22372->22373 22375 7fffe33d49b0 2 API calls 22373->22375 22376 7fffe33cbfa2 22374->22376 22378 7fffe33cbe9b 22375->22378 22379 7fffe33f4070 27 API calls 22376->22379 22381 7fffe33cbeb9 NtClose 22378->22381 22382 7fffe33cc03a 22379->22382 22380 7fffe33cc224 22380->22380 22381->22336 22383 7fffe33d49b0 2 API calls 22382->22383 22383->22336 22385 7fffe33c6c31 22384->22385 22386 7fffe33c6a16 22384->22386 22387 7fffe33f4070 27 API calls 22385->22387 22388 7fffe33c70f2 22386->22388 22395 7fffe33c6a48 22386->22395 22448 7fffe33fc1d0 WaitOnAddress GetLastError 22386->22448 22389 7fffe33c6c8b memset 22387->22389 22449 7fffe33fc2a0 WaitOnAddress GetLastError WakeByAddressAll 22388->22449 22392 7fffe33c6e2a OutputDebugStringW 22389->22392 22400 7fffe33c6cc3 22389->22400 22393 7fffe33c6e4b 22392->22393 22393->22178 22394 7fffe33c7153 22397 7fffe33f4070 27 API calls 22394->22397 22395->22394 22401 7fffe33c6a74 22395->22401 22396 7fffe33c6f07 22444 7fffe33d9510 22396->22444 22398 7fffe33c71c0 22397->22398 22402 7fffe33d49b0 2 API calls 22398->22402 22400->22392 22401->22396 22407 7fffe33f4070 27 API calls 22401->22407 22404 7fffe33c71e8 22402->22404 22450 7fffe33fd0c0 27 API calls 22404->22450 22405 7fffe33f4070 27 API calls 22406 7fffe33c6fa4 memset 22405->22406 22408 7fffe33c708a OutputDebugStringW 22406->22408 22413 7fffe33c6fe3 22406->22413 22410 7fffe33c6d42 memset 22407->22410 22415 7fffe33c70a0 22408->22415 22411 7fffe33c6eea OutputDebugStringW 22410->22411 22414 7fffe33c6d81 22410->22414 22411->22396 22413->22408 22414->22411 22415->22393 22451 7fffe33fc290 WakeByAddressSingle 22415->22451 22416->22125 22417->22131 22418->22137 22419->22145 22420->22231 22421->22231 22426 7fffe33d72ca 22424->22426 22425 7fffe33d75e5 22443 7fffe33fcfa3 27 API calls 22425->22443 22426->22425 22429 7fffe33cb131 22426->22429 22430 7fffe33d7353 22426->22430 22429->22312 22436 7fffe33e33c0 27 API calls 22429->22436 22430->22429 22442 7fffe33fb8c0 27 API calls 22430->22442 22432->22269 22433->22279 22434->22289 22435->22301 22436->22312 22437->22342 22438->22336 22439->22361 22440->22336 22441->22380 22442->22430 22445 7fffe33d974f 22444->22445 22447 7fffe33c6f2e 22444->22447 22452 7fffe33fab50 29 API calls 22445->22452 22447->22405 22448->22388 22449->22395 22452->22447

                                                  Executed Functions

                                                  Function 00007FFFE33C7CE0 Relevance: 94.5, APIs: 48, Strings: 5, Instructions: 1710processCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  • CreateToolhelp32SnapshotModule32FirstWModule32NextWThread32FirstThread32NextOpenThreadSuspendThreadResumeThreadGetProcessIdOfThreadNtCloseNtQueryInformationProcess, xrefs: 00007FFFE33C7F5B
                                                  • ntdll.dllNormalized full path for ntdll.dll: , xrefs: 00007FFFE33C81FB
                                                  • kernel32.dllNtCreateSectionNtMapViewOfSectionNtOpenFileZwOpenKeyZwCreateKeyZwSetValueKeyZwCloseVirtualAllocExGetCurrentProcessIdOpenProcessReadProcessMemoryCloseHandleWriteProcessMemoryCreateToolhelp32SnapshotModule32FirstWModule32NextWThread32FirstThread32Nex, xrefs: 00007FFFE33C7F81, 00007FFFE33C7FF1, 00007FFFE33C8061
                                                  • kernel32.dll, xrefs: 00007FFFE33C8989
                                                  • C:\Windows\System32\Resolved full path for module: , xrefs: 00007FFFE33C8214, 00007FFFE33C89A2
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.4286243601.00007FFFE33C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFFE33C0000, based on PE: true
                                                  • Associated: 00000002.00000002.4285328995.00007FFFE33C0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4287819193.00007FFFE33FE000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289006151.00007FFFE3413000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289870492.00007FFFE3414000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_7fffe33c0000_cmd.jbxd
                                                  Similarity
                                                  • API ID: DebugOutputStringmemset$CreateErrorFileFirstLastModuleModule32NameSnapshotToolhelp32memcpy
                                                  • String ID: C:\Windows\System32\Resolved full path for module: $CreateToolhelp32SnapshotModule32FirstWModule32NextWThread32FirstThread32NextOpenThreadSuspendThreadResumeThreadGetProcessIdOfThreadNtCloseNtQueryInformationProcess$kernel32.dll$kernel32.dllNtCreateSectionNtMapViewOfSectionNtOpenFileZwOpenKeyZwCreateKeyZwSetValueKeyZwCloseVirtualAllocExGetCurrentProcessIdOpenProcessReadProcessMemoryCloseHandleWriteProcessMemoryCreateToolhelp32SnapshotModule32FirstWModule32NextWThread32FirstThread32Nex$ntdll.dllNormalized full path for ntdll.dll:
                                                  • API String ID: 2813801548-372247014
                                                  • Opcode ID: 2ce420e9d4854f10dcbb2d994230e2346526eee4e52d297ab14ed32678c3cb3d
                                                  • Instruction ID: 0b4688ff0a7e5d067dd938c7e7ecaef1b25b04590fb648b584a9b2ef66e64b74
                                                  • Opcode Fuzzy Hash: 2ce420e9d4854f10dcbb2d994230e2346526eee4e52d297ab14ed32678c3cb3d
                                                  • Instruction Fuzzy Hash: 5B03A222A08BC189EB718F24D808BE967E1FF55789F405235DA4C7BB99EF3C9245C742
                                                  Function 00007FFFE33CA4E0 Relevance: 64.4, APIs: 27, Strings: 9, Instructions: 1433nativefileCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  • NtCloseNtQueryInformationProcess, xrefs: 00007FFFE33CAED1
                                                  • NtCreateSectionNtMapViewOfSectionNtOpenFileZwOpenKeyZwCreateKeyZwSetValueKeyZwCloseVirtualAllocExGetCurrentProcessIdOpenProcessReadProcessMemoryCloseHandleWriteProcessMemoryCreateToolhelp32SnapshotModule32FirstWModule32NextWThread32FirstThread32NextOpenThreadS, xrefs: 00007FFFE33CAAD1
                                                  • NtCreateSection failedNtOpenFile failed for , xrefs: 00007FFFE33CBBC7
                                                  • , xrefs: 00007FFFE33CBD06
                                                  • , xrefs: 00007FFFE33CB87A
                                                  • `, xrefs: 00007FFFE33CB36A
                                                  • NtOpenFileZwOpenKeyZwCreateKeyZwSetValueKeyZwCloseVirtualAllocExGetCurrentProcessIdOpenProcessReadProcessMemoryCloseHandleWriteProcessMemoryCreateToolhelp32SnapshotModule32FirstWModule32NextWThread32FirstThread32NextOpenThreadSuspendThreadResumeThreadGetProces, xrefs: 00007FFFE33CA8D6
                                                  • KO_S, xrefs: 00007FFFE33CB779
                                                  • NtMapViewOfSection failedSTATUS_IMAGE_NOT_AT_BASE detected. Module mapped at address: , xrefs: 00007FFFE33CC212
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.4286243601.00007FFFE33C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFFE33C0000, based on PE: true
                                                  • Associated: 00000002.00000002.4285328995.00007FFFE33C0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4287819193.00007FFFE33FE000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289006151.00007FFFE3413000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289870492.00007FFFE3414000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_7fffe33c0000_cmd.jbxd
                                                  Similarity
                                                  • API ID: DebugOutputStringmemset$Section$CloseCreateCurrentFileOpenProcessView
                                                  • String ID: $ $KO_S$NtCloseNtQueryInformationProcess$NtCreateSection failedNtOpenFile failed for $NtCreateSectionNtMapViewOfSectionNtOpenFileZwOpenKeyZwCreateKeyZwSetValueKeyZwCloseVirtualAllocExGetCurrentProcessIdOpenProcessReadProcessMemoryCloseHandleWriteProcessMemoryCreateToolhelp32SnapshotModule32FirstWModule32NextWThread32FirstThread32NextOpenThreadS$NtMapViewOfSection failedSTATUS_IMAGE_NOT_AT_BASE detected. Module mapped at address: $NtOpenFileZwOpenKeyZwCreateKeyZwSetValueKeyZwCloseVirtualAllocExGetCurrentProcessIdOpenProcessReadProcessMemoryCloseHandleWriteProcessMemoryCreateToolhelp32SnapshotModule32FirstWModule32NextWThread32FirstThread32NextOpenThreadSuspendThreadResumeThreadGetProces$`
                                                  • API String ID: 2718610588-357158946
                                                  • Opcode ID: c03f29f99e8865caf3a61e430bc7360d33b872c920dfbdc21f2b9f3d043bdc3f
                                                  • Instruction ID: 21e5ff504acffc7c2a4809da3905206883e41e5452af847821fafc1cc27ef8d3
                                                  • Opcode Fuzzy Hash: c03f29f99e8865caf3a61e430bc7360d33b872c920dfbdc21f2b9f3d043bdc3f
                                                  • Instruction Fuzzy Hash: DCF2A072A14BC18EEB718F20D8587E937A4FB59788F804236DA4D6BB59DF798344C342
                                                  Function 00007FFFE33D0470 Relevance: 62.0, APIs: 23, Strings: 12, Instructions: 749COMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 604 7fffe33d0470-7fffe33d058e memset OutputDebugStringW memset OutputDebugStringW 605 7fffe33d063c-7fffe33d063f 604->605 606 7fffe33d0594-7fffe33d063b memset OutputDebugStringW 604->606 607 7fffe33d0833-7fffe33d087e memset OutputDebugStringW 605->607 608 7fffe33d0645-7fffe33d0668 call 7fffe33ea160 605->608 611 7fffe33d0888-7fffe33d0919 call 7fffe33cc680 call 7fffe33f4070 memset 607->611 610 7fffe33d066d-7fffe33d0679 608->610 610->611 612 7fffe33d067f-7fffe33d0687 610->612 629 7fffe33d0a1a-7fffe33d0a35 OutputDebugStringW 611->629 630 7fffe33d091f-7fffe33d0931 611->630 614 7fffe33d0689-7fffe33d06b0 612->614 615 7fffe33d06f2-7fffe33d0774 memset OutputDebugStringW call 7fffe33e4390 612->615 617 7fffe33d06bb-7fffe33d06d0 614->617 618 7fffe33d06b2 614->618 625 7fffe33d077a-7fffe33d0808 call 7fffe33f4070 memset 615->625 626 7fffe33d0940-7fffe33d0992 memset OutputDebugStringW 615->626 622 7fffe33d06db-7fffe33d06ed call 7fffe33d9d30 617->622 623 7fffe33d06d2-7fffe33d06d6 call 7fffe33d9d30 617->623 618->617 622->615 623->622 642 7fffe33d080e-7fffe33d0820 625->642 643 7fffe33d0c2a-7fffe33d0c3e OutputDebugStringW 625->643 631 7fffe33d0a45-7fffe33d0aaf call 7fffe33c29d0 call 7fffe33c2de0 626->631 629->631 633 7fffe33d0a37-7fffe33d0a40 call 7fffe33d9d30 629->633 634 7fffe33d0997-7fffe33d09ba 630->634 635 7fffe33d0933-7fffe33d093b 630->635 660 7fffe33d0ab1-7fffe33d0ab8 631->660 661 7fffe33d0ac2-7fffe33d0b22 call 7fffe33c29d0 call 7fffe33c2de0 631->661 633->631 636 7fffe33d09c0-7fffe33d09ea 634->636 640 7fffe33d09ec-7fffe33d09fd 635->640 636->636 636->640 641 7fffe33d0a00-7fffe33d0a07 640->641 641->629 647 7fffe33d0a09-7fffe33d0a18 641->647 648 7fffe33d0ba3-7fffe33d0bcf 642->648 649 7fffe33d0826-7fffe33d082e 642->649 645 7fffe33d0c40-7fffe33d0c4c call 7fffe33d9d30 643->645 646 7fffe33d0c51-7fffe33d0c60 643->646 645->646 652 7fffe33d0ccb-7fffe33d0cd2 646->652 653 7fffe33d0c62-7fffe33d0c89 646->653 647->629 647->641 656 7fffe33d0bd0-7fffe33d0bfa 648->656 654 7fffe33d0bfc-7fffe33d0c0d 649->654 663 7fffe33d0cdc-7fffe33d0d38 call 7fffe33c29d0 call 7fffe33c2de0 652->663 658 7fffe33d0c8b 653->658 659 7fffe33d0c94-7fffe33d0ca9 653->659 657 7fffe33d0c10-7fffe33d0c17 654->657 656->654 656->656 657->643 664 7fffe33d0c19-7fffe33d0c28 657->664 658->659 665 7fffe33d0cab-7fffe33d0caf call 7fffe33d9d30 659->665 666 7fffe33d0cb4-7fffe33d0cc6 call 7fffe33d9d30 659->666 660->661 675 7fffe33d0b24 661->675 676 7fffe33d0b30-7fffe33d0b8c call 7fffe33c29d0 call 7fffe33c2de0 661->676 678 7fffe33d0d4b-7fffe33d0e34 memset OutputDebugStringW memset OutputDebugStringW 663->678 679 7fffe33d0d3a-7fffe33d0d41 663->679 664->643 664->657 665->666 666->652 675->676 676->663 689 7fffe33d0b92-7fffe33d0b99 676->689 684 7fffe33d0e3a-7fffe33d0e7a call 7fffe33d49b0 WriteProcessMemory 678->684 685 7fffe33d1213-7fffe33d122b call 7fffe33d49b0 678->685 679->678 692 7fffe33d1235-7fffe33d1267 call 7fffe33d49b0 684->692 693 7fffe33d0e80-7fffe33d0f05 call 7fffe33f4070 call 7fffe33d49b0 684->693 685->692 689->648 703 7fffe33d1271-7fffe33d1278 692->703 701 7fffe33d0f07-7fffe33d0f14 call 7fffe33d9d30 693->701 702 7fffe33d0f19-7fffe33d0f35 call 7fffe33d49b0 call 7fffe33d16e0 693->702 701->702 702->703 711 7fffe33d0f3b-7fffe33d0fb9 call 7fffe33f4070 call 7fffe33d49b0 702->711 707 7fffe33d1282-7fffe33d1289 703->707 710 7fffe33d1293-7fffe33d1303 call 7fffe33f4070 call 7fffe33d49b0 707->710 720 7fffe33d1317-7fffe33d1328 call 7fffe33d49b0 710->720 721 7fffe33d1305-7fffe33d1312 call 7fffe33d9d30 710->721 722 7fffe33d0fbb-7fffe33d0fc8 call 7fffe33d9d30 711->722 723 7fffe33d0fcd-7fffe33d0fe9 call 7fffe33c4d40 711->723 721->720 722->723 723->707 730 7fffe33d0fef-7fffe33d1070 call 7fffe33f4070 call 7fffe33d49b0 723->730 735 7fffe33d1084-7fffe33d10e6 call 7fffe33d49b0 call 7fffe33d9dc0 CreateRemoteThread 730->735 736 7fffe33d1072-7fffe33d107f call 7fffe33d9d30 730->736 735->710 742 7fffe33d10ec-7fffe33d11ee GetLastError call 7fffe33f4070 call 7fffe33d49b0 735->742 736->735 747 7fffe33d11f0-7fffe33d11fd call 7fffe33d9d30 742->747 748 7fffe33d1202-7fffe33d1209 742->748 747->748 748->685
                                                  APIs
                                                  Strings
                                                  • All resources cleaned up successfully. Exiting function.Failed to create remote thread. NTSTATUS: , LastError: , xrefs: 00007FFFE33D1317
                                                  • Writing DLL path to allocated memory...Failed to write DLL path to target process memory.Failed to write DLL path.DLL path written to target process memory successfully at: 0x, xrefs: 00007FFFE33D0E3D
                                                  • Failed to allocate memory for DLL path in target process.Failed to allocate memory for DLL path.Writing DLL path to allocated memory...Failed to write DLL path to target process memory.Failed to write DLL path.DLL path written to target process memory successf, xrefs: 00007FFFE33D1213
                                                  • kernel32.dllNtCreateSectionNtMapViewOfSectionNtOpenFileZwOpenKeyZwCreateKeyZwSetValueKeyZwCloseVirtualAllocExGetCurrentProcessIdOpenProcessReadProcessMemoryCloseHandleWriteProcessMemoryCreateToolhelp32SnapshotModule32FirstWModule32NextWThread32FirstThread32Nex, xrefs: 00007FFFE33D0A8A, 00007FFFE33D0AF5, 00007FFFE33D0B67, 00007FFFE33D0D13
                                                  • Failed to write DLL data to the file system.Failed to resolve VirtualAllocEx dynamicallyFailed to resolve WriteProcessMemory dynamicallyFailed to resolve CreateRemoteThread dynamicallyFailed to resolve CloseHandle dynamicallyC:\Windows\Temp\tempdll.dll, xrefs: 00007FFFE33D0CCB
                                                  • Locating kernel32.dll in the target process...kernel32.dllFailed to locate kernel32.dll in the target process.Found kernel32.dll base at: , xrefs: 00007FFFE33D0F19
                                                  • VirtualAllocExGetCurrentProcessIdOpenProcessReadProcessMemoryCloseHandleWriteProcessMemoryCreateToolhelp32SnapshotModule32FirstWModule32NextWThread32FirstThread32NextOpenThreadSuspendThreadResumeThreadGetProcessIdOfThreadNtCloseNtQueryInformationProcess, xrefs: 00007FFFE33D0A64
                                                  • CreateRemoteThreadkernel32.dllNtCreateSectionNtMapViewOfSectionNtOpenFileZwOpenKeyZwCreateKeyZwSetValueKeyZwCloseVirtualAllocExGetCurrentProcessIdOpenProcessReadProcessMemoryCloseHandleWriteProcessMemoryCreateToolhelp32SnapshotModule32FirstWModule32NextWThread, xrefs: 00007FFFE33D0B41
                                                  • Failed to create remote thread.Invalid process handle.Located module '' at base address: , xrefs: 00007FFFE33D1202
                                                  • LoadLibraryAFailed to locate LoadLibraryA in the target process.Resolved LoadLibraryA address in target process: , xrefs: 00007FFFE33D0FD4
                                                  • C:\Windows\Temp\tempdll.dllReading DLL from disk at path: , xrefs: 00007FFFE33D0645
                                                  • DLL data is empty.DLL already exists at , xrefs: 00007FFFE33D0877
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.4286243601.00007FFFE33C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFFE33C0000, based on PE: true
                                                  • Associated: 00000002.00000002.4285328995.00007FFFE33C0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4287819193.00007FFFE33FE000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289006151.00007FFFE3413000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289870492.00007FFFE3414000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_7fffe33c0000_cmd.jbxd
                                                  Similarity
                                                  • API ID: memset$DebugOutputString
                                                  • String ID: All resources cleaned up successfully. Exiting function.Failed to create remote thread. NTSTATUS: , LastError: $C:\Windows\Temp\tempdll.dllReading DLL from disk at path: $CreateRemoteThreadkernel32.dllNtCreateSectionNtMapViewOfSectionNtOpenFileZwOpenKeyZwCreateKeyZwSetValueKeyZwCloseVirtualAllocExGetCurrentProcessIdOpenProcessReadProcessMemoryCloseHandleWriteProcessMemoryCreateToolhelp32SnapshotModule32FirstWModule32NextWThread$DLL data is empty.DLL already exists at $Failed to allocate memory for DLL path in target process.Failed to allocate memory for DLL path.Writing DLL path to allocated memory...Failed to write DLL path to target process memory.Failed to write DLL path.DLL path written to target process memory successf$Failed to create remote thread.Invalid process handle.Located module '' at base address: $Failed to write DLL data to the file system.Failed to resolve VirtualAllocEx dynamicallyFailed to resolve WriteProcessMemory dynamicallyFailed to resolve CreateRemoteThread dynamicallyFailed to resolve CloseHandle dynamicallyC:\Windows\Temp\tempdll.dll$LoadLibraryAFailed to locate LoadLibraryA in the target process.Resolved LoadLibraryA address in target process: $Locating kernel32.dll in the target process...kernel32.dllFailed to locate kernel32.dll in the target process.Found kernel32.dll base at: $VirtualAllocExGetCurrentProcessIdOpenProcessReadProcessMemoryCloseHandleWriteProcessMemoryCreateToolhelp32SnapshotModule32FirstWModule32NextWThread32FirstThread32NextOpenThreadSuspendThreadResumeThreadGetProcessIdOfThreadNtCloseNtQueryInformationProcess$Writing DLL path to allocated memory...Failed to write DLL path to target process memory.Failed to write DLL path.DLL path written to target process memory successfully at: 0x$kernel32.dllNtCreateSectionNtMapViewOfSectionNtOpenFileZwOpenKeyZwCreateKeyZwSetValueKeyZwCloseVirtualAllocExGetCurrentProcessIdOpenProcessReadProcessMemoryCloseHandleWriteProcessMemoryCreateToolhelp32SnapshotModule32FirstWModule32NextWThread32FirstThread32Nex
                                                  • API String ID: 1905100485-484227781
                                                  • Opcode ID: 4e38a6d9d1784639a3487d88818faf84cfa2320eecd116bad78c37b7c6047623
                                                  • Instruction ID: e125fe84cdc6eb4ba4450deeb58af0c4dcb7da6a7a96d36b5540958cfffa5efd
                                                  • Opcode Fuzzy Hash: 4e38a6d9d1784639a3487d88818faf84cfa2320eecd116bad78c37b7c6047623
                                                  • Instruction Fuzzy Hash: F3828C22A14BC18AEB218F64E8897E977E1FF94748F444631DA4C67B69EF3CD245C342
                                                  Function 00007FFFE33CC860 Relevance: 47.2, APIs: 16, Strings: 10, Instructions: 1664nativeCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.4286243601.00007FFFE33C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFFE33C0000, based on PE: true
                                                  • Associated: 00000002.00000002.4285328995.00007FFFE33C0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4287819193.00007FFFE33FE000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289006151.00007FFFE3413000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289870492.00007FFFE3414000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_7fffe33c0000_cmd.jbxd
                                                  Similarity
