Edit tour

Windows Analysis Report
svchost.exe

Overview

General Information

Sample name:	svchost.exe
Analysis ID:	1532544
MD5:	0a8a20f78887d083909131e3206e7ea3
SHA1:	d72ccda934c157750a7a415c8caef1b7a3576720
SHA256:	2e463e9569f44d2c1f91b72e9b5fe140959738b436b25faf57b1ec5e9f253980
Tags:	exeuser-poppysec
Infos:

Detection

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

System process connects to network (likely due to code injection or exploit)

Drops PE files with benign system names

Drops large PE files

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: Suspect Svchost Activity

Sigma detected: System File Execution Location Anomaly

Sigma detected: Windows Binaries Write Suspicious Extensions

Creates a process in suspended mode (likely to inject code)

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Enables security privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May check the online IP address of the machine

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries keyboard layouts

Queries the volume information (name, serial number etc) of a device

Sigma detected: Console CodePage Lookup Via CHCP

Sigma detected: Uncommon Svchost Parent Process

Uses 32bit PE files

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

svchost.exe (PID: 6848 cmdline: "C:\Users\user\Desktop\svchost.exe" MD5: 0A8A20F78887D083909131E3206E7EA3)

svchost.exe (PID: 6804 cmdline: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe MD5: C1290736DF9A2094B6039AA50D48C442)

cmd.exe (PID: 5952 cmdline: C:\Windows\system32\cmd.exe /d /s /c "chcp" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4928 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 5436 cmdline: chcp MD5: 33395C4732A49065EA72590B14B64F32)

svchost.exe (PID: 5024 cmdline: "C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\svchost" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1880,i,10768761136844148512,6325765039296928006,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1876 /prefetch:2 MD5: C1290736DF9A2094B6039AA50D48C442)

explorer.exe (PID: 2580 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)

svchost.exe (PID: 888 cmdline: "C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\svchost" --field-trial-handle=2972,i,10768761136844148512,6325765039296928006,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=852 /prefetch:3 MD5: C1290736DF9A2094B6039AA50D48C442)

svchost.exe (PID: 6248 cmdline: "C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe" --type=renderer --user-data-dir="C:\Users\user\AppData\Roaming\svchost" --app-path="C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\resources\app.asar" --enable-sandbox --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1728824326784335 --launch-time-ticks=4868475320 --field-trial-handle=2992,i,10768761136844148512,6325765039296928006,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3020 /prefetch:1 MD5: C1290736DF9A2094B6039AA50D48C442)

cleanup

Sigma Signatures

System Summary

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\svchost.exe, ProcessId: 6848, TargetFilename: C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\svchost.exe

Sigma detected: Suspect Svchost Activity

Source: Process started

Author: David Burkett, @signalblur: Data: Command: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe, CommandLine: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\svchost.exe", ParentImage: C:\Users\user\Desktop\svchost.exe, ParentProcessId: 6848, ParentProcessName: svchost.exe, ProcessCommandLine: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe, ProcessId: 6804, ProcessName: svchost.exe

Sigma detected: System File Execution Location Anomaly

Source: Process started

Author: Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali: Data: Command: "C:\Users\user\Desktop\svchost.exe", CommandLine: "C:\Users\user\Desktop\svchost.exe", CommandLine|base64offset|contains: , Image: C:\Users\user\Desktop\svchost.exe, NewProcessName: C:\Users\user\Desktop\svchost.exe, OriginalFileName: C:\Users\user\Desktop\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\Users\user\Desktop\svchost.exe", ProcessId: 6848, ProcessName: svchost.exe

Sigma detected: Windows Binaries Write Suspicious Extensions

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\svchost.exe, ProcessId: 6848, TargetFilename: C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\doc\make.bat

Sigma detected: Console CodePage Lookup Via CHCP

Source: Process started

Author: _pete_0, TheDFIRReport: Data: Command: chcp, CommandLine: chcp, CommandLine|base64offset|contains: r), Image: C:\Windows\System32\chcp.com, NewProcessName: C:\Windows\System32\chcp.com, OriginalFileName: C:\Windows\System32\chcp.com, ParentCommandLine: C:\Windows\system32\cmd.exe /d /s /c "chcp", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5952, ParentProcessName: cmd.exe, ProcessCommandLine: chcp, ProcessId: 5436, ProcessName: chcp.com

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe, CommandLine: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\svchost.exe", ParentImage: C:\Users\user\Desktop\svchost.exe, ParentProcessId: 6848, ParentProcessName: svchost.exe, ProcessCommandLine: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe, ProcessId: 6804, ProcessName: svchost.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: "C:\Users\user\Desktop\svchost.exe", CommandLine: "C:\Users\user\Desktop\svchost.exe", CommandLine|base64offset|contains: , Image: C:\Users\user\Desktop\svchost.exe, NewProcessName: C:\Users\user\Desktop\svchost.exe, OriginalFileName: C:\Users\user\Desktop\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\Users\user\Desktop\svchost.exe", ProcessId: 6848, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: svchost.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Users\user\Desktop\svchost.exe	File created: C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\LICENSE.electron.txt	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	File created: C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\doc\static\opensans\LICENSE.txt	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	File created: C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\LICENSE.txt	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	File created: C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\src\cnoke\LICENSE.txt	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	File created: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\LICENSE.electron.txt	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	File created: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\resources\app.asar.unpacked\node_modules\koffi\LICENSE.txt	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	File created: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\resources\app.asar.unpacked\node_modules\koffi\doc\static\opensans\LICENSE.txt	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	File created: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\resources\app.asar.unpacked\node_modules\koffi\src\cnoke\LICENSE.txt	Jump to behavior