                                                  • API ID: memset$DebugOutputString$InformationProcessQuery
                                                  • String ID: Failed to read LDR_DATA_TABLE_ENTRY.BaseDllName.Buffer: , BaseDllName.Length: $GetProcessIdOfThreadNtCloseNtQueryInformationProcess$Injecting DLL into the target process...DLL injected successfully into target process ID: $OfThread$PEB.$kernel32.dllNtCreateSectionNtMapViewOfSectionNtOpenFileZwOpenKeyZwCreateKeyZwSetValueKeyZwCloseVirtualAllocExGetCurrentProcessIdOpenProcessReadProcessMemoryCloseHandleWriteProcessMemoryCreateToolhelp32SnapshotModule32FirstWModule32NextWThread32FirstThread32Nex$mory$rocessId$tempdll.dll is already loaded in the target process.DLL already loaded.Failed to open target process.Skipping hook installation for current process: PID = $tempdll.dllC:\Windows\Temp\tempdll.dllReading DLL from disk at path:
                                                  • API String ID: 1134542397-484808530
                                                  • Opcode ID: d8a9956a96f2273aab879be3e1652c3fb111aca6b2c816bfa44683506cf3387a
                                                  • Instruction ID: f819bcaca17c866cad05f46479a4362b48ecdbd55a12d849bc57003c3b0d9556
                                                  • Opcode Fuzzy Hash: d8a9956a96f2273aab879be3e1652c3fb111aca6b2c816bfa44683506cf3387a
                                                  • Instruction Fuzzy Hash: 7303B672A08BC18AE7718F24D844BF967A1FB94788F404236DA8D77A85DF39D355C312
                                                  Function 00007FFFE33C2DE0 Relevance: 46.5, APIs: 30, Instructions: 1477COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.4286243601.00007FFFE33C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFFE33C0000, based on PE: true
                                                  • Associated: 00000002.00000002.4285328995.00007FFFE33C0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4287819193.00007FFFE33FE000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289006151.00007FFFE3413000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289870492.00007FFFE3414000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_7fffe33c0000_cmd.jbxd
                                                  Similarity
                                                  • API ID: DebugOutputStringmemset
                                                  • String ID:
                                                  • API String ID: 1084755268-0
                                                  • Opcode ID: 0f90c4067d726f9085525065e47c3cf725405a3599a6989b1e85df0eca51723f
                                                  • Instruction ID: 73628e72988751676f0acf3afb131685c72ad870f25371a60339b63840476eb1
                                                  • Opcode Fuzzy Hash: 0f90c4067d726f9085525065e47c3cf725405a3599a6989b1e85df0eca51723f
                                                  • Instruction Fuzzy Hash: C1F2A432A14BC18EEB32CF60D858BE967A4FB55788F444136DA4D6BB99DF399344C302
                                                  Function 00007FFFE33C5300 Relevance: 43.0, APIs: 21, Strings: 3, Instructions: 967COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.4286243601.00007FFFE33C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFFE33C0000, based on PE: true
                                                  • Associated: 00000002.00000002.4285328995.00007FFFE33C0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4287819193.00007FFFE33FE000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289006151.00007FFFE3413000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289870492.00007FFFE3414000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_7fffe33c0000_cmd.jbxd
                                                  Similarity
                                                  • API ID: memset$DebugOutputString$HandleModuleQueryVirtual
                                                  • String ID: C:\Windows\System32\Resolved full path for module: $ntdll.dll$ntdll.dllNormalized full path for ntdll.dll:
                                                  • API String ID: 3283594973-2956908514
                                                  • Opcode ID: 2bd506e0b2866d6afb7841a99b7cb5864718d12846ff0ba418710557521c8856
                                                  • Instruction ID: 1959c4455804308d45c18d6334ff3ca58e7c8c96425c63bc5505b9eb8805f3ce
                                                  • Opcode Fuzzy Hash: 2bd506e0b2866d6afb7841a99b7cb5864718d12846ff0ba418710557521c8856
                                                  • Instruction Fuzzy Hash: F4A2A432A14BC18EEB318F31D858BE927A5FB55788F844235DA4D6BB5ADF39D244C302
                                                  Function 00007FFFE33D8630 Relevance: 42.7, APIs: 23, Strings: 1, Instructions: 715COMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 1628 7fffe33d8630-7fffe33d866f 1629 7fffe33d8683-7fffe33d8689 1628->1629 1630 7fffe33d92b8-7fffe33d92d2 1629->1630 1631 7fffe33d868f-7fffe33d86d5 call 7fffe33d9de0 call 7fffe33d9dc0 LsaOpenPolicy 1629->1631 1636 7fffe33d86d7-7fffe33d86df 1631->1636 1637 7fffe33d8700-7fffe33d8729 call 7fffe33d9dc0 GetCurrentProcess OpenProcessToken 1631->1637 1639 7fffe33d86e6-7fffe33d86f4 call 7fffe33da520 call 7fffe33da1e0 1636->1639 1642 7fffe33d888a-7fffe33d889e call 7fffe33d9f20 1637->1642 1643 7fffe33d872f-7fffe33d8748 call 7fffe33d9d50 1637->1643 1654 7fffe33d895e-7fffe33d8a18 call 7fffe33f4070 memset 1639->1654 1655 7fffe33d86fa 1639->1655 1642->1643 1651 7fffe33d88a4-7fffe33d88a7 1642->1651 1652 7fffe33d874e-7fffe33d878b GetTokenInformation 1643->1652 1653 7fffe33d92d3-7fffe33d933e call 7fffe33fcfa3 call 7fffe33d9d30 1643->1653 1657 7fffe33d88a9-7fffe33d88b0 call 7fffe33daf50 1651->1657 1658 7fffe33d88b5-7fffe33d88d1 LsaClose 1651->1658 1659 7fffe33d88d6-7fffe33d88f1 call 7fffe33d9f20 1652->1659 1660 7fffe33d8791-7fffe33d882b call 7fffe33d7650 LsaAddAccountRights LsaClose 1652->1660 1671 7fffe33d8a1e-7fffe33d8a30 1654->1671 1672 7fffe33d8aba-7fffe33d8acd OutputDebugStringW 1654->1672 1656 7fffe33d8b40-7fffe33d8bd1 call 7fffe33f4070 memset 1655->1656 1675 7fffe33d8bd7-7fffe33d8be9 1656->1675 1676 7fffe33d8c7a-7fffe33d8c8d OutputDebugStringW 1656->1676 1657->1658 1658->1639 1659->1660 1683 7fffe33d88f7-7fffe33d88fa 1659->1683 1679 7fffe33d8aff-7fffe33d8b09 1660->1679 1680 7fffe33d8831-7fffe33d886a call 7fffe33da520 call 7fffe33da1e0 1660->1680 1681 7fffe33d8a3c-7fffe33d8a5b 1671->1681 1682 7fffe33d8a32-7fffe33d8a3a 1671->1682 1677 7fffe33d8ae0-7fffe33d8ae8 1672->1677 1678 7fffe33d8acf-7fffe33d8adb call 7fffe33d9d30 1672->1678 1685 7fffe33d8beb-7fffe33d8bf3 1675->1685 1686 7fffe33d8bf5-7fffe33d8c1f 1675->1686 1690 7fffe33d8ca0-7fffe33d8cd7 call 7fffe33d9dc0 GetCurrentProcess OpenProcessToken 1676->1690 1691 7fffe33d8c8f-7fffe33d8c9b call 7fffe33d9d30 1676->1691 1688 7fffe33d8aee-7fffe33d8afa call 7fffe33daf50 1677->1688 1689 7fffe33d8680 1677->1689 1678->1677 1692 7fffe33d8b1c-7fffe33d8b33 call 7fffe33d9d30 1679->1692 1693 7fffe33d8b0b-7fffe33d8b17 call 7fffe33d9d30 1679->1693 1725 7fffe33d893d-7fffe33d8958 call 7fffe33d9d30 1680->1725 1726 7fffe33d8870-7fffe33d8885 call 7fffe33d9d30 1680->1726 1696 7fffe33d8a60-7fffe33d8a8a 1681->1696 1695 7fffe33d8a8c-7fffe33d8a9d 1682->1695 1697 7fffe33d88fc-7fffe33d8903 call 7fffe33daf50 1683->1697 1698 7fffe33d8908-7fffe33d8936 LsaClose call 7fffe33da520 call 7fffe33da1e0 1683->1698 1704 7fffe33d8c4c-7fffe33d8c5d 1685->1704 1705 7fffe33d8c20-7fffe33d8c4a 1686->1705 1688->1689 1689->1629 1719 7fffe33d8cdd-7fffe33d8d47 call 7fffe33d7a80 call 7fffe33d9dd0 LookupPrivilegeValueW 1690->1719 1720 7fffe33d8e62-7fffe33d8e69 call 7fffe33d9f20 1690->1720 1691->1690 1692->1656 1693->1692 1709 7fffe33d8aa0-7fffe33d8aa7 1695->1709 1696->1695 1696->1696 1697->1698 1698->1725 1712 7fffe33d8c60-7fffe33d8c67 1704->1712 1705->1704 1705->1705 1709->1672 1710 7fffe33d8aa9-7fffe33d8ab8 1709->1710 1710->1672 1710->1709 1712->1676 1718 7fffe33d8c69-7fffe33d8c78 1712->1718 1718->1676 1718->1712 1738 7fffe33d8d4d-7fffe33d8d90 AdjustTokenPrivileges 1719->1738 1739 7fffe33d8e74-7fffe33d8e7b call 7fffe33d9f20 1719->1739 1734 7fffe33d8f97-7fffe33d9051 call 7fffe33f4070 memset 1720->1734 1735 7fffe33d8e6f 1720->1735 1725->1654 1725->1656 1726->1725 1743 7fffe33d9057-7fffe33d9069 1734->1743 1744 7fffe33d91ba-7fffe33d91cd OutputDebugStringW 1734->1744 1735->1719 1741 7fffe33d8e86-7fffe33d8e8d call 7fffe33d9f20 1738->1741 1742 7fffe33d8d96-7fffe33d8da4 GetLastError 1738->1742 1756 7fffe33d8f65-7fffe33d8f6f 1739->1756 1757 7fffe33d8e81 1739->1757 1741->1756 1768 7fffe33d8e93 1741->1768 1748 7fffe33d8e98-7fffe33d8ea2 1742->1748 1749 7fffe33d8daa-7fffe33d8e3b call 7fffe33f4070 memset 1742->1749 1752 7fffe33d9138-7fffe33d9157 1743->1752 1753 7fffe33d906f-7fffe33d9077 1743->1753 1750 7fffe33d91e0-7fffe33d91e8 1744->1750 1751 7fffe33d91cf-7fffe33d91db call 7fffe33d9d30 1744->1751 1760 7fffe33d907c-7fffe33d910d call 7fffe33f4070 memset 1748->1760 1761 7fffe33d8ea8-7fffe33d8eb9 call 7fffe33d9d30 1748->1761 1774 7fffe33d8f3a-7fffe33d8f4d OutputDebugStringW 1749->1774 1775 7fffe33d8e41-7fffe33d8e53 1749->1775 1763 7fffe33d91ee-7fffe33d91fd call 7fffe33daf50 1750->1763 1764 7fffe33d92b0-7fffe33d92b3 1750->1764 1751->1750 1759 7fffe33d9160-7fffe33d918a 1752->1759 1755 7fffe33d918c-7fffe33d919d 1753->1755 1770 7fffe33d91a0-7fffe33d91a7 1755->1770 1766 7fffe33d8f8f-7fffe33d8f91 1756->1766 1767 7fffe33d8f71-7fffe33d8f8c call 7fffe33d9d30 1756->1767 1757->1741 1759->1755 1759->1759 1782 7fffe33d928a-7fffe33d929d OutputDebugStringW 1760->1782 1783 7fffe33d9113-7fffe33d9125 1760->1783 1761->1760 1763->1629 1764->1629 1766->1734 1766->1760 1767->1766 1768->1742 1770->1744 1777 7fffe33d91a9-7fffe33d91b8 1770->1777 1780 7fffe33d8f60 call 7fffe33d9f20 1774->1780 1781 7fffe33d8f4f-7fffe33d8f5b call 7fffe33d9d30 1774->1781 1785 7fffe33d8ebe-7fffe33d8edd 1775->1785 1786 7fffe33d8e55-7fffe33d8e5d 1775->1786 1777->1744 1777->1770 1780->1756 1781->1780 1782->1764 1789 7fffe33d929f-7fffe33d92ab call 7fffe33d9d30 1782->1789 1791 7fffe33d912b-7fffe33d9133 1783->1791 1792 7fffe33d9202-7fffe33d922e 1783->1792 1793 7fffe33d8ee0-7fffe33d8f0a 1785->1793 1790 7fffe33d8f0c-7fffe33d8f1d 1786->1790 1789->1764 1797 7fffe33d8f20-7fffe33d8f27 1790->1797 1795 7fffe33d925c-7fffe33d926d 1791->1795 1794 7fffe33d9230-7fffe33d925a 1792->1794 1793->1790 1793->1793 1794->1794 1794->1795 1798 7fffe33d9270-7fffe33d9277 1795->1798 1797->1774 1799 7fffe33d8f29-7fffe33d8f38 1797->1799 1798->1782 1800 7fffe33d9279-7fffe33d9288 1798->1800 1799->1774 1799->1797 1800->1782 1800->1798
                                                  APIs
                                                  Strings
                                                  • Failed to add privilegeFailed to get token informationFailed to open process tokenFailed to open LSA policyAdjustTokenPrivileges failed with error: , xrefs: 00007FFFE33D8840
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.4286243601.00007FFFE33C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFFE33C0000, based on PE: true
                                                  • Associated: 00000002.00000002.4285328995.00007FFFE33C0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4287819193.00007FFFE33FE000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289006151.00007FFFE3413000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289870492.00007FFFE3414000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_7fffe33c0000_cmd.jbxd
                                                  Similarity
                                                  • API ID: ErrorOpenProcessTokenmemset$AccountCloseCurrentDebugInfoInformationOriginateOutputPolicyRightsString
                                                  • String ID: Failed to add privilegeFailed to get token informationFailed to open process tokenFailed to open LSA policyAdjustTokenPrivileges failed with error:
                                                  • API String ID: 4216219486-1190080770
                                                  • Opcode ID: 1c9b6f3a3ea0e24f2d3e2c60714ec98e77a23c6d0766b1f7dc14cdf3013a1139
                                                  • Instruction ID: 6258d0d559fc9a29b3a18534aafd85a79f32b9f80e0cdce5ecf979b7d707f067
                                                  • Opcode Fuzzy Hash: 1c9b6f3a3ea0e24f2d3e2c60714ec98e77a23c6d0766b1f7dc14cdf3013a1139
                                                  • Instruction Fuzzy Hash: 9562C672B15B818EEB608F61D848BF92BA1FB95788F844235D90D7BB99DF3C9245C301
                                                  Function 00007FFFE33D16E0 Relevance: 35.5, APIs: 19, Strings: 1, Instructions: 503processCOMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 1801 7fffe33d16e0-7fffe33d17c1 memset OutputDebugStringW GetProcessId 1802 7fffe33d188d-7fffe33d18e6 memset 1801->1802 1803 7fffe33d17c7-7fffe33d17de CreateToolhelp32Snapshot 1801->1803 1806 7fffe33d18ea OutputDebugStringW 1802->1806 1804 7fffe33d17e4-7fffe33d17fb call 7fffe33d9f20 1803->1804 1805 7fffe33d18f5-7fffe33d18fc 1803->1805 1809 7fffe33d1906-7fffe33d1927 call 7fffe33d9e00 Module32FirstW 1804->1809 1813 7fffe33d1801-7fffe33d187b memset OutputDebugStringW 1804->1813 1805->1809 1808 7fffe33d18f0 1806->1808 1811 7fffe33d1fce-7fffe33d2015 1808->1811 1816 7fffe33d192d-7fffe33d1978 1809->1816 1817 7fffe33d1e26-7fffe33d1e3a call 7fffe33d9f20 1809->1817 1813->1808 1815 7fffe33d187d-7fffe33d1884 call 7fffe33daf50 1813->1815 1822 7fffe33d1889-7fffe33d188b 1815->1822 1818 7fffe33d1980-7fffe33d1999 call 7fffe33d9e30 1816->1818 1817->1816 1825 7fffe33d1e40-7fffe33d1e43 1817->1825 1826 7fffe33d199b-7fffe33d19e7 memset OutputDebugStringW 1818->1826 1827 7fffe33d19f0-7fffe33d1ab8 call 7fffe33f4070 memset 1818->1827 1822->1808 1828 7fffe33d1e45-7fffe33d1e4c call 7fffe33daf50 1825->1828 1829 7fffe33d1e51-7fffe33d1ede memset 1825->1829 1830 7fffe33d1c28-7fffe33d1c36 Module32NextW 1826->1830 1835 7fffe33d1abe-7fffe33d1ad0 1827->1835 1836 7fffe33d1b6a-7fffe33d1b8b OutputDebugStringW 1827->1836 1828->1829 1829->1806 1830->1818 1834 7fffe33d1c3c-7fffe33d1c50 call 7fffe33d9f20 1830->1834 1834->1818 1848 7fffe33d1c56-7fffe33d1c59 1834->1848 1838 7fffe33d1adc-7fffe33d1afb 1835->1838 1839 7fffe33d1ad2-7fffe33d1ada 1835->1839 1841 7fffe33d1b9b-7fffe33d1bc0 1836->1841 1842 7fffe33d1b8d-7fffe33d1b96 call 7fffe33d9d30 1836->1842 1847 7fffe33d1b00-7fffe33d1b33 1838->1847 1846 7fffe33d1b35-7fffe33d1b46 1839->1846 1844 7fffe33d1c11-7fffe33d1c1b 1841->1844 1845 7fffe33d1bc2-7fffe33d1bcc 1841->1845 1842->1841 1844->1830 1850 7fffe33d1c1d-7fffe33d1c23 call 7fffe33d9d30 1844->1850 1849 7fffe33d1bd0-7fffe33d1bd3 1845->1849 1851 7fffe33d1b50-7fffe33d1b57 1846->1851 1847->1846 1847->1847 1852 7fffe33d1c5b-7fffe33d1c62 call 7fffe33daf50 1848->1852 1853 7fffe33d1c67-7fffe33d1d0f call 7fffe33f4070 memset 1848->1853 1855 7fffe33d1bd9-7fffe33d1c0f 1849->1855 1856 7fffe33d1d3a-7fffe33d1dfb call 7fffe33f4070 memset 1849->1856 1850->1830 1851->1836 1858 7fffe33d1b59-7fffe33d1b68 1851->1858 1852->1853 1862 7fffe33d20aa-7fffe33d20c4 OutputDebugStringW 1853->1862 1863 7fffe33d1d15-7fffe33d1d27 1853->1863 1855->1844 1855->1849 1868 7fffe33d1f7a-7fffe33d1f94 OutputDebugStringW 1856->1868 1869 7fffe33d1e01-7fffe33d1e13 1856->1869 1858->1836 1858->1851 1862->1822 1865 7fffe33d20ca-7fffe33d20db call 7fffe33d9d30 1862->1865 1866 7fffe33d1d2d-7fffe33d1d35 1863->1866 1867 7fffe33d2016-7fffe33d2039 1863->1867 1865->1822 1871 7fffe33d2072-7fffe33d208e 1866->1871 1876 7fffe33d2040-7fffe33d2070 1867->1876 1872 7fffe33d1fa7-7fffe33d1fb5 1868->1872 1873 7fffe33d1f96-7fffe33d1fa2 call 7fffe33d9d30 1868->1873 1874 7fffe33d1e19-7fffe33d1e21 1869->1874 1875 7fffe33d1ee3-7fffe33d1f0f 1869->1875 1877 7fffe33d2090-7fffe33d2097 1871->1877 1881 7fffe33d1fb7-7fffe33d1fc4 call 7fffe33d9d30 1872->1881 1882 7fffe33d1fc9 1872->1882 1873->1872 1883 7fffe33d1f42-7fffe33d1f5e 1874->1883 1878 7fffe33d1f10-7fffe33d1f40 1875->1878 1876->1871 1876->1876 1877->1862 1884 7fffe33d2099-7fffe33d20a8 1877->1884 1878->1878 1878->1883 1881->1882 1882->1811 1885 7fffe33d1f60-7fffe33d1f67 1883->1885 1884->1862 1884->1877 1885->1868 1887 7fffe33d1f69-7fffe33d1f78 1885->1887 1887->1868 1887->1885
                                                  APIs
                                                  Strings
                                                  • kernel32.dllFailed to locate kernel32.dll in the target process.Found kernel32.dll base at: , xrefs: 00007FFFE33D1738
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.4286243601.00007FFFE33C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFFE33C0000, based on PE: true
                                                  • Associated: 00000002.00000002.4285328995.00007FFFE33C0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4287819193.00007FFFE33FE000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289006151.00007FFFE3413000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289870492.00007FFFE3414000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_7fffe33c0000_cmd.jbxd
                                                  Similarity
                                                  • API ID: memset$DebugOutputString$Module32$CreateErrorFirstLastNextProcessSnapshotToolhelp32
                                                  • String ID: kernel32.dllFailed to locate kernel32.dll in the target process.Found kernel32.dll base at:
                                                  • API String ID: 3715241126-3640807919
                                                  • Opcode ID: d31b1e1755dec4d8e2c0be85c1158e268936fded38915c72a984b18bff384ff1
                                                  • Instruction ID: f0ef5293ea1bdd8baad67eb65d93076ba81001409c7a311b7932752cafdd00fe
                                                  • Opcode Fuzzy Hash: d31b1e1755dec4d8e2c0be85c1158e268936fded38915c72a984b18bff384ff1
                                                  • Instruction Fuzzy Hash: AC42C422A04AC18AF7728F64D845BF867A6FFA4748F844231DA4C7BA55EF399395C301
                                                  Function 00007FFFE33CF480 Relevance: 34.0, APIs: 10, Strings: 9, Instructions: 800COMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 1888 7fffe33cf480-7fffe33cf516 call 7fffe33c29d0 call 7fffe33c2de0 1893 7fffe33cf518-7fffe33cf531 call 7fffe33d9d20 1888->1893 1894 7fffe33cf571-7fffe33cf5c9 call 7fffe33c29d0 call 7fffe33c2de0 1888->1894 1899 7fffe33cf537-7fffe33cf56c 1893->1899 1900 7fffe33d0202-7fffe33d0213 call 7fffe33fcfa3 1893->1900 1906 7fffe33cf5cb-7fffe33cf5e4 call 7fffe33d9d20 1894->1906 1907 7fffe33cf619-7fffe33cf671 call 7fffe33c29d0 call 7fffe33c2de0 1894->1907 1902 7fffe33cf80e-7fffe33cf82b 1899->1902 1905 7fffe33d0218-7fffe33d0229 call 7fffe33fcfa3 1900->1905 1912 7fffe33d022e-7fffe33d023f call 7fffe33fcfa3 1905->1912 1906->1905 1916 7fffe33cf5ea-7fffe33cf614 1906->1916 1920 7fffe33cf673-7fffe33cf68c call 7fffe33d9d20 1907->1920 1921 7fffe33cf6c1-7fffe33cf71a call 7fffe33c29d0 call 7fffe33c2de0 1907->1921 1917 7fffe33d0244-7fffe33d0255 call 7fffe33fcfa3 1912->1917 1916->1902 1922 7fffe33d025a-7fffe33d026b call 7fffe33fcfa3 1917->1922 1920->1912 1929 7fffe33cf692-7fffe33cf6bc 1920->1929 1934 7fffe33cf71c-7fffe33cf735 call 7fffe33d9d20 1921->1934 1935 7fffe33cf76a-7fffe33cf7c3 call 7fffe33c29d0 call 7fffe33c2de0 1921->1935 1928 7fffe33d0270-7fffe33d02a8 call 7fffe33fd3f0 1922->1928 1933 7fffe33d02ad-7fffe33d02d9 1928->1933 1929->1902 1937 7fffe33d02db-7fffe33d02e5 call 7fffe33d9d30 1933->1937 1938 7fffe33d02ea-7fffe33d0307 1933->1938 1934->1917 1943 7fffe33cf73b-7fffe33cf765 1934->1943 1946 7fffe33cf82c-7fffe33cf885 call 7fffe33c29d0 call 7fffe33c2de0 1935->1946 1947 7fffe33cf7c5-7fffe33cf7de call 7fffe33d9d20 1935->1947 1937->1938 1943->1902 1955 7fffe33cf8be-7fffe33cf917 call 7fffe33c29d0 call 7fffe33c2de0 1946->1955 1956 7fffe33cf887-7fffe33cf8a0 call 7fffe33d9d20 1946->1956 1947->1922 1952 7fffe33cf7e4-7fffe33cf806 1947->1952 1952->1902 1964 7fffe33cf919-7fffe33cf932 call 7fffe33d9d20 1955->1964 1965 7fffe33cf950-7fffe33cf9ad call 7fffe33c29d0 call 7fffe33c2de0 1955->1965 1956->1905 1961 7fffe33cf8a6-7fffe33cf8b1 1956->1961 1961->1955 1964->1912 1971 7fffe33cf938-7fffe33cf943 1964->1971 1973 7fffe33cf9be-7fffe33cf9d2 CreateToolhelp32Snapshot 1965->1973 1974 7fffe33cf9af-7fffe33cf9bc 1965->1974 1971->1965 1976 7fffe33cf9ee-7fffe33cfa16 Thread32First 1973->1976 1977 7fffe33cf9d4-7fffe33cf9db 1973->1977 1975 7fffe33cf9e1-7fffe33cf9e9 call 7fffe33cc760 1974->1975 1975->1976 1979 7fffe33cfa1c-7fffe33cfa24 1976->1979 1980 7fffe33d01ea-7fffe33d01fa 1976->1980 1977->1975 1982 7fffe33cfab0-7fffe33cfac6 1979->1982 1980->1900 1985 7fffe33cfacc-7fffe33cfae8 CloseHandle 1982->1985 1986 7fffe33cfa29-7fffe33cfa99 GetLastError call 7fffe33e52a0 1982->1986 1990 7fffe33cfaee-7fffe33cfb02 1985->1990 1991 7fffe33cfd95-7fffe33cfdd7 1985->1991 1988 7fffe33cfa9e-7fffe33cfaaa Thread32Next 1986->1988 1988->1980 1988->1982 1992 7fffe33cfb08-7fffe33cfb16 1990->1992 1993 7fffe33d0153-7fffe33d018e call 7fffe33fc2a0 1990->1993 1994 7fffe33cfde2-7fffe33cfde9 call 7fffe33e52a0 1991->1994 1995 7fffe33cfb1c-7fffe33cfb2c 1992->1995 1996 7fffe33d012a-7fffe33d0132 call 7fffe33fc1d0 1992->1996 2000 7fffe33d0193-7fffe33d01a6 call 7fffe33fc1a0 1993->2000 2002 7fffe33cfdee-7fffe33cfdf2 1994->2002 1995->2000 2001 7fffe33cfb32-7fffe33cfb3c 1995->2001 2014 7fffe33d0137-7fffe33d014e call 7fffe33d9d30 1996->2014 2006 7fffe33d01ac-7fffe33d01e5 call 7fffe33fd3f0 2000->2006 2007 7fffe33cfb42-7fffe33cfb47 2000->2007 2001->2006 2001->2007 2002->1988 2006->1933 2010 7fffe33cfb4d-7fffe33cfc90 2007->2010 2011 7fffe33cfd01-7fffe33cfd24 call 7fffe33c1190 2007->2011 2015 7fffe33cfc93-7fffe33cfcac 2010->2015 2026 7fffe33cfd2a-7fffe33cfd93 GetLastError 2011->2026 2027 7fffe33cfe2f-7fffe33cfe38 SuspendThread 2011->2027 2014->2002 2018 7fffe33cfcae 2015->2018 2019 7fffe33cfce6-7fffe33cfcf2 2015->2019 2022 7fffe33cfcb2-7fffe33cfccb 2018->2022 2019->2011 2020 7fffe33cfcf4-7fffe33cfcff 2019->2020 2020->2015 2023 7fffe33cfdf7-7fffe33cfe24 call 7fffe33c1190 2022->2023 2024 7fffe33cfcd1-7fffe33cfce4 2022->2024 2023->1982 2037 7fffe33cfe2a 2023->2037 2024->2019 2024->2022 2026->1994 2028 7fffe33cff1b-7fffe33cff9a GetLastError call 7fffe33e52a0 2027->2028 2029 7fffe33cfe3e-7fffe33cfe65 call 7fffe33cc860 2027->2029 2028->1982 2038 7fffe33cfe6b-7fffe33cff02 call 7fffe33e52a0 2029->2038 2039 7fffe33cff9f-7fffe33d0037 call 7fffe33e52a0 call 7fffe33d2180 call 7fffe33d5b80 2029->2039 2037->1980 2046 7fffe33cff13-7fffe33cff16 2038->2046 2047 7fffe33cff04-7fffe33cff0e call 7fffe33d9d30 2038->2047 2039->1928 2057 7fffe33d003d-7fffe33d0079 call 7fffe33d9790 call 7fffe33c1190 2039->2057 2050 7fffe33d007e-7fffe33d0087 ResumeThread 2046->2050 2047->2046 2052 7fffe33d0089-7fffe33d0100 GetLastError call 7fffe33e52a0 2050->2052 2053 7fffe33d0105-7fffe33d010e 2050->2053 2052->2053 2058 7fffe33d0110-7fffe33d011f 2053->2058 2059 7fffe33d0121-7fffe33d0125 2053->2059 2057->2050 2058->2014 2058->2059 2059->2002
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.4286243601.00007FFFE33C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFFE33C0000, based on PE: true
                                                  • Associated: 00000002.00000002.4285328995.00007FFFE33C0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4287819193.00007FFFE33FE000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289006151.00007FFFE3413000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289870492.00007FFFE3414000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_7fffe33c0000_cmd.jbxd
                                                  Similarity
                                                  • API ID: DebugOutputStringmemset
                                                  • String ID: CreateToolhelp32SnapshotModule32FirstWModule32NextWThread32FirstThread32NextOpenThreadSuspendThreadResumeThreadGetProcessIdOfThreadNtCloseNtQueryInformationProcess$Failed to create snapshot.DLL data is empty.DLL already exists at $Failed to resolve GetProcessIdOfThreadFailed to get process ID.Failed to resolve GetCurrentProcessIdFailed to resolve OpenProcesstempdll.dllC:\Windows\Temp\tempdll.dllReading DLL from disk at path: $arenegyl$called `Result::unwrap()` on an `Err` valueC:\Users\Harrison\.rustup\toolchains\nightly-x86_64-pc-windows-msvc\lib/rustlib/src/rust\library\alloc\src\slice.rs$kernel32.dllNtCreateSectionNtMapViewOfSectionNtOpenFileZwOpenKeyZwCreateKeyZwSetValueKeyZwCloseVirtualAllocExGetCurrentProcessIdOpenProcessReadProcessMemoryCloseHandleWriteProcessMemoryCreateToolhelp32SnapshotModule32FirstWModule32NextWThread32FirstThread32Nex$modnarod$setybdep$uespemos
                                                  • API String ID: 1084755268-4288001161
                                                  • Opcode ID: 5f3da2fd1b393f383e6af6a1a42ec95b2463ea420fa724853d77b852e7a3b4fa
                                                  • Instruction ID: 7b0950cc976a0d1c6cfef2fb2935fb6ce4115797ece1ea31094d5308521e777d
                                                  • Opcode Fuzzy Hash: 5f3da2fd1b393f383e6af6a1a42ec95b2463ea420fa724853d77b852e7a3b4fa
                                                  • Instruction Fuzzy Hash: C3827276A08B818AE7218F60E8447E93BE5FB55788F508235DE8D67B99DF3CD244C342
                                                  Function 00007FFFE33D39D0 Relevance: 26.9, APIs: 13, Strings: 2, Instructions: 603COMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 2099 7fffe33d39d0-7fffe33d3b46 call 7fffe33f4070 memset 2102 7fffe33d3b4c-7fffe33d3b5e 2099->2102 2103 7fffe33d3bfa-7fffe33d3c1b OutputDebugStringW 2099->2103 2106 7fffe33d3b6a-7fffe33d3b8d 2102->2106 2107 7fffe33d3b60-7fffe33d3b68 2102->2107 2104 7fffe33d3c2b-7fffe33d3c33 2103->2104 2105 7fffe33d3c1d-7fffe33d3c26 call 7fffe33d9d30 2103->2105 2111 7fffe33d3c39-7fffe33d3c41 2104->2111 2112 7fffe33d3d3f-7fffe33d3d58 call 7fffe33d9d20 2104->2112 2105->2104 2109 7fffe33d3b90-7fffe33d3bc0 2106->2109 2108 7fffe33d3bc2-7fffe33d3bde 2107->2108 2114 7fffe33d3be0-7fffe33d3be7 2108->2114 2109->2108 2109->2109 2111->2112 2115 7fffe33d3c47-7fffe33d3d18 call 7fffe33f4070 memset 2111->2115 2119 7fffe33d3d5e-7fffe33d3d8e 2112->2119 2120 7fffe33d4519-7fffe33d452a call 7fffe33fcfa3 2112->2120 2114->2103 2117 7fffe33d3be9-7fffe33d3bf8 2114->2117 2124 7fffe33d3d1e-7fffe33d3d30 2115->2124 2125 7fffe33d3e2a-7fffe33d3e44 OutputDebugStringW 2115->2125 2117->2103 2117->2114 2123 7fffe33d42f3-7fffe33d4309 2119->2123 2126 7fffe33d452f 2120->2126 2129 7fffe33d3d93-7fffe33d3db6 2124->2129 2130 7fffe33d3d32-7fffe33d3d3a 2124->2130 2127 7fffe33d3e57-7fffe33d3e69 2125->2127 2128 7fffe33d3e46-7fffe33d3e52 call 7fffe33d9d30 2125->2128 2131 7fffe33d4532-7fffe33d454b call 7fffe33fcfa3 2126->2131 2134 7fffe33d3e6b-7fffe33d3e84 2127->2134 2135 7fffe33d3eba-7fffe33d3ee8 call 7fffe33fd262 2127->2135 2128->2127 2132 7fffe33d3dc0-7fffe33d3df0 2129->2132 2136 7fffe33d3df2-7fffe33d3e0e 2130->2136 2148 7fffe33d4578-7fffe33d45b6 2131->2148 2132->2132 2132->2136 2140 7fffe33d3eed-7fffe33d3f1b call 7fffe33fd262 2134->2140 2141 7fffe33d3e86-7fffe33d3e99 2134->2141 2135->2140 2139 7fffe33d3e10-7fffe33d3e17 2136->2139 2139->2125 2144 7fffe33d3e19-7fffe33d3e28 2139->2144 2147 7fffe33d3f20-7fffe33d3f2d call 7fffe33fbdb0 2140->2147 2145 7fffe33d3f33-7fffe33d3f79 call 7fffe33e1860 call 7fffe33d2b30 memcpy * 2 2141->2145 2146 7fffe33d3e9f-7fffe33d3ea7 2141->2146 2144->2125 2144->2139 2157 7fffe33d3f7e-7fffe33d3faa memcpy 2145->2157 2146->2147 2150 7fffe33d3ea9-7fffe33d3eb5 call 7fffe33de410 2146->2150 2147->2145 2147->2150 2150->2157 2157->2126 2159 7fffe33d3fb0-7fffe33d3fb7 2157->2159 2160 7fffe33d3fb9-7fffe33d3fd6 call 7fffe33d9d20 2159->2160 2161 7fffe33d3fe1 2159->2161 2160->2131 2167 7fffe33d3fdc-7fffe33d3fdf 2160->2167 2163 7fffe33d3fe7-7fffe33d4023 memcpy * 2 2161->2163 2165 7fffe33d4029-7fffe33d406d call 7fffe33d7ed0 2163->2165 2166 7fffe33d40b2-7fffe33d415d call 7fffe33f4070 memset 2163->2166 2165->2166 2174 7fffe33d406f-7fffe33d4083 2165->2174 2172 7fffe33d421a-7fffe33d4234 OutputDebugStringW 2166->2172 2173 7fffe33d4163-7fffe33d4175 2166->2173 2167->2163 2177 7fffe33d4247-7fffe33d42ba call 7fffe33e1e10 2172->2177 2178 7fffe33d4236-7fffe33d4242 call 7fffe33d9d30 2172->2178 2175 7fffe33d4177-7fffe33d417f 2173->2175 2176 7fffe33d4181-7fffe33d41a4 2173->2176 2174->2166 2179 7fffe33d4085-7fffe33d409e 2174->2179 2180 7fffe33d41e2-7fffe33d41fe 2175->2180 2181 7fffe33d41b0-7fffe33d41e0 2176->2181 2192 7fffe33d454d-7fffe33d4573 call 7fffe33fd3f0 2177->2192 2193 7fffe33d42c0-7fffe33d42e0 2177->2193 2178->2177 2184 7fffe33d40a0-7fffe33d40a3 2179->2184 2185 7fffe33d4200-7fffe33d4207 2180->2185 2181->2180 2181->2181 2187 7fffe33d40a9-7fffe33d40b0 2184->2187 2188 7fffe33d430a-7fffe33d431a 2184->2188 2185->2172 2191 7fffe33d4209-7fffe33d4218 2185->2191 2187->2166 2187->2184 2189 7fffe33d431c 2188->2189 2190 7fffe33d4323-7fffe33d4410 call 7fffe33f4070 memset 2188->2190 2189->2190 2199 7fffe33d44ca-7fffe33d44e4 OutputDebugStringW 2190->2199 2200 7fffe33d4416-7fffe33d4428 2190->2200 2191->2172 2191->2185 2192->2148 2193->2123 2196 7fffe33d42e2-7fffe33d42ee call 7fffe33d9d30 2193->2196 2196->2123 2203 7fffe33d44f7-7fffe33d4514 2199->2203 2204 7fffe33d44e6-7fffe33d44f2 call 7fffe33d9d30 2199->2204 2201 7fffe33d442a-7fffe33d4432 2200->2201 2202 7fffe33d4434-7fffe33d4457 2200->2202 2205 7fffe33d4492-7fffe33d44ae 2201->2205 2206 7fffe33d4460-7fffe33d4490 2202->2206 2203->2123 2204->2203 2208 7fffe33d44b0-7fffe33d44b7 2205->2208 2206->2205 2206->2206 2208->2199 2209 7fffe33d44b9-7fffe33d44c8 2208->2209 2209->2199 2209->2208
                                                  APIs
                                                  Strings
                                                  • a Display implementation returned an error unexpectedlyC:\Users\Harrison\.rustup\toolchains\nightly-x86_64-pc-windows-msvc\lib/rustlib/src/rust\library\alloc\src\string.rs, xrefs: 00007FFFE33D4559
                                                  • , xrefs: 00007FFFE33D3A7E
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.4286243601.00007FFFE33C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFFE33C0000, based on PE: true
                                                  • Associated: 00000002.00000002.4285328995.00007FFFE33C0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4287819193.00007FFFE33FE000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289006151.00007FFFE3413000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289870492.00007FFFE3414000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_7fffe33c0000_cmd.jbxd
                                                  Similarity
                                                  • API ID: memcpy$DebugOutputStringmemset
                                                  • String ID: $a Display implementation returned an error unexpectedlyC:\Users\Harrison\.rustup\toolchains\nightly-x86_64-pc-windows-msvc\lib/rustlib/src/rust\library\alloc\src\string.rs
                                                  • API String ID: 4201822616-3424599729
                                                  • Opcode ID: ed1087d9a686b1eaa5fd72b424d276ba4566e79deac30bbc11a36390656a22a4
                                                  • Instruction ID: 3a81e3186451925e216069d6bf8c6901463de634bf62a6cf9f3b229c7f47eb97
                                                  • Opcode Fuzzy Hash: ed1087d9a686b1eaa5fd72b424d276ba4566e79deac30bbc11a36390656a22a4
                                                  • Instruction Fuzzy Hash: 7F52C532A19BC589EB31CF60D844BE937A0FB55788F805135DA4D6BB8AEF799345C302
                                                  Function 00007FFFE33D4D50 Relevance: 25.1, APIs: 9, Strings: 5, Instructions: 626nativeCOMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 2210 7fffe33d4d50-7fffe33d4d98 2211 7fffe33d4da7-7fffe33d4dae 2210->2211 2212 7fffe33d589a-7fffe33d58b4 2211->2212 2213 7fffe33d4db4-7fffe33d4e3c call 7fffe33c29d0 call 7fffe33c5300 2211->2213 2218 7fffe33d58b5-7fffe33d58c8 call 7fffe33fd060 2213->2218 2219 7fffe33d4e42-7fffe33d4e45 2213->2219 2222 7fffe33d58cd-7fffe33d58e0 call 7fffe33fd060 2218->2222 2219->2218 2221 7fffe33d4e4b-7fffe33d4e92 call 7fffe33c29d0 call 7fffe33c5300 2219->2221 2221->2222 2231 7fffe33d4e98-7fffe33d4e9b 2221->2231 2226 7fffe33d58e5-7fffe33d58f8 call 7fffe33fd060 2222->2226 2230 7fffe33d58fd-7fffe33d594c call 7fffe33fd060 2226->2230 2236 7fffe33d594e-7fffe33d595e call 7fffe33d9d30 2230->2236 2237 7fffe33d5963-7fffe33d5978 2230->2237 2231->2222 2232 7fffe33d4ea1-7fffe33d4eea call 7fffe33c29d0 call 7fffe33c5300 2231->2232 2232->2226 2242 7fffe33d4ef0-7fffe33d4ef3 2232->2242 2236->2237 2242->2226 2243 7fffe33d4ef9-7fffe33d4f49 call 7fffe33c29d0 call 7fffe33c5300 2242->2243 2243->2230 2248 7fffe33d4f4f-7fffe33d4f55 2243->2248 2248->2230 2249 7fffe33d4f5b-7fffe33d5040 call 7fffe33d7650 call 7fffe33d9dc0 * 2 2248->2249 2257 7fffe33d5046-7fffe33d504b 2249->2257 2258 7fffe33d51c0-7fffe33d5289 call 7fffe33d7650 NtSetValueKey 2249->2258 2259 7fffe33d53a0-7fffe33d5483 call 7fffe33f4070 memset 2257->2259 2260 7fffe33d5051-7fffe33d50ab NtCreateKey 2257->2260 2267 7fffe33d54ae-7fffe33d556a call 7fffe33f4070 memset 2258->2267 2268 7fffe33d528f-7fffe33d536b call 7fffe33f4070 memset 2258->2268 2270 7fffe33d5489-7fffe33d549b 2259->2270 2271 7fffe33d5740-7fffe33d5754 OutputDebugStringW 2259->2271 2260->2258 2263 7fffe33d50b1-7fffe33d5194 call 7fffe33f4070 memset 2260->2263 2263->2271 2279 7fffe33d519a-7fffe33d51ac 2263->2279 2281 7fffe33d5810-7fffe33d582b OutputDebugStringW 2267->2281 2289 7fffe33d5570-7fffe33d5582 2267->2289 2268->2281 2282 7fffe33d5371-7fffe33d5383 2268->2282 2277 7fffe33d5595-7fffe33d55bf 2270->2277 2278 7fffe33d54a1-7fffe33d54a9 2270->2278 2275 7fffe33d5767-7fffe33d5771 2271->2275 2276 7fffe33d5756-7fffe33d5762 call 7fffe33d9d30 2271->2276 2284 7fffe33d5777-7fffe33d578c call 7fffe33d9d30 2275->2284 2285 7fffe33d4da0 2275->2285 2276->2275 2290 7fffe33d55c0-7fffe33d55ea 2277->2290 2286 7fffe33d55ec-7fffe33d55fd 2278->2286 2287 7fffe33d56b3-7fffe33d56df 2279->2287 2288 7fffe33d51b2-7fffe33d51ba 2279->2288 2299 7fffe33d583b-7fffe33d584f NtClose 2281->2299 2300 7fffe33d582d-7fffe33d5836 call 7fffe33d9d30 2281->2300 2292 7fffe33d5389-7fffe33d5391 2282->2292 2293 7fffe33d5623-7fffe33d564f 2282->2293 2284->2285 2285->2211 2291 7fffe33d5600-7fffe33d5607 2286->2291 2295 7fffe33d56e0-7fffe33d570a 2287->2295 2296 7fffe33d570c-7fffe33d571d 2288->2296 2297 7fffe33d5588-7fffe33d5590 2289->2297 2298 7fffe33d5791-7fffe33d57ad 2289->2298 2290->2286 2290->2290 2291->2271 2303 7fffe33d560d-7fffe33d561c 2291->2303 2304 7fffe33d567c-7fffe33d568d 2292->2304 2305 7fffe33d5650-7fffe33d567a 2293->2305 2295->2295 2295->2296 2308 7fffe33d5720-7fffe33d5727 2296->2308 2309 7fffe33d57dc-7fffe33d57ed 2297->2309 2307 7fffe33d57b0-7fffe33d57da 2298->2307 2301 7fffe33d5866-7fffe33d587a 2299->2301 2302 7fffe33d5851-7fffe33d5861 call 7fffe33d9d30 2299->2302 2300->2299 2301->2211 2313 7fffe33d5880-7fffe33d5895 call 7fffe33d9d30 2301->2313 2302->2301 2303->2291 2312 7fffe33d561e 2303->2312 2314 7fffe33d5690-7fffe33d5697 2304->2314 2305->2304 2305->2305 2307->2307 2307->2309 2308->2271 2316 7fffe33d5729-7fffe33d5738 2308->2316 2315 7fffe33d57f0-7fffe33d57f7 2309->2315 2312->2271 2313->2211 2314->2281 2318 7fffe33d569d-7fffe33d56ac 2314->2318 2315->2281 2319 7fffe33d57f9-7fffe33d5808 2315->2319 2316->2308 2320 7fffe33d573a 2316->2320 2318->2314 2322 7fffe33d56ae 2318->2322 2319->2315 2323 7fffe33d580a 2319->2323 2320->2271 2322->2281 2323->2281
                                                  APIs
                                                  Strings
                                                  • Failed to resolve ZwCreateKey, xrefs: 00007FFFE33D58CD
                                                  • Failed to resolve ZwOpenKeydll\src\reg.rs, xrefs: 00007FFFE33D58B5
                                                  • Failed to resolve ZwClose, xrefs: 00007FFFE33D58FD
                                                  • ZwOpenKeyZwCreateKeyZwSetValueKeyZwCloseVirtualAllocExGetCurrentProcessIdOpenProcessReadProcessMemoryCloseHandleWriteProcessMemoryCreateToolhelp32SnapshotModule32FirstWModule32NextWThread32FirstThread32NextOpenThreadSuspendThreadResumeThreadGetProcessIdOfThrea, xrefs: 00007FFFE33D4E12
                                                  • Failed to resolve ZwSetValueKey, xrefs: 00007FFFE33D58E5
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.4286243601.00007FFFE33C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFFE33C0000, based on PE: true
                                                  • Associated: 00000002.00000002.4285328995.00007FFFE33C0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4287819193.00007FFFE33FE000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289006151.00007FFFE3413000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289870492.00007FFFE3414000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_7fffe33c0000_cmd.jbxd
                                                  Similarity
                                                  • API ID: memset$DebugOutputString$CloseCreateValue
                                                  • String ID: Failed to resolve ZwClose$Failed to resolve ZwCreateKey$Failed to resolve ZwOpenKeydll\src\reg.rs$Failed to resolve ZwSetValueKey$ZwOpenKeyZwCreateKeyZwSetValueKeyZwCloseVirtualAllocExGetCurrentProcessIdOpenProcessReadProcessMemoryCloseHandleWriteProcessMemoryCreateToolhelp32SnapshotModule32FirstWModule32NextWThread32FirstThread32NextOpenThreadSuspendThreadResumeThreadGetProcessIdOfThrea
                                                  • API String ID: 3447179383-700680066
                                                  • Opcode ID: f4dda055498536c10ebc976d9ae0fed47c31de10feaaa11f1b6a4ccd018ccd9e
                                                  • Instruction ID: 69f8ad598719212f68028237c3143ae14ff072e52e7b548e900ae5950f9fbc28
                                                  • Opcode Fuzzy Hash: f4dda055498536c10ebc976d9ae0fed47c31de10feaaa11f1b6a4ccd018ccd9e
                                                  • Instruction Fuzzy Hash: 0E625172A15BC18EEB718F60D848BE977A9FB55788F804235DA4C6BB99DF388345C301
                                                  Function 00007FFFE33D2E40 Relevance: 25.0, APIs: 13, Strings: 1, Instructions: 529COMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 2324 7fffe33d2e40-7fffe33d2fc0 call 7fffe33f4070 memset 2327 7fffe33d307a-7fffe33d309b OutputDebugStringW 2324->2327 2328 7fffe33d2fc6-7fffe33d2fd8 2324->2328 2331 7fffe33d30ab-7fffe33d30b3 2327->2331 2332 7fffe33d309d-7fffe33d30a6 call 7fffe33d9d30 2327->2332 2329 7fffe33d2fda-7fffe33d2fe2 2328->2329 2330 7fffe33d2fe4-7fffe33d3007 2328->2330 2333 7fffe33d3042-7fffe33d305e 2329->2333 2334 7fffe33d3010-7fffe33d3040 2330->2334 2336 7fffe33d30fa-7fffe33d3113 call 7fffe33d9d20 2331->2336 2337 7fffe33d30b5-7fffe33d30bd 2331->2337 2332->2331 2339 7fffe33d3060-7fffe33d3067 2333->2339 2334->2333 2334->2334 2345 7fffe33d37eb-7fffe33d37fc call 7fffe33fcfa3 2336->2345 2346 7fffe33d3119-7fffe33d315a 2336->2346 2337->2336 2340 7fffe33d30bf-7fffe33d30d9 2337->2340 2339->2327 2342 7fffe33d3069-7fffe33d3078 2339->2342 2343 7fffe33d30df-7fffe33d30e7 2340->2343 2344 7fffe33d3172-7fffe33d31b8 call 7fffe33e1860 call 7fffe33d2b30 memcpy * 2 2340->2344 2342->2327 2342->2339 2348 7fffe33d30e9-7fffe33d30f5 call 7fffe33de410 2343->2348 2349 7fffe33d315f-7fffe33d316c call 7fffe33fbdb0 2343->2349 2360 7fffe33d31bd-7fffe33d31e8 memcpy 2344->2360 2357 7fffe33d3801 2345->2357 2350 7fffe33d37d4-7fffe33d37ea 2346->2350 2348->2360 2349->2344 2349->2348 2359 7fffe33d3803-7fffe33d381c call 7fffe33fcfa3 2357->2359 2367 7fffe33d3881-7fffe33d38bd 2359->2367 2360->2357 2363 7fffe33d31ee 2360->2363 2365 7fffe33d381e-7fffe33d3834 2363->2365 2366 7fffe33d31f4-7fffe33d3210 call 7fffe33d9d50 2363->2366 2368 7fffe33d383b-7fffe33d3854 call 7fffe33fd490 2365->2368 2366->2359 2374 7fffe33d3216-7fffe33d3236 2366->2374 2372 7fffe33d38bf-7fffe33d38cc call 7fffe33d9d30 2367->2372 2373 7fffe33d38d1-7fffe33d38ea 2367->2373 2368->2367 2372->2373 2374->2368 2377 7fffe33d323c-7fffe33d3281 memcpy * 2 2374->2377 2378 7fffe33d3283-7fffe33d328d 2377->2378 2379 7fffe33d3292-7fffe33d3388 memcpy memset call 7fffe33d8070 call 7fffe33d7fd0 2377->2379 2380 7fffe33d34af-7fffe33d355e call 7fffe33f4070 memset 2378->2380 2379->2380 2391 7fffe33d338e-7fffe33d339d 2379->2391 2386 7fffe33d361a-7fffe33d3634 OutputDebugStringW 2380->2386 2387 7fffe33d3564-7fffe33d3576 2380->2387 2392 7fffe33d3647-7fffe33d36ba call 7fffe33e1df0 2386->2392 2393 7fffe33d3636-7fffe33d3642 call 7fffe33d9d30 2386->2393 2389 7fffe33d3578-7fffe33d3580 2387->2389 2390 7fffe33d3582-7fffe33d35a5 2387->2390 2394 7fffe33d35e2-7fffe33d35f3 2389->2394 2395 7fffe33d35b0-7fffe33d35e0 2390->2395 2396 7fffe33d33a6-7fffe33d3484 call 7fffe33f4070 memset 2391->2396 2397 7fffe33d339f 2391->2397 2403 7fffe33d3856-7fffe33d387c call 7fffe33fd3f0 2392->2403 2404 7fffe33d36c0-7fffe33d36ee call 7fffe33d9d30 2392->2404 2393->2392 2400 7fffe33d3600-7fffe33d3607 2394->2400 2395->2394 2395->2395 2409 7fffe33d378a-7fffe33d37a4 OutputDebugStringW 2396->2409 2410 7fffe33d348a-7fffe33d349c 2396->2410 2397->2396 2400->2386 2405 7fffe33d3609-7fffe33d3618 2400->2405 2403->2367 2404->2350 2405->2386 2405->2400 2412 7fffe33d37b7-7fffe33d37cd 2409->2412 2413 7fffe33d37a6-7fffe33d37b2 call 7fffe33d9d30 2409->2413 2414 7fffe33d36f3-7fffe33d3716 2410->2414 2415 7fffe33d34a2-7fffe33d34aa 2410->2415 2412->2350 2413->2412 2417 7fffe33d3720-7fffe33d3750 2414->2417 2416 7fffe33d3752-7fffe33d376e 2415->2416 2419 7fffe33d3770-7fffe33d3777 2416->2419 2417->2416 2417->2417 2419->2409 2420 7fffe33d3779-7fffe33d3788 2419->2420 2420->2409 2420->2419