Source: svchost.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:

Binary string: C:\projects\src\out\Default\vulkan-1.dll.pdb source: svchost.exe, 00000000.00000003.2015578894.0000000006100000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.2015833860.0000000006280000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\svchost.exe	File opened: C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\node_modules\koffi	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	File opened: C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\node_modules	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	File opened: C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\locales	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	File opened: C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\node_modules\koffi\build\koffi	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	File opened: C:\Users\user\AppData\Local\Temp\nssB89F.tmp\app-64.7z	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	File opened: C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\node_modules\koffi\build	Jump to behavior

Source: Joe Sandbox View	IP Address: 34.117.59.81 34.117.59.81
Source: Joe Sandbox View	IP Address: 34.117.59.81 34.117.59.81

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443

Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Mutant created: \Sessions\1\BaseNamedObjects\mfx_d3d_mutex
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4928:120:WilError_03

Source: unknown	Process created: C:\Users\user\Desktop\svchost.exe "C:\Users\user\Desktop\svchost.exe"
Source: C:\Users\user\Desktop\svchost.exe	Process created: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "chcp"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Process created: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe "C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\svchost" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1880,i,10768761136844148512,6325765039296928006,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1876 /prefetch:2
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Process created: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe "C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\svchost" --field-trial-handle=2972,i,10768761136844148512,6325765039296928006,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=852 /prefetch:3
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Process created: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe "C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe" --type=renderer --user-data-dir="C:\Users\user\AppData\Roaming\svchost" --app-path="C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\resources\app.asar" --enable-sandbox --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1728824326784335 --launch-time-ticks=4868475320 --field-trial-handle=2992,i,10768761136844148512,6325765039296928006,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3020 /prefetch:1
Source: C:\Users\user\Desktop\svchost.exe	Process created: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /d /s /c "chcp"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Process created: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe "C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\svchost" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1880,i,10768761136844148512,6325765039296928006,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1876 /prefetch:2	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Process created: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe "C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\svchost" --field-trial-handle=2972,i,10768761136844148512,6325765039296928006,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=852 /prefetch:3	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Process created: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe "C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe" --type=renderer --user-data-dir="C:\Users\user\AppData\Roaming\svchost" --app-path="C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\resources\app.asar" --enable-sandbox --lang=en-GB --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1728824326784335 --launch-time-ticks=4868475320 --field-trial-handle=2992,i,10768761136844148512,6325765039296928006,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3020 /prefetch:1	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp

Source: C:\Users\user\Desktop\svchost.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: ffmpeg.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: kbdus.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: mscms.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: coloradapterclient.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: windows.globalization.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: bcp47mrm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: twinapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: directmanipulation.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: msspellcheckingfacility.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: ffmpeg.dll
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: dbgcore.dll
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: dxgi.dll
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: mf.dll
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: mfplat.dll
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: rtworkq.dll
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: ffmpeg.dll
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: dbgcore.dll
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: kbdus.dll
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: ffmpeg.dll
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: dbgcore.dll
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Section loaded: mswsock.dll