                                                  APIs
                                                  Strings
                                                  • a Display implementation returned an error unexpectedlyC:\Users\Harrison\.rustup\toolchains\nightly-x86_64-pc-windows-msvc\lib/rustlib/src/rust\library\alloc\src\string.rs, xrefs: 00007FFFE33D3862
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.4286243601.00007FFFE33C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFFE33C0000, based on PE: true
                                                  • Associated: 00000002.00000002.4285328995.00007FFFE33C0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4287819193.00007FFFE33FE000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289006151.00007FFFE3413000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289870492.00007FFFE3414000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_7fffe33c0000_cmd.jbxd
                                                  Similarity
                                                  • API ID: memcpy$memset$DebugOutputString
                                                  • String ID: a Display implementation returned an error unexpectedlyC:\Users\Harrison\.rustup\toolchains\nightly-x86_64-pc-windows-msvc\lib/rustlib/src/rust\library\alloc\src\string.rs
                                                  • API String ID: 4266836622-2517649730
                                                  • Opcode ID: 9689f64de2b983799eb92ded43608e3fcaf248a8afa5c0ab1898bbafa55b948d
                                                  • Instruction ID: 09cb252951631ae1cdc335af688a2f07e3d06450dd5d8e164a3722d1fe32ff55
                                                  • Opcode Fuzzy Hash: 9689f64de2b983799eb92ded43608e3fcaf248a8afa5c0ab1898bbafa55b948d
                                                  • Instruction Fuzzy Hash: E7429322A19BC18EE7718F20D8447E977A4FB55798F804235DA8D2BB8ADF7D9344C342
                                                  Function 00007FFFE33C7370 Relevance: 19.8, APIs: 6, Strings: 5, Instructions: 512COMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 2421 7fffe33c7370-7fffe33c73bb 2422 7fffe33c73c1-7fffe33c73d1 2421->2422 2423 7fffe33c7b83-7fffe33c7bc1 call 7fffe33fc2a0 2421->2423 2424 7fffe33c73d7-7fffe33c73e7 2422->2424 2425 7fffe33c7b76-7fffe33c7b7e call 7fffe33fc1d0 2422->2425 2429 7fffe33c7bc6-7fffe33c7bd4 call 7fffe33fc1a0 2423->2429 2428 7fffe33c73ed-7fffe33c73f6 2424->2428 2424->2429 2425->2423 2432 7fffe33c7bda-7fffe33c7c09 call 7fffe33fd3f0 2428->2432 2433 7fffe33c73fc-7fffe33c740e 2428->2433 2429->2432 2429->2433 2445 7fffe33c7c0b-7fffe33c7c19 call 7fffe33fc290 2432->2445 2435 7fffe33c75cb-7fffe33c7665 call 7fffe33f4070 memset 2433->2435 2436 7fffe33c7414-7fffe33c7559 2433->2436 2449 7fffe33c781a-7fffe33c782e OutputDebugStringW 2435->2449 2450 7fffe33c766b-7fffe33c767d 2435->2450 2439 7fffe33c755d-7fffe33c7575 2436->2439 2442 7fffe33c7577-7fffe33c7592 2439->2442 2443 7fffe33c75b0-7fffe33c75bc 2439->2443 2446 7fffe33c7598-7fffe33c75a3 2442->2446 2447 7fffe33c7690-7fffe33c7763 call 7fffe33f4070 memset 2442->2447 2443->2435 2448 7fffe33c75be-7fffe33c75c9 2443->2448 2460 7fffe33c7b58-7fffe33c7b75 2445->2460 2446->2442 2454 7fffe33c75a5 2446->2454 2467 7fffe33c7afa-7fffe33c7b0e OutputDebugStringW 2447->2467 2468 7fffe33c7769-7fffe33c777b 2447->2468 2448->2439 2455 7fffe33c7841-7fffe33c7862 2449->2455 2456 7fffe33c7830-7fffe33c783c call 7fffe33d9d30 2449->2456 2457 7fffe33c778e-7fffe33c77be 2450->2457 2458 7fffe33c7683-7fffe33c768b 2450->2458 2454->2443 2464 7fffe33c7872-7fffe33c7876 2455->2464 2456->2455 2462 7fffe33c77c0-7fffe33c77ea 2457->2462 2459 7fffe33c77ec-7fffe33c77fd 2458->2459 2469 7fffe33c7800-7fffe33c7807 2459->2469 2462->2459 2462->2462 2465 7fffe33c7a5d-7fffe33c7a70 2464->2465 2466 7fffe33c787c-7fffe33c787f 2464->2466 2472 7fffe33c7a76 2465->2472 2473 7fffe33c7b35-7fffe33c7b45 2465->2473 2470 7fffe33c7881-7fffe33c7886 2466->2470 2471 7fffe33c7890-7fffe33c78aa 2466->2471 2477 7fffe33c7b21-7fffe33c7b33 2467->2477 2478 7fffe33c7b10-7fffe33c7b1c call 7fffe33d9d30 2467->2478 2474 7fffe33c7a7b-7fffe33c7a9e 2468->2474 2475 7fffe33c7781-7fffe33c7789 2468->2475 2469->2449 2476 7fffe33c7809-7fffe33c7818 2469->2476 2479 7fffe33c78b9-7fffe33c7989 call 7fffe33f4070 memset 2470->2479 2471->2471 2480 7fffe33c78ac-7fffe33c78b7 2471->2480 2481 7fffe33c7b4b-7fffe33c7b52 2472->2481 2473->2481 2485 7fffe33c7c1e-7fffe33c7c2b call 7fffe33fc1a0 2473->2485 2482 7fffe33c7aa0-7fffe33c7aca 2474->2482 2483 7fffe33c7acc-7fffe33c7add 2475->2483 2476->2449 2476->2469 2477->2473 2477->2481 2478->2477 2493 7fffe33c7a2a-7fffe33c7a41 OutputDebugStringW 2479->2493 2494 7fffe33c798f-7fffe33c79a1 2479->2494 2480->2479 2481->2445 2481->2460 2482->2482 2482->2483 2488 7fffe33c7ae0-7fffe33c7ae7 2483->2488 2485->2481 2492 7fffe33c7c31-7fffe33c7c36 2485->2492 2488->2467 2491 7fffe33c7ae9-7fffe33c7af8 2488->2491 2491->2467 2491->2488 2492->2481 2497 7fffe33c7a47-7fffe33c7a58 call 7fffe33d9d30 2493->2497 2498 7fffe33c7870 2493->2498 2495 7fffe33c79b0-7fffe33c79cf 2494->2495 2496 7fffe33c79a3-7fffe33c79ab 2494->2496 2501 7fffe33c79d0-7fffe33c79fa 2495->2501 2500 7fffe33c79fc-7fffe33c7a0d 2496->2500 2497->2498 2498->2464 2503 7fffe33c7a10-7fffe33c7a17 2500->2503 2501->2500 2501->2501 2503->2493 2504 7fffe33c7a19-7fffe33c7a28 2503->2504 2504->2493 2504->2503
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.4286243601.00007FFFE33C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFFE33C0000, based on PE: true
                                                  • Associated: 00000002.00000002.4285328995.00007FFFE33C0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4287819193.00007FFFE33FE000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289006151.00007FFFE3413000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289870492.00007FFFE3414000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_7fffe33c0000_cmd.jbxd
                                                  Similarity
                                                  • API ID: DebugOutputStringmemset
                                                  • String ID: arenegyl$called `Result::unwrap()` on an `Err` value$modnarod$setybdet$uespemos
                                                  • API String ID: 1084755268-2410307170
                                                  • Opcode ID: 7760c54a6c5f10477ab89a5ce51ae536a971f476f7558458677c57535550c02d
                                                  • Instruction ID: e7cad0279321bd03f8d650c5338252e00b0011dd46d1f4e095992b98529625c8
                                                  • Opcode Fuzzy Hash: 7760c54a6c5f10477ab89a5ce51ae536a971f476f7558458677c57535550c02d
                                                  • Instruction Fuzzy Hash: 7C22E462B14B914EEB20CF64D858BE927A1FB15794F808236DE0D7BB99DF39D245C302
                                                  Function 00007FFFE33C4D40 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 295stringCOMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 2505 7fffe33c4d40-7fffe33c4d5d 2506 7fffe33c4e01-7fffe33c4e4a memset 2505->2506 2507 7fffe33c4d63-7fffe33c4d78 2505->2507 2510 7fffe33c51fc-7fffe33c5204 OutputDebugStringW 2506->2510 2508 7fffe33c4d7e-7fffe33c4d89 2507->2508 2509 7fffe33c4e4f 2507->2509 2511 7fffe33c4e54-7fffe33c4f0f call 7fffe33f4070 memset 2508->2511 2513 7fffe33c4d8f-7fffe33c4dfc memset 2508->2513 2509->2511 2512 7fffe33c520a-7fffe33c5223 2510->2512 2516 7fffe33c4fca-7fffe33c4fea OutputDebugStringW 2511->2516 2517 7fffe33c4f15-7fffe33c4f27 2511->2517 2513->2510 2520 7fffe33c4ffa-7fffe33c5001 2516->2520 2521 7fffe33c4fec-7fffe33c4ff5 call 7fffe33d9d30 2516->2521 2518 7fffe33c4f29-7fffe33c4f31 2517->2518 2519 7fffe33c4f33-7fffe33c4f56 2517->2519 2522 7fffe33c4f92-7fffe33c4fae 2518->2522 2523 7fffe33c4f60-7fffe33c4f90 2519->2523 2525 7fffe33c5198-7fffe33c51f3 memset 2520->2525 2526 7fffe33c5007-7fffe33c5028 2520->2526 2521->2520 2527 7fffe33c4fb0-7fffe33c4fb7 2522->2527 2523->2522 2523->2523 2525->2510 2528 7fffe33c503c-7fffe33c5092 strlen call 7fffe33f5580 2526->2528 2527->2516 2530 7fffe33c4fb9-7fffe33c4fc8 2527->2530 2532 7fffe33c5030-7fffe33c5036 2528->2532 2533 7fffe33c5094-7fffe33c50a3 memcmp 2528->2533 2530->2516 2530->2527 2532->2525 2532->2528 2533->2532 2534 7fffe33c50a5-7fffe33c516d call 7fffe33f4070 memset 2533->2534 2537 7fffe33c52ba-7fffe33c52da OutputDebugStringW 2534->2537 2538 7fffe33c5173-7fffe33c5185 2534->2538 2539 7fffe33c52ea-7fffe33c52f6 2537->2539 2540 7fffe33c52dc-7fffe33c52e5 call 7fffe33d9d30 2537->2540 2541 7fffe33c518b-7fffe33c5193 2538->2541 2542 7fffe33c5224-7fffe33c5247 2538->2542 2539->2512 2540->2539 2544 7fffe33c5282-7fffe33c529e 2541->2544 2545 7fffe33c5250-7fffe33c5280 2542->2545 2546 7fffe33c52a0-7fffe33c52a7 2544->2546 2545->2544 2545->2545 2546->2537 2547 7fffe33c52a9-7fffe33c52b8 2546->2547 2547->2537 2547->2546
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.4286243601.00007FFFE33C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFFE33C0000, based on PE: true
                                                  • Associated: 00000002.00000002.4285328995.00007FFFE33C0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4287819193.00007FFFE33FE000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289006151.00007FFFE3413000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289870492.00007FFFE3414000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_7fffe33c0000_cmd.jbxd
                                                  Similarity
                                                  • API ID: DebugOutputStringmemset$memcmpstrlen
                                                  • String ID: c
                                                  • API String ID: 2294051181-112844655
                                                  • Opcode ID: a99a8362994182443d460f0a35a543525b0d7538c43e9128a993a57949b76bad
                                                  • Instruction ID: 4ed27cc76fc34dd4d5c3095c6eb65b82a021dcea68e489b1a3adb00ac977d191
                                                  • Opcode Fuzzy Hash: a99a8362994182443d460f0a35a543525b0d7538c43e9128a993a57949b76bad
                                                  • Instruction Fuzzy Hash: 67E1B522A1CBC58AE7218B15E444BFAB7E1FB95784F804235DA8D63B55EF3CD185C702
                                                  Function 00007FFFE33C69E0 Relevance: 18.0, APIs: 6, Strings: 4, Instructions: 479COMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 2548 7fffe33c69e0-7fffe33c6a10 2549 7fffe33c6c31-7fffe33c6cbd call 7fffe33f4070 memset 2548->2549 2550 7fffe33c6a16-7fffe33c6a2d 2548->2550 2559 7fffe33c6e2a-7fffe33c6e45 OutputDebugStringW 2549->2559 2560 7fffe33c6cc3-7fffe33c6cd5 2549->2560 2552 7fffe33c70f7-7fffe33c7135 call 7fffe33fc2a0 2550->2552 2553 7fffe33c6a33-7fffe33c6a42 2550->2553 2562 7fffe33c713a-7fffe33c714d call 7fffe33fc1a0 2552->2562 2556 7fffe33c70ea-7fffe33c70f2 call 7fffe33fc1d0 2553->2556 2557 7fffe33c6a48-7fffe33c6a58 2553->2557 2556->2552 2557->2562 2563 7fffe33c6a5e-7fffe33c6a6e 2557->2563 2565 7fffe33c70dc-7fffe33c70e9 2559->2565 2566 7fffe33c6e4b-7fffe33c6e59 call 7fffe33d9d30 2559->2566 2567 7fffe33c6cdb-7fffe33c6ce3 2560->2567 2568 7fffe33c6da6-7fffe33c6dc9 2560->2568 2570 7fffe33c6a74-7fffe33c6a80 2562->2570 2571 7fffe33c7153-7fffe33c71f0 call 7fffe33f4070 call 7fffe33d49b0 2562->2571 2563->2570 2563->2571 2566->2565 2574 7fffe33c6dfc-7fffe33c6e0d 2567->2574 2572 7fffe33c6dd0-7fffe33c6dfa 2568->2572 2576 7fffe33c6f18-7fffe33c6fdd call 7fffe33d9510 call 7fffe33f4070 memset 2570->2576 2577 7fffe33c6a86-7fffe33c6bca 2570->2577 2594 7fffe33c720b-7fffe33c723d call 7fffe33fd0c0 2571->2594 2595 7fffe33c71f2-7fffe33c7206 call 7fffe33d9d30 2571->2595 2572->2572 2572->2574 2582 7fffe33c6e10-7fffe33c6e17 2574->2582 2599 7fffe33c708a-7fffe33c709e OutputDebugStringW 2576->2599 2600 7fffe33c6fe3-7fffe33c6ff5 2576->2600 2579 7fffe33c6bce-7fffe33c6be6 2577->2579 2584 7fffe33c6be8-7fffe33c6bff 2579->2584 2585 7fffe33c6c12-7fffe33c6c1e 2579->2585 2582->2559 2588 7fffe33c6e19-7fffe33c6e28 2582->2588 2589 7fffe33c6ce8-7fffe33c6d7b call 7fffe33f4070 memset 2584->2589 2590 7fffe33c6c05-7fffe33c6c10 2584->2590 2585->2576 2593 7fffe33c6c24-7fffe33c6c2f 2585->2593 2588->2559 2588->2582 2608 7fffe33c6eea-7fffe33c6f05 OutputDebugStringW 2589->2608 2609 7fffe33c6d81-7fffe33c6d93 2589->2609 2590->2584 2590->2585 2593->2579 2614 7fffe33c723f-7fffe33c7247 call 7fffe33fc290 2594->2614 2595->2594 2606 7fffe33c70b1-7fffe33c70bf 2599->2606 2607 7fffe33c70a0-7fffe33c70ac call 7fffe33d9d30 2599->2607 2603 7fffe33c6ff7-7fffe33c6fff 2600->2603 2604 7fffe33c7001-7fffe33c702f 2600->2604 2612 7fffe33c705c-7fffe33c706d 2603->2612 2613 7fffe33c7030-7fffe33c705a 2604->2613 2610 7fffe33c70c1-7fffe33c70ca 2606->2610 2611 7fffe33c70d0-7fffe33c70d6 2606->2611 2607->2606 2608->2576 2616 7fffe33c6f07-7fffe33c6f13 call 7fffe33d9d30 2608->2616 2617 7fffe33c6d99-7fffe33c6da1 2609->2617 2618 7fffe33c6e5e-7fffe33c6e8e 2609->2618 2610->2611 2619 7fffe33c724c-7fffe33c7253 call 7fffe33fc1a0 2610->2619 2611->2565 2611->2614 2622 7fffe33c7070-7fffe33c7077 2612->2622 2613->2612 2613->2613 2614->2565 2616->2576 2624 7fffe33c6ebc-7fffe33c6ecd 2617->2624 2621 7fffe33c6e90-7fffe33c6eba 2618->2621 2619->2611 2631 7fffe33c7259-7fffe33c725d 2619->2631 2621->2621 2621->2624 2622->2599 2626 7fffe33c7079-7fffe33c7088 2622->2626 2627 7fffe33c6ed0-7fffe33c6ed7 2624->2627 2626->2599 2626->2622 2627->2608 2629 7fffe33c6ed9-7fffe33c6ee8 2627->2629 2629->2608 2629->2627 2631->2611
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.4286243601.00007FFFE33C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFFE33C0000, based on PE: true
                                                  • Associated: 00000002.00000002.4285328995.00007FFFE33C0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4287819193.00007FFFE33FE000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289006151.00007FFFE3413000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289870492.00007FFFE3414000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_7fffe33c0000_cmd.jbxd
                                                  Similarity
                                                  • API ID: DebugOutputStringmemset
                                                  • String ID: arenegyl$modnarod$setybdet$uespemos
                                                  • API String ID: 1084755268-66988881
                                                  • Opcode ID: 75cfd657d3a214e58818f3ecfb42dc858ebb0d6185f5b3221b4adba905bb8493
                                                  • Instruction ID: 9c9f9b175a2c2e46d20de13af1fda20ab3c8931d2e1629068f4d0097df755040
                                                  • Opcode Fuzzy Hash: 75cfd657d3a214e58818f3ecfb42dc858ebb0d6185f5b3221b4adba905bb8493
                                                  • Instruction Fuzzy Hash: CF22C572A15BC18EEB20CF60D8587E827A1EB15788F844236DE4D7BB5ADF39D245C342
                                                  Function 00007FFFE33C21F0 Relevance: 17.9, APIs: 5, Strings: 5, Instructions: 440COMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 2632 7fffe33c21f0-7fffe33c2234 2633 7fffe33c223a-7fffe33c2249 2632->2633 2634 7fffe33c2850-7fffe33c289d call 7fffe33fc2a0 2632->2634 2635 7fffe33c224f-7fffe33c2257 2633->2635 2636 7fffe33c28a3-7fffe33c28b2 call 7fffe33fc4b0 2633->2636 2634->2635 2634->2636 2635->2636 2638 7fffe33c225d-7fffe33c2264 2635->2638 2641 7fffe33c226a-7fffe33c2276 2636->2641 2642 7fffe33c28b8-7fffe33c28ec call 7fffe33fd3f0 2636->2642 2638->2641 2638->2642 2644 7fffe33c227c-7fffe33c23c0 2641->2644 2645 7fffe33c242b-7fffe33c24c5 call 7fffe33f4070 memset 2641->2645 2653 7fffe33c2910-7fffe33c2952 2642->2653 2648 7fffe33c23c4-7fffe33c23dc 2644->2648 2654 7fffe33c26da-7fffe33c26ee OutputDebugStringW 2645->2654 2655 7fffe33c24cb-7fffe33c24dd 2645->2655 2651 7fffe33c23de-7fffe33c23f9 2648->2651 2652 7fffe33c2410-7fffe33c241c 2648->2652 2658 7fffe33c24f0-7fffe33c2627 call 7fffe33f4070 memset 2651->2658 2659 7fffe33c23ff-7fffe33c240a 2651->2659 2652->2645 2660 7fffe33c241e-7fffe33c2429 2652->2660 2656 7fffe33c2954-7fffe33c2962 2653->2656 2657 7fffe33c2963-7fffe33c2968 call 7fffe33fc7c0 2653->2657 2666 7fffe33c2701-7fffe33c270e 2654->2666 2667 7fffe33c26f0-7fffe33c26fc call 7fffe33d9d30 2654->2667 2661 7fffe33c2652-7fffe33c2675 2655->2661 2662 7fffe33c24e3-7fffe33c24eb 2655->2662 2657->2656 2676 7fffe33c279a-7fffe33c27ae OutputDebugStringW 2658->2676 2677 7fffe33c262d-7fffe33c263f 2658->2677 2659->2651 2665 7fffe33c240c 2659->2665 2660->2648 2673 7fffe33c2680-7fffe33c26aa 2661->2673 2670 7fffe33c26ac-7fffe33c26bd 2662->2670 2665->2652 2669 7fffe33c2822-7fffe33c2838 2666->2669 2667->2666 2674 7fffe33c28ee-7fffe33c28f6 call 7fffe33fc7c0 2669->2674 2675 7fffe33c283e-7fffe33c284f 2669->2675 2678 7fffe33c26c0-7fffe33c26c7 2670->2678 2673->2670 2673->2673 2674->2675 2679 7fffe33c27c1-7fffe33c27cf 2676->2679 2680 7fffe33c27b0-7fffe33c27bc call 7fffe33d9d30 2676->2680 2681 7fffe33c2645-7fffe33c264d 2677->2681 2682 7fffe33c2713-7fffe33c273f 2677->2682 2678->2654 2683 7fffe33c26c9-7fffe33c26d8 2678->2683 2688 7fffe33c28fb 2679->2688 2689 7fffe33c27d5-7fffe33c27d9 2679->2689 2680->2679 2687 7fffe33c276c-7fffe33c277d 2681->2687 2685 7fffe33c2740-7fffe33c276a 2682->2685 2683->2654 2683->2678 2685->2685 2685->2687 2692 7fffe33c2780-7fffe33c2787 2687->2692 2691 7fffe33c28fe-7fffe33c290b call 7fffe33fcfa3 2688->2691 2693 7fffe33c27db-7fffe33c27f8 call 7fffe33d9d20 2689->2693 2694 7fffe33c2803 2689->2694 2691->2653 2692->2676 2697 7fffe33c2789-7fffe33c2798 2692->2697 2693->2691 2700 7fffe33c27fe-7fffe33c2801 2693->2700 2695 7fffe33c2809-7fffe33c281e memcpy 2694->2695 2695->2669 2697->2676 2697->2692 2700->2695
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.4286243601.00007FFFE33C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFFE33C0000, based on PE: true
                                                  • Associated: 00000002.00000002.4285328995.00007FFFE33C0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4287819193.00007FFFE33FE000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289006151.00007FFFE3413000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289870492.00007FFFE3414000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_7fffe33c0000_cmd.jbxd
                                                  Similarity
                                                  • API ID: DebugOutputStringmemset$memcpy
                                                  • String ID: arenegyl$called `Result::unwrap()` on an `Err` value$modnarod$setybdet$uespemos
                                                  • API String ID: 293864031-2410307170
                                                  • Opcode ID: 2b8b1b3890193a5683e3120ba43e33a864b8d9a1fba94803cb782c47358c8554
                                                  • Instruction ID: 92c32cb58a26ac8352479389a34362fc3eaabd7d51b0cc3e982a41673ca7f6cf
                                                  • Opcode Fuzzy Hash: 2b8b1b3890193a5683e3120ba43e33a864b8d9a1fba94803cb782c47358c8554
                                                  • Instruction Fuzzy Hash: 1402E472A15B814AEB20CF60D858BE937A1FB55798F808232DE1DB7799DF3C9245C342