Source: ffmpeg.dll.0.dr	Static PE information: section name: .gxfg
Source: ffmpeg.dll.0.dr	Static PE information: section name: .retplne
Source: ffmpeg.dll.0.dr	Static PE information: section name: _RDATA
Source: libEGL.dll.0.dr	Static PE information: section name: .gxfg
Source: libEGL.dll.0.dr	Static PE information: section name: .retplne
Source: libEGL.dll.0.dr	Static PE information: section name: _RDATA
Source: libGLESv2.dll.0.dr	Static PE information: section name: .gxfg
Source: libGLESv2.dll.0.dr	Static PE information: section name: .retplne
Source: libGLESv2.dll.0.dr	Static PE information: section name: _RDATA
Source: svchost.exe.0.dr	Static PE information: section name: .gxfg
Source: svchost.exe.0.dr	Static PE information: section name: .retplne
Source: svchost.exe.0.dr	Static PE information: section name: .rodata
Source: svchost.exe.0.dr	Static PE information: section name: CPADinfo
Source: svchost.exe.0.dr	Static PE information: section name: LZMADEC
Source: svchost.exe.0.dr	Static PE information: section name: _RDATA
Source: svchost.exe.0.dr	Static PE information: section name: malloc_h
Source: svchost.exe.0.dr	Static PE information: section name: prot
Source: vk_swiftshader.dll.0.dr	Static PE information: section name: .gxfg
Source: vk_swiftshader.dll.0.dr	Static PE information: section name: .retplne
Source: vk_swiftshader.dll.0.dr	Static PE information: section name: _RDATA
Source: vulkan-1.dll.0.dr	Static PE information: section name: .gxfg
Source: vulkan-1.dll.0.dr	Static PE information: section name: .retplne
Source: vulkan-1.dll.0.dr	Static PE information: section name: _RDATA
Source: ffmpeg.dll0.0.dr	Static PE information: section name: .gxfg
Source: ffmpeg.dll0.0.dr	Static PE information: section name: .retplne
Source: ffmpeg.dll0.0.dr	Static PE information: section name: _RDATA
Source: koffi.node13.0.dr	Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\svchost.exe	File created: C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\node_modules\koffi\build\koffi\win32_arm64\koffi.node	Jump to dropped file
Source: C:\Users\user\Desktop\svchost.exe	File created: C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\build\Release\better_sqlite3.node	Jump to dropped file
Source: C:\Users\user\Desktop\svchost.exe	File created: C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\build\koffi\win32_ia32\koffi.node	Jump to dropped file
Source: C:\Users\user\Desktop\svchost.exe	File created: C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\build\koffi\win32_x64\koffi.node	Jump to dropped file
Source: C:\Users\user\Desktop\svchost.exe	File created: C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\Desktop\svchost.exe	File created: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\Desktop\svchost.exe	File created: C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\vulkan-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\svchost.exe	File created: C:\Users\user\AppData\Local\Temp\nssB89F.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\Desktop\svchost.exe	File created: C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\vk_swiftshader.dll	Jump to dropped file
Source: C:\Users\user\Desktop\svchost.exe	File created: C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\node_modules\koffi\build\koffi\win32_ia32\koffi.node	Jump to dropped file
Source: C:\Users\user\Desktop\svchost.exe	File created: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\ffmpeg.dll	Jump to dropped file
Source: C:\Users\user\Desktop\svchost.exe	File created: C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\libEGL.dll	Jump to dropped file
Source: C:\Users\user\Desktop\svchost.exe	File created: C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\build\koffi\win32_arm64\koffi.node	Jump to dropped file
Source: C:\Users\user\Desktop\svchost.exe	File created: C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\resources\elevate.exe	Jump to dropped file
Source: C:\Users\user\Desktop\svchost.exe	File created: C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\ffmpeg.dll	Jump to dropped file
Source: C:\Users\user\Desktop\svchost.exe	File created: C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\node_modules\koffi\build\koffi\win32_x64\koffi.node	Jump to dropped file
Source: C:\Users\user\Desktop\svchost.exe	File created: C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\Desktop\svchost.exe	File created: C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\svchost.exe	Jump to dropped file
Source: C:\Users\user\Desktop\svchost.exe	File created: C:\Users\user\AppData\Local\Temp\nssB89F.tmp\nsis7z.dll	Jump to dropped file

Source: C:\Users\user\Desktop\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Source: C:\Users\user\Desktop\svchost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\node_modules\koffi\build\koffi\win32_arm64\koffi.node	Jump to dropped file
Source: C:\Users\user\Desktop\svchost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\build\Release\better_sqlite3.node	Jump to dropped file
Source: C:\Users\user\Desktop\svchost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\build\koffi\win32_x64\koffi.node	Jump to dropped file
Source: C:\Users\user\Desktop\svchost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\build\koffi\win32_ia32\koffi.node	Jump to dropped file
Source: C:\Users\user\Desktop\svchost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\Desktop\svchost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\Desktop\svchost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\vulkan-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\svchost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nssB89F.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\Desktop\svchost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\vk_swiftshader.dll	Jump to dropped file
Source: C:\Users\user\Desktop\svchost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\node_modules\koffi\build\koffi\win32_ia32\koffi.node	Jump to dropped file
Source: C:\Users\user\Desktop\svchost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\libEGL.dll	Jump to dropped file
Source: C:\Users\user\Desktop\svchost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\build\koffi\win32_arm64\koffi.node	Jump to dropped file
Source: C:\Users\user\Desktop\svchost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\resources\elevate.exe	Jump to dropped file
Source: C:\Users\user\Desktop\svchost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\node_modules\koffi\build\koffi\win32_x64\koffi.node	Jump to dropped file
Source: C:\Users\user\Desktop\svchost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\Desktop\svchost.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nssB89F.tmp\nsis7z.dll	Jump to dropped file

Source: svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://bgoffice.sourceforge.net/
Source: svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://brltty.app
Source: svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://casper.beckman.uiuc.edu/~c-tsai4
Source: svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cgit.freedesktop.org/~aplattner/nvidia-settings/
Source: svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://chasen.aist-nara.ac.jp/chasen/distribution.html
Source: svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://code.google.com/p/atinject/
Source: svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://code.google.com/p/google-axs-chrome/
Source: svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://code.google.com/p/google-jstemplate/
Source: svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://code.google.com/p/lao-dictionary/
Source: svchost.exe, 00000000.00000003.1922586175.0000000006A43000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://code.google.com/p/python-gflags/
Source: svchost.exe, 00000000.00000003.1922586175.0000000006A43000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://code.google.com/p/smhasher/
Source: svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://code.google.com/p/y2038
Source: svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://creativecommons.org/publicdomain/zero/1.0/
Source: svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://cristal.univ-lille.fr/~casiez/1euro/
Source: svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://daringfireball.net/
Source: svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://developer.android.com/ndk/index.html
Source: svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://developer.android.com/sdk/index.html
Source: svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1922586175.0000000006A43000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://developer.android.com/tools/extras/support-library.html
Source: svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://developer.intel.com/vtune/cbts/strmsimd/922down.htm
Source: svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://developer.intel.com/vtune/cbts/strmsimd/appnotes.htm)
Source: svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://developer.mozilla.org/en-US/docs/Accessibility/AT-APIs
Source: svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://ffmpeg.org/
Source: svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://findbugs.sourceforge.net/
Source: svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://fsf.org/>
Source: svchost.exe, 00000000.00000003.1922586175.0000000006A43000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://google.github.io/snappy/
Source: svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://harfbuzz.org
Source: svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://hunspell.sourceforge.net/
Source: svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://lao-dictionary.googlecode.com/git/Lao-Dictionary-LICENSE.txt
Source: svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://lao-dictionary.googlecode.com/git/Lao-Dictionary.txt
Source: svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://libcxx.llvm.org/
Source: svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://libcxxabi.llvm.org/
Source: svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://libevent.org/
Source: svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://libpng.org/
Source: svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://llvm.org
Source: svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://modp.com/release/base64
Source: svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://nodejs.org/
Source: svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://opensource.org/licenses/bsd-license.php
Source: svchost.exe, 00000000.00000003.1922586175.0000000006A43000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://opensource.perlig.de/rjsmin/
Source: svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://oss.sgi.com/projects/FreeB/

Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809

Source: C:\Users\user\Desktop\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	File Volume queried: C:\Users\user\AppData\Roaming\svchost\Code Cache\js FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	File Volume queried: C:\Users\user\AppData\Roaming\svchost\blob_storage\a3570230-d27d-44ab-88bd-4453727503bb FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	File Volume queried: C:\Users\user\AppData\Roaming\svchost\Code Cache\wasm FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	File Volume queried: C:\Users\user\AppData\Roaming\svchost FullSizeInformation	Jump to behavior

Source: svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: * Neither the name of the VMware, Inc. nor the names of its contributors
Source: svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: ARE DISCLAIMED. IN NO EVENT SHALL VMWARE, INC. OR CONTRIBUTORS BE LIABLE FOR
Source: svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: Copyright (c) 2011, VMware, Inc.

Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\svchost.exe	Queries volume information: C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm VolumeInformation	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Command and Scripting Interpreter	1 DLL Side-Loading	111 Process Injection	111 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	111 Process Injection	LSASS Memory	1 Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	1 Remote System Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	1 System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	22 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\d3dcompiler_47.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\ffmpeg.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\d3dcompiler_47.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\ffmpeg.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\libEGL.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\libGLESv2.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\node_modules\koffi\build\koffi\win32_arm64\koffi.node	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\node_modules\koffi\build\koffi\win32_ia32\koffi.node	5%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\node_modules\koffi\build\koffi\win32_x64\koffi.node	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\build\Release\better_sqlite3.node	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\resources\app.asar.unpacked\node_modules\better-sqlite3\deps\download.sh	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\build\koffi\win32_arm64\koffi.node	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\build\koffi\win32_ia32\koffi.node	5%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\build\koffi\win32_x64\koffi.node	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\src\cnoke\cnoke.js	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\src\core\libcc\mimetypes_gen.py	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\vendor\node-addon-api\tools\clang-format.js	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\vendor\node-addon-api\tools\conversion.js	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\resources\app.asar.unpacked\node_modules\koffi\vendor\node-addon-api\tools\eslint-format.js	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\resources\elevate.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\vk_swiftshader.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\vulkan-1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nssB89F.tmp\System.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nssB89F.tmp\nsis7z.dll	5%	ReversingLabs

Source	Detection	Scanner	Label	Link
https://sizzlejs.com/	0%	URL Reputation	safe
https://github.com/abseil/abseil-cpp	0%	Virustotal		Browse
https://github.com/simplejson/simplejson	0%	Virustotal		Browse
http://libevent.org/	0%	Virustotal		Browse
https://github.com/chromium/dom-distiller	0%	Virustotal		Browse
https://support.google.com/chrome/answer/6098869	0%	Virustotal		Browse
https://www.google.com/chrome/privacy/eula_text.htmlAy&udaGestionado	1%	Virustotal		Browse
https://github.com/Kotlin/kotlinx.coroutines	1%	Virustotal		Browse
https://www.google.com/chrome/privacy/eula_text.htmlP&al	0%	Virustotal		Browse
https://chrome.google.com/webstore?hl=fi&category=theme81https://myactivity.google.com/myactivity/?u	0%	Virustotal		Browse
https://chromium.googlesource.com/webm/libvpx	0%	Virustotal		Browse
https://github.com/liblouis/liblouis	0%	Virustotal		Browse
https://chrome.google.com/webstore?hl=pl&category=theme81https://myactivity.google.com/myactivity/?u	0%	Virustotal		Browse
https://github.com/AOMediaCodec/libavif	0%	Virustotal		Browse
http://modp.com/release/base64	0%	Virustotal		Browse
https://beto-core.googlesource.com/beto-core	0%	Virustotal		Browse
https://boringssl.googlesource.com/boringssl	0%	Virustotal		Browse
http://www.chromium.org/blink	0%	Virustotal		Browse
https://pypi.python.org/pypi/coverage	0%	Virustotal		Browse
https://github.com/google/pprof/tree/master/proto	0%	Virustotal		Browse
https://github.com/googlei18n/libphonenumber/	0%	Virustotal		Browse
https://github.com/jrmuizel/qcms/tree/v4	0%	Virustotal		Browse
https://www.google.com/chrome/privacy/eula_text.htmlPomo&cZarz	0%	Virustotal		Browse
http://www.unicode.org/cldr/data/	0%	Virustotal		Browse
https://aomedia.googlesource.com/aom/	0%	Virustotal		Browse
https://chromium.googlesource.com/chromium/src/	0%	Virustotal		Browse
https://github.com/plume-lib/)	0%	Virustotal		Browse
https://www.google.com/chrome/privacy/eula_text.htmlP&omo	1%	Virustotal		Browse
https://github.com/airbnb/lottie-web	0%	Virustotal		Browse
https://sourceware.org/newlib/	0%	Virustotal		Browse
https://chromium.googlesource.com/external/webrtc	0%	Virustotal		Browse
https://github.com/tensorflow/models	0%	Virustotal		Browse
https://github.com/typetools/annotation-tools)	0%	Virustotal		Browse
https://www.google.com/chrome/privacy/eula_text.htmlT&r	1%	Virustotal		Browse
https://github.com/KhronosGroup/SPIRV-Headers.git	0%	Virustotal		Browse

Name	Source	Malicious	Antivirus Detection	Reputation
http://libevent.org/	svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://github.com/liblouis/liblouis	svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://github.com/simplejson/simplejson	svchost.exe, 00000000.00000003.1922586175.0000000006A43000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://github.com/chromium/dom-distiller	svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://github.com/abseil/abseil-cpp	svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://support.google.com/chrome/answer/6098869	svchost.exe, 00000000.00000003.1922586175.0000000007443000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1922586175.0000000006A43000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://www.google.com/chrome/privacy/eula_text.htmlAy&udaGestionado	svchost.exe, 00000000.00000003.1922586175.0000000007443000.00000004.00001000.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
https://www.google.com/chrome/privacy/eula_text.htmlP&al	svchost.exe, 00000000.00000003.1922586175.0000000007E43000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://chrome.google.com/webstore?hl=ms&category=theme81https://myactivity.google.com/myactivity/?u	svchost.exe, 00000000.00000003.1922586175.0000000007E43000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://github.com/Kotlin/kotlinx.coroutines	svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
https://chrome.google.com/webstore?hl=fi&category=theme81https://myactivity.google.com/myactivity/?u	svchost.exe, 00000000.00000003.1922586175.0000000007443000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://chrome.google.com/webstore?hl=urCtrl$2	svchost.exe, 00000000.00000003.1922586175.0000000008843000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://chromium.googlesource.com/webm/libvpx	svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://www.chromium.org/blink	svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://chrome.google.com/webstore?hl=ltCtrl$1	svchost.exe, 00000000.00000003.1922586175.0000000007E43000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://chrome.google.com/webstore?hl=pl&category=theme81https://myactivity.google.com/myactivity/?u	svchost.exe, 00000000.00000003.1922586175.0000000007E43000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://github.com/AOMediaCodec/libavif	svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://modp.com/release/base64	svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://beto-core.googlesource.com/beto-core	svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://boringssl.googlesource.com/boringssl	svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://pypi.python.org/pypi/coverage	svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://github.com/google/pprof/tree/master/proto	svchost.exe, 00000000.00000003.1922586175.0000000006A43000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://github.com/jrmuizel/qcms/tree/v4	svchost.exe, 00000000.00000003.1922586175.0000000006A43000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://github.com/googlei18n/libphonenumber/	svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://www.google.com/chrome/privacy/eula_text.htmlPomo&cZarz	svchost.exe, 00000000.00000003.1922586175.0000000007E43000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://www.unicode.org/cldr/data/	svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://chromium.googlesource.com/chromium/src/	svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1922586175.0000000006A43000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://aomedia.googlesource.com/aom/	svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://www.google.com/chrome/privacy/eula_text.htmlP&omo	svchost.exe, 00000000.00000003.1922586175.0000000007443000.00000004.00001000.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
https://github.com/plume-lib/)	svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://github.com/typetools/annotation-tools)	svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://primer.com.Uporaba	svchost.exe, 00000000.00000003.1922586175.0000000008843000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://sourceware.org/newlib/	svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://github.com/airbnb/lottie-web	svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://github.com/tensorflow/models	svchost.exe, 00000000.00000003.1922586175.0000000006A43000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://chromium.googlesource.com/external/webrtc	svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://github.com/KhronosGroup/SPIRV-Headers.git	svchost.exe, 00000000.00000003.1922586175.0000000006A43000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
https://chrome.google.com/webstore?hl=mrCtrl$1	svchost.exe, 00000000.00000003.1922586175.0000000007E43000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://www.google.com/chrome/privacy/eula_text.htmlT&r	svchost.exe, 00000000.00000003.1922586175.0000000008843000.00000004.00001000.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
https://github.com/tensorflow/tflite-support	svchost.exe, 00000000.00000003.1922586175.0000000006A43000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://android.googlesource.com/platform/cts/	svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://libpng.org/	svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.unicode.org/cldr/data/.	svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://pypi.org/project/pyparsing	svchost.exe, 00000000.00000003.1922586175.0000000006A43000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://sqlite.org/	svchost.exe, 00000000.00000003.1922586175.0000000006A43000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://chrome.google.com/webstore?hl=id&category=theme81https://myactivity.google.com/myactivity/?u	svchost.exe, 00000000.00000003.1922586175.0000000007443000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://www.google.com/chrome/privacy/eula_text.htmlT&ulongPinapamahalaan	svchost.exe, 00000000.00000003.1922586175.0000000007443000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://chrome.google.com/webstore?hl=ukCtrl$1	svchost.exe, 00000000.00000003.1922586175.0000000008843000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://code.google.com/p/google-axs-chrome/	svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://github.com/isagalaev/ijson	svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://github.com/nih-at/libzip	svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://sizzlejs.com/	svchost.exe, 00000000.00000003.1922586175.0000000006A43000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://github.com/open-source-parsers/jsoncpp	svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://lao-dictionary.googlecode.com/git/Lao-Dictionary-LICENSE.txt	svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://android.googlesource.com/platform/external/hyphenation-patterns/	svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://chrome.google.com/webstore?hl=teCtrl$1	svchost.exe, 00000000.00000003.1922586175.0000000008843000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://code.google.com/p/y2038	svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://harfbuzz.org	svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://chrome.google.com/webstore?hl=sw&category=theme81https://myactivity.google.com/myactivity/?u	svchost.exe, 00000000.00000003.1922586175.0000000008843000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://nodejs.org/	svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://github.com/Microsoft/webauthn/	svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.portaudio.com	svchost.exe, 00000000.00000003.1922586175.0000000006A43000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.unicode.org/copyright.html	svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1922586175.0000000005800000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://js.foundation/>	svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://chrome.google.com/webstore?hl=thCtrl$1	svchost.exe, 00000000.00000003.1922586175.0000000008843000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://github.com/google/double-conversion	svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://registry.khronos.org/EGL/	svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://registry.npmjs.org	svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.freetype.org/	svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://llvm.org	svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://github.com/google/shell-encryption	svchost.exe, 00000000.00000003.1922586175.0000000006A43000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://passwords.google.comCompte	svchost.exe, 00000000.00000003.1922586175.0000000007443000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1922586175.0000000006A43000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://chrome.google.com/webstore?hl=zh-TWCtrl$1	svchost.exe, 00000000.00000003.1922586175.0000000008843000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.apache.org/).	svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://gitlab.freedesktop.org/xorg/lib/libxcb-keysyms	svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://www.google.com/chrome/privacy/eula_text.html&S	svchost.exe, 00000000.00000003.1922586175.0000000007443000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://github.com/microsoft/vscode-custom-data	svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://chromeenterprise.google/policies/#BrowserSwitcherUrlList	svchost.exe, 00000000.00000003.1922586175.0000000007443000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1922586175.0000000006A43000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://unity3d.com/legal/licenses/Unity_Companion_License	svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://github.com/typetools/jdk	svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://chrome.google.com/webstore?hl=svCtrl$1	svchost.exe, 00000000.00000003.1922586175.0000000008843000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://github.com/LinuxA11y/IAccessible2	svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://www.khronos.org/registry/	svchost.exe, 00000000.00000003.1922586175.0000000006A43000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.gnu.org/licenses/>.	svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://nodejs.org	svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://github.com/requests/toolbelt	svchost.exe, 00000000.00000003.1922586175.0000000006A43000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://chrome.google.com/webstore/category/extensions	svchost.exe, 00000000.00000003.1922586175.0000000007443000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000000.00000003.1922586175.0000000006A43000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://github.com/google/anonymous-tokens	svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://chrome.google.com/webstore?hl=hu&category=theme81https://myactivity.google.com/myactivity/?u	svchost.exe, 00000000.00000003.1922586175.0000000007443000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://bitbucket.org/jpommier/pffft/	svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://developers.google.com/ar/develop/java/enable-arcore#dependencies	svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://passwords.google.comT	svchost.exe, 00000000.00000003.1922586175.0000000008843000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.unicode.org/reports/	svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://easylist.to/easylist/easylist.txt	svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://github.com/y-256/libdivsufsort	svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://pypi.python.org/pypi/pyfakefs	svchost.exe, 00000000.00000003.1922586175.0000000006A43000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://chrome.google.com/webstore?hl=gu&category=theme81https://myactivity.google.com/myactivity/?u	svchost.exe, 00000000.00000003.1922586175.0000000007443000.00000004.00001000.00020000.00000000.sdmp	false		unknown
https://passwords.google.comKonta	svchost.exe, 00000000.00000003.1922586175.0000000007E43000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://www.openh264.org/	svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	false		unknown
http://developer.android.com/sdk/index.html	svchost.exe, 00000000.00000003.1922586175.0000000006043000.00000004.00001000.00020000.00000000.sdmp	false		unknown