                                                  Function 00007FFFE33C1350 Relevance: 14.6, APIs: 2, Strings: 6, Instructions: 576COMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 2777 7fffe33c1350-7fffe33c13b1 2778 7fffe33c1f98-7fffe33c1fd6 call 7fffe33fc2a0 2777->2778 2779 7fffe33c13b7-7fffe33c13c9 2777->2779 2784 7fffe33c1fdb-7fffe33c1fe8 call 7fffe33fc1a0 2778->2784 2780 7fffe33c13cf-7fffe33c13df 2779->2780 2781 7fffe33c1f84-7fffe33c1f8c call 7fffe33fc690 2779->2781 2780->2784 2785 7fffe33c13e5-7fffe33c13ed 2780->2785 2795 7fffe33c1f91-7fffe33c1f96 call 7fffe33fc7c0 2781->2795 2789 7fffe33c1fee-7fffe33c201d call 7fffe33fd3f0 2784->2789 2790 7fffe33c13f3-7fffe33c1419 call 7fffe33d9d20 2784->2790 2785->2789 2785->2790 2797 7fffe33c2092-7fffe33c20e3 call 7fffe33d5d30 2789->2797 2799 7fffe33c141f-7fffe33c1c16 2790->2799 2800 7fffe33c2083-7fffe33c208d call 7fffe33fcfc0 2790->2800 2808 7fffe33c1f69-7fffe33c1f83 2795->2808 2801 7fffe33c1c2b-7fffe33c1c32 2799->2801 2800->2797 2805 7fffe33c1f19-7fffe33c1f3a call 7fffe33d9d30 2801->2805 2806 7fffe33c1c38-7fffe33c1c86 call 7fffe33d2e40 2801->2806 2813 7fffe33c1f3c-7fffe33c1f4c 2805->2813 2814 7fffe33c1f52-7fffe33c1f67 2805->2814 2815 7fffe33c1c8c-7fffe33c1c9a 2806->2815 2816 7fffe33c203b-7fffe33c2081 call 7fffe33fd3f0 2806->2816 2813->2814 2817 7fffe33c201f-7fffe33c202c call 7fffe33fc1a0 2813->2817 2814->2795 2814->2808 2818 7fffe33c1ca0-7fffe33c1ca7 2815->2818 2819 7fffe33c1d54-7fffe33c1d86 call 7fffe33d99e0 2815->2819 2816->2797 2817->2814 2830 7fffe33c2032-7fffe33c2036 2817->2830 2821 7fffe33c1d29-7fffe33c1d30 2818->2821 2822 7fffe33c1cad-7fffe33c1cba 2818->2822 2832 7fffe33c1d88 2819->2832 2833 7fffe33c1d9c-7fffe33c1e42 call 7fffe33f4070 memset 2819->2833 2821->2819 2828 7fffe33c1d32-7fffe33c1d35 2821->2828 2826 7fffe33c1cc0-7fffe33c1d27 2822->2826 2826->2821 2826->2826 2831 7fffe33c1d40-7fffe33c1d52 2828->2831 2830->2814 2831->2819 2831->2831 2832->2833 2834 7fffe33c1d8a-7fffe33c1d97 call 7fffe33d9d30 2832->2834 2838 7fffe33c1eea-7fffe33c1efd OutputDebugStringW 2833->2838 2839 7fffe33c1e48-7fffe33c1e5a 2833->2839 2834->2833 2842 7fffe33c1c20-7fffe33c1c24 2838->2842 2843 7fffe33c1f03-7fffe33c1f14 call 7fffe33d9d30 2838->2843 2840 7fffe33c1e5c-7fffe33c1e64 2839->2840 2841 7fffe33c1e70-7fffe33c1e8f 2839->2841 2844 7fffe33c1ebc-7fffe33c1ecd 2840->2844 2845 7fffe33c1e90-7fffe33c1eba 2841->2845 2842->2801 2843->2842 2847 7fffe33c1ed0-7fffe33c1ed7 2844->2847 2845->2844 2845->2845 2847->2838 2849 7fffe33c1ed9-7fffe33c1ee8 2847->2849 2849->2838 2849->2847
                                                  APIs
                                                  Strings
                                                  • NtGetContextThreadNtSetContextThreadNtCloseNtCreateThreadExNtCreateProcessExNtQueryInformationThreadGetProcessIdOfThreadWriteProcessMemoryReadProcessMemoryOpenProcessVirtualProtectExCloseHandleVirtualAllocVirtualProtectOpenThreadCreateToolhelp32SnapshotThread3, xrefs: 00007FFFE33C15CC
                                                  • RtlCaptureStackBackTraceLoadLibraryAGetProcAddressLdrGetDllHandleByMappingLdrRegisterDllNotificationVirtualAllocExVirtualFreeExEnumProcessModulesGetModuleFileNameExWNtCreateSectionFailed to encrypt function name, xrefs: 00007FFFE33C1B0B
                                                  • NtProtectVirtualMemoryNtAllocateVirtualMemoryNtMapViewOfSectionNtUnmapViewOfSectionNtOpenFileLdrLoadDllEtwEventWriteFullEtwEventWriteEtwEventWriteTransferWDEnableMpWDEnableMpScanStartMpSampleSubmitMpAmsiNotifyMpSampleQueryMpAmsiScanMpThreatActionNtResumeThread, xrefs: 00007FFFE33C1434
                                                  • FindFirstFileWFindNextFileWNtQueryDirectoryFileRegQueryValueExWNtEnumerateKeyGetAsyncKeyStateSetWindowsHookExWLogonUserWCredEnumerateWCreateProcessWNtQueryInformationProcessVirtualQueryExGetProcessIdNtOpenProcessNtWriteVirtualMemoryNtReadVirtualMemoryLoadLibra, xrefs: 00007FFFE33C1962
                                                  • Thread32NextVirtualFreeWaitForSingleObjectTerminateThreadSuspendThreadResumeThreadIsWow64ProcessModule32FirstWModule32NextWGetCurrentProcessIdProcess32FirstWProcess32NextWZwOpenKeyZwCreateKeyZwSetValueKeyZwCloseCreateRemoteThreadNtQuerySystemInformationEnumPro, xrefs: 00007FFFE33C1787
                                                  • called `Result::unwrap()` on an `Err` value, xrefs: 00007FFFE33C2001
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.4286243601.00007FFFE33C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFFE33C0000, based on PE: true
                                                  • Associated: 00000002.00000002.4285328995.00007FFFE33C0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4287819193.00007FFFE33FE000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289006151.00007FFFE3413000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289870492.00007FFFE3414000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_7fffe33c0000_cmd.jbxd
                                                  Similarity
                                                  • API ID: DebugOutputStringmemset
                                                  • String ID: FindFirstFileWFindNextFileWNtQueryDirectoryFileRegQueryValueExWNtEnumerateKeyGetAsyncKeyStateSetWindowsHookExWLogonUserWCredEnumerateWCreateProcessWNtQueryInformationProcessVirtualQueryExGetProcessIdNtOpenProcessNtWriteVirtualMemoryNtReadVirtualMemoryLoadLibra$NtGetContextThreadNtSetContextThreadNtCloseNtCreateThreadExNtCreateProcessExNtQueryInformationThreadGetProcessIdOfThreadWriteProcessMemoryReadProcessMemoryOpenProcessVirtualProtectExCloseHandleVirtualAllocVirtualProtectOpenThreadCreateToolhelp32SnapshotThread3$NtProtectVirtualMemoryNtAllocateVirtualMemoryNtMapViewOfSectionNtUnmapViewOfSectionNtOpenFileLdrLoadDllEtwEventWriteFullEtwEventWriteEtwEventWriteTransferWDEnableMpWDEnableMpScanStartMpSampleSubmitMpAmsiNotifyMpSampleQueryMpAmsiScanMpThreatActionNtResumeThread$RtlCaptureStackBackTraceLoadLibraryAGetProcAddressLdrGetDllHandleByMappingLdrRegisterDllNotificationVirtualAllocExVirtualFreeExEnumProcessModulesGetModuleFileNameExWNtCreateSectionFailed to encrypt function name$Thread32NextVirtualFreeWaitForSingleObjectTerminateThreadSuspendThreadResumeThreadIsWow64ProcessModule32FirstWModule32NextWGetCurrentProcessIdProcess32FirstWProcess32NextWZwOpenKeyZwCreateKeyZwSetValueKeyZwCloseCreateRemoteThreadNtQuerySystemInformationEnumPro$called `Result::unwrap()` on an `Err` value
                                                  • API String ID: 1084755268-2364454806
                                                  • Opcode ID: a86cba747b19a2dec166d534096d0180d25d3942452bb73cc62a98bc57aa5ca0
                                                  • Instruction ID: fad67bc934e668c121d202f0e6957ddc559faab36d17c323f30f04c752c3435e
                                                  • Opcode Fuzzy Hash: a86cba747b19a2dec166d534096d0180d25d3942452bb73cc62a98bc57aa5ca0
                                                  • Instruction Fuzzy Hash: 6C72FC37905F919AE791CB10E888BE937E4FB58348F90423ADA8C67765DF789264C343
                                                  Function 00007FFFE33EA380 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 139COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  • C:\Windows\Temp\tempdll.dllReading DLL from disk at path: , xrefs: 00007FFFE33EA389
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.4286243601.00007FFFE33C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFFE33C0000, based on PE: true
                                                  • Associated: 00000002.00000002.4285328995.00007FFFE33C0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4287819193.00007FFFE33FE000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289006151.00007FFFE3413000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289870492.00007FFFE3414000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_7fffe33c0000_cmd.jbxd
                                                  Similarity
                                                  • API ID: CloseFind$FileFirstHandlememset
                                                  • String ID: C:\Windows\Temp\tempdll.dllReading DLL from disk at path:
                                                  • API String ID: 4181070385-2284096931
                                                  • Opcode ID: 5ee60c58de973cf3f2ff7aa9cccd6a501006a2920e5c456d85bcf94a7d278fb2
                                                  • Instruction ID: e7878baaafa66023a47f9eceb887d2269a8da96ffab55b8a8302627c9c2c07c4
                                                  • Opcode Fuzzy Hash: 5ee60c58de973cf3f2ff7aa9cccd6a501006a2920e5c456d85bcf94a7d278fb2
                                                  • Instruction Fuzzy Hash: 64518272A04B418AE7348F62E8487AA7BE1FB54798F104235CEAD2BBD5DF3C91858701
                                                  Function 00007FFFE33DA590 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 95librarywindowCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.4286243601.00007FFFE33C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFFE33C0000, based on PE: true
                                                  • Associated: 00000002.00000002.4285328995.00007FFFE33C0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4287819193.00007FFFE33FE000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289006151.00007FFFE3413000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289870492.00007FFFE3414000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_7fffe33c0000_cmd.jbxd
                                                  Similarity
                                                  • API ID: FormatLibraryLoadMessage
                                                  • String ID: ntdll.dll
                                                  • API String ID: 1084892078-2227199552
                                                  • Opcode ID: e48b8ad3fda81750e1c063c99fcf2319019cb68c3552c86d4b8f162092683056
                                                  • Instruction ID: 2a39e35b117af43951ba220691dfee4604dea96d0172365189015bbef3864203
                                                  • Opcode Fuzzy Hash: e48b8ad3fda81750e1c063c99fcf2319019cb68c3552c86d4b8f162092683056
                                                  • Instruction Fuzzy Hash: 12417132B14B418AF7208BA1E548BAD6BF1BB54798F944135DE8D73BD8EF7CA1848301
                                                  Function 00007FFFE33E53B0 Relevance: 4.8, APIs: 3, Instructions: 263filenativesynchronizationCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.4286243601.00007FFFE33C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFFE33C0000, based on PE: true
                                                  • Associated: 00000002.00000002.4285328995.00007FFFE33C0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4287819193.00007FFFE33FE000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289006151.00007FFFE3413000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289870492.00007FFFE3414000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_7fffe33c0000_cmd.jbxd
                                                  Similarity
                                                  • API ID: FileObjectReadSingleWait
                                                  • String ID:
                                                  • API String ID: 631497895-0
                                                  • Opcode ID: 8a661f6288b8bf3bb1ff704ba2b3738c51b4a02c125fee6866ff5a45f1fdacd1
                                                  • Instruction ID: 7e7d9407717d5324c1715b377ea6995c0b8fc34eb8136daa75d55e81e8849b66
                                                  • Opcode Fuzzy Hash: 8a661f6288b8bf3bb1ff704ba2b3738c51b4a02c125fee6866ff5a45f1fdacd1
                                                  • Instruction Fuzzy Hash: 23A18922B04B414BFB248E269D087A96BF1AB247A8F544735DE6E77BD4DF7CE4818301
                                                  Function 00007FFFE33EA7A0 Relevance: 4.6, APIs: 3, Instructions: 74filenativesynchronizationCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.4286243601.00007FFFE33C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFFE33C0000, based on PE: true
                                                  • Associated: 00000002.00000002.4285328995.00007FFFE33C0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4287819193.00007FFFE33FE000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289006151.00007FFFE3413000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289870492.00007FFFE3414000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_7fffe33c0000_cmd.jbxd
                                                  Similarity
                                                  • API ID: ErrorFileObjectReadSingleStatusWait
                                                  • String ID:
                                                  • API String ID: 3583596364-0
                                                  • Opcode ID: 1da58ea186231a0f7315c95dff934c67a8b525bad67fa97c252c166cc7286c88
                                                  • Instruction ID: 5710def3a0db9c29c886deccaa3366a9557acf6088ce29801995a3cb71e6d347
                                                  • Opcode Fuzzy Hash: 1da58ea186231a0f7315c95dff934c67a8b525bad67fa97c252c166cc7286c88
                                                  • Instruction Fuzzy Hash: 2531A232B14B818EF710CB35E8447E93BE5EB58358F508131EA5DA2B94EF38D5958701
                                                  Function 00007FFFE33D60B0 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 238threadwindowCOMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  APIs
                                                  Strings
                                                  • YOU HAVE BEEN INFECTED BY BILLC:\Users\Harrison\.rustup\toolchains\nightly-x86_64-pc-windows-msvc\lib/rustlib/src/rust\library\core\src\iter\traits\iterator.rs, xrefs: 00007FFFE33D61FB
                                                  • Bill Keaners Virus NotificationFailed to remap system modules: , xrefs: 00007FFFE33D6232
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.4286243601.00007FFFE33C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFFE33C0000, based on PE: true
                                                  • Associated: 00000002.00000002.4285328995.00007FFFE33C0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4287819193.00007FFFE33FE000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289006151.00007FFFE3413000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289870492.00007FFFE3414000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_7fffe33c0000_cmd.jbxd
                                                  Similarity
                                                  • API ID: DebugOutputStringmemset$CallsDisableErrorLastLibraryMessageThread
                                                  • String ID: Bill Keaners Virus NotificationFailed to remap system modules: $YOU HAVE BEEN INFECTED BY BILLC:\Users\Harrison\.rustup\toolchains\nightly-x86_64-pc-windows-msvc\lib/rustlib/src/rust\library\core\src\iter\traits\iterator.rs
                                                  • API String ID: 941661592-2279533013
                                                  • Opcode ID: 733bc35e339cce3e4c071547e0d5796fff2ccca9504961028c5eea382130f005
                                                  • Instruction ID: 87b59c741225aa7d3a2c2db56bc2da4b806947970392d4b007a35ec387471dd0
                                                  • Opcode Fuzzy Hash: 733bc35e339cce3e4c071547e0d5796fff2ccca9504961028c5eea382130f005
                                                  • Instruction Fuzzy Hash: 7CD19621A04AC58AF7224F38D84A7F867F1FF64359F445235EE8C66674EF39928AC341
                                                  Function 00007FFFE33D6937 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 199COMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.4286243601.00007FFFE33C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFFE33C0000, based on PE: true
                                                  • Associated: 00000002.00000002.4285328995.00007FFFE33C0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4287819193.00007FFFE33FE000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289006151.00007FFFE3413000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289870492.00007FFFE3414000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_7fffe33c0000_cmd.jbxd
                                                  Similarity
                                                  • API ID: DebugOutputStringmemset
                                                  • String ID: .$d
                                                  • API String ID: 1084755268-1990587935
                                                  • Opcode ID: 480eff27deceacaef144a112cb131a1e873a598519554838e54a36150986e7bf
                                                  • Instruction ID: 9a0ff8f8e479b59347ea82ecfac0b8906d05a0439881c6685fdb4ce7e731cbd9
                                                  • Opcode Fuzzy Hash: 480eff27deceacaef144a112cb131a1e873a598519554838e54a36150986e7bf
                                                  • Instruction Fuzzy Hash: AEA1B622A14AC58AF7218F39D8497F867A1FF64788F845231DE4C77A69EF39D285C301
                                                  Function 00007FFFE33D9F50 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 154COMMON
                                                  Download Yara Rule

                                                  Control-flow Graph

                                                  • Executed
                                                  • Not Executed
                                                  control_flow_graph 2735 7fffe33d9f50-7fffe33d9f7b 2736 7fffe33da13c-7fffe33da14c call 7fffe33da590 2735->2736 2737 7fffe33d9f81-7fffe33d9fae 2735->2737 2740 7fffe33da151 2736->2740 2741 7fffe33d9fb4-7fffe33d9fef 2737->2741 2742 7fffe33da041-7fffe33da048 2737->2742 2743 7fffe33da15e-7fffe33da170 2740->2743 2750 7fffe33d9ff7-7fffe33d9ffe 2741->2750 2751 7fffe33d9ff1 SysFreeString 2741->2751 2744 7fffe33da04a-7fffe33da052 SysStringLen 2742->2744 2745 7fffe33da065-7fffe33da07f 2742->2745 2744->2745 2746 7fffe33da054-7fffe33da061 2744->2746 2749 7fffe33da081-7fffe33da08c SysStringLen 2745->2749 2753 7fffe33da0ca 2745->2753 2748 7fffe33da063 2746->2748 2746->2749 2748->2753 2749->2753 2756 7fffe33da08e-7fffe33da0a7 SysStringLen 2749->2756 2754 7fffe33da01b-7fffe33da01f 2750->2754 2755 7fffe33da000-7fffe33da008 SysStringLen 2750->2755 2751->2750 2761 7fffe33da0cd-7fffe33da0f5 2753->2761 2760 7fffe33da034 2754->2760 2757 7fffe33da00a-7fffe33da011 2755->2757 2758 7fffe33da021-7fffe33da02c 2755->2758 2759 7fffe33da0b5-7fffe33da0c1 2756->2759 2762 7fffe33da038-7fffe33da03b 2757->2762 2763 7fffe33da013-7fffe33da019 SysFreeString 2757->2763 2758->2760 2766 7fffe33da02e SysFreeString 2758->2766 2764 7fffe33da0c3-7fffe33da0c6 2759->2764 2765 7fffe33da0b0-7fffe33da0b3 2759->2765 2760->2762 2767 7fffe33da0f7-7fffe33da12c call 7fffe33da870 2761->2767 2768 7fffe33da171-7fffe33da18b call 7fffe33fb9c0 2761->2768 2762->2742 2763->2762 2764->2765 2771 7fffe33da0c8 2764->2771 2765->2753 2765->2759 2766->2760 2774 7fffe33da12e SysFreeString 2767->2774 2775 7fffe33da134-7fffe33da13a 2767->2775 2768->2767 2771->2761 2774->2775 2775->2736 2776 7fffe33da153-7fffe33da15b 2775->2776 2776->2743
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.4286243601.00007FFFE33C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFFE33C0000, based on PE: true
                                                  • Associated: 00000002.00000002.4285328995.00007FFFE33C0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4287819193.00007FFFE33FE000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289006151.00007FFFE3413000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289870492.00007FFFE3414000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_7fffe33c0000_cmd.jbxd
                                                  Similarity
                                                  • API ID: String$Free
                                                  • String ID: KO_S
                                                  • API String ID: 1391021980-3654716168
                                                  • Opcode ID: 30a07107e0ff3211faa047ad20d94b5adba5bd9de84a85260fbe45772d9968bc
                                                  • Instruction ID: f67fedfe0e4c7a456c7fa719ee98623e3f21fee4768abd488cc9e803e65b6d56
                                                  • Opcode Fuzzy Hash: 30a07107e0ff3211faa047ad20d94b5adba5bd9de84a85260fbe45772d9968bc
                                                  • Instruction Fuzzy Hash: D6613C22B04A128AFB158FA1E958BBC2BF0BB58B88F884535DE4D77794DF3CD5458312
                                                  Function 00007FFFE33D64D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 163windowCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.4286243601.00007FFFE33C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFFE33C0000, based on PE: true
                                                  • Associated: 00000002.00000002.4285328995.00007FFFE33C0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4287819193.00007FFFE33FE000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289006151.00007FFFE3413000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289870492.00007FFFE3414000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_7fffe33c0000_cmd.jbxd
                                                  Similarity
                                                  • API ID: memset$DebugOutputString$Message
                                                  • String ID: .
                                                  • API String ID: 1131298234-248832578
                                                  • Opcode ID: 467992297ba71837c8d4f6e17be3dfe6a26c51619b1283865ebc74489fb1c9e9
                                                  • Instruction ID: b28b2fca1ee5cf621c6bb53100e30f74e30b43c15eb8baa4e0c651c4e8b7cbd3
                                                  • Opcode Fuzzy Hash: 467992297ba71837c8d4f6e17be3dfe6a26c51619b1283865ebc74489fb1c9e9
                                                  • Instruction Fuzzy Hash: EF71E422A04BC18EE7218F78D8497F967A1FF54388F944235EA4C6BB59DF399285C301
                                                  Function 00007FFFE33E9DC0 Relevance: 9.2, APIs: 6, Instructions: 180COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.4286243601.00007FFFE33C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFFE33C0000, based on PE: true
                                                  • Associated: 00000002.00000002.4285328995.00007FFFE33C0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4287819193.00007FFFE33FE000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289006151.00007FFFE3413000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289870492.00007FFFE3414000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_7fffe33c0000_cmd.jbxd
                                                  Similarity
                                                  • API ID: ErrorLast$CloseHandle
                                                  • String ID:
                                                  • API String ID: 3463825546-0
                                                  • Opcode ID: fc41aca6527e6648b4d0f4ff6d9b88250dcb67afa9d48fbea27d7b8907a5f2a9
                                                  • Instruction ID: 0676942bfb00cec1a575a3c83e65a54d381dfe5cf34aa623c3650851dcf9fbad
                                                  • Opcode Fuzzy Hash: fc41aca6527e6648b4d0f4ff6d9b88250dcb67afa9d48fbea27d7b8907a5f2a9
                                                  • Instruction Fuzzy Hash: E971C491E083528FFB618B239908BB91ED26BA4F99F144631CE4D377D8DE6DD846C302
                                                  Function 00007FFFE33E3740 Relevance: 9.1, APIs: 6, Instructions: 84timesleepsynchronizationCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.4286243601.00007FFFE33C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFFE33C0000, based on PE: true
                                                  • Associated: 00000002.00000002.4285328995.00007FFFE33C0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4287819193.00007FFFE33FE000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289006151.00007FFFE3413000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289870492.00007FFFE3414000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_7fffe33c0000_cmd.jbxd
                                                  Similarity
                                                  • API ID: CloseHandleTimerWaitable$CreateObjectSingleSleepWait
                                                  • String ID:
                                                  • API String ID: 2261246915-0
                                                  • Opcode ID: 4beffb0822dfc1a3e88e31471e0970ab1bc087e75d4bf2ee25d8726b262b1d82
                                                  • Instruction ID: c952d5ad3c96555f580741ce91cde28c3a118a58d27e62550cf074792f4c5655
                                                  • Opcode Fuzzy Hash: 4beffb0822dfc1a3e88e31471e0970ab1bc087e75d4bf2ee25d8726b262b1d82
                                                  • Instruction Fuzzy Hash: 8821E772B057420BFA588B27BD1DB719A866FA5BB0F489235DD2E327E4CE3CA4458601
                                                  Function 00007FFFE33D63C0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42windowCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.4286243601.00007FFFE33C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFFE33C0000, based on PE: true
                                                  • Associated: 00000002.00000002.4285328995.00007FFFE33C0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4287819193.00007FFFE33FE000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289006151.00007FFFE3413000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289870492.00007FFFE3414000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_7fffe33c0000_cmd.jbxd
                                                  Similarity
                                                  • API ID: memset$DebugOutputStringTimerWaitable$CloseCreateHandleMessageObjectSingleSleepWait
                                                  • String ID: t
                                                  • API String ID: 1258059249-2238339752
                                                  • Opcode ID: 66ff89dea4b4b33811c856c8bfceab9d8489b75ef48fff44f470959749caf4d4
                                                  • Instruction ID: eb61573f880a5cb829022b6476117a28f7565798c58f23ad333696173010b3fa
                                                  • Opcode Fuzzy Hash: 66ff89dea4b4b33811c856c8bfceab9d8489b75ef48fff44f470959749caf4d4
                                                  • Instruction Fuzzy Hash: 93112920A086C08EE7218F69988A7FD67A2EF61755F840135FE4D67B55DF39C206C301
                                                  Function 00007FFFE33D647B Relevance: 6.0, APIs: 4, Instructions: 42windowCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.4286243601.00007FFFE33C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFFE33C0000, based on PE: true
                                                  • Associated: 00000002.00000002.4285328995.00007FFFE33C0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4287819193.00007FFFE33FE000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289006151.00007FFFE3413000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289870492.00007FFFE3414000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_7fffe33c0000_cmd.jbxd
                                                  Similarity
                                                  • API ID: memset$DebugOutputString$TimerWaitable$CloseCreateHandleMessageObjectOpenPolicySingleSleepWait
                                                  • String ID:
                                                  • API String ID: 3925193218-0
                                                  • Opcode ID: 1ad8c932ec4039ddce86e179e8a7d0f35ffc4544ded538692a2043b7c33947f0
                                                  • Instruction ID: 34d1d799d749d9cc25ad5accbfa676a79734e6e41de8549c7e4a50623bc95db9
                                                  • Opcode Fuzzy Hash: 1ad8c932ec4039ddce86e179e8a7d0f35ffc4544ded538692a2043b7c33947f0
                                                  • Instruction Fuzzy Hash: 3C11C810E089C19AF3124F2C984B7F497E1BFA8715F841231FA8C66661EF3D92498301
                                                  Function 00007FFFE33C29D0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 218COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.4286243601.00007FFFE33C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFFE33C0000, based on PE: true
                                                  • Associated: 00000002.00000002.4285328995.00007FFFE33C0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4287819193.00007FFFE33FE000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289006151.00007FFFE3413000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289870492.00007FFFE3414000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_7fffe33c0000_cmd.jbxd
                                                  Similarity
                                                  • API ID: DebugOutputStringmemset
                                                  • String ID: Failed to encrypt function name
                                                  • API String ID: 1084755268-2980051713
                                                  • Opcode ID: 028cd22a41b48819f3e899562e151631483065e75272154ee15d35b77e5d0452
                                                  • Instruction ID: 41000906288fc21a3c610241719661ecde829f606ebf194d425775b3480a94e7
                                                  • Opcode Fuzzy Hash: 028cd22a41b48819f3e899562e151631483065e75272154ee15d35b77e5d0452
                                                  • Instruction Fuzzy Hash: CDA1C472E14BD189EB308F64E848BE86BA0FB65758F448239CE5C77B96DF398650C341
                                                  Function 00007FFFE33EA050 Relevance: 4.6, APIs: 3, Instructions: 69COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.4286243601.00007FFFE33C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFFE33C0000, based on PE: true
                                                  • Associated: 00000002.00000002.4285328995.00007FFFE33C0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4287819193.00007FFFE33FE000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289006151.00007FFFE3413000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289870492.00007FFFE3414000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_7fffe33c0000_cmd.jbxd
                                                  Similarity
                                                  • API ID: FileHandleInformation$ErrorLast
                                                  • String ID:
                                                  • API String ID: 3070998852-0
                                                  • Opcode ID: 29bf78f7700aa70b538bd5f32c0f37c3d17a8cf08f425b9c92b30fe459eacc25
                                                  • Instruction ID: e9bdc2aeb602de67d94370856ebe250cd6072c141411168132a69ddf828a23f7
                                                  • Opcode Fuzzy Hash: 29bf78f7700aa70b538bd5f32c0f37c3d17a8cf08f425b9c92b30fe459eacc25
                                                  • Instruction Fuzzy Hash: 09313A72A146518FF320CFAAE845BAD77B0FB58788F108125CF8963B54EB78E985C750
                                                  Function 00007FFFE33D49B0 Relevance: 3.1, APIs: 2, Instructions: 65COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.4286243601.00007FFFE33C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFFE33C0000, based on PE: true
                                                  • Associated: 00000002.00000002.4285328995.00007FFFE33C0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4287819193.00007FFFE33FE000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289006151.00007FFFE3413000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289870492.00007FFFE3414000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_7fffe33c0000_cmd.jbxd
                                                  Similarity
                                                  • API ID: DebugOutputStringmemset
                                                  • String ID:
                                                  • API String ID: 1084755268-0
                                                  • Opcode ID: 519279796822fbfbf782d768fd8c1d405b605cd0aeca0a7c53aa89044ea1f249
                                                  • Instruction ID: 8e69b3035e9194dce827b67766d5684cf8cbf10819fef465e852cab52dbd7f24
                                                  • Opcode Fuzzy Hash: 519279796822fbfbf782d768fd8c1d405b605cd0aeca0a7c53aa89044ea1f249
                                                  • Instruction Fuzzy Hash: 07214C12F28A9546EF208764F119BB99761DBA67C4F909331DA4E33F86EE1CC2418705
                                                  Function 00007FFFE33D6610 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 21COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.4286243601.00007FFFE33C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFFE33C0000, based on PE: true
                                                  • Associated: 00000002.00000002.4285328995.00007FFFE33C0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4287819193.00007FFFE33FE000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289006151.00007FFFE3413000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289870492.00007FFFE3414000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_7fffe33c0000_cmd.jbxd
                                                  Similarity
                                                  • API ID: memset
                                                  • String ID: .
                                                  • API String ID: 2221118986-248832578
                                                  • Opcode ID: 2c4ff2979f64f62ac0768455e2215e96c315b7e98d153b16bd299b4b07521b9d
                                                  • Instruction ID: 5ee79d62ae24798a135aa16acf6e97f2718a4bdd5a20a1364d9d2a56e735efc3
                                                  • Opcode Fuzzy Hash: 2c4ff2979f64f62ac0768455e2215e96c315b7e98d153b16bd299b4b07521b9d
                                                  • Instruction Fuzzy Hash: 86F096109087C1C9F3224F3DD84A7F4ABB1BFA9748F445230DE887A564EF3852CA8342
                                                  Function 00007FFFE33E40D0 Relevance: 1.4, APIs: 1, Instructions: 117COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.4286243601.00007FFFE33C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFFE33C0000, based on PE: true
                                                  • Associated: 00000002.00000002.4285328995.00007FFFE33C0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4287819193.00007FFFE33FE000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289006151.00007FFFE3413000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289870492.00007FFFE3414000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_7fffe33c0000_cmd.jbxd
                                                  Similarity
                                                  • API ID: CloseHandle
                                                  • String ID:
                                                  • API String ID: 2962429428-0
                                                  • Opcode ID: 33e5a1a56ea49f71465d51b73869dc5e58191c23f66ceb0e3bb1084ebf7b1143
                                                  • Instruction ID: fad9d2cc95b79299ebdbb516d71d8c801b5aaeca6ca696e5abeb28dadeb4c96d
                                                  • Opcode Fuzzy Hash: 33e5a1a56ea49f71465d51b73869dc5e58191c23f66ceb0e3bb1084ebf7b1143
                                                  • Instruction Fuzzy Hash: 1D515D32A15B458AEB608F66D8487EC3BE0FB68798F144135DE5D27B98DF39E484C341
                                                  Function 00007FFFE33E5750 Relevance: 1.3, APIs: 1, Instructions: 63COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.4286243601.00007FFFE33C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFFE33C0000, based on PE: true
                                                  • Associated: 00000002.00000002.4285328995.00007FFFE33C0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4287819193.00007FFFE33FE000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289006151.00007FFFE3413000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289870492.00007FFFE3414000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_7fffe33c0000_cmd.jbxd
                                                  Similarity
                                                  • API ID: memcpy
                                                  • String ID:
                                                  • API String ID: 3510742995-0
                                                  • Opcode ID: 5f4e8af40bdbf23ddab40c68a6def5b7f245a9436734d355c60e30132b3370f6
                                                  • Instruction ID: 69bb2f48fe2deb5e4c160e7e78668d961b70f7227f2a65ac264ce492342a0d41
                                                  • Opcode Fuzzy Hash: 5f4e8af40bdbf23ddab40c68a6def5b7f245a9436734d355c60e30132b3370f6
                                                  • Instruction Fuzzy Hash: 2A210522B0875586FA248B56E9087E85B72BF54BE4F584231DE5E377D5EF3CE1828301

                                                  Non-executed Functions

                                                  Function 000002A38BE30470 Relevance: 58.5, APIs: 21, Strings: 12, Instructions: 749COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  • Writing DLL path to allocated memory...Failed to write DLL path to target process memory.Failed to write DLL path.DLL path written to target process memory successfully at: 0x, xrefs: 000002A38BE30E3D
                                                  • VirtualAllocExGetCurrentProcessIdOpenProcessReadProcessMemoryCloseHandleWriteProcessMemoryCreateToolhelp32SnapshotModule32FirstWModule32NextWThread32FirstThread32NextOpenThreadSuspendThreadResumeThreadGetProcessIdOfThreadNtCloseNtQueryInformationProcess, xrefs: 000002A38BE30A64
                                                  • CreateRemoteThreadkernel32.dllNtCreateSectionNtMapViewOfSectionNtOpenFileZwOpenKeyZwCreateKeyZwSetValueKeyZwCloseVirtualAllocExGetCurrentProcessIdOpenProcessReadProcessMemoryCloseHandleWriteProcessMemoryCreateToolhelp32SnapshotModule32FirstWModule32NextWThread, xrefs: 000002A38BE30B41
                                                  • C:\Windows\Temp\tempdll.dllReading DLL from disk at path: , xrefs: 000002A38BE30645
                                                  • Failed to create remote thread.Invalid process handle.Located module '' at base address: , xrefs: 000002A38BE31202
                                                  • Locating kernel32.dll in the target process...kernel32.dllFailed to locate kernel32.dll in the target process.Found kernel32.dll base at: , xrefs: 000002A38BE30F19
                                                  • Failed to write DLL data to the file system.Failed to resolve VirtualAllocEx dynamicallyFailed to resolve WriteProcessMemory dynamicallyFailed to resolve CreateRemoteThread dynamicallyFailed to resolve CloseHandle dynamicallyC:\Windows\Temp\tempdll.dll, xrefs: 000002A38BE30CCB
                                                  • kernel32.dllNtCreateSectionNtMapViewOfSectionNtOpenFileZwOpenKeyZwCreateKeyZwSetValueKeyZwCloseVirtualAllocExGetCurrentProcessIdOpenProcessReadProcessMemoryCloseHandleWriteProcessMemoryCreateToolhelp32SnapshotModule32FirstWModule32NextWThread32FirstThread32Nex, xrefs: 000002A38BE30A8A, 000002A38BE30AF5, 000002A38BE30B67, 000002A38BE30D13
                                                  • Failed to allocate memory for DLL path in target process.Failed to allocate memory for DLL path.Writing DLL path to allocated memory...Failed to write DLL path to target process memory.Failed to write DLL path.DLL path written to target process memory successf, xrefs: 000002A38BE31213
                                                  • LoadLibraryAFailed to locate LoadLibraryA in the target process.Resolved LoadLibraryA address in target process: , xrefs: 000002A38BE30FD4
                                                  • All resources cleaned up successfully. Exiting function.Failed to create remote thread. NTSTATUS: , LastError: , xrefs: 000002A38BE31317
                                                  • DLL data is empty.DLL already exists at , xrefs: 000002A38BE30877
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.4278089901.000002A38BE21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000002A38BE20000, based on PE: true
                                                  • Associated: 00000002.00000002.4277288296.000002A38BE20000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4279591592.000002A38BE5E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4280746408.000002A38BE73000.00000008.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4281622622.000002A38BE74000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_2a38be20000_cmd.jbxd
                                                  Similarity
                                                  • API ID: memset$DebugOutputString
                                                  • String ID: All resources cleaned up successfully. Exiting function.Failed to create remote thread. NTSTATUS: , LastError: $C:\Windows\Temp\tempdll.dllReading DLL from disk at path: $CreateRemoteThreadkernel32.dllNtCreateSectionNtMapViewOfSectionNtOpenFileZwOpenKeyZwCreateKeyZwSetValueKeyZwCloseVirtualAllocExGetCurrentProcessIdOpenProcessReadProcessMemoryCloseHandleWriteProcessMemoryCreateToolhelp32SnapshotModule32FirstWModule32NextWThread$DLL data is empty.DLL already exists at $Failed to allocate memory for DLL path in target process.Failed to allocate memory for DLL path.Writing DLL path to allocated memory...Failed to write DLL path to target process memory.Failed to write DLL path.DLL path written to target process memory successf$Failed to create remote thread.Invalid process handle.Located module '' at base address: $Failed to write DLL data to the file system.Failed to resolve VirtualAllocEx dynamicallyFailed to resolve WriteProcessMemory dynamicallyFailed to resolve CreateRemoteThread dynamicallyFailed to resolve CloseHandle dynamicallyC:\Windows\Temp\tempdll.dll$LoadLibraryAFailed to locate LoadLibraryA in the target process.Resolved LoadLibraryA address in target process: $Locating kernel32.dll in the target process...kernel32.dllFailed to locate kernel32.dll in the target process.Found kernel32.dll base at: $VirtualAllocExGetCurrentProcessIdOpenProcessReadProcessMemoryCloseHandleWriteProcessMemoryCreateToolhelp32SnapshotModule32FirstWModule32NextWThread32FirstThread32NextOpenThreadSuspendThreadResumeThreadGetProcessIdOfThreadNtCloseNtQueryInformationProcess$Writing DLL path to allocated memory...Failed to write DLL path to target process memory.Failed to write DLL path.DLL path written to target process memory successfully at: 0x$kernel32.dllNtCreateSectionNtMapViewOfSectionNtOpenFileZwOpenKeyZwCreateKeyZwSetValueKeyZwCloseVirtualAllocExGetCurrentProcessIdOpenProcessReadProcessMemoryCloseHandleWriteProcessMemoryCreateToolhelp32SnapshotModule32FirstWModule32NextWThread32FirstThread32Nex
                                                  • API String ID: 1905100485-484227781
                                                  • Opcode ID: 8dc5711205e4c546c9b3452254c9f632374efe67bddf50cf9e95db6d51225af3
                                                  • Instruction ID: c5d46375baa2e219a9364cd175b7ae1eaf7560a0e2ab29d2982c4422aaa45976
                                                  • Opcode Fuzzy Hash: 8dc5711205e4c546c9b3452254c9f632374efe67bddf50cf9e95db6d51225af3
                                                  • Instruction Fuzzy Hash: 20825A21312B828EEB21CF64F8893DD63A0FB9A748F445215FB8917B69EF399345C341
                                                  Function 00007FFFE33EC730 Relevance: 45.8, APIs: 18, Strings: 8, Instructions: 340libraryloadersynchronizationCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.4286243601.00007FFFE33C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFFE33C0000, based on PE: true
                                                  • Associated: 00000002.00000002.4285328995.00007FFFE33C0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4287819193.00007FFFE33FE000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289006151.00007FFFE3413000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289870492.00007FFFE3414000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_7fffe33c0000_cmd.jbxd
                                                  Similarity
                                                  • API ID: AddressProc$CurrentProcess$Mutex$CloseCreateHandleLibraryLoadObjectReleaseSingleWaitlstrlenmemset
                                                  • String ID: EnumerateLoadedModulesW64$SymGetOptions$SymGetSearchPathW$SymInitializeW$SymSetOptions$SymSetSearchPathW$assertion failed: len >= 0$dbghelp.dll
                                                  • API String ID: 18767598-310313858
                                                  • Opcode ID: 322fdff71ec87d0a8c7e856c9b972d255191d7d35ffee03c8467bd5706081174
                                                  • Instruction ID: b021ca4f1fe2b3dabb0efcb422f036b1ec65448239c9fd87781948bd7dcdc150
                                                  • Opcode Fuzzy Hash: 322fdff71ec87d0a8c7e856c9b972d255191d7d35ffee03c8467bd5706081174
                                                  • Instruction Fuzzy Hash: EFE19D21B09B529AFB109B26EC48BB82BE1BF54B58F444635DD5D777A4EF3CE0498302
                                                  Function 000002A38BE24D40 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 295stringCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.4278089901.000002A38BE21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000002A38BE20000, based on PE: true
                                                  • Associated: 00000002.00000002.4277288296.000002A38BE20000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4279591592.000002A38BE5E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4280746408.000002A38BE73000.00000008.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4281622622.000002A38BE74000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_2a38be20000_cmd.jbxd
                                                  Similarity
                                                  • API ID: DebugOutputStringmemset$memcmpstrlen
                                                  • String ID: c
                                                  • API String ID: 2294051181-112844655
                                                  • Opcode ID: 4394bea11df96680a750f5f0d1c5b3c8108adbd8e6e6c9e9f50e24a4e7eacf6c
                                                  • Instruction ID: 9a5b8b134bafe34c7ec010bfd5861ad323e6f4a0d33a031e5b8e88210425cf12
                                                  • Opcode Fuzzy Hash: 4394bea11df96680a750f5f0d1c5b3c8108adbd8e6e6c9e9f50e24a4e7eacf6c
                                                  • Instruction Fuzzy Hash: 2DE17E22719B858AEB21CF24F4557EEA3A1FB86784F405215FB8902B95EF3CE285C701
                                                  Function 000002A38BE269E0 Relevance: 18.0, APIs: 6, Strings: 4, Instructions: 479COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.4278089901.000002A38BE21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000002A38BE20000, based on PE: true
                                                  • Associated: 00000002.00000002.4277288296.000002A38BE20000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4279591592.000002A38BE5E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4280746408.000002A38BE73000.00000008.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4281622622.000002A38BE74000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_2a38be20000_cmd.jbxd
                                                  Similarity
                                                  • API ID: DebugOutputStringmemset
                                                  • String ID: arenegyl$modnarod$setybdet$uespemos
                                                  • API String ID: 1084755268-66988881
                                                  • Opcode ID: d03c909489f8b567af717f7a7deb4a8a6dba1245a0d552de165b9294efc43a01
                                                  • Instruction ID: 3adb9f3ced9686c73729d235a48128c06011df4ed0901479e8d0bc9b159691a7
                                                  • Opcode Fuzzy Hash: d03c909489f8b567af717f7a7deb4a8a6dba1245a0d552de165b9294efc43a01
                                                  • Instruction Fuzzy Hash: FC228072712BC28EEB60CF70E8987DD2761E716788F408226FE495BB5ADF289745C341
                                                  Function 000002A38BE221F0 Relevance: 17.9, APIs: 5, Strings: 5, Instructions: 440COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.4278089901.000002A38BE21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000002A38BE20000, based on PE: true
                                                  • Associated: 00000002.00000002.4277288296.000002A38BE20000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4279591592.000002A38BE5E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4280746408.000002A38BE73000.00000008.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4281622622.000002A38BE74000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_2a38be20000_cmd.jbxd
                                                  Similarity
                                                  • API ID: DebugOutputStringmemset$memcpy
                                                  • String ID: arenegyl$called `Result::unwrap()` on an `Err` value$modnarod$setybdet$uespemos
                                                  • API String ID: 293864031-2410307170
                                                  • Opcode ID: e5defab2256fd89ad628390450379904b137d1c08009ad006c96280e43a84705
                                                  • Instruction ID: 78d53ea79abf2fb4df5136cbc09b07c052c73e2dc993ebf4a5467bc638e81aaa
                                                  • Opcode Fuzzy Hash: e5defab2256fd89ad628390450379904b137d1c08009ad006c96280e43a84705
                                                  • Instruction Fuzzy Hash: 7D029E72712B814EEB21CF70E8587ED2361F746798F408226FE695BB99DF389245C341
                                                  Function 00007FFFE33FA5EC Relevance: 13.6, APIs: 9, Instructions: 71COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.4286243601.00007FFFE33C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFFE33C0000, based on PE: true
                                                  • Associated: 00000002.00000002.4285328995.00007FFFE33C0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4287819193.00007FFFE33FE000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289006151.00007FFFE3413000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289870492.00007FFFE3414000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_7fffe33c0000_cmd.jbxd
                                                  Similarity
                                                  • API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                  • String ID:
                                                  • API String ID: 313767242-0
                                                  • Opcode ID: d03019518c56e25ee5a8d1d249ed9694f867fde2062d97edec67c5f27bdadc10
                                                  • Instruction ID: efbe2b9f38f56ed28f5f37abe91b0004176bda8c478ca5d7de524f1c8c3cefd4
                                                  • Opcode Fuzzy Hash: d03019518c56e25ee5a8d1d249ed9694f867fde2062d97edec67c5f27bdadc10
                                                  • Instruction Fuzzy Hash: 6A319272608B818AEB609F61E844BED77B4FB94744F84443ADA4D67B95EF3CC248CB01
                                                  Function 000002A38BE5A5EC Relevance: 13.6, APIs: 9, Instructions: 71COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.4278089901.000002A38BE21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000002A38BE20000, based on PE: true
                                                  • Associated: 00000002.00000002.4277288296.000002A38BE20000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4279591592.000002A38BE5E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4280746408.000002A38BE73000.00000008.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4281622622.000002A38BE74000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_2a38be20000_cmd.jbxd
                                                  Similarity
                                                  • API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                  • String ID:
                                                  • API String ID: 313767242-0
                                                  • Opcode ID: d03019518c56e25ee5a8d1d249ed9694f867fde2062d97edec67c5f27bdadc10
                                                  • Instruction ID: c21070de288421de91d1abd6a6721d4168cc2aa89eca125f5a76dc99cdb265fc
                                                  • Opcode Fuzzy Hash: d03019518c56e25ee5a8d1d249ed9694f867fde2062d97edec67c5f27bdadc10
                                                  • Instruction Fuzzy Hash: 6E312576306A828EEB60CF60E8847ED7364F785748F44442AEB4E47B98EF38D648C711
                                                  Function 000002A38BE4A8C0 Relevance: 12.6, APIs: 6, Strings: 1, Instructions: 301filenativesynchronizationCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.4278089901.000002A38BE21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000002A38BE20000, based on PE: true
                                                  • Associated: 00000002.00000002.4277288296.000002A38BE20000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4279591592.000002A38BE5E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4280746408.000002A38BE73000.00000008.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4281622622.000002A38BE74000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_2a38be20000_cmd.jbxd
                                                  Similarity
                                                  • API ID: Error$FileFormatHandleLastMessageModuleObjectSingleStatusWaitWrite
                                                  • String ID: NTDLL.DLL
                                                  • API String ID: 415079386-1613819793
                                                  • Opcode ID: ffed6a8691bb262886920d7399c36b8e8ca446f5b19f8d79c4a7150492a7172d
                                                  • Instruction ID: e190a4bd2d90823dee1c9d0ed590ed80c60699d48b6bb420827a92643d533b1a
                                                  • Opcode Fuzzy Hash: ffed6a8691bb262886920d7399c36b8e8ca446f5b19f8d79c4a7150492a7172d
                                                  • Instruction Fuzzy Hash: A9D18A36302B828EE771CF20F8487ED26A1F7463A8F545125FB9946B94DF789785C305
                                                  Function 000002A38BE4A380 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 139COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  • C:\Windows\Temp\tempdll.dllReading DLL from disk at path: , xrefs: 000002A38BE4A389
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.4278089901.000002A38BE21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000002A38BE20000, based on PE: true
                                                  • Associated: 00000002.00000002.4277288296.000002A38BE20000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4279591592.000002A38BE5E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4280746408.000002A38BE73000.00000008.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4281622622.000002A38BE74000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_2a38be20000_cmd.jbxd
                                                  Similarity
                                                  • API ID: CloseFind$FileFirstHandlememset
                                                  • String ID: C:\Windows\Temp\tempdll.dllReading DLL from disk at path:
                                                  • API String ID: 4181070385-2284096931
                                                  • Opcode ID: 34bccfb1b2eb7c794fcbf1a84e3fb99ad4fdc8fc518fb8e40e75125d0aa03e49
                                                  • Instruction ID: b120b17671bc8b8e3d215492b32d7f3da21a647bb9a438455623f9a9edcf7258
                                                  • Opcode Fuzzy Hash: 34bccfb1b2eb7c794fcbf1a84e3fb99ad4fdc8fc518fb8e40e75125d0aa03e49
                                                  • Instruction Fuzzy Hash: 8D515D32701A818EE774CF61F8983DE76A0F7467A8F105615EFA90BB95DF3C92858701
                                                  Function 00007FFFE33FAB50 Relevance: 7.8, APIs: 1, Strings: 4, Instructions: 296COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • memset.VCRUNTIME140(?,?,?,?,7065646279746573,?,6C7967656E657261,646F72616E646F6D,?,?,?,?,00007FFFE33D9768,?,00007FFFE34132A8), ref: 00007FFFE33FACD9
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.4286243601.00007FFFE33C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFFE33C0000, based on PE: true
                                                  • Associated: 00000002.00000002.4285328995.00007FFFE33C0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4287819193.00007FFFE33FE000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289006151.00007FFFE3413000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289870492.00007FFFE3414000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_7fffe33c0000_cmd.jbxd
                                                  Similarity
                                                  • API ID: memset
                                                  • String ID: arenegyl$modnarod$setybdet$uespemos
                                                  • API String ID: 2221118986-66988881
                                                  • Opcode ID: 8719a766e0c2dadd78f59f58a575cd8adfcec2408329665a8598a81e333178a7
                                                  • Instruction ID: 736e1f214d407eab3358bf76bfd1e78d879cd0de4ddacb77843fa331e3d76357
                                                  • Opcode Fuzzy Hash: 8719a766e0c2dadd78f59f58a575cd8adfcec2408329665a8598a81e333178a7
                                                  • Instruction Fuzzy Hash: EBA17662F187954BEF509B19A8097EA6A91AB14BE4F8C5731DEAC7B3C0EE3CD141D201
                                                  Function 000002A38BE5AB50 Relevance: 7.8, APIs: 1, Strings: 4, Instructions: 296COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • memset.VCRUNTIME140(?,?,?,?,7065646279746573,?,6C7967656E657261,646F72616E646F6D,?,?,?,?,000002A38BE39768,?,00007FFFE34132A8), ref: 000002A38BE5ACD9
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.4278089901.000002A38BE21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000002A38BE20000, based on PE: true
                                                  • Associated: 00000002.00000002.4277288296.000002A38BE20000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4279591592.000002A38BE5E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4280746408.000002A38BE73000.00000008.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4281622622.000002A38BE74000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_2a38be20000_cmd.jbxd
                                                  Similarity
                                                  • API ID: memset
                                                  • String ID: arenegyl$modnarod$setybdet$uespemos
                                                  • API String ID: 2221118986-66988881
                                                  • Opcode ID: c273a004d073242d9d75f774e59af2c0a54f541896cd6076bf3a64caba8b06a2
                                                  • Instruction ID: a42bcc8826de4836bb82ea907cc6bb7653aea3ac007ffcacaaa15370149662e0
                                                  • Opcode Fuzzy Hash: c273a004d073242d9d75f774e59af2c0a54f541896cd6076bf3a64caba8b06a2
                                                  • Instruction Fuzzy Hash: 3DA13362B127954FEE60DF19B8093DA6691A346BA4F486721FFAD177C0EE3CD241D201
                                                  Function 00007FFFE33FAFB0 Relevance: 7.8, APIs: 1, Strings: 4, Instructions: 294COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • memset.VCRUNTIME140(?,?,?,?,00000023,?,00000000,?,00000023,0000000B,?,?,00007FFFE33D9CA5), ref: 00007FFFE33FB13C
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.4286243601.00007FFFE33C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFFE33C0000, based on PE: true
                                                  • Associated: 00000002.00000002.4285328995.00007FFFE33C0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4287819193.00007FFFE33FE000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289006151.00007FFFE3413000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289870492.00007FFFE3414000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_7fffe33c0000_cmd.jbxd
                                                  Similarity
                                                  • API ID: memset
                                                  • String ID: arenegyl$modnarod$setybdet$uespemos
                                                  • API String ID: 2221118986-66988881
                                                  • Opcode ID: 3307e8769bf9a53a833e0c47a619130cb0ae68f9f37e19d8241f575669528261
                                                  • Instruction ID: f58217bd0ca402e19a906be8712c167f79d976ad4f9a9ae68c56a437bd9bdc0d
                                                  • Opcode Fuzzy Hash: 3307e8769bf9a53a833e0c47a619130cb0ae68f9f37e19d8241f575669528261
                                                  • Instruction Fuzzy Hash: C7A16AA2F187958BEE109F19A8057EA6A91BB54BE4F885331DEAC377C0DF7CD141C201
                                                  Function 000002A38BE5AFB0 Relevance: 7.8, APIs: 1, Strings: 4, Instructions: 294COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • memset.VCRUNTIME140(?,?,?,?,00000023,?,00000000,?,00000023,0000000B,?,?,000002A38BE39CA5), ref: 000002A38BE5B13C
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.4278089901.000002A38BE21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000002A38BE20000, based on PE: true
                                                  • Associated: 00000002.00000002.4277288296.000002A38BE20000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4279591592.000002A38BE5E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4280746408.000002A38BE73000.00000008.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4281622622.000002A38BE74000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_2a38be20000_cmd.jbxd
                                                  Similarity
                                                  • API ID: memset
                                                  • String ID: arenegyl$modnarod$setybdet$uespemos
                                                  • API String ID: 2221118986-66988881
                                                  • Opcode ID: 89cb1448f8fe010d3a20d73c54152bbbb83aa94d3f5f60c44ebccdfc65d9ac20
                                                  • Instruction ID: cf268812282b0a8f83231bf76cb9de176979d6e279b87112426ec902d41b025d
                                                  • Opcode Fuzzy Hash: 89cb1448f8fe010d3a20d73c54152bbbb83aa94d3f5f60c44ebccdfc65d9ac20
                                                  • Instruction Fuzzy Hash: B3A13462B12B958BEE509F2AB8093DE6651B746BE4F485321FFAC173C0EE7CD241C201
                                                  Function 00007FFFE33FB410 Relevance: 7.8, APIs: 1, Strings: 4, Instructions: 286COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • memset.VCRUNTIME140(?,?,736F6D6570736575,?,6C7967656E657261,7065646279746573,?,00000000,?,?,00007FFFE33D99C0,?,?,?,00007FFFE33D0064), ref: 00007FFFE33FB59A
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.4286243601.00007FFFE33C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFFE33C0000, based on PE: true
                                                  • Associated: 00000002.00000002.4285328995.00007FFFE33C0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4287819193.00007FFFE33FE000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289006151.00007FFFE3413000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289870492.00007FFFE3414000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_7fffe33c0000_cmd.jbxd
                                                  Similarity
                                                  • API ID: memset
                                                  • String ID: arenegyl$modnarod$setybdet$uespemos
                                                  • API String ID: 2221118986-66988881
                                                  • Opcode ID: bcbc9f5b36224cbf7982f22a5ebf85cad7a91bd05f56ab483a074b40c42df810
                                                  • Instruction ID: ba031caff0f0c195e347095bd673926555857b979d156574c72051128357be48
                                                  • Opcode Fuzzy Hash: bcbc9f5b36224cbf7982f22a5ebf85cad7a91bd05f56ab483a074b40c42df810
                                                  • Instruction Fuzzy Hash: 8BA15AA2F186A547FA509F69A404BEA5A91BB15BE4FC85331EE6C773C0DF3CD941C201
                                                  Function 000002A38BE5B410 Relevance: 7.8, APIs: 1, Strings: 4, Instructions: 286COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  • memset.VCRUNTIME140(?,?,736F6D6570736575,?,6C7967656E657261,7065646279746573,?,00000000,?,?,000002A38BE399C0,?,?,?,000002A38BE30064), ref: 000002A38BE5B59A
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.4278089901.000002A38BE21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000002A38BE20000, based on PE: true
                                                  • Associated: 00000002.00000002.4277288296.000002A38BE20000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4279591592.000002A38BE5E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4280746408.000002A38BE73000.00000008.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4281622622.000002A38BE74000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_2a38be20000_cmd.jbxd
                                                  Similarity
                                                  • API ID: memset
                                                  • String ID: arenegyl$modnarod$setybdet$uespemos
                                                  • API String ID: 2221118986-66988881
                                                  • Opcode ID: 5bb68cb60287ef42c826943cfbdd8a1eeca421f5457cd190efe777ac04a2b2f4
                                                  • Instruction ID: 6a68777b08ce5b6a560a8f3bcbd0bd4653ac624b9fd47ae0d70b452ff04aee10
                                                  • Opcode Fuzzy Hash: 5bb68cb60287ef42c826943cfbdd8a1eeca421f5457cd190efe777ac04a2b2f4
                                                  • Instruction Fuzzy Hash: 7CA16862B11AA64BEA50DF39B4087DE6751B306BE4F885311FF69573C1EE3CDA42C201
                                                  Function 000002A38BE360B0 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 238threadwindowCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  • Bill Keaners Virus NotificationFailed to remap system modules: , xrefs: 000002A38BE36232
                                                  • YOU HAVE BEEN INFECTED BY BILLC:\Users\Harrison\.rustup\toolchains\nightly-x86_64-pc-windows-msvc\lib/rustlib/src/rust\library\core\src\iter\traits\iterator.rs, xrefs: 000002A38BE361FB
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.4278089901.000002A38BE21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000002A38BE20000, based on PE: true
                                                  • Associated: 00000002.00000002.4277288296.000002A38BE20000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4279591592.000002A38BE5E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4280746408.000002A38BE73000.00000008.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4281622622.000002A38BE74000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_2a38be20000_cmd.jbxd
                                                  Similarity
                                                  • API ID: DebugOutputStringmemset$CallsDisableErrorLastLibraryMessageThread
                                                  • String ID: Bill Keaners Virus NotificationFailed to remap system modules: $YOU HAVE BEEN INFECTED BY BILLC:\Users\Harrison\.rustup\toolchains\nightly-x86_64-pc-windows-msvc\lib/rustlib/src/rust\library\core\src\iter\traits\iterator.rs
                                                  • API String ID: 941661592-2279533013
                                                  • Opcode ID: 38c4df6ab7028c9941154242f94b5f774958c9b7a3cf28c48766c2f8ac8605b1
                                                  • Instruction ID: 7153b69fa9de9b8acf250ecd51a7494fa7b7552f656815ad19649d161cd4976c
                                                  • Opcode Fuzzy Hash: 38c4df6ab7028c9941154242f94b5f774958c9b7a3cf28c48766c2f8ac8605b1
                                                  • Instruction Fuzzy Hash: 76D14121601AC59EF7228F38E84A3ECA3B0FF5A359F445215FF8816665EF799386C341
                                                  Function 00007FFFE33ECD50 Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 220libraryloaderCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.4286243601.00007FFFE33C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFFE33C0000, based on PE: true
                                                  • Associated: 00000002.00000002.4285328995.00007FFFE33C0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4287819193.00007FFFE33FE000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289006151.00007FFFE3413000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289870492.00007FFFE3414000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_7fffe33c0000_cmd.jbxd
                                                  Similarity
                                                  • API ID: AddressProc$CurrentProcessmemset
                                                  • String ID: SymAddrIncludeInlineTrace$SymFromInlineContextW$SymGetLineFromInlineContextW$SymQueryInlineTrace
                                                  • API String ID: 3017635649-3384281969
                                                  • Opcode ID: 2a6472fe9800fceb02fa2b25493d37ae258293617e266c0357c3c7797ca8a363
                                                  • Instruction ID: 78bfbd9ffc3bddd27879c686f67d69130be369091f05787a620d2520110fd8b2
                                                  • Opcode Fuzzy Hash: 2a6472fe9800fceb02fa2b25493d37ae258293617e266c0357c3c7797ca8a363
                                                  • Instruction Fuzzy Hash: 05B1AE31A08AC19AE7318F25EC49BE97BE0FF54798F044135EA8C6BB58DF7992858341
                                                  Function 00007FFFE33EBC40 Relevance: 17.9, APIs: 7, Strings: 3, Instructions: 409COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.4286243601.00007FFFE33C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFFE33C0000, based on PE: true
                                                  • Associated: 00000002.00000002.4285328995.00007FFFE33C0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4287819193.00007FFFE33FE000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289006151.00007FFFE3413000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289870492.00007FFFE3414000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_7fffe33c0000_cmd.jbxd
                                                  Similarity
                                                  • API ID: ErrorLast$FullNamePathmemcpy
                                                  • String ID: \\?\$\\?\UNC\$internal error: entered unreachable code/rustc/a4cb3c831823d9baa56c3d90514b75b2660116fa\library\alloc\src\vec\mod.rs
                                                  • API String ID: 674145353-264738257
                                                  • Opcode ID: 8552348834eedd1e015324abcdfd09d577b24eca8e8dde3345596d9d21ea4101
                                                  • Instruction ID: db230164e5b7988cd1fd98a4e2b89d226af9547a59ae457fd71b333576c27080
                                                  • Opcode Fuzzy Hash: 8552348834eedd1e015324abcdfd09d577b24eca8e8dde3345596d9d21ea4101
                                                  • Instruction Fuzzy Hash: 0502B362A087828AEB718F56D848BFD2AE5FB24B94F404536DA5D77784DF3CE5818302
                                                  Function 000002A38BE4BC40 Relevance: 17.9, APIs: 7, Strings: 3, Instructions: 409COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.4278089901.000002A38BE21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000002A38BE20000, based on PE: true
                                                  • Associated: 00000002.00000002.4277288296.000002A38BE20000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4279591592.000002A38BE5E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4280746408.000002A38BE73000.00000008.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4281622622.000002A38BE74000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_2a38be20000_cmd.jbxd
                                                  Similarity
                                                  • API ID: ErrorLast$FullNamePathmemcpy
                                                  • String ID: \\?\$\\?\UNC\$internal error: entered unreachable code/rustc/a4cb3c831823d9baa56c3d90514b75b2660116fa\library\alloc\src\vec\mod.rs
                                                  • API String ID: 674145353-264738257
                                                  • Opcode ID: e2ecec9641d672354c35334f02de41ac815b17a11119a411aa4b1c7baa62af10
                                                  • Instruction ID: cd7a21000961b5b12f94607aa0405674972ea96238fb9e9a060f723aec6888f2
                                                  • Opcode Fuzzy Hash: e2ecec9641d672354c35334f02de41ac815b17a11119a411aa4b1c7baa62af10
                                                  • Instruction Fuzzy Hash: 10028B62702E868EEB74CF25E8483ED32A4F346B98F404516FB594B784DF78E7859302
                                                  Function 00007FFFE33E7530 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 225COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  • note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.__rust_end_short_backtrace__rust_begin_short_backtraces [... omitted frame ...], xrefs: 00007FFFE33E7980
                                                  • stack backtrace:, xrefs: 00007FFFE33E764B
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.4286243601.00007FFFE33C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFFE33C0000, based on PE: true
                                                  • Associated: 00000002.00000002.4285328995.00007FFFE33C0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4287819193.00007FFFE33FE000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289006151.00007FFFE3413000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289870492.00007FFFE3414000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_7fffe33c0000_cmd.jbxd
                                                  Similarity
                                                  • API ID: ErrorLast$CaptureContextCurrentDirectoryEntryFunctionLookupmemset
                                                  • String ID: note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace.__rust_end_short_backtrace__rust_begin_short_backtraces [... omitted frame ...]$stack backtrace:
                                                  • API String ID: 3347127084-3486849450
                                                  • Opcode ID: abf155c4dd5993d64fa160be99264a5b236c31ad7f40356405c816848981d3be
                                                  • Instruction ID: 054ac9c41e887cb9c563c976c6951bbe13eb4b6d5214ca5bc2f8bb33c38dcc40
                                                  • Opcode Fuzzy Hash: abf155c4dd5993d64fa160be99264a5b236c31ad7f40356405c816848981d3be
                                                  • Instruction Fuzzy Hash: B2C13836605FC18DEB708F25EC447EA3BA4FB55789F40112ADA4C6BB98DF399285CB01
                                                  Function 00007FFFE33E3B80 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 243COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  • internal error: entered unreachable code/rustc/a4cb3c831823d9baa56c3d90514b75b2660116fa\library\alloc\src\vec\mod.rs, xrefs: 00007FFFE33E3F30
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.4286243601.00007FFFE33C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFFE33C0000, based on PE: true
                                                  • Associated: 00000002.00000002.4285328995.00007FFFE33C0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4287819193.00007FFFE33FE000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289006151.00007FFFE3413000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289870492.00007FFFE3414000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_7fffe33c0000_cmd.jbxd
                                                  Similarity
                                                  • API ID: ErrorLast$EnvironmentVariable
                                                  • String ID: internal error: entered unreachable code/rustc/a4cb3c831823d9baa56c3d90514b75b2660116fa\library\alloc\src\vec\mod.rs
                                                  • API String ID: 2691138088-1438511490
                                                  • Opcode ID: 070ad722f130e4ff0ca96f13f1fa1786d97355ba3654709ab6070b5a7c54a9bb
                                                  • Instruction ID: 991d504b3a398747242d0a27864baa92a4496d971982dae9a51d8f57ed2a4d90
                                                  • Opcode Fuzzy Hash: 070ad722f130e4ff0ca96f13f1fa1786d97355ba3654709ab6070b5a7c54a9bb
                                                  • Instruction Fuzzy Hash: 1EA1A262B04BC58AEB708F26DC487E967A5FB54BA8F408535DE1C7B799DF38D2818301
                                                  Function 000002A38BE43B80 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 243COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  • internal error: entered unreachable code/rustc/a4cb3c831823d9baa56c3d90514b75b2660116fa\library\alloc\src\vec\mod.rs, xrefs: 000002A38BE43F30
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.4278089901.000002A38BE21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000002A38BE20000, based on PE: true
                                                  • Associated: 00000002.00000002.4277288296.000002A38BE20000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4279591592.000002A38BE5E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4280746408.000002A38BE73000.00000008.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4281622622.000002A38BE74000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_2a38be20000_cmd.jbxd
                                                  Similarity
                                                  • API ID: ErrorLast$EnvironmentVariable
                                                  • String ID: internal error: entered unreachable code/rustc/a4cb3c831823d9baa56c3d90514b75b2660116fa\library\alloc\src\vec\mod.rs
                                                  • API String ID: 2691138088-1438511490
                                                  • Opcode ID: a8445cfed583d5251d7f525310e5c38a969190012ee19b687adebf5920b8b1df
                                                  • Instruction ID: 7046850c4e2aa7ab007866f1812e61f9be193feedaa1ae0fd22b72367a388d1b
                                                  • Opcode Fuzzy Hash: a8445cfed583d5251d7f525310e5c38a969190012ee19b687adebf5920b8b1df
                                                  • Instruction Fuzzy Hash: 31A16962302A858EEB60CF26E8483DD6364F74AB98F448525FF5D5BB89DF38D3818351
                                                  Function 00007FFFE33E38A0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 168COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  • internal error: entered unreachable code/rustc/a4cb3c831823d9baa56c3d90514b75b2660116fa\library\alloc\src\vec\mod.rs, xrefs: 00007FFFE33E3B07
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.4286243601.00007FFFE33C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFFE33C0000, based on PE: true
                                                  • Associated: 00000002.00000002.4285328995.00007FFFE33C0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4287819193.00007FFFE33FE000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289006151.00007FFFE3413000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289870492.00007FFFE3414000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_7fffe33c0000_cmd.jbxd
                                                  Similarity
                                                  • API ID: ErrorLast$CurrentDirectory
                                                  • String ID: internal error: entered unreachable code/rustc/a4cb3c831823d9baa56c3d90514b75b2660116fa\library\alloc\src\vec\mod.rs
                                                  • API String ID: 3993060814-1438511490
                                                  • Opcode ID: 8d9e688dd62760ca7b8eb2dbae6d4c967e90f0f7ed288081bee47df232cc08cf
                                                  • Instruction ID: 31064f8d5f93044b36d2b01e12b19e13a95ad3dcc8daef5893399659900f4b20
                                                  • Opcode Fuzzy Hash: 8d9e688dd62760ca7b8eb2dbae6d4c967e90f0f7ed288081bee47df232cc08cf
                                                  • Instruction Fuzzy Hash: B961A262A04BC28AE7719F26EC48BE96B95FB14BA8F404135DD5D7B785DF3CE2818301
                                                  Function 000002A38BE49DC0 Relevance: 9.2, APIs: 6, Instructions: 180COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.4278089901.000002A38BE21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000002A38BE20000, based on PE: true
                                                  • Associated: 00000002.00000002.4277288296.000002A38BE20000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4279591592.000002A38BE5E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4280746408.000002A38BE73000.00000008.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4281622622.000002A38BE74000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_2a38be20000_cmd.jbxd
                                                  Similarity
                                                  • API ID: ErrorLast$CloseHandle
                                                  • String ID:
                                                  • API String ID: 3463825546-0
                                                  • Opcode ID: 15f3bc612f8892eafb275b5396dcf15e6c6d1523e8ba766b23b6127d3abdca4f
                                                  • Instruction ID: f19afa5d7e0ef48f603ba2d486f846a087e86aa1ba7eaa8e4132e2674b8ab8b2
                                                  • Opcode Fuzzy Hash: 15f3bc612f8892eafb275b5396dcf15e6c6d1523e8ba766b23b6127d3abdca4f
                                                  • Instruction Fuzzy Hash: EC71D1A5706A528FFB61CEA1A5083ED26E0A746B98F144511FF4937BC8CE2DEB45D302
                                                  Function 00007FFFE33EADC0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 202COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.4286243601.00007FFFE33C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFFE33C0000, based on PE: true
                                                  • Associated: 00000002.00000002.4285328995.00007FFFE33C0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4287819193.00007FFFE33FE000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289006151.00007FFFE3413000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289870492.00007FFFE3414000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_7fffe33c0000_cmd.jbxd
                                                  Similarity
                                                  • API ID: Handle$CloseConsoleErrorLastMode
                                                  • String ID: called `Result::unwrap()` on an `Err` value
                                                  • API String ID: 1170577072-2333694755
                                                  • Opcode ID: d3f8241ead872ad73c2426530aed2ed4068c552042143b37c70fce03d71c10d0
                                                  • Instruction ID: cdbd54bb9cff2f2487322ab9b0fa91eefc15d7ed9695ba65bed7824e9419d3e8
                                                  • Opcode Fuzzy Hash: d3f8241ead872ad73c2426530aed2ed4068c552042143b37c70fce03d71c10d0
                                                  • Instruction Fuzzy Hash: 8F91A361A087928EFB118B62D8487FD2FE1AB64798F404532DE9D36B99DF3CD185C302
                                                  Function 000002A38BE4ADC0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 202COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.4278089901.000002A38BE21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000002A38BE20000, based on PE: true
                                                  • Associated: 00000002.00000002.4277288296.000002A38BE20000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4279591592.000002A38BE5E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4280746408.000002A38BE73000.00000008.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4281622622.000002A38BE74000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_2a38be20000_cmd.jbxd
                                                  Similarity
                                                  • API ID: Handle$CloseConsoleErrorLastMode
                                                  • String ID: called `Result::unwrap()` on an `Err` value
                                                  • API String ID: 1170577072-2333694755
                                                  • Opcode ID: 7386bfed59b85a5b089caff814a4fd3ce99b5ee6720e2d7d50c860cff9acbf3e
                                                  • Instruction ID: 8c2219ce70b0572f9fdc85fda5d9627fbaed7197917c935a84eef315d7092730
                                                  • Opcode Fuzzy Hash: 7386bfed59b85a5b089caff814a4fd3ce99b5ee6720e2d7d50c860cff9acbf3e
                                                  • Instruction Fuzzy Hash: 7191A262706B928EFB21CF61B5483ED2761B7067A8F408511FF9A12A85DF3CE385C346
                                                  Function 000002A38BE4B0E0 Relevance: 7.6, APIs: 5, Instructions: 147COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.4278089901.000002A38BE21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000002A38BE20000, based on PE: true
                                                  • Associated: 00000002.00000002.4277288296.000002A38BE20000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4279591592.000002A38BE5E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4280746408.000002A38BE73000.00000008.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4281622622.000002A38BE74000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_2a38be20000_cmd.jbxd
                                                  Similarity
                                                  • API ID: ConsoleErrorLastWrite$ByteCharMultiWide
                                                  • String ID:
                                                  • API String ID: 1956605914-0
                                                  • Opcode ID: bc6ea8a625286ab0a8054021b8405d894c01c3fab86ca13ade8d1d82f62da186
                                                  • Instruction ID: 1096ad8a8d789d50d8636c68a1ef536b90e3e55282e4660a6fc3d978eb04a96c
                                                  • Opcode Fuzzy Hash: bc6ea8a625286ab0a8054021b8405d894c01c3fab86ca13ade8d1d82f62da186
                                                  • Instruction Fuzzy Hash: 2751AB21706E928FF760CF71E80C7EE7251F70A794F404221BA494BAD9DF7CA7868202
                                                  Function 00007FFFE33EB0E0 Relevance: 7.6, APIs: 5, Instructions: 141COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.4286243601.00007FFFE33C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFFE33C0000, based on PE: true
                                                  • Associated: 00000002.00000002.4285328995.00007FFFE33C0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4287819193.00007FFFE33FE000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289006151.00007FFFE3413000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289870492.00007FFFE3414000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_7fffe33c0000_cmd.jbxd
                                                  Similarity
                                                  • API ID: ConsoleErrorLastWrite$ByteCharMultiWide
                                                  • String ID:
                                                  • API String ID: 1956605914-0
                                                  • Opcode ID: e1c51f5f3a8edd67ad37ddf8b664ae14cd0f02306c14cc74507015e171a4cf9a
                                                  • Instruction ID: 4ab54a417aa0a7f98547d5e26656e7f5c6fd4091351510bab3b599f1e00aa758
                                                  • Opcode Fuzzy Hash: e1c51f5f3a8edd67ad37ddf8b664ae14cd0f02306c14cc74507015e171a4cf9a
                                                  • Instruction Fuzzy Hash: 6851D131A0C6924BF7218B62D84CBFD6A91FB64794F804132D98D7BBD8DF3CD5858242
                                                  Function 00007FFFE33EA9E0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 219windowCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.4286243601.00007FFFE33C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFFE33C0000, based on PE: true
                                                  • Associated: 00000002.00000002.4285328995.00007FFFE33C0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4287819193.00007FFFE33FE000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289006151.00007FFFE3413000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289870492.00007FFFE3414000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_7fffe33c0000_cmd.jbxd
                                                  Similarity
                                                  • API ID: ErrorFormatHandleLastMessageModule
                                                  • String ID: NTDLL.DLL
                                                  • API String ID: 1273946083-1613819793
                                                  • Opcode ID: 88f45b97fdc75684a513df4b7fc9a8bd2ee26a36a8344fcda721fd4cd3e23859
                                                  • Instruction ID: b1925ec513f29b3ff61e2a73c14e98c04efee230c04bc96c4694f19bfa2d7048
                                                  • Opcode Fuzzy Hash: 88f45b97fdc75684a513df4b7fc9a8bd2ee26a36a8344fcda721fd4cd3e23859
                                                  • Instruction Fuzzy Hash: B3A1C036A09BC28EE7358F25DC08BF82AE1BB54394F444136CA9D76BD4DF789685D302
                                                  Function 00007FFFE33E9AC0 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 155stringCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.4286243601.00007FFFE33C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFFE33C0000, based on PE: true
                                                  • Associated: 00000002.00000002.4285328995.00007FFFE33C0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4287819193.00007FFFE33FE000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289006151.00007FFFE3413000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289870492.00007FFFE3414000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_7fffe33c0000_cmd.jbxd
                                                  Similarity
                                                  • API ID: lstrlenmemcmpmemcpy
                                                  • String ID: called `Result::unwrap()` on an `Err` value
                                                  • API String ID: 3623198841-2333694755
                                                  • Opcode ID: 5467477b69dae406c704081a848d82c145c4875ad30d0bde8fea6ee1f9415490
                                                  • Instruction ID: c498687de5174b612cc7035c880d8222d1c79a9060c2427c7fcd8d189b457931
                                                  • Opcode Fuzzy Hash: 5467477b69dae406c704081a848d82c145c4875ad30d0bde8fea6ee1f9415490
                                                  • Instruction Fuzzy Hash: 4951B352A087569BEA109B629C08BAA2BE1BB65BB4F544731DE7D337D0DF3CE445C302
                                                  Function 00007FFFE33FA1CC Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.4286243601.00007FFFE33C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFFE33C0000, based on PE: true
                                                  • Associated: 00000002.00000002.4285328995.00007FFFE33C0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4287819193.00007FFFE33FE000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289006151.00007FFFE3413000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289870492.00007FFFE3414000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_7fffe33c0000_cmd.jbxd
                                                  Similarity
                                                  • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                  • String ID:
                                                  • API String ID: 2933794660-0
                                                  • Opcode ID: 6edbb3fd13094330cdc7f06bdb8bfa20a36bb9b7d606bf60de730f4b72130cfe
                                                  • Instruction ID: 19901ae013d2a1d51a3503297ae49f08a86baca28a3838ee63010c3c8f8fdcf4
                                                  • Opcode Fuzzy Hash: 6edbb3fd13094330cdc7f06bdb8bfa20a36bb9b7d606bf60de730f4b72130cfe
                                                  • Instruction Fuzzy Hash: 21112E32B15F018AEB00DF61E8583B837E4F759B58F440E32EA6D967A4DF78D1588341
                                                  Function 000002A38BE5A1CC Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.4278089901.000002A38BE21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000002A38BE20000, based on PE: true
                                                  • Associated: 00000002.00000002.4277288296.000002A38BE20000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4279591592.000002A38BE5E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4280746408.000002A38BE73000.00000008.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4281622622.000002A38BE74000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_2a38be20000_cmd.jbxd
                                                  Similarity
                                                  • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                  • String ID:
                                                  • API String ID: 2933794660-0
                                                  • Opcode ID: 6edbb3fd13094330cdc7f06bdb8bfa20a36bb9b7d606bf60de730f4b72130cfe
                                                  • Instruction ID: 8b940ee13398dea8401cc1715cdf2b7371231fd1febc00fed3b90a439c367874
                                                  • Opcode Fuzzy Hash: 6edbb3fd13094330cdc7f06bdb8bfa20a36bb9b7d606bf60de730f4b72130cfe
                                                  • Instruction Fuzzy Hash: D4110326712B058EEB00CF60E8593AC33A4F71AB58F441E21FB6D87BA4DF78E2558341
                                                  Function 000002A38BE229D0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 218COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.4278089901.000002A38BE21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000002A38BE20000, based on PE: true
                                                  • Associated: 00000002.00000002.4277288296.000002A38BE20000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4279591592.000002A38BE5E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4280746408.000002A38BE73000.00000008.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4281622622.000002A38BE74000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_2a38be20000_cmd.jbxd
                                                  Similarity
                                                  • API ID: DebugOutputStringmemset
                                                  • String ID: Failed to encrypt function name
                                                  • API String ID: 1084755268-2980051713
                                                  • Opcode ID: a27cfad827d6ae0a999ba0a18242da53c4d1df53253adeb34094dc71fa201e46
                                                  • Instruction ID: dbc68d728aebcd04d9fd9322f12b95d490a3cd2374cb4e0b377defc02b550e09
                                                  • Opcode Fuzzy Hash: a27cfad827d6ae0a999ba0a18242da53c4d1df53253adeb34094dc71fa201e46
                                                  • Instruction Fuzzy Hash: 41A1AD72A01BD18DEB308F64E8497DC6760F75A758F448229EF981BB96DF788294C380
                                                  Function 00007FFFE33CF100 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 173COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.4286243601.00007FFFE33C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFFE33C0000, based on PE: true
                                                  • Associated: 00000002.00000002.4285328995.00007FFFE33C0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4287819193.00007FFFE33FE000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289006151.00007FFFE3413000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289870492.00007FFFE3414000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_7fffe33c0000_cmd.jbxd
                                                  Similarity
                                                  • API ID: DebugOutputStringmemset
                                                  • String ID: LL file.
                                                  • API String ID: 1084755268-1255835901
                                                  • Opcode ID: c701a7f804882fd8cd3c9164aeb46908b369442d1bad4ba94d23187de13e217e
                                                  • Instruction ID: c266a2f9879e2f3cb3f5f120171de84ee76e14f53f91899dc862c136460ad7ee
                                                  • Opcode Fuzzy Hash: c701a7f804882fd8cd3c9164aeb46908b369442d1bad4ba94d23187de13e217e
                                                  • Instruction Fuzzy Hash: AC71F536B14B8189EB618F61D8447EC3BA1FB99B88F848136CE0C67B89DF39D245C301
                                                  Function 000002A38BE2F100 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 173COMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Strings
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.4278089901.000002A38BE21000.00000020.00000001.01000000.00000005.sdmp, Offset: 000002A38BE20000, based on PE: true
                                                  • Associated: 00000002.00000002.4277288296.000002A38BE20000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4279591592.000002A38BE5E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4280746408.000002A38BE73000.00000008.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4281622622.000002A38BE74000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_2a38be20000_cmd.jbxd
                                                  Similarity
                                                  • API ID: DebugOutputStringmemset
                                                  • String ID: LL file.
                                                  • API String ID: 1084755268-1255835901
                                                  • Opcode ID: dc372ee067a9702d27070e02f97289e2543f7d12e08caf81bb61d40d7eb219ea
                                                  • Instruction ID: f51d2acad8b5033520695902e55133765d100c78660e835971e50869a6461556
                                                  • Opcode Fuzzy Hash: dc372ee067a9702d27070e02f97289e2543f7d12e08caf81bb61d40d7eb219ea
                                                  • Instruction Fuzzy Hash: BB719E36712B818DEB61CF21E8443EC2760F78AB88F448126EF495BB99DF39D685C341
                                                  Function 00007FFFE33E8560 Relevance: 5.1, APIs: 4, Instructions: 60memoryCOMMON
                                                  Download Yara Rule
                                                  APIs
                                                  Memory Dump Source
                                                  • Source File: 00000002.00000002.4286243601.00007FFFE33C1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FFFE33C0000, based on PE: true
                                                  • Associated: 00000002.00000002.4285328995.00007FFFE33C0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4287819193.00007FFFE33FE000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289006151.00007FFFE3413000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                  • Associated: 00000002.00000002.4289870492.00007FFFE3414000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                  Joe Sandbox IDA Plugin
                                                  • Snapshot File: hcaresult_2_2_7fffe33c0000_cmd.jbxd
                                                  Similarity
                                                  • API ID: Heap$Process$Freememcpy
                                                  • String ID:
                                                  • API String ID: 1144931586-0
                                                  • Opcode ID: cbaa8a4bf3bff821ab4a09d7aab3bf74b7114b8dcce7e488f653a3abb563c08e
                                                  • Instruction ID: ef400d28ed8652b45340805af54ab4d988c19ea661533df3f3acdf0a50bc4c80
                                                  • Opcode Fuzzy Hash: cbaa8a4bf3bff821ab4a09d7aab3bf74b7114b8dcce7e488f653a3abb563c08e
                                                  • Instruction Fuzzy Hash: 5D01C423B497684BF906DB936D489B94A816FA8FE4B494832DE4D33B51EE3CD1878201