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1532544
Start date and time:	2024-10-13 16:18:17 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 41s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	svchost.exe
Detection:	MAL
Classification:	mal72.evad.winEXE@14/502@1/1
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
34.117.59.81	UjbjOP.ps1	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	I9xuKI2p2B.ps1	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	licarisan_api.exe	Get hash	malicious	Icarus	Browse	ipinfo.io/ip
	build.exe	Get hash	malicious	Unknown	Browse	ipinfo.io/ip
	YjcgpfVBcm.bat	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	lePDF.cmd	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	6Mpsoq1.php.ps1	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	mjOiDa1hrN.bat	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	8ym4cxJPyl.ps1	Get hash	malicious	Unknown	Browse	ipinfo.io/json
	GKrKPXOkdF.zsb.dll	Get hash	malicious	Unknown	Browse	ipinfo.io/json

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report svchost.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\chrome_100_percent.pak

C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\chrome_200_percent.pak

C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\d3dcompiler_47.dll

C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\ffmpeg.dll

C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\icudtl.dat

C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\LICENSE.electron.txt

C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\LICENSES.chromium.html

C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\chrome_100_percent.pak

C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\chrome_200_percent.pak

C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\d3dcompiler_47.dll

C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\ffmpeg.dll

C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\icudtl.dat

C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\libEGL.dll

C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\libGLESv2.dll

C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\locales\af.pak

C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\locales\am.pak

C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\locales\ar.pak

C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\locales\bg.pak

C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\locales\bn.pak

C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\locales\ca.pak

C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\locales\cs.pak

C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\locales\da.pak

C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\locales\de.pak

C:\Users\user\AppData\Local\Temp\nssB89F.tmp\7z-out\locales\el.pak

Windows Analysis Report
svchost.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ipinfo.io	d3ca1c9cdcf0f664f4c4b469ce935febb6d974693647c.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	34.117.59.81
	http://boot.uleif.com	Get hash	malicious	Unknown	Browse	34.117.59.81
	https://load.alisonball.com.au	Get hash	malicious	Unknown	Browse	34.117.59.81
	SecuriteInfo.com.Trojan-Ransom.Win32.Zerber.gkca.4990.15640.exe	Get hash	malicious	Unknown	Browse	34.117.59.81
	SecuriteInfo.com.Trojan-Ransom.Win32.Zerber.gkca.4990.15640.exe	Get hash	malicious	Unknown	Browse	34.117.59.81
	https://loadfile.komanda.cl/	Get hash	malicious	Unknown	Browse	34.117.59.81
	https://loadfile.komanda.cl/	Get hash	malicious	HTMLPhisher	Browse	34.117.59.81
	https://loadfile.komanda.cl/	Get hash	malicious	Unknown	Browse	34.117.59.81
	UjbjOP.ps1	Get hash	malicious	Unknown	Browse	34.117.59.81
	I9xuKI2p2B.ps1	Get hash	malicious	Unknown	Browse	34.117.59.81

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	c5yDnHUmFv.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	c5yDnHUmFv.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	oUbgeGwOL8.exe	Get hash	malicious	LummaC, Amadey, Stealc	Browse	34.117.188.166
	d3ca1c9cdcf0f664f4c4b469ce935febb6d974693647c.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	34.117.59.81
	http://boot.uleif.com	Get hash	malicious	Unknown	Browse	34.117.59.81
	https://lessonfulladvocating.z19.web.core.windows.net/	Get hash	malicious	Anonymous Proxy	Browse	34.117.77.79
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166
	file.exe	Get hash	malicious	Credential Flusher	Browse	34.117.188.166

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\2nL7nS3HEmMzaquEkAHxy2ighT7\d3dcompiler_47.dll	JaborSetup.exe	Get hash	malicious	Unknown	Browse
	ArenaWarsSetup.exe	Get hash	malicious	Unknown	Browse
	ArenaWarsSetup.exe	Get hash	malicious	Unknown	Browse
	DungeOfDestiny Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse
	Game.exe	Get hash	malicious	Unknown	Browse
	bot_library.exe	Get hash	malicious	Unknown	Browse
	svAsYrT598.exe	Get hash	malicious	Unknown	Browse
	kc8qrDHj1V.exe	Get hash	malicious	Unknown	Browse
	Solicitud de Cotizaci#U00f3n #U2013 Cat#U00e1logo de Muestras2024.vbs	Get hash	malicious	FormBook, GuLoader	Browse
	t4xSDtqF.posh.ps1	Get hash	malicious	PoshC2	Browse

Process:	C:\Users\user\Desktop\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	151856
Entropy (8bit):	7.916234678329522
Encrypted:	false
SSDEEP:	3072:iz8JCGIdkwTPaNkx0auKdL2o418Gb0+VRLf0ld0GY3cQ3ERVm2I:iz81Idk8aqT5K18Gb0OV8ld0GecQ3Er2
MD5:	CB4F128469CD84711ED1C9C02212C7A8
SHA1:	8AE60303BE80B74163D5C4132DE4A465A1EAFC52
SHA-256:	7DD5485DEF22A53C0635EFDF8AE900F147EC8C8A22B9ED71C24668075DD605D3
SHA-512:	0F0FEBE4EE321EB09D6A841FE3460D1F5B657B449058653111E7D0F7A9F36620B3D30369E367235948529409A6CE0CE625AEDE0C61B60926DEC4D2C308306277
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	..........<.....................\...........I.......................:.....4.....o.....?......!.....%....@'.....1.....<....l?.....C.....G.....I.....J.....M.....O.....R....\|V.....Z.....]....N`.....a....3c....Zd....f....f....l...Jr....v....y....}............9.....................+..............".....{...........C....1....R..................&....7............0.q...1.....2.....3.]...4.P...5.....:.....;.....<.."..R..%..S..'..T..0..U..2..V..6..W.4;..X.DF..Z..G..\.)P..]..W..^.c\.._..a..`..h..a._j..b..n..c..r..e.W\|..f.w...h....i.....k.S...l.....r....s.Y...t.$...u.....v.....w.....x....y.....{.....}.....~.......}.....T...........X...........j...........3.....a...........T...........T.....).............................t...........z.....O.....#.......................'...............................................R#.....$.....$.....%....w&....@'.....'....+)....!*.....+...../.....3....44....4.....4....5....6....w7.....7.....8....g8....8.....8.....?.....B....tC

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.999975803440211
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	svchost.exe
File size:	87'716'694 bytes
MD5:	0a8a20f78887d083909131e3206e7ea3
SHA1:	d72ccda934c157750a7a415c8caef1b7a3576720
SHA256:	2e463e9569f44d2c1f91b72e9b5fe140959738b436b25faf57b1ec5e9f253980
SHA512:	9fc0ba688845512dee331f23ceb121ec4f98fef52823a4cee958067a0a0890b2708340d81342699c4541a08d8996e58a0fc901781ab42467867fcd268ce7f7c0
SSDEEP:	1572864:89eyHWNREPsHOrTkGfShdCrto6VlVes3/G+nJ/THR5T02NeJmoOJNbF3x7:8a+NnjahsK6VLxdHj0uMmoWbFB7
TLSH:	43183338C70A8D33FEA49D36B1A51FD946C97D35DED68997886C601834B90434AFC3AE
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L......\.................h...8...@.

Entrypoint:	0x40338f
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x5C157F86 [Sat Dec 15 22:26:14 2018 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	b34f154ec913d2d2c435cbd644e91687

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8610	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x10b000	0xd8b8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6627	0x6800	7618d4c0cd8bb67ea9595b4266b3a91f	False	0.6646259014423077	data	6.450282348506287	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x14a2	0x1600	eecac1fed9cc6b447d50940d178404d8	False	0.4405184659090909	data	5.025178929113415	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x70ff8	0x600	db8f31a08a2242d80c29e1f9500c6527	False	0.5182291666666666	data	4.037117731448378	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x7b000	0x90000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x10b000	0xd8b8	0xda00	cab5b0009dbb2d9dcb0551d938ecd4ea	False	0.25808127866972475	data	4.742205898198625	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x10b328	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 0	English	United States	0.06565895134624469
RT_ICON	0x10f550	0x25c4	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9738311956971453
RT_ICON	0x111b18	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	United States	0.08236514522821577
RT_ICON	0x1140c0	0x1a68	Device independent bitmap graphic, 40 x 80 x 32, image size 0	English	United States	0.10488165680473373
RT_ICON	0x115b28	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	United States	0.13062851782363977
RT_ICON	0x116bd0	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	English	United States	0.1610655737704918
RT_ICON	0x117558	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 0	English	United States	0.19127906976744186
RT_ICON	0x117c10	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	United States	0.2393617021276596
RT_DIALOG	0x118078	0x100	data	English	United States	0.5234375
RT_DIALOG	0x118178	0xf8	data	English	United States	0.6330645161290323
RT_DIALOG	0x118270	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x1182d0	0x76	data	English	United States	0.7457627118644068
RT_VERSION	0x118348	0x230	data	English	United States	0.49107142857142855
RT_MANIFEST	0x118578	0x33e	XML 1.0 document, ASCII text, with very long lines (830), with no line terminators	English	United States	0.5542168674698795

DLL	Import
KERNEL32.dll	SetEnvironmentVariableW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, SetCurrentDirectoryW, GetFileAttributesW, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, GetVersion, SetErrorMode, lstrlenW, lstrcpynW, GetDiskFreeSpaceW, ExitProcess, GetShortPathNameW, CreateThread, GetLastError, CreateDirectoryW, CreateProcessW, RemoveDirectoryW, lstrcmpiA, CreateFileW, GetTempFileNameW, WriteFile, lstrcpyA, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, lstrcmpiW, MoveFileW, GetFullPathNameW, SetFileTime, SearchPathW, CompareFileTime, lstrcmpW, CloseHandle, ExpandEnvironmentStringsW, GlobalFree, GlobalLock, GlobalUnlock, GlobalAlloc, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, lstrlenA, MulDiv, MultiByteToWideChar, WideCharToMultiByte, GetPrivateProfileStringW, WritePrivateProfileStringW, FreeLibrary, LoadLibraryExW, GetModuleHandleW
USER32.dll	GetSystemMenu, SetClassLongW, EnableMenuItem, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, ScreenToClient, GetWindowRect, GetDlgItem, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, GetDC, SetTimer, SetWindowTextW, LoadImageW, SetForegroundWindow, ShowWindow, IsWindow, SetWindowLongW, FindWindowExW, TrackPopupMenu, AppendMenuW, CreatePopupMenu, EndPaint, CreateDialogParamW, SendMessageTimeoutW, wsprintfW, PostQuitMessage
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, ShellExecuteExW, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, SHFileOperationW
ADVAPI32.dll	AdjustTokenPrivileges, RegCreateKeyExW, RegOpenKeyExW, SetFileSecurityW, OpenProcessToken, LookupPrivilegeValueW, RegEnumValueW, RegDeleteKeyW, RegDeleteValueW, RegCloseKey, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance