Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
YiqjcLlhew.exe

Overview

General Information

Sample name:YiqjcLlhew.exe
renamed because original name is a hash value
Original sample name:e01a1e921ef924c2e1407fae1f09ec200cdb144973f431e81440e39b1005a9ce.exe
Analysis ID:1551217
MD5:f51da33b8f97ec40e1960522549dcca7
SHA1:001ffe1d668e5131cef1f105bfede3780c123ef8
SHA256:e01a1e921ef924c2e1407fae1f09ec200cdb144973f431e81440e39b1005a9ce
Tags:exeuser-adrian__luca
Infos:

Detection

Score:96
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
AI detected suspicious sample
Machine Learning detection for dropped file
Machine Learning detection for sample
Tries to resolve many domain names, but no domain seems valid
Connects to many different domains
Contains functionality to dynamically determine API calls
Contains functionality to enumerate running services
Contains functionality to query network adapater information
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates files inside the system directory
Deletes files inside the Windows folder
Detected potential crypto function
Drops PE files
Executes massive DNS lookups (> 100)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found decision node followed by non-executed suspicious APIs
Found evasive API chain (date check)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Sample execution stops while process was sleeping (likely an evasion)
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

  • System is w10x64
  • YiqjcLlhew.exe (PID: 6864 cmdline: "C:\Users\user\Desktop\YiqjcLlhew.exe" MD5: F51DA33B8F97EC40E1960522549DCCA7)
    • kfdag3aedbkjqfngi9xbw.exe (PID: 6912 cmdline: "C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exe" MD5: F51DA33B8F97EC40E1960522549DCCA7)
      • skjlipudplp.exe (PID: 3156 cmdline: "C:\vdjmzgowdzhfmld\skjlipudplp.exe" MD5: F51DA33B8F97EC40E1960522549DCCA7)
  • skjlipudplp.exe (PID: 6980 cmdline: C:\vdjmzgowdzhfmld\skjlipudplp.exe MD5: F51DA33B8F97EC40E1960522549DCCA7)
    • xmjofjnkdlv.exe (PID: 7092 cmdline: owwisyfkhljp "c:\vdjmzgowdzhfmld\skjlipudplp.exe" MD5: F51DA33B8F97EC40E1960522549DCCA7)
      • skjlipudplp.exe (PID: 5320 cmdline: "c:\vdjmzgowdzhfmld\skjlipudplp.exe" MD5: F51DA33B8F97EC40E1960522549DCCA7)
        • xmjofjnkdlv.exe (PID: 4852 cmdline: owwisyfkhljp "c:\vdjmzgowdzhfmld\skjlipudplp.exe" MD5: F51DA33B8F97EC40E1960522549DCCA7)
  • cleanup
No configs have been found
No yara matches
No Sigma rule has matched
TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
2024-11-07T15:57:41.186092+010020229301A Network Trojan was detected52.149.20.212443192.168.2.452907TCP
2024-11-07T15:58:19.852670+010020229301A Network Trojan was detected52.149.20.212443192.168.2.452927TCP
TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
2024-11-07T15:57:28.607734+010020181411A Network Trojan was detected18.143.155.6380192.168.2.456256TCP
2024-11-07T15:57:31.033944+010020181411A Network Trojan was detected54.244.188.17780192.168.2.456257TCP
TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
2024-11-07T15:57:28.607734+010020377711A Network Trojan was detected18.143.155.6380192.168.2.456256TCP
2024-11-07T15:57:31.033944+010020377711A Network Trojan was detected54.244.188.17780192.168.2.456257TCP
TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
2024-11-07T15:57:31.045246+010020183161A Network Trojan was detected1.1.1.153192.168.2.457543UDP
TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
2024-11-07T15:57:31.381815+010028115421A Network Trojan was detected1.1.1.153192.168.2.453861UDP
2024-11-07T15:59:15.174980+010028115421A Network Trojan was detected1.1.1.153192.168.2.457323UDP
TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
2024-11-07T15:57:26.487582+010028155681A Network Trojan was detected192.168.2.456255199.59.243.22780TCP
2024-11-07T15:58:59.354865+010028155681A Network Trojan was detected192.168.2.453059199.59.243.22780TCP
TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
2024-11-07T15:57:26.487582+010028206801Malware Command and Control Activity Detected192.168.2.456255199.59.243.22780TCP
2024-11-07T15:58:59.354865+010028206801Malware Command and Control Activity Detected192.168.2.453059199.59.243.22780TCP

Click to jump to signature section

Show All Signature Results

AV Detection

barindex
Source: YiqjcLlhew.exeAvira: detected
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeAvira: detection malicious, Label: TR/Nivdort.Gen2
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeAvira: detection malicious, Label: TR/Nivdort.Gen2
Source: C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exeAvira: detection malicious, Label: TR/Nivdort.Gen2
Source: C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exeReversingLabs: Detection: 92%
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeReversingLabs: Detection: 92%
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeReversingLabs: Detection: 92%
Source: YiqjcLlhew.exeReversingLabs: Detection: 92%
Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeJoe Sandbox ML: detected
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeJoe Sandbox ML: detected
Source: C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exeJoe Sandbox ML: detected
Source: YiqjcLlhew.exeJoe Sandbox ML: detected
Source: YiqjcLlhew.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: YiqjcLlhew.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: C:\Users\user\Desktop\YiqjcLlhew.exeCode function: 0_2_00CF3740 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,0_2_00CF3740
Source: C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exeCode function: 1_2_00DA3740 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,1_2_00DA3740
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: 2_2_00473740 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,2_2_00473740
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: 3_2_00053740 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,3_2_00053740
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: 4_2_00473740 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,4_2_00473740
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: 10_2_004B3740 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,10_2_004B3740

Networking

barindex
Source: Network trafficSuricata IDS: 2820680 - Severity 1 - ETPRO MALWARE W32/Bayrob Attempted Checkin 2 : 192.168.2.4:56255 -> 199.59.243.227:80
Source: Network trafficSuricata IDS: 2820680 - Severity 1 - ETPRO MALWARE W32/Bayrob Attempted Checkin 2 : 192.168.2.4:53059 -> 199.59.243.227:80
Source: unknownDNS traffic detected: query: heavydivide.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: glassinstead.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: degreemanner.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: heardbusiness.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: degreeready.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: difficultbrown.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: returnanother.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: necessaryappear.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: heavenbottle.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: leaderbusiness.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: glassinside.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: necessaryinstead.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: degreeexplain.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: heavendivide.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: requirebusiness.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: returnmanner.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: leaderbottle.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: heavenbusiness.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: heardinstead.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: heardready.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: orderappear.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: variousinside.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: answerappear.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: glassexplain.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: returndivide.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: heaveninside.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: glasspeople.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gentleappear.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: glassmanner.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: orderexplain.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: difficultmanner.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pleasantappear.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: heardanother.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: answerbrown.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: answerdaughter.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pleasantexplain.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: leaderappear.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: heavenanother.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: heavyexplain.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pleasantmanner.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: heavybusiness.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: variousmanner.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: necessarymanner.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: leadermanner.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: necessarybusiness.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: difficultexplain.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: answerready.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: forwardpeople.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gentlestream.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: heavystream.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: heavyanother.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: forwardexplain.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: requireinstead.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pleasantinside.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: difficultanother.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: forwardbusiness.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: necessaryexplain.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: returninstead.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: returnexplain.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: requirebright.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: requiremanner.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: answerbright.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: degreeanother.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: requireappear.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: glassanother.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: difficultready.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: degreebright.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: orderinside.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: heardinside.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: orderinstead.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gentlenothing.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: leaderinstead.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: answeranother.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: heavyinside.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: heardmanner.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: returnbusiness.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: orderbusiness.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: forwardinstead.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: answerexplain.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: necessaryinside.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: leaderexplain.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gentlemanner.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: variousnothing.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gentlebusiness.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: forwardready.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: heaveninstead.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gentleinstead.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: answermanner.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: difficultbright.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: returnappear.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: degreebrown.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gentlebottle.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: heavenbright.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: forwardbrown.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: leaderinside.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: heavymanner.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: forwardinside.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: difficultbusiness.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: returnnothing.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: heavynothing.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: leaderanother.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: heavyappear.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pleasantbright.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: heavenexplain.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gentleinside.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: heardappear.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: answerinside.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: degreebusiness.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: necessarybright.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: glassappear.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: glassbusiness.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: heardexplain.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: variousanother.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: ordermanner.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: variousbusiness.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: requireanother.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: leaderdivide.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: necessaryanother.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: variousexplain.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: answerpeople.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: variousbottle.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: orderbright.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: heavybottle.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: leadernothing.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: heavybright.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: difficultinstead.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: heavyinstead.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: heardbrown.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: variousdivide.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: degreeappear.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: requireinside.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gentlebright.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: glassbrown.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pleasantbusiness.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: answerinstead.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: heavenappear.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: variousappear.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: degreepeople.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: forwardanother.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: forwardbright.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: leaderbright.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gentleexplain.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: variousbright.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: requireexplain.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: glassready.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: heavennothing.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: forwarddaughter.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: forwardmanner.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: heardbright.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: answerbusiness.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: returnstream.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: variousinstead.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: pleasantanother.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: difficultinside.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: difficultappear.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: forwardappear.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: degreeinstead.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: glassdaughter.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: returnbright.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: heavenmanner.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: degreeinside.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: gentledivide.net replaycode: Name error (3)
Source: unknownDNS traffic detected: query: orderanother.net replaycode: Name error (3)
Source: unknownNetwork traffic detected: DNS query count 170
Source: global trafficDNS traffic detected: number of DNS queries: 170
Source: global trafficHTTP traffic detected: GET /index.php HTTP/1.0Accept: */*Connection: closeHost: variousstream.net
Source: global trafficHTTP traffic detected: GET /index.php HTTP/1.0Accept: */*Connection: closeHost: returnbottle.net
Source: global trafficHTTP traffic detected: GET /index.php HTTP/1.0Accept: */*Connection: closeHost: gentleanother.net
Source: global trafficHTTP traffic detected: GET /index.php HTTP/1.0Accept: */*Connection: closeHost: glassbright.net
Source: global trafficHTTP traffic detected: GET /index.php HTTP/1.0Accept: */*Connection: closeHost: pleasantinstead.net
Source: global trafficHTTP traffic detected: GET /index.php HTTP/1.0Accept: */*Connection: closeHost: degreedaughter.net
Source: global trafficHTTP traffic detected: GET /index.php HTTP/1.0Accept: */*Connection: closeHost: variousstream.net
Source: global trafficHTTP traffic detected: GET /index.php HTTP/1.0Accept: */*Connection: closeHost: returnbottle.net
Source: Joe Sandbox ViewIP Address: 18.143.155.63 18.143.155.63
Source: Joe Sandbox ViewIP Address: 85.214.228.140 85.214.228.140
Source: Joe Sandbox ViewIP Address: 199.59.243.227 199.59.243.227
Source: Network trafficSuricata IDS: 2018316 - Severity 1 - ET MALWARE Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses : 1.1.1.1:53 -> 192.168.2.4:57543
Source: Network trafficSuricata IDS: 2811542 - Severity 1 - ETPRO MALWARE Possible Tinba DGA NXDOMAIN Responses (net) : 1.1.1.1:53 -> 192.168.2.4:53861
Source: Network trafficSuricata IDS: 2815568 - Severity 1 - ETPRO MALWARE Terse HTTP 1.0 Request Possible Nivdort : 192.168.2.4:56255 -> 199.59.243.227:80
Source: Network trafficSuricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 54.244.188.177:80 -> 192.168.2.4:56257
Source: Network trafficSuricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 54.244.188.177:80 -> 192.168.2.4:56257
Source: Network trafficSuricata IDS: 2018141 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz : 18.143.155.63:80 -> 192.168.2.4:56256
Source: Network trafficSuricata IDS: 2037771 - Severity 1 - ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst : 18.143.155.63:80 -> 192.168.2.4:56256
Source: Network trafficSuricata IDS: 2815568 - Severity 1 - ETPRO MALWARE Terse HTTP 1.0 Request Possible Nivdort : 192.168.2.4:53059 -> 199.59.243.227:80
Source: Network trafficSuricata IDS: 2811542 - Severity 1 - ETPRO MALWARE Possible Tinba DGA NXDOMAIN Responses (net) : 1.1.1.1:53 -> 192.168.2.4:57323
Source: Network trafficSuricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 52.149.20.212:443 -> 192.168.2.4:52927
Source: Network trafficSuricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 52.149.20.212:443 -> 192.168.2.4:52907
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: C:\Users\user\Desktop\YiqjcLlhew.exeCode function: 0_2_00D06C30 socket,setsockopt,gethostbyname,inet_ntoa,inet_addr,htons,connect,send,recv,closesocket,0_2_00D06C30
Source: global trafficHTTP traffic detected: GET /index.php HTTP/1.0Accept: */*Connection: closeHost: variousstream.net
Source: global trafficHTTP traffic detected: GET /index.php HTTP/1.0Accept: */*Connection: closeHost: returnbottle.net
Source: global trafficHTTP traffic detected: GET /index.php HTTP/1.0Accept: */*Connection: closeHost: gentleanother.net
Source: global trafficHTTP traffic detected: GET /index.php HTTP/1.0Accept: */*Connection: closeHost: glassbright.net
Source: global trafficHTTP traffic detected: GET /index.php HTTP/1.0Accept: */*Connection: closeHost: pleasantinstead.net
Source: global trafficHTTP traffic detected: GET /index.php HTTP/1.0Accept: */*Connection: closeHost: degreedaughter.net
Source: global trafficHTTP traffic detected: GET /index.php HTTP/1.0Accept: */*Connection: closeHost: variousstream.net
Source: global trafficHTTP traffic detected: GET /index.php HTTP/1.0Accept: */*Connection: closeHost: returnbottle.net
Source: global trafficDNS traffic detected: DNS query: leadernothing.net
Source: global trafficDNS traffic detected: DNS query: heavennothing.net
Source: global trafficDNS traffic detected: DNS query: leaderbottle.net
Source: global trafficDNS traffic detected: DNS query: heavenbottle.net
Source: global trafficDNS traffic detected: DNS query: leaderdivide.net
Source: global trafficDNS traffic detected: DNS query: heavendivide.net
Source: global trafficDNS traffic detected: DNS query: heavystream.net
Source: global trafficDNS traffic detected: DNS query: gentlestream.net
Source: global trafficDNS traffic detected: DNS query: heavynothing.net
Source: global trafficDNS traffic detected: DNS query: gentlenothing.net
Source: global trafficDNS traffic detected: DNS query: heavybottle.net
Source: global trafficDNS traffic detected: DNS query: gentlebottle.net
Source: global trafficDNS traffic detected: DNS query: heavydivide.net
Source: global trafficDNS traffic detected: DNS query: gentledivide.net
Source: global trafficDNS traffic detected: DNS query: variousstream.net
Source: global trafficDNS traffic detected: DNS query: returnstream.net
Source: global trafficDNS traffic detected: DNS query: variousnothing.net
Source: global trafficDNS traffic detected: DNS query: returnnothing.net
Source: global trafficDNS traffic detected: DNS query: variousbottle.net
Source: global trafficDNS traffic detected: DNS query: returnbottle.net
Source: global trafficDNS traffic detected: DNS query: variousdivide.net
Source: global trafficDNS traffic detected: DNS query: returndivide.net
Source: global trafficDNS traffic detected: DNS query: degreemanner.net
Source: global trafficDNS traffic detected: DNS query: forwardmanner.net
Source: global trafficDNS traffic detected: DNS query: degreeanother.net
Source: global trafficDNS traffic detected: DNS query: forwardanother.net
Source: global trafficDNS traffic detected: DNS query: degreebusiness.net
Source: global trafficDNS traffic detected: DNS query: forwardbusiness.net
Source: global trafficDNS traffic detected: DNS query: degreeappear.net
Source: global trafficDNS traffic detected: DNS query: forwardappear.net
Source: global trafficDNS traffic detected: DNS query: answermanner.net
Source: global trafficDNS traffic detected: DNS query: glassmanner.net
Source: global trafficDNS traffic detected: DNS query: answeranother.net
Source: global trafficDNS traffic detected: DNS query: glassanother.net
Source: global trafficDNS traffic detected: DNS query: answerbusiness.net
Source: global trafficDNS traffic detected: DNS query: glassbusiness.net
Source: global trafficDNS traffic detected: DNS query: answerappear.net
Source: global trafficDNS traffic detected: DNS query: glassappear.net
Source: global trafficDNS traffic detected: DNS query: difficultmanner.net
Source: global trafficDNS traffic detected: DNS query: heardmanner.net
Source: global trafficDNS traffic detected: DNS query: difficultanother.net
Source: global trafficDNS traffic detected: DNS query: heardanother.net
Source: global trafficDNS traffic detected: DNS query: difficultbusiness.net
Source: global trafficDNS traffic detected: DNS query: heardbusiness.net
Source: global trafficDNS traffic detected: DNS query: difficultappear.net
Source: global trafficDNS traffic detected: DNS query: heardappear.net
Source: global trafficDNS traffic detected: DNS query: pleasantmanner.net
Source: global trafficDNS traffic detected: DNS query: necessarymanner.net
Source: global trafficDNS traffic detected: DNS query: pleasantanother.net
Source: global trafficDNS traffic detected: DNS query: necessaryanother.net
Source: global trafficDNS traffic detected: DNS query: pleasantbusiness.net
Source: global trafficDNS traffic detected: DNS query: necessarybusiness.net
Source: global trafficDNS traffic detected: DNS query: pleasantappear.net
Source: global trafficDNS traffic detected: DNS query: necessaryappear.net
Source: global trafficDNS traffic detected: DNS query: ordermanner.net
Source: global trafficDNS traffic detected: DNS query: requiremanner.net
Source: global trafficDNS traffic detected: DNS query: orderanother.net
Source: global trafficDNS traffic detected: DNS query: requireanother.net
Source: global trafficDNS traffic detected: DNS query: orderbusiness.net
Source: global trafficDNS traffic detected: DNS query: requirebusiness.net
Source: global trafficDNS traffic detected: DNS query: orderappear.net
Source: global trafficDNS traffic detected: DNS query: requireappear.net
Source: global trafficDNS traffic detected: DNS query: leadermanner.net
Source: global trafficDNS traffic detected: DNS query: heavenmanner.net
Source: global trafficDNS traffic detected: DNS query: leaderanother.net
Source: global trafficDNS traffic detected: DNS query: heavenanother.net
Source: global trafficDNS traffic detected: DNS query: leaderbusiness.net
Source: global trafficDNS traffic detected: DNS query: heavenbusiness.net
Source: global trafficDNS traffic detected: DNS query: leaderappear.net
Source: global trafficDNS traffic detected: DNS query: heavenappear.net
Source: global trafficDNS traffic detected: DNS query: heavymanner.net
Source: global trafficDNS traffic detected: DNS query: gentlemanner.net
Source: global trafficDNS traffic detected: DNS query: heavyanother.net
Source: global trafficDNS traffic detected: DNS query: gentleanother.net
Source: global trafficDNS traffic detected: DNS query: heavybusiness.net
Source: global trafficDNS traffic detected: DNS query: gentlebusiness.net
Source: global trafficDNS traffic detected: DNS query: heavyappear.net
Source: global trafficDNS traffic detected: DNS query: gentleappear.net
Source: global trafficDNS traffic detected: DNS query: variousmanner.net
Source: global trafficDNS traffic detected: DNS query: returnmanner.net
Source: global trafficDNS traffic detected: DNS query: variousanother.net
Source: global trafficDNS traffic detected: DNS query: returnanother.net
Source: global trafficDNS traffic detected: DNS query: variousbusiness.net
Source: global trafficDNS traffic detected: DNS query: returnbusiness.net
Source: global trafficDNS traffic detected: DNS query: variousappear.net
Source: global trafficDNS traffic detected: DNS query: returnappear.net
Source: global trafficDNS traffic detected: DNS query: degreeinstead.net
Source: global trafficDNS traffic detected: DNS query: forwardinstead.net
Source: global trafficDNS traffic detected: DNS query: degreeexplain.net
Source: global trafficDNS traffic detected: DNS query: forwardexplain.net
Source: global trafficDNS traffic detected: DNS query: degreebright.net
Source: global trafficDNS traffic detected: DNS query: forwardbright.net
Source: global trafficDNS traffic detected: DNS query: degreeinside.net
Source: global trafficDNS traffic detected: DNS query: forwardinside.net
Source: global trafficDNS traffic detected: DNS query: answerinstead.net
Source: global trafficDNS traffic detected: DNS query: glassinstead.net
Source: global trafficDNS traffic detected: DNS query: answerexplain.net
Source: global trafficDNS traffic detected: DNS query: glassexplain.net
Source: global trafficDNS traffic detected: DNS query: answerbright.net
Source: global trafficDNS traffic detected: DNS query: glassbright.net
Source: skjlipudplp.exe, 00000002.00000002.2493185721.0000000000961000.00000004.00000020.00020000.00000000.sdmp, skjlipudplp.exe, 00000009.00000002.2971823456.0000000001557000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.google.com
Source: C:\Users\user\Desktop\YiqjcLlhew.exeFile created: C:\Windows\vdjmzgowdzhfmld\Jump to behavior
Source: C:\Users\user\Desktop\YiqjcLlhew.exeFile created: C:\Windows\vdjmzgowdzhfmld\ceoxltniaJump to behavior
Source: C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exeFile created: C:\Windows\vdjmzgowdzhfmld\ceoxltniaJump to behavior
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeFile created: C:\Windows\vdjmzgowdzhfmld\ceoxltniaJump to behavior
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeFile created: C:\Windows\vdjmzgowdzhfmld\ceoxltniaJump to behavior
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeFile created: C:\Windows\vdjmzgowdzhfmld\ceoxltniaJump to behavior
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeFile created: C:\Windows\vdjmzgowdzhfmld\ceoxltniaJump to behavior
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeFile created: C:\Windows\vdjmzgowdzhfmld\ceoxltniaJump to behavior
Source: C:\Users\user\Desktop\YiqjcLlhew.exeFile deleted: C:\Windows\vdjmzgowdzhfmld\ceoxltniaJump to behavior
Source: C:\Users\user\Desktop\YiqjcLlhew.exeCode function: 0_2_00D1D0EB0_2_00D1D0EB
Source: C:\Users\user\Desktop\YiqjcLlhew.exeCode function: 0_2_00D0B3870_2_00D0B387
Source: C:\Users\user\Desktop\YiqjcLlhew.exeCode function: 0_2_00CF7FA00_2_00CF7FA0
Source: C:\Users\user\Desktop\YiqjcLlhew.exeCode function: 0_2_00D248F00_2_00D248F0
Source: C:\Users\user\Desktop\YiqjcLlhew.exeCode function: 0_2_00CFD4460_2_00CFD446
Source: C:\Users\user\Desktop\YiqjcLlhew.exeCode function: 0_2_00D138600_2_00D13860
Source: C:\Users\user\Desktop\YiqjcLlhew.exeCode function: 0_2_00D06C300_2_00D06C30
Source: C:\Users\user\Desktop\YiqjcLlhew.exeCode function: 0_2_00CF98200_2_00CF9820
Source: C:\Users\user\Desktop\YiqjcLlhew.exeCode function: 0_2_00D0E1D60_2_00D0E1D6
Source: C:\Users\user\Desktop\YiqjcLlhew.exeCode function: 0_2_00CF45C00_2_00CF45C0
Source: C:\Users\user\Desktop\YiqjcLlhew.exeCode function: 0_2_00CFD1F00_2_00CFD1F0
Source: C:\Users\user\Desktop\YiqjcLlhew.exeCode function: 0_2_00D009500_2_00D00950
Source: C:\Users\user\Desktop\YiqjcLlhew.exeCode function: 0_2_00D221700_2_00D22170
Source: C:\Users\user\Desktop\YiqjcLlhew.exeCode function: 0_2_00D209300_2_00D20930
Source: C:\Users\user\Desktop\YiqjcLlhew.exeCode function: 0_2_00D236D00_2_00D236D0
Source: C:\Users\user\Desktop\YiqjcLlhew.exeCode function: 0_2_00D202F00_2_00D202F0
Source: C:\Users\user\Desktop\YiqjcLlhew.exeCode function: 0_2_00CF2AE00_2_00CF2AE0
Source: C:\Users\user\Desktop\YiqjcLlhew.exeCode function: 0_2_00CFA6F00_2_00CFA6F0
Source: C:\Users\user\Desktop\YiqjcLlhew.exeCode function: 0_2_00D0D2430_2_00D0D243
Source: C:\Users\user\Desktop\YiqjcLlhew.exeCode function: 0_2_00D106700_2_00D10670
Source: C:\Users\user\Desktop\YiqjcLlhew.exeCode function: 0_2_00D0D2710_2_00D0D271
Source: C:\Users\user\Desktop\YiqjcLlhew.exeCode function: 0_2_00D0E2060_2_00D0E206
Source: C:\Users\user\Desktop\YiqjcLlhew.exeCode function: 0_2_00D0422D0_2_00D0422D
Source: C:\Users\user\Desktop\YiqjcLlhew.exeCode function: 0_2_00D1F7900_2_00D1F790
Source: C:\Users\user\Desktop\YiqjcLlhew.exeCode function: 0_2_00D157100_2_00D15710
Source: C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exeCode function: 1_2_00DCD0EB1_2_00DCD0EB
Source: C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exeCode function: 1_2_00DB09501_2_00DB0950
Source: C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exeCode function: 1_2_00DD36D01_2_00DD36D0
Source: C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exeCode function: 1_2_00DA7FA01_2_00DA7FA0
Source: C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exeCode function: 1_2_00DBB37F1_2_00DBB37F
Source: C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exeCode function: 1_2_00DD48F01_2_00DD48F0
Source: C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exeCode function: 1_2_00DAD4461_2_00DAD446
Source: C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exeCode function: 1_2_00DC38601_2_00DC3860
Source: C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exeCode function: 1_2_00DB6C301_2_00DB6C30
Source: C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exeCode function: 1_2_00DA98201_2_00DA9820
Source: C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exeCode function: 1_2_00DA45C01_2_00DA45C0
Source: C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exeCode function: 1_2_00DAD1F01_2_00DAD1F0
Source: C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exeCode function: 1_2_00DD21701_2_00DD2170
Source: C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exeCode function: 1_2_00DD09301_2_00DD0930
Source: C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exeCode function: 1_2_00DAA6F01_2_00DAA6F0
Source: C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exeCode function: 1_2_00DD02F01_2_00DD02F0
Source: C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exeCode function: 1_2_00DA2AE01_2_00DA2AE0
Source: C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exeCode function: 1_2_00DBD2431_2_00DBD243
Source: C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exeCode function: 1_2_00DBD2711_2_00DBD271
Source: C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exeCode function: 1_2_00DC06701_2_00DC0670
Source: C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exeCode function: 1_2_00DB422D1_2_00DB422D
Source: C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exeCode function: 1_2_00DBD79A1_2_00DBD79A
Source: C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exeCode function: 1_2_00DCF7901_2_00DCF790
Source: C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exeCode function: 1_2_00DBD7551_2_00DBD755
Source: C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exeCode function: 1_2_00DBD7721_2_00DBD772
Source: C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exeCode function: 1_2_00DC57101_2_00DC5710
Source: C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exeCode function: 1_2_00DBD7161_2_00DBD716
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: 2_2_00486C302_2_00486C30
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: 2_2_0049D0EB2_2_0049D0EB
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: 2_2_004809502_2_00480950
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: 2_2_004A36D02_2_004A36D0
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: 2_2_00472AE02_2_00472AE0
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: 2_2_0048B37D2_2_0048B37D
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: 2_2_00477FA02_2_00477FA0
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: 2_2_0047D4462_2_0047D446
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: 2_2_004938602_2_00493860
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: 2_2_0048C41C2_2_0048C41C
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: 2_2_004798202_2_00479820
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: 2_2_004A48F02_2_004A48F0
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: 2_2_004A21702_2_004A2170
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: 2_2_004A09302_2_004A0930
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: 2_2_004745C02_2_004745C0
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: 2_2_0047D1F02_2_0047D1F0
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: 2_2_004906702_2_00490670
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: 2_2_0048D2712_2_0048D271
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: 2_2_0048422C2_2_0048422C
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: 2_2_0047A6F02_2_0047A6F0
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: 2_2_004A02F02_2_004A02F0
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: 2_2_0048D7552_2_0048D755
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: 2_2_0048D7722_2_0048D772
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: 2_2_004957102_2_00495710
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: 2_2_0048D7162_2_0048D716
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: 2_2_0048D79A2_2_0048D79A
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: 2_2_0049F7902_2_0049F790
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: 3_2_0007D0EB3_2_0007D0EB
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: 3_2_0006B37D3_2_0006B37D
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: 3_2_00057FA03_2_00057FA0
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: 3_2_000598203_2_00059820
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: 3_2_00066C303_2_00066C30
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: 3_2_0005D4463_2_0005D446
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: 3_2_000738603_2_00073860
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: 3_2_000848F03_2_000848F0
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: 3_2_000809303_2_00080930
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: 3_2_000609503_2_00060950
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: 3_2_000821703_2_00082170
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: 3_2_000545C03_2_000545C0
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: 3_2_0005D1F03_2_0005D1F0
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: 3_2_0006422D3_2_0006422D
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: 3_2_0006D2433_2_0006D243
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: 3_2_000706703_2_00070670
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: 3_2_0006D2713_2_0006D271
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: 3_2_000836D03_2_000836D0
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: 3_2_00052AE03_2_00052AE0
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: 3_2_0005A6F03_2_0005A6F0
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: 3_2_000802F03_2_000802F0
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: 3_2_0006D7163_2_0006D716
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: 3_2_000757103_2_00075710
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: 3_2_0006D7553_2_0006D755
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: 3_2_0006D7723_2_0006D772
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: 3_2_0007F7903_2_0007F790
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: 3_2_0006D79A3_2_0006D79A
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: 4_2_0049D0EB4_2_0049D0EB
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: 4_2_0048B37D4_2_0048B37D
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: 4_2_00477FA04_2_00477FA0
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: 4_2_0047D4464_2_0047D446
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: 4_2_004938604_2_00493860
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: 4_2_0048C41C4_2_0048C41C
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: 4_2_004798204_2_00479820
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: 4_2_00486C304_2_00486C30
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: 4_2_004A48F04_2_004A48F0
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: 4_2_004809504_2_00480950
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: 4_2_004A21704_2_004A2170
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: 4_2_004A09304_2_004A0930
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: 4_2_004745C04_2_004745C0
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: 4_2_0047D1F04_2_0047D1F0
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: 4_2_004906704_2_00490670
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: 4_2_0048D2714_2_0048D271
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: 4_2_0048422C4_2_0048422C
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: 4_2_004A36D04_2_004A36D0
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: 4_2_00472AE04_2_00472AE0
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: 4_2_0047A6F04_2_0047A6F0
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: 4_2_004A02F04_2_004A02F0
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: 4_2_0048D7554_2_0048D755
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: 4_2_0048D7724_2_0048D772
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: 4_2_004957104_2_00495710
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: 4_2_0048D7164_2_0048D716
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: 4_2_0048D79A4_2_0048D79A
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: 4_2_0049F7904_2_0049F790
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: 10_2_004DD0EB10_2_004DD0EB
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: 10_2_004CB37D10_2_004CB37D
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: 10_2_004B7FA010_2_004B7FA0
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: 10_2_004BD44610_2_004BD446
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: 10_2_004D386010_2_004D3860
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: 10_2_004CC41C10_2_004CC41C
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: 10_2_004B982010_2_004B9820
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: 10_2_004C6C3010_2_004C6C30
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: 10_2_004E48F010_2_004E48F0
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: 10_2_004C095010_2_004C0950
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: 10_2_004E217010_2_004E2170
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: 10_2_004E093010_2_004E0930
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: 10_2_004B45C010_2_004B45C0
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: 10_2_004BD1F010_2_004BD1F0
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: 10_2_004D067010_2_004D0670
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: 10_2_004CD27110_2_004CD271
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: 10_2_004C422C10_2_004C422C
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: 10_2_004E36D010_2_004E36D0
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: 10_2_004B2AE010_2_004B2AE0
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: 10_2_004BA6F010_2_004BA6F0
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: 10_2_004E02F010_2_004E02F0
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: 10_2_004CD75510_2_004CD755
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: 10_2_004CD77210_2_004CD772
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: 10_2_004CD71610_2_004CD716
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: 10_2_004D571010_2_004D5710
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: 10_2_004CD79A10_2_004CD79A
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: 10_2_004DF79010_2_004DF790
Source: YiqjcLlhew.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: classification engineClassification label: mal96.troj.winEXE@12/5@212/4
Source: C:\Users\user\Desktop\YiqjcLlhew.exeCode function: OpenSCManagerA,CreateServiceA,ChangeServiceConfig2A,StartServiceA,CloseServiceHandle,OpenServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,0_2_00CF53B0
Source: C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exeCode function: OpenSCManagerA,CreateServiceA,ChangeServiceConfig2A,StartServiceA,CloseServiceHandle,OpenServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,1_2_00DA53B0
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: OpenSCManagerA,CreateServiceA,ChangeServiceConfig2A,StartServiceA,CloseServiceHandle,OpenServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,2_2_004753B0
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: OpenSCManagerA,CreateServiceA,ChangeServiceConfig2A,StartServiceA,CloseServiceHandle,OpenServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,3_2_000553B0
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: OpenSCManagerA,CreateServiceA,ChangeServiceConfig2A,StartServiceA,CloseServiceHandle,OpenServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,4_2_004753B0
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: OpenSCManagerA,CreateServiceA,ChangeServiceConfig2A,StartServiceA,CloseServiceHandle,OpenServiceA,StartServiceA,CloseServiceHandle,CloseServiceHandle,10_2_004B53B0
Source: C:\Users\user\Desktop\YiqjcLlhew.exeCode function: 0_2_00D10250 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,0_2_00D10250
Source: C:\Users\user\Desktop\YiqjcLlhew.exeCode function: 0_2_00CF6430 StartServiceCtrlDispatcherA,0_2_00CF6430
Source: C:\Users\user\Desktop\YiqjcLlhew.exeCode function: 0_2_00CF6430 StartServiceCtrlDispatcherA,0_2_00CF6430
Source: C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exeCode function: 1_2_00DA6430 StartServiceCtrlDispatcherA,1_2_00DA6430
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: 2_2_00476430 StartServiceCtrlDispatcherA,2_2_00476430
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: 3_2_00056430 StartServiceCtrlDispatcherA,3_2_00056430
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: 4_2_00476430 StartServiceCtrlDispatcherA,4_2_00476430
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: 10_2_004B6430 StartServiceCtrlDispatcherA,10_2_004B6430
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeMutant created: NULL
Source: YiqjcLlhew.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\YiqjcLlhew.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: YiqjcLlhew.exeReversingLabs: Detection: 92%
Source: C:\Users\user\Desktop\YiqjcLlhew.exeFile read: C:\Users\user\Desktop\YiqjcLlhew.exeJump to behavior
Source: unknownProcess created: C:\Users\user\Desktop\YiqjcLlhew.exe "C:\Users\user\Desktop\YiqjcLlhew.exe"
Source: C:\Users\user\Desktop\YiqjcLlhew.exeProcess created: C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exe "C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exe"
Source: unknownProcess created: C:\vdjmzgowdzhfmld\skjlipudplp.exe C:\vdjmzgowdzhfmld\skjlipudplp.exe
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeProcess created: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exe owwisyfkhljp "c:\vdjmzgowdzhfmld\skjlipudplp.exe"
Source: C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exeProcess created: C:\vdjmzgowdzhfmld\skjlipudplp.exe "C:\vdjmzgowdzhfmld\skjlipudplp.exe"
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeProcess created: C:\vdjmzgowdzhfmld\skjlipudplp.exe "c:\vdjmzgowdzhfmld\skjlipudplp.exe"
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeProcess created: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exe owwisyfkhljp "c:\vdjmzgowdzhfmld\skjlipudplp.exe"
Source: C:\Users\user\Desktop\YiqjcLlhew.exeProcess created: C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exe "C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exe"Jump to behavior
Source: C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exeProcess created: C:\vdjmzgowdzhfmld\skjlipudplp.exe "C:\vdjmzgowdzhfmld\skjlipudplp.exe"Jump to behavior
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeProcess created: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exe owwisyfkhljp "c:\vdjmzgowdzhfmld\skjlipudplp.exe"Jump to behavior
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeProcess created: C:\vdjmzgowdzhfmld\skjlipudplp.exe "c:\vdjmzgowdzhfmld\skjlipudplp.exe"Jump to behavior
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeProcess created: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exe owwisyfkhljp "c:\vdjmzgowdzhfmld\skjlipudplp.exe"Jump to behavior
Source: C:\Users\user\Desktop\YiqjcLlhew.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\Desktop\YiqjcLlhew.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Users\user\Desktop\YiqjcLlhew.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\YiqjcLlhew.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\YiqjcLlhew.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Users\user\Desktop\YiqjcLlhew.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Users\user\Desktop\YiqjcLlhew.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\Desktop\YiqjcLlhew.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\Desktop\YiqjcLlhew.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\Desktop\YiqjcLlhew.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\YiqjcLlhew.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\YiqjcLlhew.exeSection loaded: wintypes.dllJump to behavior
Source: C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exeSection loaded: apphelp.dllJump to behavior
Source: C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exeSection loaded: sspicli.dllJump to behavior
Source: C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exeSection loaded: userenv.dllJump to behavior
Source: C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exeSection loaded: profapi.dllJump to behavior
Source: C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeSection loaded: apphelp.dllJump to behavior
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeSection loaded: sspicli.dllJump to behavior
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeSection loaded: profapi.dllJump to behavior
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeSection loaded: mswsock.dllJump to behavior
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeSection loaded: napinsp.dllJump to behavior
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeSection loaded: pnrpnsp.dllJump to behavior
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeSection loaded: wshbth.dllJump to behavior
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeSection loaded: nlaapi.dllJump to behavior
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeSection loaded: winrnr.dllJump to behavior
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeSection loaded: apphelp.dllJump to behavior
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeSection loaded: dhcpcsvc.dllJump to behavior
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeSection loaded: sspicli.dllJump to behavior
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeSection loaded: profapi.dllJump to behavior
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeSection loaded: mswsock.dllJump to behavior
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeSection loaded: napinsp.dllJump to behavior
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeSection loaded: pnrpnsp.dllJump to behavior
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeSection loaded: wshbth.dllJump to behavior
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeSection loaded: nlaapi.dllJump to behavior
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeSection loaded: winrnr.dllJump to behavior
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeSection loaded: fwpuclnt.dllJump to behavior
Source: YiqjcLlhew.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: C:\Users\user\Desktop\YiqjcLlhew.exeCode function: 0_2_00D236D0 GetProcessHeap,LoadLibraryA,GetProcAddress,FreeLibrary,HeapAlloc,FreeLibrary,HeapFree,HeapAlloc,FreeLibrary,HeapFree,FreeLibrary,0_2_00D236D0
Source: C:\Users\user\Desktop\YiqjcLlhew.exeCode function: 0_2_00D190D3 push es; iretd 0_2_00D190D9
Source: C:\Users\user\Desktop\YiqjcLlhew.exeCode function: 0_2_00D00854 push 8BFFFFB2h; iretd 0_2_00D00859
Source: C:\Users\user\Desktop\YiqjcLlhew.exeCode function: 0_2_00D03454 push 0D00D2D7h; ret 0_2_00D03459
Source: C:\Users\user\Desktop\YiqjcLlhew.exeCode function: 0_2_00D02A2B push 0000002Bh; ret 0_2_00D02A2D
Source: C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exeCode function: 1_2_00DC90D3 push es; iretd 1_2_00DC90D9
Source: C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exeCode function: 1_2_00DB0854 push 8BFFFFB2h; iretd 1_2_00DB0859
Source: C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exeCode function: 1_2_00DB3454 push 0D00DDD7h; ret 1_2_00DB3459
Source: C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exeCode function: 1_2_00DB2A2B push 0000002Bh; ret 1_2_00DB2A2D
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: 2_2_00481C5F pushfd ; retn 004Ah2_2_00481C60
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: 2_2_00480854 push 8BFFFFB2h; iretd 2_2_00480859
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: 2_2_00483454 push 0D004AD7h; ret 2_2_00483459
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: 2_2_004990D3 push es; iretd 2_2_004990D9
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: 2_2_00482A2B push 0000002Bh; ret 2_2_00482A2D
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: 3_2_00060854 push 8BFFFFB2h; iretd 3_2_00060859
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: 3_2_00063454 push 0D0008D7h; ret 3_2_00063459
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: 3_2_00061C5F pushfd ; retn 0008h3_2_00061C60
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: 3_2_000790D3 push es; iretd 3_2_000790D9
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: 3_2_00062A2B push 0000002Bh; ret 3_2_00062A2D
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: 4_2_00481C5F pushfd ; retn 004Ah4_2_00481C60
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: 4_2_00480854 push 8BFFFFB2h; iretd 4_2_00480859
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: 4_2_00483454 push 0D004AD7h; ret 4_2_00483459
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: 4_2_004990D3 push es; iretd 4_2_004990D9
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: 4_2_00482A2B push 0000002Bh; ret 4_2_00482A2D
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: 10_2_004C1C5F pushfd ; retn 004Eh10_2_004C1C60
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: 10_2_004C0854 push 8BFFFFB2h; iretd 10_2_004C0859
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: 10_2_004C3454 push 0D004ED7h; ret 10_2_004C3459
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: 10_2_004D90D3 push es; iretd 10_2_004D90D9
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: 10_2_004C2A2B push 0000002Bh; ret 10_2_004C2A2D
Source: YiqjcLlhew.exeStatic PE information: section name: .text entropy: 6.868137010503397
Source: kfdag3aedbkjqfngi9xbw.exe.0.drStatic PE information: section name: .text entropy: 6.868137010503397
Source: skjlipudplp.exe.1.drStatic PE information: section name: .text entropy: 6.868137010503397
Source: xmjofjnkdlv.exe.2.drStatic PE information: section name: .text entropy: 6.868137010503397
Source: C:\Users\user\Desktop\YiqjcLlhew.exeFile created: C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exeJump to dropped file
Source: C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exeFile created: C:\vdjmzgowdzhfmld\skjlipudplp.exeJump to dropped file
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeFile created: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeJump to dropped file
Source: C:\Users\user\Desktop\YiqjcLlhew.exeCode function: 0_2_00CF6430 StartServiceCtrlDispatcherA,0_2_00CF6430
Source: C:\Users\user\Desktop\YiqjcLlhew.exeCode function: OpenSCManagerA,EnumServicesStatusA,GetLastError,EnumServicesStatusA,CloseServiceHandle,0_2_00D062D0
Source: C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exeCode function: OpenSCManagerA,EnumServicesStatusA,GetLastError,EnumServicesStatusA,CloseServiceHandle,1_2_00DB62D0
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: OpenSCManagerA,EnumServicesStatusA,GetLastError,EnumServicesStatusA,CloseServiceHandle,2_2_004862D0
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: OpenSCManagerA,EnumServicesStatusA,GetLastError,EnumServicesStatusA,CloseServiceHandle,3_2_000662D0
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: OpenSCManagerA,EnumServicesStatusA,GetLastError,EnumServicesStatusA,CloseServiceHandle,4_2_004862D0
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: OpenSCManagerA,EnumServicesStatusA,GetLastError,EnumServicesStatusA,CloseServiceHandle,10_2_004C62D0
Source: C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exeCode function: GetProcessHeap,LoadLibraryA,GetProcAddress,FreeLibrary,HeapAlloc,FreeLibrary,GetAdaptersInfo,HeapFree,HeapAlloc,FreeLibrary,GetAdaptersInfo,HeapFree,FreeLibrary,1_2_00DD36D0
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: GetProcessHeap,LoadLibraryA,GetProcAddress,FreeLibrary,HeapAlloc,FreeLibrary,GetAdaptersInfo,HeapFree,HeapAlloc,FreeLibrary,GetAdaptersInfo,HeapFree,FreeLibrary,2_2_004A36D0
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeWindow / User API: threadDelayed 655Jump to behavior
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeWindow / User API: threadDelayed 1220Jump to behavior
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeWindow / User API: threadDelayed 381Jump to behavior
Source: C:\Users\user\Desktop\YiqjcLlhew.exeDecision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)graph_0-10449
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeDecision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)graph_4-12305
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeDecision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)graph_3-11417
Source: C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exeDecision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)graph_1-11304
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeEvasive API call chain: GetSystemTimeAsFileTime,DecisionNodesgraph_3-9991
Source: C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exeEvasive API call chain: GetSystemTimeAsFileTime,DecisionNodesgraph_1-9677
Source: C:\Users\user\Desktop\YiqjcLlhew.exeEvasive API call chain: GetSystemTimeAsFileTime,DecisionNodesgraph_0-9220
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeEvasive API call chain: GetSystemTimeAsFileTime,DecisionNodesgraph_2-10531
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exe TID: 5328Thread sleep time: -39996s >= -30000sJump to behavior
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exe TID: 2004Thread sleep count: 655 > 30Jump to behavior
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exe TID: 2004Thread sleep time: -655000s >= -30000sJump to behavior
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exe TID: 2004Thread sleep count: 1220 > 30Jump to behavior
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exe TID: 2004Thread sleep time: -1220000s >= -30000sJump to behavior
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exe TID: 2188Thread sleep count: 381 > 30Jump to behavior
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exe TID: 2188Thread sleep time: -19050000s >= -30000sJump to behavior
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exe TID: 2188Thread sleep time: -50000s >= -30000sJump to behavior
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exe TID: 6336Thread sleep count: 46 > 30Jump to behavior
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exe TID: 6336Thread sleep time: -46000s >= -30000sJump to behavior
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeLast function: Thread delayed
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeLast function: Thread delayed
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeLast function: Thread delayed
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeLast function: Thread delayed
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeLast function: Thread delayed
Source: C:\Users\user\Desktop\YiqjcLlhew.exeCode function: 0_2_00CF3740 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,0_2_00CF3740
Source: C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exeCode function: 1_2_00DA3740 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,1_2_00DA3740
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: 2_2_00473740 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,2_2_00473740
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: 3_2_00053740 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,3_2_00053740
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeCode function: 4_2_00473740 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,4_2_00473740
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeCode function: 10_2_004B3740 Sleep,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,10_2_004B3740
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeThread delayed: delay time: 50000Jump to behavior
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeThread delayed: delay time: 50000Jump to behavior
Source: kfdag3aedbkjqfngi9xbw.exe.0.drBinary or memory string: Ogrleg mojpiwclu hgohensv gcpiejjg jodgipweki wnbobpgecx dsogobetfu jtdubbcems jmfev gvsoec dzjivmci clazigzd uazmga eovw frsou ujcmomdg bbxux jrkakam dkmome vaoceuui bur ggohoalduo xsucerb ninonoadcd ecpoey mgpidsyue bungiy mho zvo lpwap gsoijedge xylojggey polfuul ffmica ewwvoaku fpneripja drjevim ocv nylenmzo fdyiof kgpuosc arinyiblpu itc sfyeshege dre cglumcx vjjafy euenspiocf linbege lno gccuzomzek wdvulklu ncde fhjeurlw cpnejsp todpildsa tppafg qdzi ugpmohpt cgc rsmemlosi shpaofmge csfefi fzroldm fjafapd jjgiepjucu rinjiwib jaocupi nifimiou rguhiun uaglyipret ffsedei bulejucgm doncilsna vntigpjeag zcep mcuinu adj lmdexcokic mgvinfgug funfo dxueloudi beppie askqum jmidinbqi rvyanue jmxa qdozau cbdacfvuu baziwilt pcgasjn iuxmdip gfmama bnama cdf lva fviaab bogg lbide lsesommmuv iwjdea lpfaortio pxcu gblulmn lxr mupjaeao pbf jeifgo panuec pgyia j?'
Source: kfdag3aedbkjqfngi9xbw.exe, 00000001.00000002.1744552481.00000000013AE000.00000004.00000020.00020000.00000000.sdmp, skjlipudplp.exe, 00000009.00000002.2971823456.0000000001557000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: skjlipudplp.exe, 00000002.00000002.2493185721.000000000093A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlld
Source: C:\Users\user\Desktop\YiqjcLlhew.exeAPI call chain: ExitProcess graph end nodegraph_0-8941
Source: C:\Users\user\Desktop\YiqjcLlhew.exeAPI call chain: ExitProcess graph end nodegraph_0-8999
Source: C:\Users\user\Desktop\YiqjcLlhew.exeAPI call chain: ExitProcess graph end nodegraph_0-8912
Source: C:\Users\user\Desktop\YiqjcLlhew.exeAPI call chain: ExitProcess graph end nodegraph_0-8814
Source: C:\Users\user\Desktop\YiqjcLlhew.exeAPI call chain: ExitProcess graph end nodegraph_0-8922
Source: C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exeAPI call chain: ExitProcess graph end nodegraph_1-9716
Source: C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exeAPI call chain: ExitProcess graph end nodegraph_1-9747
Source: C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exeAPI call chain: ExitProcess graph end nodegraph_1-9652
Source: C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exeAPI call chain: ExitProcess graph end nodegraph_1-9710
Source: C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exeAPI call chain: ExitProcess graph end nodegraph_1-9683
Source: C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exeAPI call chain: ExitProcess graph end nodegraph_1-9662
Source: C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exeAPI call chain: ExitProcess graph end nodegraph_1-10659
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeAPI call chain: ExitProcess graph end nodegraph_2-10583
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeAPI call chain: ExitProcess graph end nodegraph_2-10574
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeAPI call chain: ExitProcess graph end nodegraph_2-10538
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeAPI call chain: ExitProcess graph end nodegraph_2-10517
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeAPI call chain: ExitProcess graph end nodegraph_2-10568
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeAPI call chain: ExitProcess graph end nodegraph_2-11624
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeAPI call chain: ExitProcess graph end nodegraph_2-10606
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeAPI call chain: ExitProcess graph end nodegraph_2-10506
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeAPI call chain: ExitProcess graph end nodegraph_3-9696
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeAPI call chain: ExitProcess graph end nodegraph_3-9669
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeAPI call chain: ExitProcess graph end nodegraph_3-9679
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeAPI call chain: ExitProcess graph end nodegraph_3-9560
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeAPI call chain: ExitProcess graph end nodegraph_3-9717
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeAPI call chain: ExitProcess graph end nodegraph_4-10629
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeAPI call chain: ExitProcess graph end nodegraph_4-11385
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeAPI call chain: ExitProcess graph end nodegraph_4-10569
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeAPI call chain: ExitProcess graph end nodegraph_4-10540
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeAPI call chain: ExitProcess graph end nodegraph_4-10589
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeAPI call chain: ExitProcess graph end node
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeAPI call chain: ExitProcess graph end node
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeAPI call chain: ExitProcess graph end node
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeAPI call chain: ExitProcess graph end node
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeAPI call chain: ExitProcess graph end node
Source: C:\vdjmzgowdzhfmld\xmjofjnkdlv.exeAPI call chain: ExitProcess graph end node
Source: C:\vdjmzgowdzhfmld\skjlipudplp.exeProcess information queried: ProcessInformationJump to behavior
Source: C:\Users\user\Desktop\YiqjcLlhew.exeCode function: 0_2_00D236D0 GetProcessHeap,LoadLibraryA,GetProcAddress,FreeLibrary,HeapAlloc,FreeLibrary,HeapFree,HeapAlloc,FreeLibrary,HeapFree,FreeLibrary,0_2_00D236D0
Source: C:\Users\user\Desktop\YiqjcLlhew.exeCode function: 0_2_00D259B0 GetProcessHeap,RtlFreeHeap,0_2_00D259B0
Source: C:\Users\user\Desktop\YiqjcLlhew.exeCode function: 0_2_00D11510 AllocateAndInitializeSid,CheckTokenMembership,0_2_00D11510
Source: C:\Users\user\Desktop\YiqjcLlhew.exeCode function: 0_2_00CF7A90 GetSystemTimeAsFileTime,__aulldiv,0_2_00CF7A90
Source: C:\Users\user\Desktop\YiqjcLlhew.exeCode function: 0_2_00CF7FA0 GetVersionExA,CreateDirectoryA,DeleteFileA,RemoveDirectoryA,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,CreateDirectoryA,GetTempPathA,CreateDirectoryA,GetTempPathA,SetFileAttributesA,0_2_00CF7FA0
Source: C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
Service Execution
4
Windows Service
4
Windows Service
1
Masquerading
OS Credential Dumping1
System Time Discovery
Remote Services1
Archive Collected Data
1
Encrypted Channel
Exfiltration Over Other Network MediumAbuse Accessibility Features
CredentialsDomainsDefault Accounts2
Native API
1
DLL Side-Loading
1
Process Injection
11
Virtualization/Sandbox Evasion
LSASS Memory111
Security Software Discovery
Remote Desktop ProtocolData from Removable Media2
Ingress Tool Transfer
Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
DLL Side-Loading
1
Process Injection
Security Account Manager11
Virtualization/Sandbox Evasion
SMB/Windows Admin SharesData from Network Shared Drive2
Non-Application Layer Protocol
Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook2
Obfuscated Files or Information
NTDS2
Process Discovery
Distributed Component Object ModelInput Capture2
Application Layer Protocol
Traffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
Software Packing
LSA Secrets1
Application Window Discovery
SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
DLL Side-Loading
Cached Domain Credentials1
System Service Discovery
VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
File Deletion
DCSync1
System Network Configuration Discovery
Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/JobIndicator Removal from ToolsProc Filesystem1
File and Directory Discovery
Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAtHTML Smuggling/etc/passwd and /etc/shadow4
System Information Discovery
Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1551217 Sample: YiqjcLlhew.exe Startdate: 07/11/2024 Architecture: WINDOWS Score: 96 34 variousinstead.net 2->34 36 variousbright.net 2->36 38 169 other IPs or domains 2->38 52 Suricata IDS alerts for network traffic 2->52 54 Antivirus / Scanner detection for submitted sample 2->54 56 Multi AV Scanner detection for submitted file 2->56 58 3 other signatures 2->58 9 skjlipudplp.exe 10 2->9         started        14 YiqjcLlhew.exe 6 2->14         started        signatures3 process4 dnsIp5 40 degreedaughter.net 85.214.228.140, 52906, 80 STRATOSTRATOAGDE Germany 9->40 42 7450.bodis.com 199.59.243.227, 53059, 56255, 56258 BODIS-NJUS United States 9->42 44 2 other IPs or domains 9->44 30 C:\vdjmzgowdzhfmld\xmjofjnkdlv.exe, PE32 9->30 dropped 60 Antivirus detection for dropped file 9->60 62 Multi AV Scanner detection for dropped file 9->62 64 Machine Learning detection for dropped file 9->64 16 xmjofjnkdlv.exe 4 9->16         started        32 C:\...\kfdag3aedbkjqfngi9xbw.exe, PE32 14->32 dropped 19 kfdag3aedbkjqfngi9xbw.exe 10 14->19         started        file6 signatures7 process8 file9 22 skjlipudplp.exe 8 16->22         started        28 C:\vdjmzgowdzhfmld\skjlipudplp.exe, PE32 19->28 dropped 46 Antivirus detection for dropped file 19->46 48 Multi AV Scanner detection for dropped file 19->48 50 Machine Learning detection for dropped file 19->50 24 skjlipudplp.exe 4 19->24         started        signatures10 process11 process12 26 xmjofjnkdlv.exe 4 22->26         started       

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand
SourceDetectionScannerLabelLink
YiqjcLlhew.exe92%ReversingLabsWin32.Spyware.Nivdort
YiqjcLlhew.exe100%AviraTR/Nivdort.Gen2
YiqjcLlhew.exe100%Joe Sandbox ML
SourceDetectionScannerLabelLink
C:\vdjmzgowdzhfmld\xmjofjnkdlv.exe100%AviraTR/Nivdort.Gen2
C:\vdjmzgowdzhfmld\skjlipudplp.exe100%AviraTR/Nivdort.Gen2
C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exe100%AviraTR/Nivdort.Gen2
C:\vdjmzgowdzhfmld\xmjofjnkdlv.exe100%Joe Sandbox ML
C:\vdjmzgowdzhfmld\skjlipudplp.exe100%Joe Sandbox ML
C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exe100%Joe Sandbox ML
C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exe92%ReversingLabsWin32.Spyware.Nivdort
C:\vdjmzgowdzhfmld\skjlipudplp.exe92%ReversingLabsWin32.Spyware.Nivdort
C:\vdjmzgowdzhfmld\xmjofjnkdlv.exe92%ReversingLabsWin32.Spyware.Nivdort
No Antivirus matches
No Antivirus matches
No Antivirus matches
NameIPActiveMaliciousAntivirus DetectionReputation
degreedaughter.net
85.214.228.140
truefalse
    high
    7450.bodis.com
    199.59.243.227
    truefalse
      high
      gentleanother.net
      54.244.188.177
      truefalse
        high
        returnbottle.net
        18.143.155.63
        truefalse
          high
          pleasantinstead.net
          18.143.155.63
          truefalse
            high
            forwardpeople.net
            unknown
            unknowntrue
              unknown
              degreeanother.net
              unknown
              unknownfalse
                high
                degreeexplain.net
                unknown
                unknownfalse
                  high
                  heaveninside.net
                  unknown
                  unknowntrue
                    unknown
                    answerappear.net
                    unknown
                    unknownfalse
                      high
                      heavybusiness.net
                      unknown
                      unknownfalse
                        high
                        pleasantinside.net
                        unknown
                        unknowntrue
                          unknown
                          requirebusiness.net
                          unknown
                          unknownfalse
                            high
                            forwardinside.net
                            unknown
                            unknownfalse
                              high
                              glassmanner.net
                              unknown
                              unknownfalse
                                high
                                answerexplain.net
                                unknown
                                unknownfalse
                                  high
                                  orderinside.net
                                  unknown
                                  unknowntrue
                                    unknown
                                    variousappear.net
                                    unknown
                                    unknownfalse
                                      high
                                      returnbright.net
                                      unknown
                                      unknowntrue
                                        unknown
                                        difficultanother.net
                                        unknown
                                        unknownfalse
                                          high
                                          heavyinside.net
                                          unknown
                                          unknowntrue
                                            unknown
                                            forwardready.net
                                            unknown
                                            unknowntrue
                                              unknown
                                              glassdaughter.net
                                              unknown
                                              unknowntrue
                                                unknown
                                                necessarymanner.net
                                                unknown
                                                unknownfalse
                                                  high
                                                  leadernothing.net
                                                  unknown
                                                  unknownfalse
                                                    high
                                                    answeranother.net
                                                    unknown
                                                    unknownfalse
                                                      high
                                                      leadermanner.net
                                                      unknown
                                                      unknownfalse
                                                        high
                                                        heavybottle.net
                                                        unknown
                                                        unknownfalse
                                                          high
                                                          heavenbright.net
                                                          unknown
                                                          unknowntrue
                                                            unknown
                                                            heavydivide.net
                                                            unknown
                                                            unknownfalse
                                                              high
                                                              degreebrown.net
                                                              unknown
                                                              unknowntrue
                                                                unknown
                                                                gentleinstead.net
                                                                unknown
                                                                unknowntrue
                                                                  unknown
                                                                  glassanother.net
                                                                  unknown
                                                                  unknownfalse
                                                                    high
                                                                    heavenanother.net
                                                                    unknown
                                                                    unknownfalse
                                                                      high
                                                                      difficultmanner.net
                                                                      unknown
                                                                      unknownfalse
                                                                        high
                                                                        glassexplain.net
                                                                        unknown
                                                                        unknownfalse
                                                                          high
                                                                          requireinside.net
                                                                          unknown
                                                                          unknowntrue
                                                                            unknown
                                                                            heavenexplain.net
                                                                            unknown
                                                                            unknowntrue
                                                                              unknown
                                                                              forwardbusiness.net
                                                                              unknown
                                                                              unknownfalse
                                                                                high
                                                                                difficultexplain.net
                                                                                unknown
                                                                                unknowntrue
                                                                                  unknown
                                                                                  gentleappear.net
                                                                                  unknown
                                                                                  unknownfalse
                                                                                    high
                                                                                    pleasantbright.net
                                                                                    unknown
                                                                                    unknowntrue
                                                                                      unknown
                                                                                      returnexplain.net
                                                                                      unknown
                                                                                      unknowntrue
                                                                                        unknown
                                                                                        gentlemanner.net
                                                                                        unknown
                                                                                        unknownfalse
                                                                                          high
                                                                                          answerdaughter.net
                                                                                          unknown
                                                                                          unknowntrue
                                                                                            unknown
                                                                                            heardinside.net
                                                                                            unknown
                                                                                            unknowntrue
                                                                                              unknown
                                                                                              requiremanner.net
                                                                                              unknown
                                                                                              unknownfalse
                                                                                                high
                                                                                                gentleexplain.net
                                                                                                unknown
                                                                                                unknowntrue
                                                                                                  unknown
                                                                                                  glassappear.net
                                                                                                  unknown
                                                                                                  unknownfalse
                                                                                                    high
                                                                                                    necessaryanother.net
                                                                                                    unknown
                                                                                                    unknownfalse
                                                                                                      high
                                                                                                      glassinside.net
                                                                                                      unknown
                                                                                                      unknowntrue
                                                                                                        unknown
                                                                                                        difficultbright.net
                                                                                                        unknown
                                                                                                        unknowntrue
                                                                                                          unknown
                                                                                                          heardbrown.net
                                                                                                          unknown
                                                                                                          unknowntrue
                                                                                                            unknown
                                                                                                            glasspeople.net
                                                                                                            unknown
                                                                                                            unknowntrue
                                                                                                              unknown
                                                                                                              requireinstead.net
                                                                                                              unknown
                                                                                                              unknowntrue
                                                                                                                unknown
                                                                                                                necessaryinside.net
                                                                                                                unknown
                                                                                                                unknowntrue
                                                                                                                  unknown
                                                                                                                  returndivide.net
                                                                                                                  unknown
                                                                                                                  unknownfalse
                                                                                                                    high
                                                                                                                    heardinstead.net
                                                                                                                    unknown
                                                                                                                    unknowntrue
                                                                                                                      unknown
                                                                                                                      variousbright.net
                                                                                                                      unknown
                                                                                                                      unknowntrue
                                                                                                                        unknown
                                                                                                                        degreebusiness.net
                                                                                                                        unknown
                                                                                                                        unknownfalse
                                                                                                                          high
                                                                                                                          answerbusiness.net
                                                                                                                          unknown
                                                                                                                          unknownfalse
                                                                                                                            high
                                                                                                                            heavenbusiness.net
                                                                                                                            unknown
                                                                                                                            unknownfalse
                                                                                                                              high
                                                                                                                              gentledivide.net
                                                                                                                              unknown
                                                                                                                              unknownfalse
                                                                                                                                high
                                                                                                                                variousinstead.net
                                                                                                                                unknown
                                                                                                                                unknowntrue
                                                                                                                                  unknown
                                                                                                                                  gentlestream.net
                                                                                                                                  unknown
                                                                                                                                  unknownfalse
                                                                                                                                    high
                                                                                                                                    pleasantmanner.net
                                                                                                                                    unknown
                                                                                                                                    unknownfalse
                                                                                                                                      high
                                                                                                                                      necessaryappear.net
                                                                                                                                      unknown
                                                                                                                                      unknownfalse
                                                                                                                                        high
                                                                                                                                        pleasantbusiness.net
                                                                                                                                        unknown
                                                                                                                                        unknownfalse
                                                                                                                                          high
                                                                                                                                          heardbright.net
                                                                                                                                          unknown
                                                                                                                                          unknowntrue
                                                                                                                                            unknown
                                                                                                                                            heavenbottle.net
                                                                                                                                            unknown
                                                                                                                                            unknownfalse
                                                                                                                                              high
                                                                                                                                              heavynothing.net
                                                                                                                                              unknown
                                                                                                                                              unknownfalse
                                                                                                                                                high
                                                                                                                                                gentlebusiness.net
                                                                                                                                                unknown
                                                                                                                                                unknownfalse
                                                                                                                                                  high
                                                                                                                                                  ordermanner.net
                                                                                                                                                  unknown
                                                                                                                                                  unknownfalse
                                                                                                                                                    high
                                                                                                                                                    leaderbottle.net
                                                                                                                                                    unknown
                                                                                                                                                    unknownfalse
                                                                                                                                                      high
                                                                                                                                                      pleasantanother.net
                                                                                                                                                      unknown
                                                                                                                                                      unknownfalse
                                                                                                                                                        high
                                                                                                                                                        heavyanother.net
                                                                                                                                                        unknown
                                                                                                                                                        unknownfalse
                                                                                                                                                          high
                                                                                                                                                          degreeinstead.net
                                                                                                                                                          unknown
                                                                                                                                                          unknownfalse
                                                                                                                                                            high
                                                                                                                                                            degreepeople.net
                                                                                                                                                            unknown
                                                                                                                                                            unknowntrue
                                                                                                                                                              unknown
                                                                                                                                                              answerready.net
                                                                                                                                                              unknown
                                                                                                                                                              unknowntrue
                                                                                                                                                                unknown
                                                                                                                                                                difficultbrown.net
                                                                                                                                                                unknown
                                                                                                                                                                unknowntrue
                                                                                                                                                                  unknown
                                                                                                                                                                  answerbright.net
                                                                                                                                                                  unknown
                                                                                                                                                                  unknownfalse
                                                                                                                                                                    high
                                                                                                                                                                    heavennothing.net
                                                                                                                                                                    unknown
                                                                                                                                                                    unknownfalse
                                                                                                                                                                      high
                                                                                                                                                                      returninside.net
                                                                                                                                                                      unknown
                                                                                                                                                                      unknowntrue
                                                                                                                                                                        unknown
                                                                                                                                                                        forwardbright.net
                                                                                                                                                                        unknown
                                                                                                                                                                        unknownfalse
                                                                                                                                                                          high
                                                                                                                                                                          difficultinside.net
                                                                                                                                                                          unknown
                                                                                                                                                                          unknowntrue
                                                                                                                                                                            unknown
                                                                                                                                                                            heavybright.net
                                                                                                                                                                            unknown
                                                                                                                                                                            unknowntrue
                                                                                                                                                                              unknown
                                                                                                                                                                              leaderanother.net
                                                                                                                                                                              unknown
                                                                                                                                                                              unknownfalse
                                                                                                                                                                                high
                                                                                                                                                                                returninstead.net
                                                                                                                                                                                unknown
                                                                                                                                                                                unknowntrue
                                                                                                                                                                                  unknown
                                                                                                                                                                                  difficultinstead.net
                                                                                                                                                                                  unknown
                                                                                                                                                                                  unknowntrue
                                                                                                                                                                                    unknown
                                                                                                                                                                                    heavenappear.net
                                                                                                                                                                                    unknown
                                                                                                                                                                                    unknownfalse
                                                                                                                                                                                      high
                                                                                                                                                                                      answerinside.net
                                                                                                                                                                                      unknown
                                                                                                                                                                                      unknowntrue
                                                                                                                                                                                        unknown
                                                                                                                                                                                        degreebright.net
                                                                                                                                                                                        unknown
                                                                                                                                                                                        unknownfalse
                                                                                                                                                                                          high
                                                                                                                                                                                          forwardbrown.net
                                                                                                                                                                                          unknown
                                                                                                                                                                                          unknowntrue
                                                                                                                                                                                            unknown
                                                                                                                                                                                            heavyinstead.net
                                                                                                                                                                                            unknown
                                                                                                                                                                                            unknowntrue
                                                                                                                                                                                              unknown
                                                                                                                                                                                              gentleinside.net
                                                                                                                                                                                              unknown
                                                                                                                                                                                              unknowntrue
                                                                                                                                                                                                unknown
                                                                                                                                                                                                heardexplain.net
                                                                                                                                                                                                unknown
                                                                                                                                                                                                unknowntrue
                                                                                                                                                                                                  unknown
                                                                                                                                                                                                  heavyappear.net
                                                                                                                                                                                                  unknown
                                                                                                                                                                                                  unknownfalse
                                                                                                                                                                                                    high
                                                                                                                                                                                                    answerpeople.net
                                                                                                                                                                                                    unknown
                                                                                                                                                                                                    unknowntrue
                                                                                                                                                                                                      unknown
                                                                                                                                                                                                      pleasantexplain.net
                                                                                                                                                                                                      unknown
                                                                                                                                                                                                      unknowntrue
                                                                                                                                                                                                        unknown
                                                                                                                                                                                                        requireexplain.net
                                                                                                                                                                                                        unknown
                                                                                                                                                                                                        unknowntrue
                                                                                                                                                                                                          unknown
                                                                                                                                                                                                          NameSourceMaliciousAntivirus DetectionReputation
                                                                                                                                                                                                          https://www.google.comskjlipudplp.exe, 00000002.00000002.2493185721.0000000000961000.00000004.00000020.00020000.00000000.sdmp, skjlipudplp.exe, 00000009.00000002.2971823456.0000000001557000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                            high
                                                                                                                                                                                                            • No. of IPs < 25%
                                                                                                                                                                                                            • 25% < No. of IPs < 50%
                                                                                                                                                                                                            • 50% < No. of IPs < 75%
                                                                                                                                                                                                            • 75% < No. of IPs
                                                                                                                                                                                                            IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                                                                            18.143.155.63
                                                                                                                                                                                                            returnbottle.netUnited States
                                                                                                                                                                                                            16509AMAZON-02USfalse
                                                                                                                                                                                                            85.214.228.140
                                                                                                                                                                                                            degreedaughter.netGermany
                                                                                                                                                                                                            6724STRATOSTRATOAGDEfalse
                                                                                                                                                                                                            199.59.243.227
                                                                                                                                                                                                            7450.bodis.comUnited States
                                                                                                                                                                                                            395082BODIS-NJUSfalse
                                                                                                                                                                                                            54.244.188.177
                                                                                                                                                                                                            gentleanother.netUnited States
                                                                                                                                                                                                            16509AMAZON-02USfalse
                                                                                                                                                                                                            Joe Sandbox version:41.0.0 Charoite
                                                                                                                                                                                                            Analysis ID:1551217
                                                                                                                                                                                                            Start date and time:2024-11-07 15:56:26 +01:00
                                                                                                                                                                                                            Joe Sandbox product:CloudBasic
                                                                                                                                                                                                            Overall analysis duration:0h 6m 23s
                                                                                                                                                                                                            Hypervisor based Inspection enabled:false
                                                                                                                                                                                                            Report type:full
                                                                                                                                                                                                            Cookbook file name:default.jbs
                                                                                                                                                                                                            Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                                                            Number of analysed new started processes analysed:11
                                                                                                                                                                                                            Number of new started drivers analysed:0
                                                                                                                                                                                                            Number of existing processes analysed:0
                                                                                                                                                                                                            Number of existing drivers analysed:0
                                                                                                                                                                                                            Number of injected processes analysed:0
                                                                                                                                                                                                            Technologies:
                                                                                                                                                                                                            • HCA enabled
                                                                                                                                                                                                            • EGA enabled
                                                                                                                                                                                                            • AMSI enabled
                                                                                                                                                                                                            Analysis Mode:default
                                                                                                                                                                                                            Analysis stop reason:Timeout
                                                                                                                                                                                                            Sample name:YiqjcLlhew.exe
                                                                                                                                                                                                            renamed because original name is a hash value
                                                                                                                                                                                                            Original Sample Name:e01a1e921ef924c2e1407fae1f09ec200cdb144973f431e81440e39b1005a9ce.exe
                                                                                                                                                                                                            Detection:MAL
                                                                                                                                                                                                            Classification:mal96.troj.winEXE@12/5@212/4
                                                                                                                                                                                                            EGA Information:
                                                                                                                                                                                                            • Successful, ratio: 100%
                                                                                                                                                                                                            HCA Information:
                                                                                                                                                                                                            • Successful, ratio: 90%
                                                                                                                                                                                                            • Number of executed functions: 85
                                                                                                                                                                                                            • Number of non-executed functions: 84
                                                                                                                                                                                                            Cookbook Comments:
                                                                                                                                                                                                            • Found application associated with file extension: .exe
                                                                                                                                                                                                            • Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
                                                                                                                                                                                                            • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                                                                                                                                                                                                            • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                                                                            • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                                                                                                                                            • VT rate limit hit for: YiqjcLlhew.exe
                                                                                                                                                                                                            TimeTypeDescription
                                                                                                                                                                                                            09:57:55API Interceptor1859x Sleep call for process: xmjofjnkdlv.exe modified
                                                                                                                                                                                                            09:58:40API Interceptor444x Sleep call for process: skjlipudplp.exe modified
                                                                                                                                                                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                            18.143.155.6366HKNPT1fl.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • pleasantinstead.net/index.php
                                                                                                                                                                                                            8CO4P3HwDt.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • returnbottle.net/index.php
                                                                                                                                                                                                            nnzZhhVIqM.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • returnbottle.net/index.php
                                                                                                                                                                                                            66HKNPT1fl.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • returnbottle.net/index.php
                                                                                                                                                                                                            PORgjGswYg.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • pleasantinstead.net/index.php
                                                                                                                                                                                                            BNGj6QoBjK.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • pleasantinstead.net/index.php
                                                                                                                                                                                                            PORgjGswYg.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • returnbottle.net/index.php
                                                                                                                                                                                                            BNGj6QoBjK.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • returnbottle.net/index.php
                                                                                                                                                                                                            DBROG0eWH7.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • returnbottle.net/index.php
                                                                                                                                                                                                            DBROG0eWH7.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • returnbottle.net/index.php
                                                                                                                                                                                                            85.214.228.14066HKNPT1fl.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • degreedaughter.net/index.php
                                                                                                                                                                                                            8CO4P3HwDt.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • degreedaughter.net/index.php
                                                                                                                                                                                                            nnzZhhVIqM.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • degreedaughter.net/index.php
                                                                                                                                                                                                            66HKNPT1fl.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • degreedaughter.net/index.php
                                                                                                                                                                                                            PORgjGswYg.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • degreedaughter.net/index.php
                                                                                                                                                                                                            BNGj6QoBjK.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • degreedaughter.net/index.php
                                                                                                                                                                                                            PORgjGswYg.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • degreedaughter.net/index.php
                                                                                                                                                                                                            BNGj6QoBjK.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • degreedaughter.net/index.php
                                                                                                                                                                                                            AENiBH7X1q.exeGet hashmaliciousPureLog Stealer, RedLineBrowse
                                                                                                                                                                                                            • dlynankz.biz/mfjpaqkdwglsvxqo
                                                                                                                                                                                                            E_dekont.cmdGet hashmaliciousDBatLoader, Nitol, PureLog Stealer, XWormBrowse
                                                                                                                                                                                                            • dlynankz.biz/rgkgvuyxljjatio
                                                                                                                                                                                                            199.59.243.22766HKNPT1fl.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • glassbright.net/index.php
                                                                                                                                                                                                            8CO4P3HwDt.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • variousstream.net/index.php
                                                                                                                                                                                                            nnzZhhVIqM.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • variousstream.net/index.php
                                                                                                                                                                                                            66HKNPT1fl.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • variousstream.net/index.php
                                                                                                                                                                                                            PORgjGswYg.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • glassbright.net/index.php
                                                                                                                                                                                                            BNGj6QoBjK.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • glassbright.net/index.php
                                                                                                                                                                                                            PORgjGswYg.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • variousstream.net/index.php
                                                                                                                                                                                                            BNGj6QoBjK.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • variousstream.net/index.php
                                                                                                                                                                                                            DBROG0eWH7.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • variousstream.net/index.php
                                                                                                                                                                                                            DBROG0eWH7.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • glassbright.net/index.php
                                                                                                                                                                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                            gentleanother.net66HKNPT1fl.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 54.244.188.177
                                                                                                                                                                                                            8CO4P3HwDt.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 54.244.188.177
                                                                                                                                                                                                            nnzZhhVIqM.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 54.244.188.177
                                                                                                                                                                                                            66HKNPT1fl.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 54.244.188.177
                                                                                                                                                                                                            PORgjGswYg.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 54.244.188.177
                                                                                                                                                                                                            BNGj6QoBjK.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 54.244.188.177
                                                                                                                                                                                                            PORgjGswYg.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 54.244.188.177
                                                                                                                                                                                                            BNGj6QoBjK.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 54.244.188.177
                                                                                                                                                                                                            returnbottle.net66HKNPT1fl.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 18.143.155.63
                                                                                                                                                                                                            8CO4P3HwDt.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 18.143.155.63
                                                                                                                                                                                                            nnzZhhVIqM.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 18.143.155.63
                                                                                                                                                                                                            66HKNPT1fl.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 18.143.155.63
                                                                                                                                                                                                            PORgjGswYg.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 18.143.155.63
                                                                                                                                                                                                            BNGj6QoBjK.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 18.143.155.63
                                                                                                                                                                                                            PORgjGswYg.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 18.143.155.63
                                                                                                                                                                                                            BNGj6QoBjK.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 18.143.155.63
                                                                                                                                                                                                            DBROG0eWH7.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 18.143.155.63
                                                                                                                                                                                                            DBROG0eWH7.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 18.143.155.63
                                                                                                                                                                                                            degreedaughter.net66HKNPT1fl.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 85.214.228.140
                                                                                                                                                                                                            8CO4P3HwDt.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 85.214.228.140
                                                                                                                                                                                                            nnzZhhVIqM.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 85.214.228.140
                                                                                                                                                                                                            66HKNPT1fl.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 85.214.228.140
                                                                                                                                                                                                            PORgjGswYg.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 85.214.228.140
                                                                                                                                                                                                            BNGj6QoBjK.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 85.214.228.140
                                                                                                                                                                                                            PORgjGswYg.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 85.214.228.140
                                                                                                                                                                                                            BNGj6QoBjK.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 85.214.228.140
                                                                                                                                                                                                            7450.bodis.com66HKNPT1fl.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 199.59.243.227
                                                                                                                                                                                                            8CO4P3HwDt.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 199.59.243.227
                                                                                                                                                                                                            nnzZhhVIqM.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 199.59.243.227
                                                                                                                                                                                                            66HKNPT1fl.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 199.59.243.227
                                                                                                                                                                                                            PORgjGswYg.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 199.59.243.227
                                                                                                                                                                                                            BNGj6QoBjK.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 199.59.243.227
                                                                                                                                                                                                            PORgjGswYg.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 199.59.243.227
                                                                                                                                                                                                            BNGj6QoBjK.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 199.59.243.227
                                                                                                                                                                                                            DBROG0eWH7.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 199.59.243.227
                                                                                                                                                                                                            DBROG0eWH7.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 199.59.243.227
                                                                                                                                                                                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                            AMAZON-02US66HKNPT1fl.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 54.244.188.177
                                                                                                                                                                                                            8CO4P3HwDt.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 54.244.188.177
                                                                                                                                                                                                            m8P4HaY7dU.vbsGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 18.226.186.214
                                                                                                                                                                                                            nnzZhhVIqM.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 54.244.188.177
                                                                                                                                                                                                            66HKNPT1fl.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 54.244.188.177
                                                                                                                                                                                                            PORgjGswYg.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 54.244.188.177
                                                                                                                                                                                                            BNGj6QoBjK.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 54.244.188.177
                                                                                                                                                                                                            PORgjGswYg.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 54.244.188.177
                                                                                                                                                                                                            BNGj6QoBjK.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 54.244.188.177
                                                                                                                                                                                                            ch89yHIa99.exeGet hashmaliciousDucktailBrowse
                                                                                                                                                                                                            • 13.35.58.111
                                                                                                                                                                                                            STRATOSTRATOAGDE66HKNPT1fl.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 85.214.228.140
                                                                                                                                                                                                            8CO4P3HwDt.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 85.214.228.140
                                                                                                                                                                                                            nnzZhhVIqM.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 85.214.228.140
                                                                                                                                                                                                            66HKNPT1fl.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 85.214.228.140
                                                                                                                                                                                                            PORgjGswYg.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 85.214.228.140
                                                                                                                                                                                                            BNGj6QoBjK.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 85.214.228.140
                                                                                                                                                                                                            PORgjGswYg.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 85.214.228.140
                                                                                                                                                                                                            BNGj6QoBjK.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 85.214.228.140
                                                                                                                                                                                                            http://googe.deGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 85.214.62.112
                                                                                                                                                                                                            debug.dbg.elfGet hashmaliciousMiraiBrowse
                                                                                                                                                                                                            • 85.215.233.6
                                                                                                                                                                                                            BODIS-NJUS66HKNPT1fl.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 199.59.243.227
                                                                                                                                                                                                            8CO4P3HwDt.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 199.59.243.227
                                                                                                                                                                                                            nnzZhhVIqM.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 199.59.243.227
                                                                                                                                                                                                            66HKNPT1fl.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 199.59.243.227
                                                                                                                                                                                                            PORgjGswYg.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 199.59.243.227
                                                                                                                                                                                                            BNGj6QoBjK.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 199.59.243.227
                                                                                                                                                                                                            PORgjGswYg.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 199.59.243.227
                                                                                                                                                                                                            BNGj6QoBjK.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 199.59.243.227
                                                                                                                                                                                                            DBROG0eWH7.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 199.59.243.227
                                                                                                                                                                                                            DBROG0eWH7.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 199.59.243.227
                                                                                                                                                                                                            AMAZON-02US66HKNPT1fl.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 54.244.188.177
                                                                                                                                                                                                            8CO4P3HwDt.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 54.244.188.177
                                                                                                                                                                                                            m8P4HaY7dU.vbsGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 18.226.186.214
                                                                                                                                                                                                            nnzZhhVIqM.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 54.244.188.177
                                                                                                                                                                                                            66HKNPT1fl.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 54.244.188.177
                                                                                                                                                                                                            PORgjGswYg.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 54.244.188.177
                                                                                                                                                                                                            BNGj6QoBjK.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 54.244.188.177
                                                                                                                                                                                                            PORgjGswYg.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 54.244.188.177
                                                                                                                                                                                                            BNGj6QoBjK.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                            • 54.244.188.177
                                                                                                                                                                                                            ch89yHIa99.exeGet hashmaliciousDucktailBrowse
                                                                                                                                                                                                            • 13.35.58.111
                                                                                                                                                                                                            No context
                                                                                                                                                                                                            No context
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\YiqjcLlhew.exe
                                                                                                                                                                                                            File Type:Non-ISO extended-ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):9
                                                                                                                                                                                                            Entropy (8bit):3.169925001442312
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3:ign:ig
                                                                                                                                                                                                            MD5:848E1C84F4DAA882C9652ECE27785309
                                                                                                                                                                                                            SHA1:B87C783FEE5FE47917E533D4995701851ED25EE2
                                                                                                                                                                                                            SHA-256:3B8F78C362F113BCD28891E0E1195F4D2B98AB523B1C6E0FEA7B74FC0A7AF5AA
                                                                                                                                                                                                            SHA-512:2276401873F5713355A0ECF990A72CD402D1CD432ECF971637E4239D8DE877BB485B87A35A4DB94E29621B64A94AC0A6F566259CBC5742A088F07969F35A7FC9
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Reputation:low
                                                                                                                                                                                                            Preview:..`s.b1.
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\YiqjcLlhew.exe
                                                                                                                                                                                                            File Type:Non-ISO extended-ASCII text
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):9
                                                                                                                                                                                                            Entropy (8bit):3.169925001442312
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:3:ign:ig
                                                                                                                                                                                                            MD5:848E1C84F4DAA882C9652ECE27785309
                                                                                                                                                                                                            SHA1:B87C783FEE5FE47917E533D4995701851ED25EE2
                                                                                                                                                                                                            SHA-256:3B8F78C362F113BCD28891E0E1195F4D2B98AB523B1C6E0FEA7B74FC0A7AF5AA
                                                                                                                                                                                                            SHA-512:2276401873F5713355A0ECF990A72CD402D1CD432ECF971637E4239D8DE877BB485B87A35A4DB94E29621B64A94AC0A6F566259CBC5742A088F07969F35A7FC9
                                                                                                                                                                                                            Malicious:false
                                                                                                                                                                                                            Reputation:low
                                                                                                                                                                                                            Preview:..`s.b1.
                                                                                                                                                                                                            Process:C:\Users\user\Desktop\YiqjcLlhew.exe
                                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):282112
                                                                                                                                                                                                            Entropy (8bit):7.143656205471311
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:6144:0u5QPgyknFyneuvNYXK/+w6doLOjO3+0UnGiE7saNZ:KPgnnEnh1GNsO49UGX7saP
                                                                                                                                                                                                            MD5:F51DA33B8F97EC40E1960522549DCCA7
                                                                                                                                                                                                            SHA1:001FFE1D668E5131CEF1F105BFEDE3780C123EF8
                                                                                                                                                                                                            SHA-256:E01A1E921EF924C2E1407FAE1F09EC200CDB144973F431E81440E39B1005A9CE
                                                                                                                                                                                                            SHA-512:A3C31FDD2C71A21EA007860E13860D79746BEC527D31B200D7905569DDC1A4495DD0C0440B1E9EF97D61BBB1B91367DDFDF87F583B96ED60E8C5A44DE43F1684
                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: Avira, Detection: 100%
                                                                                                                                                                                                            • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 92%
                                                                                                                                                                                                            Reputation:low
                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........i..............%|.................................Rich............PE..L....-.V.................\...>.......U.......p....@.......................................@....................................P............................ .......................................................p..|............................text....[.......\.................. ..`.rdata...H...p...J...`..............@..@.data...lP..........................@....reloc....... ......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                                                            Process:C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exe
                                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):282112
                                                                                                                                                                                                            Entropy (8bit):7.143656205471311
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:6144:0u5QPgyknFyneuvNYXK/+w6doLOjO3+0UnGiE7saNZ:KPgnnEnh1GNsO49UGX7saP
                                                                                                                                                                                                            MD5:F51DA33B8F97EC40E1960522549DCCA7
                                                                                                                                                                                                            SHA1:001FFE1D668E5131CEF1F105BFEDE3780C123EF8
                                                                                                                                                                                                            SHA-256:E01A1E921EF924C2E1407FAE1F09EC200CDB144973F431E81440E39B1005A9CE
                                                                                                                                                                                                            SHA-512:A3C31FDD2C71A21EA007860E13860D79746BEC527D31B200D7905569DDC1A4495DD0C0440B1E9EF97D61BBB1B91367DDFDF87F583B96ED60E8C5A44DE43F1684
                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: Avira, Detection: 100%
                                                                                                                                                                                                            • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 92%
                                                                                                                                                                                                            Reputation:low
                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........i..............%|.................................Rich............PE..L....-.V.................\...>.......U.......p....@.......................................@....................................P............................ .......................................................p..|............................text....[.......\.................. ..`.rdata...H...p...J...`..............@..@.data...lP..........................@....reloc....... ......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                                                            Process:C:\vdjmzgowdzhfmld\skjlipudplp.exe
                                                                                                                                                                                                            File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                            Category:dropped
                                                                                                                                                                                                            Size (bytes):282112
                                                                                                                                                                                                            Entropy (8bit):7.143656205471311
                                                                                                                                                                                                            Encrypted:false
                                                                                                                                                                                                            SSDEEP:6144:0u5QPgyknFyneuvNYXK/+w6doLOjO3+0UnGiE7saNZ:KPgnnEnh1GNsO49UGX7saP
                                                                                                                                                                                                            MD5:F51DA33B8F97EC40E1960522549DCCA7
                                                                                                                                                                                                            SHA1:001FFE1D668E5131CEF1F105BFEDE3780C123EF8
                                                                                                                                                                                                            SHA-256:E01A1E921EF924C2E1407FAE1F09EC200CDB144973F431E81440E39B1005A9CE
                                                                                                                                                                                                            SHA-512:A3C31FDD2C71A21EA007860E13860D79746BEC527D31B200D7905569DDC1A4495DD0C0440B1E9EF97D61BBB1B91367DDFDF87F583B96ED60E8C5A44DE43F1684
                                                                                                                                                                                                            Malicious:true
                                                                                                                                                                                                            Antivirus:
                                                                                                                                                                                                            • Antivirus: Avira, Detection: 100%
                                                                                                                                                                                                            • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                                                                                                            • Antivirus: ReversingLabs, Detection: 92%
                                                                                                                                                                                                            Reputation:low
                                                                                                                                                                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........i..............%|.................................Rich............PE..L....-.V.................\...>.......U.......p....@.......................................@....................................P............................ .......................................................p..|............................text....[.......\.................. ..`.rdata...H...p...J...`..............@..@.data...lP..........................@....reloc....... ......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                                                                                            File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                            Entropy (8bit):7.143656205471311
                                                                                                                                                                                                            TrID:
                                                                                                                                                                                                            • Win32 Executable (generic) a (10002005/4) 99.96%
                                                                                                                                                                                                            • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                                                                                                                            • DOS Executable Generic (2002/1) 0.02%
                                                                                                                                                                                                            • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                                                                            File name:YiqjcLlhew.exe
                                                                                                                                                                                                            File size:282'112 bytes
                                                                                                                                                                                                            MD5:f51da33b8f97ec40e1960522549dcca7
                                                                                                                                                                                                            SHA1:001ffe1d668e5131cef1f105bfede3780c123ef8
                                                                                                                                                                                                            SHA256:e01a1e921ef924c2e1407fae1f09ec200cdb144973f431e81440e39b1005a9ce
                                                                                                                                                                                                            SHA512:a3c31fdd2c71a21ea007860e13860d79746bec527d31b200d7905569ddc1a4495dd0c0440b1e9ef97d61bbb1b91367ddfdf87f583b96ed60e8c5a44de43f1684
                                                                                                                                                                                                            SSDEEP:6144:0u5QPgyknFyneuvNYXK/+w6doLOjO3+0UnGiE7saNZ:KPgnnEnh1GNsO49UGX7saP
                                                                                                                                                                                                            TLSH:D2548C55C9BA542ECC525EFD85AA3B72FCAF1072A7E805C3938230D0A4602F8DB76757
                                                                                                                                                                                                            File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........i..............%|.....................................Rich............PE..L....-.V.................\...>.......U.......p....@
                                                                                                                                                                                                            Icon Hash:90cececece8e8eb0
                                                                                                                                                                                                            Entrypoint:0x425510
                                                                                                                                                                                                            Entrypoint Section:.text
                                                                                                                                                                                                            Digitally signed:false
                                                                                                                                                                                                            Imagebase:0x400000
                                                                                                                                                                                                            Subsystem:windows gui
                                                                                                                                                                                                            Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                                                                                                                                                                                                            DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                                                                                                                                                                                                            Time Stamp:0x56892DF4 [Sun Jan 3 14:19:32 2016 UTC]
                                                                                                                                                                                                            TLS Callbacks:
                                                                                                                                                                                                            CLR (.Net) Version:
                                                                                                                                                                                                            OS Version Major:5
                                                                                                                                                                                                            OS Version Minor:1
                                                                                                                                                                                                            File Version Major:5
                                                                                                                                                                                                            File Version Minor:1
                                                                                                                                                                                                            Subsystem Version Major:5
                                                                                                                                                                                                            Subsystem Version Minor:1
                                                                                                                                                                                                            Import Hash:fd660912aa6dbf67a78c3e4af3a5d215
                                                                                                                                                                                                            Instruction
                                                                                                                                                                                                            fld dword ptr [004790DCh]
                                                                                                                                                                                                            fld dword ptr [0047DDD0h]
                                                                                                                                                                                                            fmul qword ptr [004635D8h]
                                                                                                                                                                                                            fadd dword ptr [00474998h]
                                                                                                                                                                                                            fxch st(0), st(1)
                                                                                                                                                                                                            fucomip st(0), st(1)
                                                                                                                                                                                                            fstp st(0)
                                                                                                                                                                                                            lahf
                                                                                                                                                                                                            test ah, 00000044h
                                                                                                                                                                                                            jnp 00007F22948CEC44h
                                                                                                                                                                                                            fld dword ptr [0047C3CCh]
                                                                                                                                                                                                            fmul qword ptr [004588E0h]
                                                                                                                                                                                                            fstp dword ptr [0047C3CCh]
                                                                                                                                                                                                            call 00007F22948B4F7Ah
                                                                                                                                                                                                            mov eax, dword ptr [00446434h]
                                                                                                                                                                                                            imul eax, eax, 9882A734h
                                                                                                                                                                                                            mov dword ptr [00446434h], eax
                                                                                                                                                                                                            call 00007F22948D02B5h
                                                                                                                                                                                                            push 00437184h
                                                                                                                                                                                                            fld dword ptr [00474484h]
                                                                                                                                                                                                            push 0043717Ch
                                                                                                                                                                                                            fld qword ptr [00463938h]
                                                                                                                                                                                                            fld dword ptr [0047977Ch]
                                                                                                                                                                                                            fmulp st(2), st(0)
                                                                                                                                                                                                            fsubrp st(1), st(0)
                                                                                                                                                                                                            fstp dword ptr [00475624h]
                                                                                                                                                                                                            fld dword ptr [0047977Ch]
                                                                                                                                                                                                            fsub qword ptr [0043B0B0h]
                                                                                                                                                                                                            fstp dword ptr [0047977Ch]
                                                                                                                                                                                                            call 00007F22948DB508h
                                                                                                                                                                                                            mov cx, word ptr [0046FA0Ch]
                                                                                                                                                                                                            mov edx, dword ptr [0043FF54h]
                                                                                                                                                                                                            dec word ptr [0046FA0Ch]
                                                                                                                                                                                                            imul edx, edx, ABEE16C1h
                                                                                                                                                                                                            movsx eax, cx
                                                                                                                                                                                                            sub eax, 0FAF8D35h
                                                                                                                                                                                                            and eax, 1399A9A9h
                                                                                                                                                                                                            and edx, CDFEA84Fh
                                                                                                                                                                                                            add esp, 08h
                                                                                                                                                                                                            cmp edx, eax
                                                                                                                                                                                                            jnle 00007F22948CEC4Fh
                                                                                                                                                                                                            mov eax, dword ptr [0043F104h]
                                                                                                                                                                                                            mov ecx, dword ptr [00000000h]
                                                                                                                                                                                                            Programming Language:
                                                                                                                                                                                                            • [IMP] VS2005 build 50727
                                                                                                                                                                                                            • [C++] VS2008 build 21022
                                                                                                                                                                                                            • [ASM] VS2008 build 21022
                                                                                                                                                                                                            • [LNK] VS2008 build 21022
                                                                                                                                                                                                            NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_IMPORT0x3b0e80x50.rdata
                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_RESOURCE0x00x0
                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_BASERELOC0x820000x9e1c.reloc
                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_IAT0x370000x17c.rdata
                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                                            IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0
                                                                                                                                                                                                            NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                                            .text0x10000x35bea0x35c0050375fc1d8dd7a60063c581b5c9ced1bFalse0.6988235828488372data6.868137010503397IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                            .rdata0x370000x48f40x4a0055ae83737777b356f3e01b6037c5df9eFalse0.8528821790540541data7.170520001196571IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                            .data0x3c0000x4506c0x20007b5472d347d42780469fb2654b7fc54False0.02734375data0.020393135236084953IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                            .reloc0x820000xa12e0xa2003af76855a0826f29034716a6eb8b96c5False0.6822675540123457data6.81111315269099IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                            DLLImport
                                                                                                                                                                                                            GDI32.dllGetClipRgn, GetStretchBltMode, GetPixelFormat, GetNearestPaletteIndex, GetNearestColor, GetTextCharacterExtra, GetTextCharset, SetSystemPaletteUse, GetMetaRgn, GetRandomRgn, GetMapMode, GetBkColor, GetDeviceCaps, GetFontLanguageInfo, SetTextJustification, GetObjectType, GetGraphicsMode, GetCurrentObject, GetFontUnicodeRanges, GetDCPenColor, GetDCBrushColor, GetSystemPaletteUse, GetPolyFillMode
                                                                                                                                                                                                            USER32.dllGetMenuItemID, ShowWindow, SendMessageA, GetDlgItemInt, GetScrollPos, GetMenuState, IsWindowEnabled, GetForegroundWindow, GetCursor, GetMenuItemCount, GetDlgItem, EndDialog, CheckDlgButton, GetWindowContextHelpId, MoveWindow, SetDlgItemTextA, SetFocus, DrawTextA, EnableWindow, RemovePropA, PostMessageA, GetQueueStatus, SetWindowTextA, EndPaint, IsWindowUnicode, BeginPaint, CallWindowProcA, GetPropA, GetMenuCheckMarkDimensions, GetKeyboardType, LoadIconA, GetInputState, GetMenu, WindowFromDC, GetDC, GetWindowDC, GetMenuContextHelpId
                                                                                                                                                                                                            KERNEL32.dllHeapAlloc, GetFileTime, WriteFile, GetCurrentThreadId, GetLastError, IsProcessorFeaturePresent, GetModuleHandleA, FlushFileBuffers, DeleteFileA, IsDebuggerPresent, GlobalSize, GetCurrentProcess, LockResource, MoveFileA, GlobalAlloc, CloseHandle, GetCurrentProcessId, SizeofResource, LocalFlags, GetDriveTypeA, GetTickCount, FindClose, GlobalHandle, GetFileType, GetVersion, GlobalFlags, QueryPerformanceCounter, FindResourceA, GetStdHandle, GetProcAddress, SetFilePointer, GetProcessHeap
                                                                                                                                                                                                            TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                                                                                                                                                                            2024-11-07T15:57:26.487582+01002815568ETPRO MALWARE Terse HTTP 1.0 Request Possible Nivdort1192.168.2.456255199.59.243.22780TCP
                                                                                                                                                                                                            2024-11-07T15:57:26.487582+01002820680ETPRO MALWARE W32/Bayrob Attempted Checkin 21192.168.2.456255199.59.243.22780TCP
                                                                                                                                                                                                            2024-11-07T15:57:28.607734+01002018141ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz118.143.155.6380192.168.2.456256TCP
                                                                                                                                                                                                            2024-11-07T15:57:28.607734+01002037771ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst118.143.155.6380192.168.2.456256TCP
                                                                                                                                                                                                            2024-11-07T15:57:31.033944+01002018141ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value Snkz154.244.188.17780192.168.2.456257TCP
                                                                                                                                                                                                            2024-11-07T15:57:31.033944+01002037771ET MALWARE Possible Compromised Host AnubisNetworks Sinkhole Cookie Value btst154.244.188.17780192.168.2.456257TCP
                                                                                                                                                                                                            2024-11-07T15:57:31.045246+01002018316ET MALWARE Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses11.1.1.153192.168.2.457543UDP
                                                                                                                                                                                                            2024-11-07T15:57:31.381815+01002811542ETPRO MALWARE Possible Tinba DGA NXDOMAIN Responses (net)11.1.1.153192.168.2.453861UDP
                                                                                                                                                                                                            2024-11-07T15:57:41.186092+01002022930ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow152.149.20.212443192.168.2.452907TCP
                                                                                                                                                                                                            2024-11-07T15:58:19.852670+01002022930ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow152.149.20.212443192.168.2.452927TCP
                                                                                                                                                                                                            2024-11-07T15:58:59.354865+01002815568ETPRO MALWARE Terse HTTP 1.0 Request Possible Nivdort1192.168.2.453059199.59.243.22780TCP
                                                                                                                                                                                                            2024-11-07T15:58:59.354865+01002820680ETPRO MALWARE W32/Bayrob Attempted Checkin 21192.168.2.453059199.59.243.22780TCP
                                                                                                                                                                                                            2024-11-07T15:59:15.174980+01002811542ETPRO MALWARE Possible Tinba DGA NXDOMAIN Responses (net)11.1.1.153192.168.2.457323UDP
                                                                                                                                                                                                            TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                            Nov 7, 2024 15:57:25.853058100 CET5625580192.168.2.4199.59.243.227
                                                                                                                                                                                                            Nov 7, 2024 15:57:25.858227015 CET8056255199.59.243.227192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:25.858352900 CET5625580192.168.2.4199.59.243.227
                                                                                                                                                                                                            Nov 7, 2024 15:57:25.858414888 CET5625580192.168.2.4199.59.243.227
                                                                                                                                                                                                            Nov 7, 2024 15:57:25.863919973 CET8056255199.59.243.227192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:26.487468004 CET8056255199.59.243.227192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:26.487528086 CET8056255199.59.243.227192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:26.487581968 CET5625580192.168.2.4199.59.243.227
                                                                                                                                                                                                            Nov 7, 2024 15:57:26.488176107 CET8056255199.59.243.227192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:26.488265038 CET5625580192.168.2.4199.59.243.227
                                                                                                                                                                                                            Nov 7, 2024 15:57:26.502768993 CET5625580192.168.2.4199.59.243.227
                                                                                                                                                                                                            Nov 7, 2024 15:57:26.507595062 CET8056255199.59.243.227192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:26.746654034 CET5625680192.168.2.418.143.155.63
                                                                                                                                                                                                            Nov 7, 2024 15:57:26.751493931 CET805625618.143.155.63192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:26.751589060 CET5625680192.168.2.418.143.155.63
                                                                                                                                                                                                            Nov 7, 2024 15:57:26.751705885 CET5625680192.168.2.418.143.155.63
                                                                                                                                                                                                            Nov 7, 2024 15:57:26.756625891 CET805625618.143.155.63192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:28.186042070 CET805625618.143.155.63192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:28.236475945 CET5625680192.168.2.418.143.155.63
                                                                                                                                                                                                            Nov 7, 2024 15:57:28.607733965 CET805625618.143.155.63192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:28.607805967 CET5625680192.168.2.418.143.155.63
                                                                                                                                                                                                            Nov 7, 2024 15:57:28.607949972 CET5625680192.168.2.418.143.155.63
                                                                                                                                                                                                            Nov 7, 2024 15:57:28.613217115 CET805625618.143.155.63192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:30.072261095 CET5625780192.168.2.454.244.188.177
                                                                                                                                                                                                            Nov 7, 2024 15:57:30.077280998 CET805625754.244.188.177192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:30.077378035 CET5625780192.168.2.454.244.188.177
                                                                                                                                                                                                            Nov 7, 2024 15:57:30.077418089 CET5625780192.168.2.454.244.188.177
                                                                                                                                                                                                            Nov 7, 2024 15:57:30.082412958 CET805625754.244.188.177192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:30.916203022 CET805625754.244.188.177192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:30.974944115 CET5625780192.168.2.454.244.188.177
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.033943892 CET805625754.244.188.177192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.034012079 CET5625780192.168.2.454.244.188.177
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.034077883 CET5625780192.168.2.454.244.188.177
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.039436102 CET805625754.244.188.177192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.808835030 CET5625880192.168.2.4199.59.243.227
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.813731909 CET8056258199.59.243.227192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.813812971 CET5625880192.168.2.4199.59.243.227
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.813858986 CET5625880192.168.2.4199.59.243.227
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.818928003 CET8056258199.59.243.227192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:32.439815044 CET8056258199.59.243.227192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:32.440130949 CET8056258199.59.243.227192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:32.440232992 CET5625880192.168.2.4199.59.243.227
                                                                                                                                                                                                            Nov 7, 2024 15:57:32.440695047 CET8056258199.59.243.227192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:32.440751076 CET5625880192.168.2.4199.59.243.227
                                                                                                                                                                                                            Nov 7, 2024 15:57:32.440788984 CET5625880192.168.2.4199.59.243.227
                                                                                                                                                                                                            Nov 7, 2024 15:57:32.445626020 CET8056258199.59.243.227192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:32.859895945 CET5625980192.168.2.418.143.155.63
                                                                                                                                                                                                            Nov 7, 2024 15:57:32.865720987 CET805625918.143.155.63192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:32.865818024 CET5625980192.168.2.418.143.155.63
                                                                                                                                                                                                            Nov 7, 2024 15:57:32.865911007 CET5625980192.168.2.418.143.155.63
                                                                                                                                                                                                            Nov 7, 2024 15:57:32.871763945 CET805625918.143.155.63192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:34.301917076 CET805625918.143.155.63192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:34.345855951 CET5625980192.168.2.418.143.155.63
                                                                                                                                                                                                            Nov 7, 2024 15:57:34.720617056 CET805625918.143.155.63192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:34.720716000 CET5625980192.168.2.418.143.155.63
                                                                                                                                                                                                            Nov 7, 2024 15:57:34.720835924 CET5625980192.168.2.418.143.155.63
                                                                                                                                                                                                            Nov 7, 2024 15:57:34.725684881 CET805625918.143.155.63192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:36.290576935 CET5290680192.168.2.485.214.228.140
                                                                                                                                                                                                            Nov 7, 2024 15:57:36.295619011 CET805290685.214.228.140192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:36.295722008 CET5290680192.168.2.485.214.228.140
                                                                                                                                                                                                            Nov 7, 2024 15:57:36.295778990 CET5290680192.168.2.485.214.228.140
                                                                                                                                                                                                            Nov 7, 2024 15:57:36.301033020 CET805290685.214.228.140192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:37.167211056 CET805290685.214.228.140192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:37.167440891 CET5290680192.168.2.485.214.228.140
                                                                                                                                                                                                            Nov 7, 2024 15:57:37.173258066 CET805290685.214.228.140192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:37.173316002 CET5290680192.168.2.485.214.228.140
                                                                                                                                                                                                            Nov 7, 2024 15:58:58.691948891 CET5305980192.168.2.4199.59.243.227
                                                                                                                                                                                                            Nov 7, 2024 15:58:58.696762085 CET8053059199.59.243.227192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:58:58.696835041 CET5305980192.168.2.4199.59.243.227
                                                                                                                                                                                                            Nov 7, 2024 15:58:58.696934938 CET5305980192.168.2.4199.59.243.227
                                                                                                                                                                                                            Nov 7, 2024 15:58:58.701845884 CET8053059199.59.243.227192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:58:59.354711056 CET8053059199.59.243.227192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:58:59.354749918 CET8053059199.59.243.227192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:58:59.354865074 CET5305980192.168.2.4199.59.243.227
                                                                                                                                                                                                            Nov 7, 2024 15:58:59.386847019 CET8053059199.59.243.227192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:58:59.386931896 CET5305980192.168.2.4199.59.243.227
                                                                                                                                                                                                            Nov 7, 2024 15:58:59.386960030 CET5305980192.168.2.4199.59.243.227
                                                                                                                                                                                                            Nov 7, 2024 15:58:59.391727924 CET8053059199.59.243.227192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:59:04.487379074 CET5306080192.168.2.418.143.155.63
                                                                                                                                                                                                            Nov 7, 2024 15:59:04.492321968 CET805306018.143.155.63192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:59:04.492455959 CET5306080192.168.2.418.143.155.63
                                                                                                                                                                                                            Nov 7, 2024 15:59:04.492487907 CET5306080192.168.2.418.143.155.63
                                                                                                                                                                                                            Nov 7, 2024 15:59:04.498064995 CET805306018.143.155.63192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:59:05.946990013 CET805306018.143.155.63192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:59:05.950577021 CET5306080192.168.2.418.143.155.63
                                                                                                                                                                                                            Nov 7, 2024 15:59:05.956269979 CET805306018.143.155.63192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:59:05.957601070 CET5306080192.168.2.418.143.155.63
                                                                                                                                                                                                            TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                            Nov 7, 2024 15:57:25.598953009 CET6168753192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:25.631861925 CET53616871.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:25.633697033 CET5259553192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:25.645848989 CET53525951.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:25.646873951 CET5936753192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:25.656449080 CET53593671.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:25.657315016 CET5462653192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:25.667129040 CET53546261.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:25.667728901 CET4968753192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:25.677459955 CET53496871.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:25.678292036 CET5866053192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:25.687184095 CET53586601.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:25.687746048 CET6347753192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:25.719547987 CET53634771.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:25.720197916 CET6029253192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:25.731822014 CET53602921.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:25.732448101 CET6023053192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:25.742547989 CET53602301.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:25.743042946 CET5153953192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:25.753448009 CET53515391.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:25.753922939 CET6454253192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:25.763569117 CET53645421.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:25.764054060 CET5178153192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:25.795557022 CET53517811.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:25.796324015 CET6135953192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:25.805303097 CET53613591.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:25.806137085 CET5398453192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:25.815865040 CET53539841.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:25.816534996 CET5802853192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:25.850419998 CET53580281.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:26.504765987 CET5989553192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:26.516118050 CET53598951.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:26.519882917 CET5485253192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:26.530613899 CET53548521.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:26.531505108 CET5208453192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:26.540194035 CET53520841.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:26.540818930 CET5502653192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:26.551168919 CET53550261.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:26.551928043 CET6102853192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:26.746041059 CET53610281.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:28.608932018 CET4947653192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:28.640121937 CET53494761.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:28.641144991 CET6138753192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:28.651575089 CET53613871.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:28.652244091 CET6276653192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:28.683953047 CET53627661.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:28.684809923 CET6239553192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:28.695125103 CET53623951.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:28.706078053 CET5772153192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:28.717513084 CET53577211.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:28.718172073 CET5271753192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:28.749032974 CET53527171.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:28.752068043 CET6550053192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:28.761738062 CET53655001.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:28.762501001 CET6491453192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:28.769593954 CET53649141.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:28.770487070 CET5769953192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:28.802685022 CET53576991.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:28.803914070 CET5279053192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:28.813733101 CET53527901.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:28.814615965 CET5312553192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:28.846529961 CET53531251.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:28.890871048 CET6269153192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:28.922717094 CET53626911.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:28.943527937 CET5693653192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:28.975121975 CET53569361.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:28.983619928 CET5436553192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:28.995428085 CET53543651.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.023113966 CET6031953192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.033108950 CET53603191.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.056510925 CET6499953192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.088630915 CET53649991.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.092259884 CET6300353192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.100744009 CET53630031.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.102926970 CET6162953192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.114103079 CET53616291.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.114737988 CET4953853192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.125330925 CET53495381.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.126133919 CET5792153192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.135571003 CET53579211.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.136465073 CET5685753192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.146785975 CET53568571.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.150029898 CET5205353192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.160728931 CET53520531.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.162488937 CET5567253192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.195027113 CET53556721.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.195741892 CET4976653192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.205692053 CET53497661.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.206238985 CET4989253192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.216232061 CET53498921.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.216711044 CET6318953192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.248083115 CET53631891.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.248653889 CET5606253192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.259063959 CET53560621.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.259706974 CET4931353192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.271241903 CET53493131.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.280312061 CET6226253192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.289757013 CET53622621.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.290527105 CET5589253192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.300761938 CET53558921.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.301466942 CET6232753192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.311243057 CET53623271.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.311822891 CET6408953192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.321863890 CET53640891.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.322402954 CET6075253192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.333460093 CET53607521.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.334032059 CET5752253192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.341922998 CET53575221.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.342523098 CET5348053192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.373936892 CET53534801.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.374519110 CET5438753192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.385025024 CET53543871.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.385798931 CET5649253192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.395087004 CET53564921.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.395567894 CET4942653192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.427052975 CET53494261.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.427556038 CET5452753192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.458486080 CET53545271.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.459433079 CET5038753192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.478652954 CET53503871.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.479537010 CET5018053192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.489219904 CET53501801.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.489816904 CET5089453192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.521697044 CET53508941.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.522387028 CET4982353192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.532649040 CET53498231.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.533108950 CET6199653192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.543586969 CET53619961.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.544166088 CET5602553192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.551742077 CET53560251.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.552328110 CET5187253192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.563178062 CET53518721.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.563798904 CET5204653192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.574742079 CET53520461.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.575304031 CET5792053192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.605519056 CET53579201.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.608778954 CET6382053192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.639822006 CET53638201.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.640881062 CET5531153192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.800131083 CET53553111.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.801202059 CET6337953192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.810688019 CET53633791.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.811295986 CET5763953192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.819685936 CET53576391.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.820270061 CET5194753192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.851707935 CET53519471.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.852560997 CET5316753192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:30.071521997 CET53531671.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.034883022 CET5754353192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.045245886 CET53575431.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.046117067 CET5166853192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.056803942 CET53516681.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.057584047 CET5672353192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.067895889 CET53567231.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.070287943 CET5615753192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.079752922 CET53561571.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.083619118 CET5835353192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.093905926 CET53583531.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.094738960 CET6314153192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.129702091 CET53631411.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.130283117 CET6070053192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.160774946 CET53607001.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.161422968 CET6394353192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.170933962 CET53639431.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.171503067 CET5693453192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.178939104 CET53569341.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.179951906 CET6309453192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.191473961 CET53630941.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.193454027 CET5055353192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.203186035 CET53505531.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.207791090 CET4967753192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.217197895 CET53496771.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.217861891 CET5379853192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.228225946 CET53537981.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.240741968 CET4997353192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.271872997 CET53499731.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.272670984 CET5756053192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.282432079 CET53575601.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.282916069 CET5586853192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.290476084 CET53558681.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.291152954 CET6329053192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.303997993 CET53632901.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.328244925 CET5512353192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.337970972 CET53551231.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.338823080 CET5265153192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.348360062 CET53526511.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.349282980 CET6022953192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.359241009 CET53602291.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.359914064 CET5640053192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.370657921 CET53564001.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.372553110 CET5386153192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.381814957 CET53538611.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.383318901 CET5636353192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.393755913 CET53563631.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.394382954 CET6377053192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.404901981 CET53637701.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.405455112 CET5597353192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.416102886 CET53559731.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.416682005 CET6196853192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.808114052 CET53619681.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:32.441715956 CET5870353192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:32.451536894 CET53587031.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:32.452512980 CET6455553192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:32.484488010 CET53645551.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:32.485547066 CET5505353192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:32.495065928 CET53550531.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:32.495738983 CET5977853192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:32.535895109 CET53597781.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:32.536716938 CET6051353192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:32.546379089 CET53605131.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:32.546979904 CET5933553192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:32.579175949 CET53593351.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:32.579816103 CET6134553192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:32.589665890 CET53613451.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:32.590279102 CET6493553192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:32.622515917 CET53649351.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:32.623049974 CET4946253192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:32.653708935 CET53494621.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:32.654361963 CET5409553192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:32.664206028 CET53540951.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:32.664824009 CET6176153192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:32.859258890 CET53617611.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:34.721852064 CET5561953192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:34.752906084 CET53556191.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:34.754009008 CET5423753192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:34.763824940 CET53542371.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:34.765712023 CET5156153192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:34.775659084 CET53515611.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:34.776513100 CET5688453192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:34.785609007 CET53568841.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:34.786246061 CET5947053192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:34.819991112 CET53594701.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:34.820839882 CET5889553192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:34.831909895 CET53588951.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:34.832411051 CET6243353192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:34.842245102 CET53624331.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:34.842756033 CET5828653192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:34.852189064 CET53582861.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:34.853035927 CET5746653192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:34.862122059 CET53574661.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:34.862692118 CET5205453192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:34.894512892 CET53520541.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:34.895277023 CET5932253192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:34.927958965 CET53593221.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:34.928857088 CET6301353192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:34.960393906 CET53630131.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:34.961563110 CET5078753192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:34.991811991 CET53507871.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:34.992927074 CET5720453192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.005132914 CET53572041.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.006141901 CET5434253192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.016954899 CET53543421.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.017961025 CET5000253192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.049014091 CET53500021.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.050293922 CET6035953192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.061455965 CET53603591.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.062438011 CET5759253192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.095782995 CET53575921.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.103013039 CET6207253192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.113306999 CET53620721.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.114564896 CET5008953192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.146603107 CET53500891.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.148169041 CET5201053192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.159138918 CET53520101.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.160119057 CET5559053192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.170059919 CET53555901.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.171287060 CET5701353192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.181094885 CET53570131.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.181827068 CET6503653192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.193017006 CET53650361.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.193883896 CET5599953192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.204135895 CET53559991.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.204827070 CET5489553192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.237279892 CET53548951.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.238082886 CET6009353192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.270993948 CET53600931.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.271697044 CET5550253192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.282653093 CET53555021.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.283339977 CET6532153192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.293380022 CET53653211.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.294009924 CET5765753192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.304930925 CET53576571.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.305702925 CET5162153192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.316421032 CET53516211.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.317099094 CET5698953192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.348077059 CET53569891.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.349088907 CET5625453192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.379626036 CET53562541.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.380559921 CET5180553192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.389906883 CET53518051.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.390535116 CET4958053192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.401525021 CET53495801.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.402508020 CET6356753192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.414895058 CET53635671.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.415702105 CET5331253192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.426203012 CET53533121.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.426805019 CET6501353192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.457942963 CET53650131.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.458795071 CET6329153192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.466090918 CET53632911.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:36.080801964 CET5561853192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:36.091259003 CET53556181.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:36.092027903 CET5449853192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:36.104262114 CET53544981.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:36.104963064 CET6282453192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:36.136810064 CET53628241.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:36.137752056 CET5093953192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:36.150038958 CET53509391.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:36.150887012 CET5779453192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:36.183873892 CET53577941.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:36.184926987 CET6473553192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:36.195394993 CET53647351.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:36.202963114 CET6000653192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:36.289940119 CET53600061.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:37.168531895 CET6355353192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:37.178915977 CET53635531.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:37.179748058 CET5037553192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:37.188942909 CET53503751.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:37.190592051 CET5018253192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:37.220582962 CET53501821.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:37.222835064 CET5054253192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:37.253858089 CET53505421.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:37.254793882 CET6266953192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:37.264949083 CET53626691.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:37.265779972 CET5704753192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:37.296228886 CET53570471.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:37.297281981 CET5566553192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:37.327457905 CET53556651.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:37.328386068 CET4992553192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:37.337937117 CET53499251.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:37.338747978 CET6170853192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:37.348233938 CET53617081.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:37.348999977 CET4982253192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:37.380656958 CET53498221.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:37.381479025 CET5173453192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:37.414180040 CET53517341.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:37.415046930 CET6297653192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:37.425971985 CET53629761.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:57:37.426877022 CET6308353192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:57:37.437093973 CET53630831.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:58:45.244280100 CET6182753192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:58:45.275635004 CET53618271.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:58:46.284641981 CET6347153192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:58:46.295077085 CET53634711.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:58:47.315727949 CET5799953192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:58:47.325715065 CET53579991.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:58:48.331154108 CET6283053192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:58:48.339792013 CET53628301.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:58:49.347044945 CET6466353192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:58:49.359157085 CET53646631.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:58:50.362693071 CET5951453192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:58:50.372262955 CET53595141.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:58:51.378467083 CET6072453192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:58:51.387005091 CET53607241.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:58:52.409006119 CET5108253192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:58:52.418625116 CET53510821.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:58:53.424958944 CET5148553192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:58:53.456137896 CET53514851.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:58:54.472050905 CET5691153192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:58:54.483752012 CET53569111.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:58:55.612168074 CET5623953192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:58:55.643434048 CET53562391.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:58:56.659132004 CET6259853192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:58:56.669537067 CET53625981.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:58:57.675082922 CET6195553192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:58:57.685509920 CET53619551.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:59:00.393326998 CET5936753192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:59:00.424079895 CET53593671.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:59:01.440242052 CET6332853192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:59:01.449789047 CET53633281.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:59:02.455888987 CET6527153192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:59:02.465276003 CET53652711.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:59:03.471364975 CET5416153192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:59:03.483633995 CET53541611.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:59:06.955768108 CET5784753192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:59:06.965877056 CET53578471.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:59:07.971486092 CET6134153192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:59:07.981679916 CET53613411.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:59:08.987201929 CET5841853192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:59:08.996021032 CET53584181.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:59:10.002863884 CET6482953192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:59:10.013009071 CET53648291.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:59:11.019175053 CET5410653192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:59:11.029616117 CET53541061.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:59:12.034075022 CET6100753192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:59:12.045104980 CET53610071.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:59:13.049737930 CET5497553192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:59:13.081716061 CET53549751.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:59:14.096457958 CET5804453192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:59:14.126576900 CET53580441.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:59:15.143170118 CET5732353192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:59:15.174979925 CET53573231.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:59:16.190762997 CET4958653192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:59:16.201395988 CET53495861.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:59:17.206154108 CET5393453192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:59:17.215400934 CET53539341.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:59:18.221826077 CET5000953192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:59:18.232784033 CET53500091.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:59:19.238291025 CET5085853192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:59:19.247200012 CET53508581.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:59:20.221410990 CET5253853192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:59:20.231200933 CET53525381.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:59:21.174698114 CET6533653192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:59:21.185820103 CET53653361.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:59:22.096545935 CET5240853192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:59:22.107166052 CET53524081.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:59:22.986951113 CET5623753192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:59:22.996701002 CET53562371.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:59:23.846404076 CET5574453192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:59:23.855959892 CET53557441.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:59:24.674396992 CET5700953192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:59:24.681726933 CET53570091.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:59:25.487883091 CET5935353192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:59:25.497222900 CET53593531.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:59:26.268379927 CET6130353192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:59:26.427541018 CET53613031.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:59:27.174776077 CET5654453192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:59:27.184636116 CET53565441.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:59:28.002542973 CET4923153192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:59:28.012492895 CET53492311.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:59:28.013588905 CET6284753192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:59:28.044290066 CET53628471.1.1.1192.168.2.4
                                                                                                                                                                                                            Nov 7, 2024 15:59:28.045198917 CET6071953192.168.2.41.1.1.1
                                                                                                                                                                                                            Nov 7, 2024 15:59:28.054019928 CET53607191.1.1.1192.168.2.4
                                                                                                                                                                                                            TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                                                                            Nov 7, 2024 15:57:25.598953009 CET192.168.2.41.1.1.10xaf52Standard query (0)leadernothing.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:25.633697033 CET192.168.2.41.1.1.10xecf2Standard query (0)heavennothing.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:25.646873951 CET192.168.2.41.1.1.10xad35Standard query (0)leaderbottle.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:25.657315016 CET192.168.2.41.1.1.10xd76dStandard query (0)heavenbottle.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:25.667728901 CET192.168.2.41.1.1.10x91cdStandard query (0)leaderdivide.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:25.678292036 CET192.168.2.41.1.1.10xd9eStandard query (0)heavendivide.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:25.687746048 CET192.168.2.41.1.1.10x37e1Standard query (0)heavystream.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:25.720197916 CET192.168.2.41.1.1.10xf3cbStandard query (0)gentlestream.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:25.732448101 CET192.168.2.41.1.1.10xbebeStandard query (0)heavynothing.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:25.743042946 CET192.168.2.41.1.1.10x3cceStandard query (0)gentlenothing.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:25.753922939 CET192.168.2.41.1.1.10xceb2Standard query (0)heavybottle.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:25.764054060 CET192.168.2.41.1.1.10x179Standard query (0)gentlebottle.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:25.796324015 CET192.168.2.41.1.1.10x9d0bStandard query (0)heavydivide.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:25.806137085 CET192.168.2.41.1.1.10xc039Standard query (0)gentledivide.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:25.816534996 CET192.168.2.41.1.1.10x1b99Standard query (0)variousstream.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:26.504765987 CET192.168.2.41.1.1.10x2bf5Standard query (0)returnstream.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:26.519882917 CET192.168.2.41.1.1.10x469aStandard query (0)variousnothing.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:26.531505108 CET192.168.2.41.1.1.10xfc0dStandard query (0)returnnothing.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:26.540818930 CET192.168.2.41.1.1.10x7f50Standard query (0)variousbottle.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:26.551928043 CET192.168.2.41.1.1.10xc09aStandard query (0)returnbottle.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:28.608932018 CET192.168.2.41.1.1.10x88efStandard query (0)variousdivide.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:28.641144991 CET192.168.2.41.1.1.10x7907Standard query (0)returndivide.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:28.652244091 CET192.168.2.41.1.1.10x8d09Standard query (0)degreemanner.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:28.684809923 CET192.168.2.41.1.1.10x1099Standard query (0)forwardmanner.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:28.706078053 CET192.168.2.41.1.1.10x198bStandard query (0)degreeanother.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:28.718172073 CET192.168.2.41.1.1.10x4b45Standard query (0)forwardanother.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:28.752068043 CET192.168.2.41.1.1.10x8330Standard query (0)degreebusiness.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:28.762501001 CET192.168.2.41.1.1.10x18dcStandard query (0)forwardbusiness.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:28.770487070 CET192.168.2.41.1.1.10x3a59Standard query (0)degreeappear.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:28.803914070 CET192.168.2.41.1.1.10x91f1Standard query (0)forwardappear.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:28.814615965 CET192.168.2.41.1.1.10xf8a5Standard query (0)answermanner.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:28.890871048 CET192.168.2.41.1.1.10xf0d9Standard query (0)glassmanner.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:28.943527937 CET192.168.2.41.1.1.10xfdafStandard query (0)answeranother.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:28.983619928 CET192.168.2.41.1.1.10x27dfStandard query (0)glassanother.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.023113966 CET192.168.2.41.1.1.10xe933Standard query (0)answerbusiness.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.056510925 CET192.168.2.41.1.1.10x21c1Standard query (0)glassbusiness.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.092259884 CET192.168.2.41.1.1.10xeff5Standard query (0)answerappear.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.102926970 CET192.168.2.41.1.1.10x60dcStandard query (0)glassappear.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.114737988 CET192.168.2.41.1.1.10xc60dStandard query (0)difficultmanner.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.126133919 CET192.168.2.41.1.1.10x41abStandard query (0)heardmanner.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.136465073 CET192.168.2.41.1.1.10xe98bStandard query (0)difficultanother.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.150029898 CET192.168.2.41.1.1.10x1cb1Standard query (0)heardanother.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.162488937 CET192.168.2.41.1.1.10x8867Standard query (0)difficultbusiness.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.195741892 CET192.168.2.41.1.1.10x6e2cStandard query (0)heardbusiness.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.206238985 CET192.168.2.41.1.1.10x4386Standard query (0)difficultappear.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.216711044 CET192.168.2.41.1.1.10x9e32Standard query (0)heardappear.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.248653889 CET192.168.2.41.1.1.10x2baeStandard query (0)pleasantmanner.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.259706974 CET192.168.2.41.1.1.10xc762Standard query (0)necessarymanner.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.280312061 CET192.168.2.41.1.1.10x1a63Standard query (0)pleasantanother.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.290527105 CET192.168.2.41.1.1.10xbd41Standard query (0)necessaryanother.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.301466942 CET192.168.2.41.1.1.10x6c1cStandard query (0)pleasantbusiness.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.311822891 CET192.168.2.41.1.1.10x1ba9Standard query (0)necessarybusiness.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.322402954 CET192.168.2.41.1.1.10x98a6Standard query (0)pleasantappear.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.334032059 CET192.168.2.41.1.1.10xa1e0Standard query (0)necessaryappear.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.342523098 CET192.168.2.41.1.1.10x6e61Standard query (0)ordermanner.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.374519110 CET192.168.2.41.1.1.10x3ed8Standard query (0)requiremanner.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.385798931 CET192.168.2.41.1.1.10x3f9dStandard query (0)orderanother.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.395567894 CET192.168.2.41.1.1.10x77caStandard query (0)requireanother.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.427556038 CET192.168.2.41.1.1.10xb6f6Standard query (0)orderbusiness.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.459433079 CET192.168.2.41.1.1.10x9177Standard query (0)requirebusiness.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.479537010 CET192.168.2.41.1.1.10xd39cStandard query (0)orderappear.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.489816904 CET192.168.2.41.1.1.10x9d90Standard query (0)requireappear.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.522387028 CET192.168.2.41.1.1.10xd092Standard query (0)leadermanner.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.533108950 CET192.168.2.41.1.1.10x2300Standard query (0)heavenmanner.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.544166088 CET192.168.2.41.1.1.10xe73bStandard query (0)leaderanother.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.552328110 CET192.168.2.41.1.1.10x2055Standard query (0)heavenanother.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.563798904 CET192.168.2.41.1.1.10x4b45Standard query (0)leaderbusiness.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.575304031 CET192.168.2.41.1.1.10xc24aStandard query (0)heavenbusiness.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.608778954 CET192.168.2.41.1.1.10xb9fcStandard query (0)leaderappear.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.640881062 CET192.168.2.41.1.1.10xab7Standard query (0)heavenappear.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.801202059 CET192.168.2.41.1.1.10xd36dStandard query (0)heavymanner.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.811295986 CET192.168.2.41.1.1.10xbcfStandard query (0)gentlemanner.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.820270061 CET192.168.2.41.1.1.10x2629Standard query (0)heavyanother.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.852560997 CET192.168.2.41.1.1.10x611aStandard query (0)gentleanother.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.034883022 CET192.168.2.41.1.1.10xf2d2Standard query (0)heavybusiness.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.046117067 CET192.168.2.41.1.1.10xc0c4Standard query (0)gentlebusiness.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.057584047 CET192.168.2.41.1.1.10x916dStandard query (0)heavyappear.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.070287943 CET192.168.2.41.1.1.10x8812Standard query (0)gentleappear.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.083619118 CET192.168.2.41.1.1.10x1cb6Standard query (0)variousmanner.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.094738960 CET192.168.2.41.1.1.10x25cbStandard query (0)returnmanner.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.130283117 CET192.168.2.41.1.1.10x150fStandard query (0)variousanother.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.161422968 CET192.168.2.41.1.1.10xe252Standard query (0)returnanother.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.171503067 CET192.168.2.41.1.1.10xbaaaStandard query (0)variousbusiness.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.179951906 CET192.168.2.41.1.1.10x72dfStandard query (0)returnbusiness.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.193454027 CET192.168.2.41.1.1.10x69caStandard query (0)variousappear.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.207791090 CET192.168.2.41.1.1.10x6ec2Standard query (0)returnappear.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.217861891 CET192.168.2.41.1.1.10x61faStandard query (0)degreeinstead.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.240741968 CET192.168.2.41.1.1.10xd02dStandard query (0)forwardinstead.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.272670984 CET192.168.2.41.1.1.10xa6caStandard query (0)degreeexplain.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.282916069 CET192.168.2.41.1.1.10xe30eStandard query (0)forwardexplain.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.291152954 CET192.168.2.41.1.1.10xe750Standard query (0)degreebright.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.328244925 CET192.168.2.41.1.1.10x2190Standard query (0)forwardbright.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.338823080 CET192.168.2.41.1.1.10x56deStandard query (0)degreeinside.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.349282980 CET192.168.2.41.1.1.10xd2abStandard query (0)forwardinside.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.359914064 CET192.168.2.41.1.1.10x86edStandard query (0)answerinstead.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.372553110 CET192.168.2.41.1.1.10x8f12Standard query (0)glassinstead.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.383318901 CET192.168.2.41.1.1.10x588cStandard query (0)answerexplain.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.394382954 CET192.168.2.41.1.1.10x727cStandard query (0)glassexplain.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.405455112 CET192.168.2.41.1.1.10x9aaeStandard query (0)answerbright.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.416682005 CET192.168.2.41.1.1.10x74a2Standard query (0)glassbright.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:32.441715956 CET192.168.2.41.1.1.10xbd99Standard query (0)answerinside.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:32.452512980 CET192.168.2.41.1.1.10xbe38Standard query (0)glassinside.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:32.485547066 CET192.168.2.41.1.1.10xe81bStandard query (0)difficultinstead.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:32.495738983 CET192.168.2.41.1.1.10x2a29Standard query (0)heardinstead.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:32.536716938 CET192.168.2.41.1.1.10x28aaStandard query (0)difficultexplain.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:32.546979904 CET192.168.2.41.1.1.10x4d0cStandard query (0)heardexplain.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:32.579816103 CET192.168.2.41.1.1.10xc290Standard query (0)difficultbright.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:32.590279102 CET192.168.2.41.1.1.10xd67dStandard query (0)heardbright.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:32.623049974 CET192.168.2.41.1.1.10xdeffStandard query (0)difficultinside.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:32.654361963 CET192.168.2.41.1.1.10x1490Standard query (0)heardinside.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:32.664824009 CET192.168.2.41.1.1.10xfc65Standard query (0)pleasantinstead.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:34.721852064 CET192.168.2.41.1.1.10x5af2Standard query (0)necessaryinstead.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:34.754009008 CET192.168.2.41.1.1.10xe748Standard query (0)pleasantexplain.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:34.765712023 CET192.168.2.41.1.1.10x9737Standard query (0)necessaryexplain.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:34.776513100 CET192.168.2.41.1.1.10xdfaaStandard query (0)pleasantbright.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:34.786246061 CET192.168.2.41.1.1.10xabc7Standard query (0)necessarybright.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:34.820839882 CET192.168.2.41.1.1.10xf5e5Standard query (0)pleasantinside.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:34.832411051 CET192.168.2.41.1.1.10xc2afStandard query (0)necessaryinside.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:34.842756033 CET192.168.2.41.1.1.10xeb89Standard query (0)orderinstead.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:34.853035927 CET192.168.2.41.1.1.10x9cdeStandard query (0)requireinstead.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:34.862692118 CET192.168.2.41.1.1.10xe005Standard query (0)orderexplain.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:34.895277023 CET192.168.2.41.1.1.10x369fStandard query (0)requireexplain.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:34.928857088 CET192.168.2.41.1.1.10x87b4Standard query (0)orderbright.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:34.961563110 CET192.168.2.41.1.1.10x410aStandard query (0)requirebright.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:34.992927074 CET192.168.2.41.1.1.10xeabStandard query (0)orderinside.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.006141901 CET192.168.2.41.1.1.10xf201Standard query (0)requireinside.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.017961025 CET192.168.2.41.1.1.10x2536Standard query (0)leaderinstead.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.050293922 CET192.168.2.41.1.1.10x2ec5Standard query (0)heaveninstead.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.062438011 CET192.168.2.41.1.1.10x6f2fStandard query (0)leaderexplain.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.103013039 CET192.168.2.41.1.1.10x5c75Standard query (0)heavenexplain.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.114564896 CET192.168.2.41.1.1.10x7d62Standard query (0)leaderbright.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.148169041 CET192.168.2.41.1.1.10xc3dcStandard query (0)heavenbright.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.160119057 CET192.168.2.41.1.1.10x99a8Standard query (0)leaderinside.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.171287060 CET192.168.2.41.1.1.10x6ab5Standard query (0)heaveninside.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.181827068 CET192.168.2.41.1.1.10xb6e3Standard query (0)heavyinstead.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.193883896 CET192.168.2.41.1.1.10x3deaStandard query (0)gentleinstead.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.204827070 CET192.168.2.41.1.1.10xfb78Standard query (0)heavyexplain.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.238082886 CET192.168.2.41.1.1.10xd62dStandard query (0)gentleexplain.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.271697044 CET192.168.2.41.1.1.10x1dbdStandard query (0)heavybright.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.283339977 CET192.168.2.41.1.1.10xb435Standard query (0)gentlebright.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.294009924 CET192.168.2.41.1.1.10x7090Standard query (0)heavyinside.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.305702925 CET192.168.2.41.1.1.10x8471Standard query (0)gentleinside.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.317099094 CET192.168.2.41.1.1.10xcf5Standard query (0)variousinstead.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.349088907 CET192.168.2.41.1.1.10x811aStandard query (0)returninstead.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.380559921 CET192.168.2.41.1.1.10xdd10Standard query (0)variousexplain.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.390535116 CET192.168.2.41.1.1.10xda0aStandard query (0)returnexplain.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.402508020 CET192.168.2.41.1.1.10xf8feStandard query (0)variousbright.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.415702105 CET192.168.2.41.1.1.10x1e5dStandard query (0)returnbright.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.426805019 CET192.168.2.41.1.1.10x86a8Standard query (0)variousinside.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.458795071 CET192.168.2.41.1.1.10x3ffcStandard query (0)returninside.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:36.080801964 CET192.168.2.41.1.1.10x7706Standard query (0)degreeready.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:36.092027903 CET192.168.2.41.1.1.10x9fe3Standard query (0)forwardready.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:36.104963064 CET192.168.2.41.1.1.10x9e86Standard query (0)degreebrown.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:36.137752056 CET192.168.2.41.1.1.10xf846Standard query (0)forwardbrown.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:36.150887012 CET192.168.2.41.1.1.10xc31dStandard query (0)degreepeople.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:36.184926987 CET192.168.2.41.1.1.10x6ea2Standard query (0)forwardpeople.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:36.202963114 CET192.168.2.41.1.1.10xd1e1Standard query (0)degreedaughter.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:37.168531895 CET192.168.2.41.1.1.10xaff5Standard query (0)forwarddaughter.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:37.179748058 CET192.168.2.41.1.1.10x245cStandard query (0)answerready.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:37.190592051 CET192.168.2.41.1.1.10x7cc9Standard query (0)glassready.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:37.222835064 CET192.168.2.41.1.1.10x1381Standard query (0)answerbrown.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:37.254793882 CET192.168.2.41.1.1.10xb81fStandard query (0)glassbrown.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:37.265779972 CET192.168.2.41.1.1.10x95feStandard query (0)answerpeople.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:37.297281981 CET192.168.2.41.1.1.10x4a6aStandard query (0)glasspeople.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:37.328386068 CET192.168.2.41.1.1.10xe7caStandard query (0)answerdaughter.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:37.338747978 CET192.168.2.41.1.1.10x3f9bStandard query (0)glassdaughter.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:37.348999977 CET192.168.2.41.1.1.10x7bffStandard query (0)difficultready.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:37.381479025 CET192.168.2.41.1.1.10x7059Standard query (0)heardready.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:37.415046930 CET192.168.2.41.1.1.10x21b1Standard query (0)difficultbrown.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:37.426877022 CET192.168.2.41.1.1.10x52fbStandard query (0)heardbrown.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:58:45.244280100 CET192.168.2.41.1.1.10x9b56Standard query (0)heavennothing.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:58:46.284641981 CET192.168.2.41.1.1.10xaedbStandard query (0)leaderbottle.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:58:47.315727949 CET192.168.2.41.1.1.10x7c6aStandard query (0)heavenbottle.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:58:48.331154108 CET192.168.2.41.1.1.10xe7edStandard query (0)leaderdivide.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:58:49.347044945 CET192.168.2.41.1.1.10xf9c0Standard query (0)heavendivide.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:58:50.362693071 CET192.168.2.41.1.1.10xfb3cStandard query (0)heavystream.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:58:51.378467083 CET192.168.2.41.1.1.10x21b3Standard query (0)gentlestream.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:58:52.409006119 CET192.168.2.41.1.1.10x1bc2Standard query (0)heavynothing.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:58:53.424958944 CET192.168.2.41.1.1.10xf7f9Standard query (0)gentlenothing.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:58:54.472050905 CET192.168.2.41.1.1.10xedd4Standard query (0)heavybottle.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:58:55.612168074 CET192.168.2.41.1.1.10x846eStandard query (0)gentlebottle.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:58:56.659132004 CET192.168.2.41.1.1.10x9680Standard query (0)heavydivide.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:58:57.675082922 CET192.168.2.41.1.1.10x33d4Standard query (0)gentledivide.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:59:00.393326998 CET192.168.2.41.1.1.10xd02aStandard query (0)returnstream.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:59:01.440242052 CET192.168.2.41.1.1.10x412eStandard query (0)variousnothing.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:59:02.455888987 CET192.168.2.41.1.1.10xaec0Standard query (0)returnnothing.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:59:03.471364975 CET192.168.2.41.1.1.10xee0dStandard query (0)variousbottle.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:59:06.955768108 CET192.168.2.41.1.1.10x5172Standard query (0)variousdivide.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:59:07.971486092 CET192.168.2.41.1.1.10xc2ccStandard query (0)returndivide.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:59:08.987201929 CET192.168.2.41.1.1.10x979aStandard query (0)degreemanner.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:59:10.002863884 CET192.168.2.41.1.1.10x6622Standard query (0)forwardmanner.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:59:11.019175053 CET192.168.2.41.1.1.10xaf55Standard query (0)degreeanother.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:59:12.034075022 CET192.168.2.41.1.1.10x8f7dStandard query (0)forwardanother.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:59:13.049737930 CET192.168.2.41.1.1.10x2cb9Standard query (0)degreebusiness.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:59:14.096457958 CET192.168.2.41.1.1.10x6480Standard query (0)forwardbusiness.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:59:15.143170118 CET192.168.2.41.1.1.10x42d8Standard query (0)degreeappear.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:59:16.190762997 CET192.168.2.41.1.1.10x4e46Standard query (0)forwardappear.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:59:17.206154108 CET192.168.2.41.1.1.10x99aStandard query (0)answermanner.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:59:18.221826077 CET192.168.2.41.1.1.10x429Standard query (0)glassmanner.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:59:19.238291025 CET192.168.2.41.1.1.10x7b65Standard query (0)answeranother.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:59:20.221410990 CET192.168.2.41.1.1.10x55cbStandard query (0)glassanother.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:59:21.174698114 CET192.168.2.41.1.1.10xe7a2Standard query (0)answerbusiness.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:59:22.096545935 CET192.168.2.41.1.1.10x1d09Standard query (0)glassbusiness.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:59:22.986951113 CET192.168.2.41.1.1.10x2f35Standard query (0)answerappear.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:59:23.846404076 CET192.168.2.41.1.1.10x97c2Standard query (0)glassappear.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:59:24.674396992 CET192.168.2.41.1.1.10x3d68Standard query (0)difficultmanner.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:59:25.487883091 CET192.168.2.41.1.1.10xf30fStandard query (0)heardmanner.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:59:26.268379927 CET192.168.2.41.1.1.10xafffStandard query (0)difficultanother.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:59:27.174776077 CET192.168.2.41.1.1.10xec8dStandard query (0)heardanother.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:59:28.002542973 CET192.168.2.41.1.1.10x3807Standard query (0)difficultbusiness.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:59:28.013588905 CET192.168.2.41.1.1.10x458cStandard query (0)heardbusiness.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:59:28.045198917 CET192.168.2.41.1.1.10xe3ceStandard query (0)difficultappear.netA (IP address)IN (0x0001)false
                                                                                                                                                                                                            TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                                                                            Nov 7, 2024 15:57:25.631861925 CET1.1.1.1192.168.2.40xaf52Name error (3)leadernothing.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:25.645848989 CET1.1.1.1192.168.2.40xecf2Name error (3)heavennothing.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:25.656449080 CET1.1.1.1192.168.2.40xad35Name error (3)leaderbottle.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:25.667129040 CET1.1.1.1192.168.2.40xd76dName error (3)heavenbottle.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:25.677459955 CET1.1.1.1192.168.2.40x91cdName error (3)leaderdivide.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:25.687184095 CET1.1.1.1192.168.2.40xd9eName error (3)heavendivide.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:25.719547987 CET1.1.1.1192.168.2.40x37e1Name error (3)heavystream.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:25.731822014 CET1.1.1.1192.168.2.40xf3cbName error (3)gentlestream.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:25.742547989 CET1.1.1.1192.168.2.40xbebeName error (3)heavynothing.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:25.753448009 CET1.1.1.1192.168.2.40x3cceName error (3)gentlenothing.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:25.763569117 CET1.1.1.1192.168.2.40xceb2Name error (3)heavybottle.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:25.795557022 CET1.1.1.1192.168.2.40x179Name error (3)gentlebottle.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:25.805303097 CET1.1.1.1192.168.2.40x9d0bName error (3)heavydivide.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:25.815865040 CET1.1.1.1192.168.2.40xc039Name error (3)gentledivide.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:25.850419998 CET1.1.1.1192.168.2.40x1b99No error (0)variousstream.net7450.bodis.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:25.850419998 CET1.1.1.1192.168.2.40x1b99No error (0)7450.bodis.com199.59.243.227A (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:26.516118050 CET1.1.1.1192.168.2.40x2bf5Name error (3)returnstream.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:26.530613899 CET1.1.1.1192.168.2.40x469aName error (3)variousnothing.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:26.540194035 CET1.1.1.1192.168.2.40xfc0dName error (3)returnnothing.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:26.551168919 CET1.1.1.1192.168.2.40x7f50Name error (3)variousbottle.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:26.746041059 CET1.1.1.1192.168.2.40xc09aNo error (0)returnbottle.net18.143.155.63A (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:28.640121937 CET1.1.1.1192.168.2.40x88efName error (3)variousdivide.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:28.651575089 CET1.1.1.1192.168.2.40x7907Name error (3)returndivide.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:28.683953047 CET1.1.1.1192.168.2.40x8d09Name error (3)degreemanner.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:28.695125103 CET1.1.1.1192.168.2.40x1099Name error (3)forwardmanner.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:28.717513084 CET1.1.1.1192.168.2.40x198bName error (3)degreeanother.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:28.749032974 CET1.1.1.1192.168.2.40x4b45Name error (3)forwardanother.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:28.761738062 CET1.1.1.1192.168.2.40x8330Name error (3)degreebusiness.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:28.769593954 CET1.1.1.1192.168.2.40x18dcName error (3)forwardbusiness.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:28.802685022 CET1.1.1.1192.168.2.40x3a59Name error (3)degreeappear.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:28.813733101 CET1.1.1.1192.168.2.40x91f1Name error (3)forwardappear.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:28.846529961 CET1.1.1.1192.168.2.40xf8a5Name error (3)answermanner.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:28.922717094 CET1.1.1.1192.168.2.40xf0d9Name error (3)glassmanner.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:28.975121975 CET1.1.1.1192.168.2.40xfdafName error (3)answeranother.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:28.995428085 CET1.1.1.1192.168.2.40x27dfName error (3)glassanother.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.033108950 CET1.1.1.1192.168.2.40xe933Name error (3)answerbusiness.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.088630915 CET1.1.1.1192.168.2.40x21c1Name error (3)glassbusiness.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.100744009 CET1.1.1.1192.168.2.40xeff5Name error (3)answerappear.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.114103079 CET1.1.1.1192.168.2.40x60dcName error (3)glassappear.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.125330925 CET1.1.1.1192.168.2.40xc60dName error (3)difficultmanner.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.135571003 CET1.1.1.1192.168.2.40x41abName error (3)heardmanner.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.146785975 CET1.1.1.1192.168.2.40xe98bName error (3)difficultanother.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.160728931 CET1.1.1.1192.168.2.40x1cb1Name error (3)heardanother.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.195027113 CET1.1.1.1192.168.2.40x8867Name error (3)difficultbusiness.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.205692053 CET1.1.1.1192.168.2.40x6e2cName error (3)heardbusiness.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.216232061 CET1.1.1.1192.168.2.40x4386Name error (3)difficultappear.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.248083115 CET1.1.1.1192.168.2.40x9e32Name error (3)heardappear.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.259063959 CET1.1.1.1192.168.2.40x2baeName error (3)pleasantmanner.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.271241903 CET1.1.1.1192.168.2.40xc762Name error (3)necessarymanner.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.289757013 CET1.1.1.1192.168.2.40x1a63Name error (3)pleasantanother.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.300761938 CET1.1.1.1192.168.2.40xbd41Name error (3)necessaryanother.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.311243057 CET1.1.1.1192.168.2.40x6c1cName error (3)pleasantbusiness.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.321863890 CET1.1.1.1192.168.2.40x1ba9Name error (3)necessarybusiness.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.333460093 CET1.1.1.1192.168.2.40x98a6Name error (3)pleasantappear.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.341922998 CET1.1.1.1192.168.2.40xa1e0Name error (3)necessaryappear.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.373936892 CET1.1.1.1192.168.2.40x6e61Name error (3)ordermanner.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.385025024 CET1.1.1.1192.168.2.40x3ed8Name error (3)requiremanner.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.395087004 CET1.1.1.1192.168.2.40x3f9dName error (3)orderanother.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.427052975 CET1.1.1.1192.168.2.40x77caName error (3)requireanother.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.458486080 CET1.1.1.1192.168.2.40xb6f6Name error (3)orderbusiness.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.478652954 CET1.1.1.1192.168.2.40x9177Name error (3)requirebusiness.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.489219904 CET1.1.1.1192.168.2.40xd39cName error (3)orderappear.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.521697044 CET1.1.1.1192.168.2.40x9d90Name error (3)requireappear.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.532649040 CET1.1.1.1192.168.2.40xd092Name error (3)leadermanner.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.543586969 CET1.1.1.1192.168.2.40x2300Name error (3)heavenmanner.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.551742077 CET1.1.1.1192.168.2.40xe73bName error (3)leaderanother.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.563178062 CET1.1.1.1192.168.2.40x2055Name error (3)heavenanother.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.574742079 CET1.1.1.1192.168.2.40x4b45Name error (3)leaderbusiness.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.605519056 CET1.1.1.1192.168.2.40xc24aName error (3)heavenbusiness.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.639822006 CET1.1.1.1192.168.2.40xb9fcName error (3)leaderappear.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.800131083 CET1.1.1.1192.168.2.40xab7Name error (3)heavenappear.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.810688019 CET1.1.1.1192.168.2.40xd36dName error (3)heavymanner.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.819685936 CET1.1.1.1192.168.2.40xbcfName error (3)gentlemanner.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:29.851707935 CET1.1.1.1192.168.2.40x2629Name error (3)heavyanother.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:30.071521997 CET1.1.1.1192.168.2.40x611aNo error (0)gentleanother.net54.244.188.177A (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.045245886 CET1.1.1.1192.168.2.40xf2d2Name error (3)heavybusiness.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.056803942 CET1.1.1.1192.168.2.40xc0c4Name error (3)gentlebusiness.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.067895889 CET1.1.1.1192.168.2.40x916dName error (3)heavyappear.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.079752922 CET1.1.1.1192.168.2.40x8812Name error (3)gentleappear.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.093905926 CET1.1.1.1192.168.2.40x1cb6Name error (3)variousmanner.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.129702091 CET1.1.1.1192.168.2.40x25cbName error (3)returnmanner.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.160774946 CET1.1.1.1192.168.2.40x150fName error (3)variousanother.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.170933962 CET1.1.1.1192.168.2.40xe252Name error (3)returnanother.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.178939104 CET1.1.1.1192.168.2.40xbaaaName error (3)variousbusiness.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.191473961 CET1.1.1.1192.168.2.40x72dfName error (3)returnbusiness.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.203186035 CET1.1.1.1192.168.2.40x69caName error (3)variousappear.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.217197895 CET1.1.1.1192.168.2.40x6ec2Name error (3)returnappear.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.228225946 CET1.1.1.1192.168.2.40x61faName error (3)degreeinstead.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.271872997 CET1.1.1.1192.168.2.40xd02dName error (3)forwardinstead.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.282432079 CET1.1.1.1192.168.2.40xa6caName error (3)degreeexplain.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.290476084 CET1.1.1.1192.168.2.40xe30eName error (3)forwardexplain.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.303997993 CET1.1.1.1192.168.2.40xe750Name error (3)degreebright.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.337970972 CET1.1.1.1192.168.2.40x2190Name error (3)forwardbright.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.348360062 CET1.1.1.1192.168.2.40x56deName error (3)degreeinside.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.359241009 CET1.1.1.1192.168.2.40xd2abName error (3)forwardinside.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.370657921 CET1.1.1.1192.168.2.40x86edName error (3)answerinstead.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.381814957 CET1.1.1.1192.168.2.40x8f12Name error (3)glassinstead.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.393755913 CET1.1.1.1192.168.2.40x588cName error (3)answerexplain.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.404901981 CET1.1.1.1192.168.2.40x727cName error (3)glassexplain.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.416102886 CET1.1.1.1192.168.2.40x9aaeName error (3)answerbright.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.808114052 CET1.1.1.1192.168.2.40x74a2No error (0)glassbright.net7450.bodis.comCNAME (Canonical name)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.808114052 CET1.1.1.1192.168.2.40x74a2No error (0)7450.bodis.com199.59.243.227A (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:32.451536894 CET1.1.1.1192.168.2.40xbd99Name error (3)answerinside.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:32.484488010 CET1.1.1.1192.168.2.40xbe38Name error (3)glassinside.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:32.495065928 CET1.1.1.1192.168.2.40xe81bName error (3)difficultinstead.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:32.535895109 CET1.1.1.1192.168.2.40x2a29Name error (3)heardinstead.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:32.546379089 CET1.1.1.1192.168.2.40x28aaName error (3)difficultexplain.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:32.579175949 CET1.1.1.1192.168.2.40x4d0cName error (3)heardexplain.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:32.589665890 CET1.1.1.1192.168.2.40xc290Name error (3)difficultbright.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:32.622515917 CET1.1.1.1192.168.2.40xd67dName error (3)heardbright.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:32.653708935 CET1.1.1.1192.168.2.40xdeffName error (3)difficultinside.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:32.664206028 CET1.1.1.1192.168.2.40x1490Name error (3)heardinside.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:32.859258890 CET1.1.1.1192.168.2.40xfc65No error (0)pleasantinstead.net18.143.155.63A (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:34.752906084 CET1.1.1.1192.168.2.40x5af2Name error (3)necessaryinstead.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:34.763824940 CET1.1.1.1192.168.2.40xe748Name error (3)pleasantexplain.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:34.775659084 CET1.1.1.1192.168.2.40x9737Name error (3)necessaryexplain.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:34.785609007 CET1.1.1.1192.168.2.40xdfaaName error (3)pleasantbright.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:34.819991112 CET1.1.1.1192.168.2.40xabc7Name error (3)necessarybright.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:34.831909895 CET1.1.1.1192.168.2.40xf5e5Name error (3)pleasantinside.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:34.842245102 CET1.1.1.1192.168.2.40xc2afName error (3)necessaryinside.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:34.852189064 CET1.1.1.1192.168.2.40xeb89Name error (3)orderinstead.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:34.862122059 CET1.1.1.1192.168.2.40x9cdeName error (3)requireinstead.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:34.894512892 CET1.1.1.1192.168.2.40xe005Name error (3)orderexplain.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:34.927958965 CET1.1.1.1192.168.2.40x369fName error (3)requireexplain.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:34.960393906 CET1.1.1.1192.168.2.40x87b4Name error (3)orderbright.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:34.991811991 CET1.1.1.1192.168.2.40x410aName error (3)requirebright.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.005132914 CET1.1.1.1192.168.2.40xeabName error (3)orderinside.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.016954899 CET1.1.1.1192.168.2.40xf201Name error (3)requireinside.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.049014091 CET1.1.1.1192.168.2.40x2536Name error (3)leaderinstead.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.061455965 CET1.1.1.1192.168.2.40x2ec5Name error (3)heaveninstead.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.095782995 CET1.1.1.1192.168.2.40x6f2fName error (3)leaderexplain.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.113306999 CET1.1.1.1192.168.2.40x5c75Name error (3)heavenexplain.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.146603107 CET1.1.1.1192.168.2.40x7d62Name error (3)leaderbright.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.159138918 CET1.1.1.1192.168.2.40xc3dcName error (3)heavenbright.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.170059919 CET1.1.1.1192.168.2.40x99a8Name error (3)leaderinside.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.181094885 CET1.1.1.1192.168.2.40x6ab5Name error (3)heaveninside.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.193017006 CET1.1.1.1192.168.2.40xb6e3Name error (3)heavyinstead.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.204135895 CET1.1.1.1192.168.2.40x3deaName error (3)gentleinstead.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.237279892 CET1.1.1.1192.168.2.40xfb78Name error (3)heavyexplain.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.270993948 CET1.1.1.1192.168.2.40xd62dName error (3)gentleexplain.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.282653093 CET1.1.1.1192.168.2.40x1dbdName error (3)heavybright.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.293380022 CET1.1.1.1192.168.2.40xb435Name error (3)gentlebright.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.304930925 CET1.1.1.1192.168.2.40x7090Name error (3)heavyinside.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.316421032 CET1.1.1.1192.168.2.40x8471Name error (3)gentleinside.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.348077059 CET1.1.1.1192.168.2.40xcf5Name error (3)variousinstead.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.379626036 CET1.1.1.1192.168.2.40x811aName error (3)returninstead.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.389906883 CET1.1.1.1192.168.2.40xdd10Name error (3)variousexplain.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.401525021 CET1.1.1.1192.168.2.40xda0aName error (3)returnexplain.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.414895058 CET1.1.1.1192.168.2.40xf8feName error (3)variousbright.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.426203012 CET1.1.1.1192.168.2.40x1e5dName error (3)returnbright.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:35.457942963 CET1.1.1.1192.168.2.40x86a8Name error (3)variousinside.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:36.091259003 CET1.1.1.1192.168.2.40x7706Name error (3)degreeready.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:36.104262114 CET1.1.1.1192.168.2.40x9fe3Name error (3)forwardready.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:36.136810064 CET1.1.1.1192.168.2.40x9e86Name error (3)degreebrown.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:36.150038958 CET1.1.1.1192.168.2.40xf846Name error (3)forwardbrown.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:36.183873892 CET1.1.1.1192.168.2.40xc31dName error (3)degreepeople.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:36.195394993 CET1.1.1.1192.168.2.40x6ea2Name error (3)forwardpeople.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:36.289940119 CET1.1.1.1192.168.2.40xd1e1No error (0)degreedaughter.net85.214.228.140A (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:37.178915977 CET1.1.1.1192.168.2.40xaff5Name error (3)forwarddaughter.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:37.188942909 CET1.1.1.1192.168.2.40x245cName error (3)answerready.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:37.220582962 CET1.1.1.1192.168.2.40x7cc9Name error (3)glassready.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:37.253858089 CET1.1.1.1192.168.2.40x1381Name error (3)answerbrown.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:37.264949083 CET1.1.1.1192.168.2.40xb81fName error (3)glassbrown.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:37.296228886 CET1.1.1.1192.168.2.40x95feName error (3)answerpeople.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:37.327457905 CET1.1.1.1192.168.2.40x4a6aName error (3)glasspeople.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:37.337937117 CET1.1.1.1192.168.2.40xe7caName error (3)answerdaughter.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:37.348233938 CET1.1.1.1192.168.2.40x3f9bName error (3)glassdaughter.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:37.380656958 CET1.1.1.1192.168.2.40x7bffName error (3)difficultready.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:37.414180040 CET1.1.1.1192.168.2.40x7059Name error (3)heardready.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:37.425971985 CET1.1.1.1192.168.2.40x21b1Name error (3)difficultbrown.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:57:37.437093973 CET1.1.1.1192.168.2.40x52fbName error (3)heardbrown.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:58:45.275635004 CET1.1.1.1192.168.2.40x9b56Name error (3)heavennothing.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:58:46.295077085 CET1.1.1.1192.168.2.40xaedbName error (3)leaderbottle.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:58:47.325715065 CET1.1.1.1192.168.2.40x7c6aName error (3)heavenbottle.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:58:48.339792013 CET1.1.1.1192.168.2.40xe7edName error (3)leaderdivide.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:58:49.359157085 CET1.1.1.1192.168.2.40xf9c0Name error (3)heavendivide.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:58:50.372262955 CET1.1.1.1192.168.2.40xfb3cName error (3)heavystream.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:58:51.387005091 CET1.1.1.1192.168.2.40x21b3Name error (3)gentlestream.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:58:52.418625116 CET1.1.1.1192.168.2.40x1bc2Name error (3)heavynothing.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:58:53.456137896 CET1.1.1.1192.168.2.40xf7f9Name error (3)gentlenothing.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:58:54.483752012 CET1.1.1.1192.168.2.40xedd4Name error (3)heavybottle.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:58:55.643434048 CET1.1.1.1192.168.2.40x846eName error (3)gentlebottle.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:58:56.669537067 CET1.1.1.1192.168.2.40x9680Name error (3)heavydivide.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:58:57.685509920 CET1.1.1.1192.168.2.40x33d4Name error (3)gentledivide.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:59:00.424079895 CET1.1.1.1192.168.2.40xd02aName error (3)returnstream.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:59:01.449789047 CET1.1.1.1192.168.2.40x412eName error (3)variousnothing.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:59:02.465276003 CET1.1.1.1192.168.2.40xaec0Name error (3)returnnothing.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:59:03.483633995 CET1.1.1.1192.168.2.40xee0dName error (3)variousbottle.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:59:06.965877056 CET1.1.1.1192.168.2.40x5172Name error (3)variousdivide.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:59:07.981679916 CET1.1.1.1192.168.2.40xc2ccName error (3)returndivide.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:59:08.996021032 CET1.1.1.1192.168.2.40x979aName error (3)degreemanner.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:59:10.013009071 CET1.1.1.1192.168.2.40x6622Name error (3)forwardmanner.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:59:11.029616117 CET1.1.1.1192.168.2.40xaf55Name error (3)degreeanother.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:59:12.045104980 CET1.1.1.1192.168.2.40x8f7dName error (3)forwardanother.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:59:13.081716061 CET1.1.1.1192.168.2.40x2cb9Name error (3)degreebusiness.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:59:14.126576900 CET1.1.1.1192.168.2.40x6480Name error (3)forwardbusiness.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:59:15.174979925 CET1.1.1.1192.168.2.40x42d8Name error (3)degreeappear.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:59:16.201395988 CET1.1.1.1192.168.2.40x4e46Name error (3)forwardappear.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:59:17.215400934 CET1.1.1.1192.168.2.40x99aName error (3)answermanner.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:59:18.232784033 CET1.1.1.1192.168.2.40x429Name error (3)glassmanner.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:59:19.247200012 CET1.1.1.1192.168.2.40x7b65Name error (3)answeranother.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:59:20.231200933 CET1.1.1.1192.168.2.40x55cbName error (3)glassanother.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:59:21.185820103 CET1.1.1.1192.168.2.40xe7a2Name error (3)answerbusiness.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:59:22.107166052 CET1.1.1.1192.168.2.40x1d09Name error (3)glassbusiness.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:59:22.996701002 CET1.1.1.1192.168.2.40x2f35Name error (3)answerappear.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:59:23.855959892 CET1.1.1.1192.168.2.40x97c2Name error (3)glassappear.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:59:24.681726933 CET1.1.1.1192.168.2.40x3d68Name error (3)difficultmanner.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:59:25.497222900 CET1.1.1.1192.168.2.40xf30fName error (3)heardmanner.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:59:26.427541018 CET1.1.1.1192.168.2.40xafffName error (3)difficultanother.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:59:27.184636116 CET1.1.1.1192.168.2.40xec8dName error (3)heardanother.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:59:28.012492895 CET1.1.1.1192.168.2.40x3807Name error (3)difficultbusiness.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:59:28.044290066 CET1.1.1.1192.168.2.40x458cName error (3)heardbusiness.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            Nov 7, 2024 15:59:28.054019928 CET1.1.1.1192.168.2.40xe3ceName error (3)difficultappear.netnonenoneA (IP address)IN (0x0001)false
                                                                                                                                                                                                            • variousstream.net
                                                                                                                                                                                                            • returnbottle.net
                                                                                                                                                                                                            • gentleanother.net
                                                                                                                                                                                                            • glassbright.net
                                                                                                                                                                                                            • pleasantinstead.net
                                                                                                                                                                                                            • degreedaughter.net
                                                                                                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                            0192.168.2.456255199.59.243.227806980C:\vdjmzgowdzhfmld\skjlipudplp.exe
                                                                                                                                                                                                            TimestampBytes transferredDirectionData
                                                                                                                                                                                                            Nov 7, 2024 15:57:25.858414888 CET84OUTGET /index.php HTTP/1.0
                                                                                                                                                                                                            Accept: */*
                                                                                                                                                                                                            Connection: close
                                                                                                                                                                                                            Host: variousstream.net
                                                                                                                                                                                                            Nov 7, 2024 15:57:26.487468004 CET1236INHTTP/1.1 200 OK
                                                                                                                                                                                                            date: Thu, 07 Nov 2024 14:57:25 GMT
                                                                                                                                                                                                            content-type: text/html; charset=utf-8
                                                                                                                                                                                                            content-length: 1066
                                                                                                                                                                                                            x-request-id: b5fc8853-cb18-488e-a090-89d118c5b184
                                                                                                                                                                                                            cache-control: no-store, max-age=0
                                                                                                                                                                                                            accept-ch: sec-ch-prefers-color-scheme
                                                                                                                                                                                                            critical-ch: sec-ch-prefers-color-scheme
                                                                                                                                                                                                            vary: sec-ch-prefers-color-scheme
                                                                                                                                                                                                            x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_SHWxKaDwoDowf6LK87H7CgandudCZDmQGZDfulHzF3+qa77WR6zSAOp2GnomDKEzaEbdPgFOG1Hw8AghzNNtEQ==
                                                                                                                                                                                                            set-cookie: parking_session=b5fc8853-cb18-488e-a090-89d118c5b184; expires=Thu, 07 Nov 2024 15:12:26 GMT; path=/
                                                                                                                                                                                                            connection: close
                                                                                                                                                                                                            Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 53 48 57 78 4b 61 44 77 6f 44 6f 77 66 36 4c 4b 38 37 48 37 43 67 61 6e 64 75 64 43 5a 44 6d 51 47 5a 44 66 75 6c 48 7a 46 33 2b 71 61 37 37 57 52 36 7a 53 41 4f 70 32 47 6e 6f 6d 44 4b 45 7a 61 45 62 64 50 67 46 4f 47 31 48 77 38 41 67 68 7a 4e 4e 74 45 51 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED]
                                                                                                                                                                                                            Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_SHWxKaDwoDowf6LK87H7CgandudCZDmQGZDfulHzF3+qa77WR6zSAOp2GnomDKEzaEbdPgFOG1Hw8AghzNNtEQ==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
                                                                                                                                                                                                            Nov 7, 2024 15:57:26.487528086 CET519INData Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62
                                                                                                                                                                                                            Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiYjVmYzg4NTMtY2IxOC00ODhlLWEwOTAtODlkMTE4YzViMTg0IiwicGFnZV90aW1lIjoxNzMwOTkxND


                                                                                                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                            1192.168.2.45625618.143.155.63806980C:\vdjmzgowdzhfmld\skjlipudplp.exe
                                                                                                                                                                                                            TimestampBytes transferredDirectionData
                                                                                                                                                                                                            Nov 7, 2024 15:57:26.751705885 CET83OUTGET /index.php HTTP/1.0
                                                                                                                                                                                                            Accept: */*
                                                                                                                                                                                                            Connection: close
                                                                                                                                                                                                            Host: returnbottle.net
                                                                                                                                                                                                            Nov 7, 2024 15:57:28.186042070 CET387INHTTP/1.1 200 OK
                                                                                                                                                                                                            Server: nginx
                                                                                                                                                                                                            Date: Thu, 07 Nov 2024 14:57:27 GMT
                                                                                                                                                                                                            Content-Type: text/html
                                                                                                                                                                                                            Connection: close
                                                                                                                                                                                                            Set-Cookie: btst=d43b3b1824a4e82d85f980359edf3f05|173.254.250.79|1730991447|1730991447|0|1|0; path=/; domain=.returnbottle.net; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                                                                                                                                                                            Set-Cookie: snkz=173.254.250.79; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT


                                                                                                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                            2192.168.2.45625754.244.188.177806980C:\vdjmzgowdzhfmld\skjlipudplp.exe
                                                                                                                                                                                                            TimestampBytes transferredDirectionData
                                                                                                                                                                                                            Nov 7, 2024 15:57:30.077418089 CET84OUTGET /index.php HTTP/1.0
                                                                                                                                                                                                            Accept: */*
                                                                                                                                                                                                            Connection: close
                                                                                                                                                                                                            Host: gentleanother.net
                                                                                                                                                                                                            Nov 7, 2024 15:57:30.916203022 CET388INHTTP/1.1 200 OK
                                                                                                                                                                                                            Server: nginx
                                                                                                                                                                                                            Date: Thu, 07 Nov 2024 14:57:30 GMT
                                                                                                                                                                                                            Content-Type: text/html
                                                                                                                                                                                                            Connection: close
                                                                                                                                                                                                            Set-Cookie: btst=bd48f42502fd23479cbe14187b54b7bd|173.254.250.79|1730991450|1730991450|0|1|0; path=/; domain=.gentleanother.net; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                                                                                                                                                                            Set-Cookie: snkz=173.254.250.79; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT


                                                                                                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                            3192.168.2.456258199.59.243.227806980C:\vdjmzgowdzhfmld\skjlipudplp.exe
                                                                                                                                                                                                            TimestampBytes transferredDirectionData
                                                                                                                                                                                                            Nov 7, 2024 15:57:31.813858986 CET82OUTGET /index.php HTTP/1.0
                                                                                                                                                                                                            Accept: */*
                                                                                                                                                                                                            Connection: close
                                                                                                                                                                                                            Host: glassbright.net
                                                                                                                                                                                                            Nov 7, 2024 15:57:32.439815044 CET1236INHTTP/1.1 200 OK
                                                                                                                                                                                                            date: Thu, 07 Nov 2024 14:57:31 GMT
                                                                                                                                                                                                            content-type: text/html; charset=utf-8
                                                                                                                                                                                                            content-length: 1062
                                                                                                                                                                                                            x-request-id: d5a7ae70-d0ba-46ca-85ad-3dc4a81dadee
                                                                                                                                                                                                            cache-control: no-store, max-age=0
                                                                                                                                                                                                            accept-ch: sec-ch-prefers-color-scheme
                                                                                                                                                                                                            critical-ch: sec-ch-prefers-color-scheme
                                                                                                                                                                                                            vary: sec-ch-prefers-color-scheme
                                                                                                                                                                                                            x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_s1OLzxnUOnEH716kBpk/hwkQW3g8J3psjBCQ57GUAZtZS2F4eueKl4iEoqmB9qt7hkS99NIC/yKfNwi3+MVPyg==
                                                                                                                                                                                                            set-cookie: parking_session=d5a7ae70-d0ba-46ca-85ad-3dc4a81dadee; expires=Thu, 07 Nov 2024 15:12:32 GMT; path=/
                                                                                                                                                                                                            connection: close
                                                                                                                                                                                                            Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 73 31 4f 4c 7a 78 6e 55 4f 6e 45 48 37 31 36 6b 42 70 6b 2f 68 77 6b 51 57 33 67 38 4a 33 70 73 6a 42 43 51 35 37 47 55 41 5a 74 5a 53 32 46 34 65 75 65 4b 6c 34 69 45 6f 71 6d 42 39 71 74 37 68 6b 53 39 39 4e 49 43 2f 79 4b 66 4e 77 69 33 2b 4d 56 50 79 67 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED]
                                                                                                                                                                                                            Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_s1OLzxnUOnEH716kBpk/hwkQW3g8J3psjBCQ57GUAZtZS2F4eueKl4iEoqmB9qt7hkS99NIC/yKfNwi3+MVPyg==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
                                                                                                                                                                                                            Nov 7, 2024 15:57:32.440130949 CET515INData Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62
                                                                                                                                                                                                            Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiZDVhN2FlNzAtZDBiYS00NmNhLTg1YWQtM2RjNGE4MWRhZGVlIiwicGFnZV90aW1lIjoxNzMwOTkxND


                                                                                                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                            4192.168.2.45625918.143.155.63806980C:\vdjmzgowdzhfmld\skjlipudplp.exe
                                                                                                                                                                                                            TimestampBytes transferredDirectionData
                                                                                                                                                                                                            Nov 7, 2024 15:57:32.865911007 CET86OUTGET /index.php HTTP/1.0
                                                                                                                                                                                                            Accept: */*
                                                                                                                                                                                                            Connection: close
                                                                                                                                                                                                            Host: pleasantinstead.net
                                                                                                                                                                                                            Nov 7, 2024 15:57:34.301917076 CET390INHTTP/1.1 200 OK
                                                                                                                                                                                                            Server: nginx
                                                                                                                                                                                                            Date: Thu, 07 Nov 2024 14:57:34 GMT
                                                                                                                                                                                                            Content-Type: text/html
                                                                                                                                                                                                            Connection: close
                                                                                                                                                                                                            Set-Cookie: btst=a5d8ab8f6971c20a8281e4335e72db53|173.254.250.79|1730991454|1730991454|0|1|0; path=/; domain=.pleasantinstead.net; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                                                                                                                                                                            Set-Cookie: snkz=173.254.250.79; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT


                                                                                                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                            5192.168.2.45290685.214.228.140806980C:\vdjmzgowdzhfmld\skjlipudplp.exe
                                                                                                                                                                                                            TimestampBytes transferredDirectionData
                                                                                                                                                                                                            Nov 7, 2024 15:57:36.295778990 CET85OUTGET /index.php HTTP/1.0
                                                                                                                                                                                                            Accept: */*
                                                                                                                                                                                                            Connection: close
                                                                                                                                                                                                            Host: degreedaughter.net
                                                                                                                                                                                                            Nov 7, 2024 15:57:37.167211056 CET176INHTTP/1.0 404 Not Found
                                                                                                                                                                                                            Content-Type: text/plain; charset=utf-8
                                                                                                                                                                                                            X-Content-Type-Options: nosniff
                                                                                                                                                                                                            Date: Thu, 07 Nov 2024 14:57:37 GMT
                                                                                                                                                                                                            Content-Length: 19
                                                                                                                                                                                                            Data Raw: 34 30 34 20 70 61 67 65 20 6e 6f 74 20 66 6f 75 6e 64 0a
                                                                                                                                                                                                            Data Ascii: 404 page not found


                                                                                                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                            6192.168.2.453059199.59.243.227805320C:\vdjmzgowdzhfmld\skjlipudplp.exe
                                                                                                                                                                                                            TimestampBytes transferredDirectionData
                                                                                                                                                                                                            Nov 7, 2024 15:58:58.696934938 CET84OUTGET /index.php HTTP/1.0
                                                                                                                                                                                                            Accept: */*
                                                                                                                                                                                                            Connection: close
                                                                                                                                                                                                            Host: variousstream.net
                                                                                                                                                                                                            Nov 7, 2024 15:58:59.354711056 CET1236INHTTP/1.1 200 OK
                                                                                                                                                                                                            date: Thu, 07 Nov 2024 14:58:59 GMT
                                                                                                                                                                                                            content-type: text/html; charset=utf-8
                                                                                                                                                                                                            content-length: 1066
                                                                                                                                                                                                            x-request-id: fa5bb619-a948-4114-8503-e67a64ec4149
                                                                                                                                                                                                            cache-control: no-store, max-age=0
                                                                                                                                                                                                            accept-ch: sec-ch-prefers-color-scheme
                                                                                                                                                                                                            critical-ch: sec-ch-prefers-color-scheme
                                                                                                                                                                                                            vary: sec-ch-prefers-color-scheme
                                                                                                                                                                                                            x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_SHWxKaDwoDowf6LK87H7CgandudCZDmQGZDfulHzF3+qa77WR6zSAOp2GnomDKEzaEbdPgFOG1Hw8AghzNNtEQ==
                                                                                                                                                                                                            set-cookie: parking_session=fa5bb619-a948-4114-8503-e67a64ec4149; expires=Thu, 07 Nov 2024 15:13:59 GMT; path=/
                                                                                                                                                                                                            connection: close
                                                                                                                                                                                                            Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 53 48 57 78 4b 61 44 77 6f 44 6f 77 66 36 4c 4b 38 37 48 37 43 67 61 6e 64 75 64 43 5a 44 6d 51 47 5a 44 66 75 6c 48 7a 46 33 2b 71 61 37 37 57 52 36 7a 53 41 4f 70 32 47 6e 6f 6d 44 4b 45 7a 61 45 62 64 50 67 46 4f 47 31 48 77 38 41 67 68 7a 4e 4e 74 45 51 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED]
                                                                                                                                                                                                            Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_SHWxKaDwoDowf6LK87H7CgandudCZDmQGZDfulHzF3+qa77WR6zSAOp2GnomDKEzaEbdPgFOG1Hw8AghzNNtEQ==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
                                                                                                                                                                                                            Nov 7, 2024 15:58:59.354749918 CET519INData Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62
                                                                                                                                                                                                            Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiZmE1YmI2MTktYTk0OC00MTE0LTg1MDMtZTY3YTY0ZWM0MTQ5IiwicGFnZV90aW1lIjoxNzMwOTkxNT


                                                                                                                                                                                                            Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                            7192.168.2.45306018.143.155.63805320C:\vdjmzgowdzhfmld\skjlipudplp.exe
                                                                                                                                                                                                            TimestampBytes transferredDirectionData
                                                                                                                                                                                                            Nov 7, 2024 15:59:04.492487907 CET83OUTGET /index.php HTTP/1.0
                                                                                                                                                                                                            Accept: */*
                                                                                                                                                                                                            Connection: close
                                                                                                                                                                                                            Host: returnbottle.net
                                                                                                                                                                                                            Nov 7, 2024 15:59:05.946990013 CET387INHTTP/1.1 200 OK
                                                                                                                                                                                                            Server: nginx
                                                                                                                                                                                                            Date: Thu, 07 Nov 2024 14:59:05 GMT
                                                                                                                                                                                                            Content-Type: text/html
                                                                                                                                                                                                            Connection: close
                                                                                                                                                                                                            Set-Cookie: btst=475f49ca9169f7ed144f5a60e3bacf6a|173.254.250.79|1730991545|1730991545|0|1|0; path=/; domain=.returnbottle.net; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
                                                                                                                                                                                                            Set-Cookie: snkz=173.254.250.79; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT


                                                                                                                                                                                                            Click to jump to process

                                                                                                                                                                                                            Click to jump to process

                                                                                                                                                                                                            Click to dive into process behavior distribution

                                                                                                                                                                                                            Click to jump to process

                                                                                                                                                                                                            Target ID:0
                                                                                                                                                                                                            Start time:09:57:20
                                                                                                                                                                                                            Start date:07/11/2024
                                                                                                                                                                                                            Path:C:\Users\user\Desktop\YiqjcLlhew.exe
                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                            Commandline:"C:\Users\user\Desktop\YiqjcLlhew.exe"
                                                                                                                                                                                                            Imagebase:0xcf0000
                                                                                                                                                                                                            File size:282'112 bytes
                                                                                                                                                                                                            MD5 hash:F51DA33B8F97EC40E1960522549DCCA7
                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                            Reputation:low
                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                            Target ID:1
                                                                                                                                                                                                            Start time:09:57:20
                                                                                                                                                                                                            Start date:07/11/2024
                                                                                                                                                                                                            Path:C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exe
                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                            Commandline:"C:\vdjmzgowdzhfmld\kfdag3aedbkjqfngi9xbw.exe"
                                                                                                                                                                                                            Imagebase:0xda0000
                                                                                                                                                                                                            File size:282'112 bytes
                                                                                                                                                                                                            MD5 hash:F51DA33B8F97EC40E1960522549DCCA7
                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                            Antivirus matches:
                                                                                                                                                                                                            • Detection: 100%, Avira
                                                                                                                                                                                                            • Detection: 100%, Joe Sandbox ML
                                                                                                                                                                                                            • Detection: 92%, ReversingLabs
                                                                                                                                                                                                            Reputation:low
                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                            Target ID:2
                                                                                                                                                                                                            Start time:09:57:20
                                                                                                                                                                                                            Start date:07/11/2024
                                                                                                                                                                                                            Path:C:\vdjmzgowdzhfmld\skjlipudplp.exe
                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                            Commandline:C:\vdjmzgowdzhfmld\skjlipudplp.exe
                                                                                                                                                                                                            Imagebase:0x470000
                                                                                                                                                                                                            File size:282'112 bytes
                                                                                                                                                                                                            MD5 hash:F51DA33B8F97EC40E1960522549DCCA7
                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                            Antivirus matches:
                                                                                                                                                                                                            • Detection: 100%, Avira
                                                                                                                                                                                                            • Detection: 100%, Joe Sandbox ML
                                                                                                                                                                                                            • Detection: 92%, ReversingLabs
                                                                                                                                                                                                            Reputation:low
                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                            Target ID:3
                                                                                                                                                                                                            Start time:09:57:22
                                                                                                                                                                                                            Start date:07/11/2024
                                                                                                                                                                                                            Path:C:\vdjmzgowdzhfmld\xmjofjnkdlv.exe
                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                            Commandline:owwisyfkhljp "c:\vdjmzgowdzhfmld\skjlipudplp.exe"
                                                                                                                                                                                                            Imagebase:0x50000
                                                                                                                                                                                                            File size:282'112 bytes
                                                                                                                                                                                                            MD5 hash:F51DA33B8F97EC40E1960522549DCCA7
                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                            Antivirus matches:
                                                                                                                                                                                                            • Detection: 100%, Avira
                                                                                                                                                                                                            • Detection: 100%, Joe Sandbox ML
                                                                                                                                                                                                            • Detection: 92%, ReversingLabs
                                                                                                                                                                                                            Reputation:low
                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                            Target ID:4
                                                                                                                                                                                                            Start time:09:57:23
                                                                                                                                                                                                            Start date:07/11/2024
                                                                                                                                                                                                            Path:C:\vdjmzgowdzhfmld\skjlipudplp.exe
                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                            Commandline:"C:\vdjmzgowdzhfmld\skjlipudplp.exe"
                                                                                                                                                                                                            Imagebase:0x470000
                                                                                                                                                                                                            File size:282'112 bytes
                                                                                                                                                                                                            MD5 hash:F51DA33B8F97EC40E1960522549DCCA7
                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                            Reputation:low
                                                                                                                                                                                                            Has exited:true

                                                                                                                                                                                                            Target ID:9
                                                                                                                                                                                                            Start time:09:58:39
                                                                                                                                                                                                            Start date:07/11/2024
                                                                                                                                                                                                            Path:C:\vdjmzgowdzhfmld\skjlipudplp.exe
                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                            Commandline:"c:\vdjmzgowdzhfmld\skjlipudplp.exe"
                                                                                                                                                                                                            Imagebase:0x470000
                                                                                                                                                                                                            File size:282'112 bytes
                                                                                                                                                                                                            MD5 hash:F51DA33B8F97EC40E1960522549DCCA7
                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                            Reputation:low
                                                                                                                                                                                                            Has exited:false

                                                                                                                                                                                                            Target ID:10
                                                                                                                                                                                                            Start time:09:58:40
                                                                                                                                                                                                            Start date:07/11/2024
                                                                                                                                                                                                            Path:C:\vdjmzgowdzhfmld\xmjofjnkdlv.exe
                                                                                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                                                                                            Commandline:owwisyfkhljp "c:\vdjmzgowdzhfmld\skjlipudplp.exe"
                                                                                                                                                                                                            Imagebase:0x4b0000
                                                                                                                                                                                                            File size:282'112 bytes
                                                                                                                                                                                                            MD5 hash:F51DA33B8F97EC40E1960522549DCCA7
                                                                                                                                                                                                            Has elevated privileges:true
                                                                                                                                                                                                            Has administrator privileges:true
                                                                                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                                                                                            Reputation:low
                                                                                                                                                                                                            Has exited:false

                                                                                                                                                                                                            Reset < >

                                                                                                                                                                                                              Execution Graph

                                                                                                                                                                                                              Execution Coverage:7%
                                                                                                                                                                                                              Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                              Signature Coverage:43.7%
                                                                                                                                                                                                              Total number of Nodes:1525
                                                                                                                                                                                                              Total number of Limit Nodes:24
                                                                                                                                                                                                              execution_graph 9967 cfd446 9970 cfd450 9967->9970 9968 cfdd9a 9969 cfa430 2 API calls 9968->9969 9973 cfddda 9969->9973 9971 d11a50 8 API calls 9970->9971 9972 cfc2d0 9 API calls 9970->9972 9975 cfd87c 9970->9975 9971->9970 9972->9970 9974 d11a50 8 API calls 9974->9975 9975->9968 9975->9974 9976 cfc2d0 9 API calls 9975->9976 9977 cfdc6c 9975->9977 9976->9975 9977->9968 9978 d11a50 8 API calls 9977->9978 9979 cfc2d0 9 API calls 9977->9979 9978->9977 9979->9977 9755 cf40c0 9756 cf40dc 9755->9756 9759 cf6850 9756->9759 9760 cf6887 9759->9760 9761 cf6a3f 9760->9761 9763 cf68a1 9760->9763 9778 d15710 9761->9778 9764 cf68e9 9763->9764 9765 cf6982 9763->9765 9769 d00420 9764->9769 9767 d00420 4 API calls 9765->9767 9768 cf41df 9767->9768 9771 d00464 9769->9771 9770 d0046b 9770->9768 9771->9770 9772 d00502 9771->9772 9786 cf4260 9771->9786 9774 cf4260 4 API calls 9772->9774 9775 d00566 9772->9775 9774->9775 9791 cfe980 9775->9791 9779 d15753 9778->9779 9780 d1582b 9779->9780 9781 cf4260 4 API calls 9779->9781 9782 d173c0 4 API calls 9780->9782 9783 d15aa8 9780->9783 9781->9780 9784 d1587c 9782->9784 9783->9768 9784->9783 9785 d173c0 4 API calls 9784->9785 9785->9784 9787 cf42b2 9786->9787 9788 cf42b8 9786->9788 9787->9772 9795 d173c0 9788->9795 9790 cf435d 9790->9772 9792 cfe9b9 9791->9792 9794 cfec11 9792->9794 9802 d259b0 GetProcessHeap RtlFreeHeap 9792->9802 9794->9768 9796 d173ef 9795->9796 9797 d156a0 2 API calls 9796->9797 9798 d17467 9796->9798 9799 d1745e 9797->9799 9798->9790 9799->9798 9801 d259b0 GetProcessHeap RtlFreeHeap 9799->9801 9801->9798 9802->9792 10720 cf1140 10721 cf1162 10720->10721 10725 cf1169 SetServiceStatus 10720->10725 10722 cf1219 SetServiceStatus SetEvent 10721->10722 10723 cf1180 10721->10723 10721->10725 10723->10722 10726 cf1356 10725->10726 10128 d255c3 10130 d255d0 10128->10130 10129 d257da 10131 d25809 10129->10131 10132 d257fd 10129->10132 10130->10129 10134 cfe980 2 API calls 10130->10134 10133 cfe980 2 API calls 10131->10133 10135 cfe980 2 API calls 10132->10135 10136 d25804 10133->10136 10134->10130 10135->10136 9984 d0d243 9985 d0d250 9984->9985 9987 d0d2eb 9985->9987 9988 d12260 lstrlen 9985->9988 9988->9987 9807 cf6ad0 9810 d1ffd0 9807->9810 9813 d26470 9810->9813 9812 cf6adf 9814 d2647e 9813->9814 9817 d12260 lstrlen 9814->9817 9816 d26489 9816->9812 9817->9816 10137 cfc9ef 10138 cfca00 10137->10138 10139 cfcb28 CreatePipe 10138->10139 10140 cfcba9 SetHandleInformation 10139->10140 10147 cfcb94 10139->10147 10141 cfcc1e CreatePipe 10140->10141 10142 cfcbf9 10140->10142 10143 cfcc4d SetHandleInformation 10141->10143 10144 cfcc36 10141->10144 10142->10141 10151 cfccca 10143->10151 10146 cfce9c CloseHandle 10144->10146 10145 d12070 8 API calls 10150 cfcf1f 10145->10150 10146->10147 10148 cfceb4 CloseHandle 10146->10148 10147->10145 10147->10150 10148->10147 10152 cfcdf2 CreateProcessA 10151->10152 10153 cfcf4e WriteFile 10152->10153 10154 cfce32 CloseHandle 10152->10154 10158 cfcfbb CloseHandle CloseHandle 10153->10158 10159 cfcfaa 10153->10159 10156 cfce6c CloseHandle 10154->10156 10157 cfce62 10154->10157 10156->10146 10157->10156 10160 cfd01e 10158->10160 10159->10158 10163 d146f0 10160->10163 10164 d146fd 10163->10164 10165 d12070 8 API calls 10164->10165 10166 d14759 ReadFile 10165->10166 10168 cfd063 WaitForSingleObject CloseHandle CloseHandle 10166->10168 10169 d147a4 10166->10169 10169->10168 10170 d060d0 8 API calls 10169->10170 10171 d147e4 ReadFile 10170->10171 10171->10168 10171->10169 9818 cf24ec 9819 d18570 WaitForSingleObject 9818->9819 9820 cf24f5 9819->9820 9821 cfc9b0 ExitProcess 9820->9821 9822 cf2509 9821->9822 9823 d158f8 9824 d15900 9823->9824 9824->9824 9825 d15aa8 9824->9825 9826 d173c0 4 API calls 9824->9826 9826->9824 9827 cfbce1 9828 cfbd0b 9827->9828 9829 d13790 4 API calls 9828->9829 9830 cfbdb3 9828->9830 9829->9830 9841 cf2ae0 9842 cf2b16 9841->9842 9843 d24650 3 API calls 9842->9843 9844 cf2c4a 9843->9844 9845 cf3740 10 API calls 9844->9845 9846 cf2c7a 9845->9846 9847 d15d80 lstrlen 9846->9847 9848 cf2ca0 9847->9848 9849 d231e0 2 API calls 9848->9849 9850 cf2cbe 9849->9850 9851 cfa430 2 API calls 9850->9851 9863 cf2d41 9851->9863 9852 cf7a90 GetSystemTimeAsFileTime 9852->9863 9853 d12ba0 12 API calls 9853->9863 9854 d12070 8 API calls 9855 cf35ad Sleep 9854->9855 9888 cf1d60 9855->9888 9857 d10250 5 API calls 9857->9863 9859 d05eb0 3 API calls 9859->9863 9860 d06c30 21 API calls 9860->9863 9861 d231e0 GetProcessHeap RtlAllocateHeap 9861->9863 9862 d17870 9 API calls 9862->9863 9863->9852 9863->9853 9863->9854 9863->9857 9863->9859 9863->9860 9863->9861 9863->9862 9864 cfc3e0 8 API calls 9863->9864 9865 cf7a50 8 API calls 9863->9865 9867 cfa430 GetProcessHeap RtlFreeHeap 9863->9867 9868 d22170 50 API calls 9863->9868 9869 cf1700 31 API calls 9863->9869 9870 d18830 9863->9870 9882 cf6e40 9863->9882 9864->9863 9865->9863 9867->9863 9868->9863 9869->9863 9871 d18853 9870->9871 9872 d231e0 2 API calls 9871->9872 9873 d188eb 9872->9873 9874 d231e0 2 API calls 9873->9874 9875 d1890e 9874->9875 9897 cf45c0 9875->9897 9878 cfa430 2 API calls 9879 d18983 9878->9879 9880 cfa430 2 API calls 9879->9880 9881 d189b5 9880->9881 9881->9863 9884 cf6e5a 9882->9884 9883 cf7011 9883->9863 9884->9883 9885 d060d0 8 API calls 9884->9885 9886 cf6fbb 9885->9886 9887 d06c10 2 API calls 9886->9887 9887->9883 9893 cf1d8c 9888->9893 9889 cf1f9f 9889->9863 9890 cf1f8d 9913 cff220 9890->9913 9891 cf1e8f DeleteFileA 9891->9893 9893->9889 9893->9891 9896 cf1ee9 9893->9896 9903 cff3c0 9893->9903 9896->9890 9909 d061f0 9896->9909 9898 cf45e5 9897->9898 9899 d231e0 2 API calls 9898->9899 9900 cf4a9d 9899->9900 9901 cfa430 2 API calls 9900->9901 9902 cf4ac4 9901->9902 9902->9878 9904 cff3d2 9903->9904 9917 cfbed0 9904->9917 9906 cff3e9 9921 cf4230 9906->9921 9910 d06216 9909->9910 9911 d0625c 9910->9911 9936 d17970 9910->9936 9911->9896 9914 cff228 9913->9914 9915 d176e0 2 API calls 9914->9915 9916 d1737e 9915->9916 9918 cfbf12 9917->9918 9919 d0f910 8 API calls 9918->9919 9920 cfbf1a 9919->9920 9920->9906 9922 cf423e 9921->9922 9923 cf4250 9922->9923 9925 d25b90 9922->9925 9923->9893 9928 d16a90 9925->9928 9927 d25b9f 9927->9923 9929 d16aa1 9928->9929 9932 cffe60 9929->9932 9931 d16ab7 9931->9927 9933 cffe6b 9932->9933 9934 cfdf30 8 API calls 9933->9934 9935 cffeee 9934->9935 9935->9931 9939 d15e80 9936->9939 9940 d15ed2 9939->9940 9943 d17730 9940->9943 9942 d16026 9942->9911 9944 d17750 9943->9944 9945 d0f910 8 API calls 9944->9945 9946 d1778e 9945->9946 9946->9942 10731 cfbb60 10732 cfbb88 10731->10732 10741 d12260 lstrlen 10732->10741 10734 cfbbc1 10735 d0f910 8 API calls 10734->10735 10736 cfbbd7 10735->10736 10737 cfc2d0 9 API calls 10736->10737 10738 cfbbe9 10737->10738 10739 cf1380 8 API calls 10738->10739 10740 cfbbfe 10739->10740 10741->10734 10742 d11760 10743 d1176b 10742->10743 10744 d11777 10743->10744 10745 d008b0 2 API calls 10743->10745 10745->10744 9997 d12868 10000 d12870 9997->10000 9998 d128b2 ReadFile 9998->10000 9999 d0f910 8 API calls 9999->10000 10000->9998 10000->9999 10001 d12a7e CloseHandle 10000->10001 10002 d060d0 8 API calls 10000->10002 10005 d129c1 CloseHandle 10000->10005 10003 d12abb 10001->10003 10002->10000 10004 d12290 ReleaseMutex 10003->10004 10007 d12ac6 10004->10007 10006 d12290 ReleaseMutex 10005->10006 10008 d129f1 10006->10008 9752 cf9770 9753 d156a0 2 API calls 9752->9753 9754 cf978e 9753->9754 10009 d17610 10014 cfe490 10009->10014 10023 d0fbe0 10014->10023 10024 cfe370 8 API calls 10023->10024 10025 d0fc0c 10024->10025 10180 d10190 10181 d101b3 10180->10181 10182 cf1530 8 API calls 10181->10182 10183 d101e5 10182->10183 10186 cf1380 10183->10186 10187 cf138e 10186->10187 10188 d060d0 8 API calls 10187->10188 10189 cf139c 10188->10189 10749 d15510 10750 d15546 10749->10750 10751 cfb890 2 API calls 10750->10751 10752 d1554b 10751->10752 10753 d16be0 3 API calls 10752->10753 10754 d15560 10753->10754 10755 d15605 ExitProcess 10754->10755 10756 d20110 10757 d245e0 12 API calls 10756->10757 10758 d2012d 10757->10758 10759 d060d0 8 API calls 10758->10759 10760 d201b2 10759->10760 10761 d22d10 10762 d22d24 10761->10762 10764 d22d46 10761->10764 10763 d22d70 10764->10763 10765 d22e65 ReadFile 10764->10765 10766 d22ea3 10765->10766 10767 d24510 10768 cfb670 2 API calls 10767->10768 10769 d2451b 10768->10769 10770 d24527 10769->10770 10771 d008b0 2 API calls 10769->10771 10771->10770 10772 cf5b09 10773 cf5b10 10772->10773 10774 d202f0 4 API calls 10773->10774 10775 cf5bc3 10773->10775 10774->10773 10783 cf7307 10784 cf7310 10783->10784 10785 cf73ea WriteFile 10784->10785 10786 cf748e CloseHandle 10784->10786 10785->10784 10788 d12290 ReleaseMutex 10786->10788 10789 cf7551 10788->10789 9947 cf2480 9948 cf2498 9947->9948 9951 d12510 9948->9951 9950 cf24c0 9953 d1252f 9951->9953 9952 d17730 8 API calls 9954 d12607 9952->9954 9953->9952 9954->9950 9955 cfee80 9956 cfee8b 9955->9956 9957 cfee97 9956->9957 9958 d008b0 2 API calls 9956->9958 9958->9957 10030 cf6000 10031 cf6085 RegisterServiceCtrlHandlerA 10030->10031 10033 cf613b SetServiceStatus CreateEventA SetServiceStatus 10031->10033 10034 cf6410 10031->10034 10035 cf6220 WaitForSingleObject 10033->10035 10037 cf6279 10035->10037 10038 d18570 WaitForSingleObject 10037->10038 10039 cf62b9 SetServiceStatus CloseHandle 10038->10039 10041 cf637c 10039->10041 10042 cf6388 SetServiceStatus 10039->10042 10041->10042 10042->10034 10790 cf4f00 10791 cf4f0b 10790->10791 10792 cf7c20 8 API calls 10791->10792 10793 cf4f38 10792->10793 10194 d00780 10195 d007a0 10194->10195 10200 d12260 lstrlen 10195->10200 10197 d007d1 10201 d17fc0 10197->10201 10200->10197 10204 cf1560 10201->10204 10203 d007e7 10205 cf158d 10204->10205 10206 cf160d 10205->10206 10207 cf161a 10205->10207 10208 d17730 8 API calls 10206->10208 10209 d006b0 8 API calls 10207->10209 10210 cf1618 10207->10210 10208->10210 10209->10210 10210->10203 10043 d20e07 10045 d20e10 10043->10045 10055 d20eaa 10045->10055 10060 cfe4f0 10045->10060 10046 d217b9 10047 cf4260 4 API calls 10046->10047 10051 d2183c 10046->10051 10047->10051 10048 cfeeb0 GetProcessHeap RtlAllocateHeap GetProcessHeap RtlFreeHeap 10048->10055 10049 cfe980 2 API calls 10050 d21a37 10049->10050 10052 cf4260 4 API calls 10051->10052 10054 d21949 10051->10054 10052->10054 10053 cf66a0 GetProcessHeap RtlAllocateHeap GetProcessHeap RtlFreeHeap 10053->10055 10054->10049 10055->10046 10055->10048 10055->10053 10055->10054 10056 d05a60 GetProcessHeap RtlAllocateHeap GetProcessHeap RtlFreeHeap 10055->10056 10057 cfe4f0 4 API calls 10055->10057 10058 cf4260 4 API calls 10055->10058 10059 cf6850 4 API calls 10055->10059 10056->10055 10057->10055 10058->10055 10059->10055 10061 cfe67f 10060->10061 10064 cfe542 10060->10064 10062 d15710 4 API calls 10061->10062 10063 cfe591 10062->10063 10063->10045 10065 cfe57c 10064->10065 10066 cfe5e5 10064->10066 10067 d00420 4 API calls 10065->10067 10068 d00420 4 API calls 10066->10068 10067->10063 10068->10063 10069 d0e206 10070 d0e23c 10069->10070 10071 d0e3a7 10070->10071 10072 d0e35f 10070->10072 10073 d0e3b0 10071->10073 10074 d0e4f3 10071->10074 10075 d10cf0 wvsprintfA 10072->10075 10076 d0e441 10073->10076 10079 d0e3dd 10073->10079 10077 d0e593 10074->10077 10078 d0e50e 10074->10078 10084 d0e389 10075->10084 10080 d10cf0 wvsprintfA 10076->10080 10081 d10cf0 wvsprintfA 10077->10081 10083 d10cf0 wvsprintfA 10078->10083 10078->10084 10082 d10cf0 wvsprintfA 10079->10082 10079->10084 10080->10084 10081->10084 10082->10084 10083->10084 10798 cf1f19 10800 cf1f20 10798->10800 10799 d061f0 8 API calls 10799->10800 10800->10799 10801 cf1f8d 10800->10801 10802 cff220 2 API calls 10801->10802 10803 cf1f9f 10802->10803 10211 d0b387 10212 d0b3cc 10211->10212 10214 d1d0eb 132 API calls 10212->10214 10213 d0bf02 10214->10213 10804 cfdb18 10806 cfdb20 10804->10806 10805 d11a50 8 API calls 10805->10806 10806->10805 10807 cfc2d0 9 API calls 10806->10807 10810 cfdc6c 10806->10810 10807->10806 10808 cfdd9a 10809 cfa430 2 API calls 10808->10809 10813 cfddda 10809->10813 10810->10808 10811 d11a50 8 API calls 10810->10811 10812 cfc2d0 9 API calls 10810->10812 10811->10810 10812->10810 10814 d21d0a 10815 d21d4b GetProcessHeap HeapAlloc 10814->10815 10816 d21d3b 10814->10816 10816->10815 8828 d0bf0e 8829 d0bece 8828->8829 8830 d0befc 8828->8830 8834 d1d0eb 8829->8834 8831 d0bf02 8830->8831 8833 d1d0eb 132 API calls 8830->8833 8833->8831 8835 d1d0f0 8834->8835 9044 d231e0 8835->9044 8837 d1d130 9048 cfa430 8837->9048 8840 d231e0 2 API calls 8841 d1d1ff 8840->8841 8842 cfa430 2 API calls 8841->8842 8843 d1d225 8842->8843 8844 d231e0 2 API calls 8843->8844 8845 d1d2d7 8844->8845 8846 cfa430 2 API calls 8845->8846 8847 d1d2f8 8846->8847 8848 d231e0 2 API calls 8847->8848 8849 d1d3b3 8848->8849 8850 cfa430 2 API calls 8849->8850 8851 d1d3d5 8850->8851 8852 d231e0 2 API calls 8851->8852 8853 d1d425 8852->8853 8854 cfa430 2 API calls 8853->8854 8855 d1d46b 8854->8855 8856 d231e0 2 API calls 8855->8856 8857 d1d4d9 8856->8857 8858 cfa430 2 API calls 8857->8858 8859 d1d4ed 8858->8859 8860 d231e0 2 API calls 8859->8860 8861 d1d541 8860->8861 8862 cfa430 2 API calls 8861->8862 8863 d1d555 8862->8863 8864 cfa430 2 API calls 8863->8864 8865 d1d58b 8864->8865 9052 d259b0 GetProcessHeap RtlFreeHeap 8865->9052 8867 d1d5f4 9053 d24650 8867->9053 8869 d1d603 8870 d231e0 2 API calls 8869->8870 8871 d1d628 GetEnvironmentVariableA 8870->8871 8872 d1d67c 8871->8872 8873 cfa430 2 API calls 8872->8873 8874 d1d6c4 CreateMutexA CreateMutexA CreateMutexA 8873->8874 8876 d1d7c6 8874->8876 8877 d1d954 8876->8877 8878 d1d81b GetTickCount 8876->8878 9061 cf7fa0 8877->9061 8879 d1d83a 8878->8879 8881 d231e0 2 API calls 8879->8881 8884 d1d86a 8881->8884 8882 d1d9c1 GetCommandLineA 8883 d1da10 8882->8883 8885 d231e0 2 API calls 8883->8885 8886 cfa430 2 API calls 8884->8886 8888 d1da7b 8885->8888 8887 d1d8ff 8886->8887 8887->8877 8889 cfa430 2 API calls 8888->8889 8890 d1dad8 8889->8890 8891 d1e64f GetCommandLineA 8890->8891 8892 d231e0 2 API calls 8890->8892 9164 cf3e80 8891->9164 8894 d1db4c 8892->8894 8895 cfa430 2 API calls 8894->8895 8897 d1db98 8895->8897 8896 d1e66d 9167 d12260 lstrlen 8896->9167 8900 d1dbfa 8897->8900 8902 cfc9b0 ExitProcess 8897->8902 8899 d1e6d4 GetModuleFileNameA 9168 d18a10 8899->9168 8903 d231e0 2 API calls 8900->8903 8902->8900 8906 d1dc36 8903->8906 8904 d1e750 8905 d18a10 lstrlen 8904->8905 8907 d1e7cf 8905->8907 8908 cfa430 2 API calls 8906->8908 8910 d18a10 lstrlen 8907->8910 8909 d1dccc 8908->8909 8911 d1dcfb 8909->8911 8912 cfc9b0 ExitProcess 8909->8912 8929 d1e842 8910->8929 9196 d15d80 8911->9196 8912->8911 8914 d1eaf4 8928 d1ead8 8914->8928 8915 d1dd2a 8916 d231e0 2 API calls 8915->8916 8917 d1dd40 8916->8917 8921 cfa430 2 API calls 8917->8921 8919 d1eb30 8920 d1eb58 8919->8920 8922 cfc9b0 ExitProcess 8919->8922 9248 d00950 8920->9248 8924 d1dd73 8921->8924 8922->8920 8946 d1ddd4 8924->8946 8928->8914 9239 d05770 8928->9239 8929->8914 8929->8928 9172 d11c40 8929->9172 8933 d1e8ff 9178 cf3740 8933->9178 8937 d1eaad 8941 cfc9b0 ExitProcess 8937->8941 8938 d1de8c Sleep 8940 d14990 5 API calls 8938->8940 8940->8946 8941->8928 8942 d1e92b 8942->8937 8943 d231e0 2 API calls 8942->8943 8944 d1e9cf 8943->8944 9192 d12260 lstrlen 8944->9192 8945 d1e014 Sleep 8945->8946 8946->8938 8946->8945 8958 d1e07c 8946->8958 9202 d10250 8946->9202 9213 d14990 CreateFileA 8946->9213 9220 cf7a90 GetSystemTimeAsFileTime 8946->9220 8950 d1ea28 MessageBoxA 8955 cfa430 2 API calls 8950->8955 8952 d10250 5 API calls 8952->8958 8957 d1ea8b 8955->8957 9193 cfc9b0 8957->9193 8958->8952 8959 d1e16f 8958->8959 9222 cf1fe0 CreateToolhelp32Snapshot 8958->9222 8966 d14990 5 API calls 8959->8966 8969 d1e1c9 8966->8969 8968 d1e12b Sleep 8968->8958 8968->8959 8974 d1e5bd 8969->8974 8980 d1e25e GetModuleFileNameA 8969->8980 9234 d05eb0 8974->9234 8985 d1e294 8980->8985 8986 d1e2b8 SetFileAttributesA 8980->8986 8985->8986 8991 d1e2d5 8986->8991 8992 d1e304 CopyFileA 8986->8992 8991->8992 9001 d231e0 2 API calls 8992->9001 8998 d1e627 8999 cfc9b0 ExitProcess 8998->8999 8999->8891 9006 d1e353 9001->9006 9008 cfa430 2 API calls 9006->9008 9009 d1e3a9 9008->9009 9011 d1e4a2 9009->9011 9015 d231e0 2 API calls 9009->9015 9013 d1e574 SetFileAttributesA 9011->9013 9014 d1e53c SetFileAttributesA 9011->9014 9013->8974 9014->8974 9019 d1e410 9015->9019 9021 cfa430 2 API calls 9019->9021 9021->9011 9045 d2320c 9044->9045 9429 d156a0 9045->9429 9047 d232e3 9047->8837 9049 cfa450 9048->9049 9432 d259b0 GetProcessHeap RtlFreeHeap 9049->9432 9051 cfa48a 9051->8840 9052->8867 9054 d2468a 9053->9054 9055 d24705 9054->9055 9056 d24729 GetSystemTime 9054->9056 9055->9056 9057 d2476a 9056->9057 9058 cf7a90 GetSystemTimeAsFileTime 9057->9058 9059 d24831 GetTickCount 9058->9059 9060 d2486a 9059->9060 9060->8869 9062 cf7fbe 9061->9062 9063 cf8072 GetVersionExA 9062->9063 9433 d11510 9063->9433 9068 cf824c 9069 d231e0 2 API calls 9068->9069 9071 cf830a 9069->9071 9454 d17870 9071->9454 9072 cf8114 9075 cf81ba CreateDirectoryA 9072->9075 9077 d231e0 2 API calls 9075->9077 9076 cfa430 2 API calls 9079 cf838c 9076->9079 9078 cf820d 9077->9078 9080 cfa430 2 API calls 9078->9080 9458 cf70d0 9079->9458 9080->9068 9082 cf83cb 9083 cf8443 9082->9083 9084 cf83d2 DeleteFileA RemoveDirectoryA 9082->9084 9085 cff420 6 API calls 9083->9085 9084->9083 9086 cf8459 9085->9086 9087 cf849f CreateDirectoryA 9086->9087 9088 cf84fe 9087->9088 9089 d15d80 lstrlen 9088->9089 9090 cf859b CreateDirectoryA 9089->9090 9092 cf85ff 9090->9092 9093 d231e0 2 API calls 9092->9093 9094 cf865d 9093->9094 9095 d231e0 2 API calls 9094->9095 9096 cf8712 9095->9096 9097 cfa430 2 API calls 9096->9097 9098 cf8726 9097->9098 9099 d17870 9 API calls 9098->9099 9100 cf8742 9099->9100 9101 cfa430 2 API calls 9100->9101 9102 cf875e 9101->9102 9103 cf70d0 5 API calls 9102->9103 9104 cf878b 9103->9104 9105 cf90cb 9104->9105 9106 cf883d 9104->9106 9107 cf87ad 9104->9107 9108 d15d80 lstrlen 9105->9108 9109 d231e0 2 API calls 9106->9109 9110 d231e0 2 API calls 9107->9110 9111 cf90e1 SetFileAttributesA 9108->9111 9112 cf8861 9109->9112 9113 cf87c3 9110->9113 9118 cf912f 9111->9118 9114 d10cf0 wvsprintfA 9112->9114 9115 d10cf0 wvsprintfA 9113->9115 9116 cf887f 9114->9116 9117 cf87fb 9115->9117 9119 cfa430 2 API calls 9116->9119 9120 cfa430 2 API calls 9117->9120 9118->8882 9121 cf882c 9119->9121 9120->9121 9122 cf88fb 9121->9122 9123 cf894c CreateDirectoryA 9122->9123 9124 cf898b 9123->9124 9125 d15d80 lstrlen 9124->9125 9126 cf89ca CreateDirectoryA 9125->9126 9128 cf8a46 9126->9128 9129 d231e0 2 API calls 9128->9129 9130 cf8a70 9129->9130 9131 d231e0 2 API calls 9130->9131 9132 cf8ae6 9131->9132 9133 cfa430 2 API calls 9132->9133 9134 cf8b6e 9133->9134 9135 d17870 9 API calls 9134->9135 9136 cf8ba5 9135->9136 9137 cfa430 2 API calls 9136->9137 9138 cf8bb9 9137->9138 9139 cf70d0 5 API calls 9138->9139 9140 cf8bef 9139->9140 9141 cf8c22 GetTempPathA 9140->9141 9163 cf9012 9140->9163 9476 d12260 lstrlen 9141->9476 9143 cf8c52 9144 d15d80 lstrlen 9143->9144 9145 cf8dd8 CreateDirectoryA 9144->9145 9146 d231e0 2 API calls 9145->9146 9147 cf8e12 9146->9147 9148 d231e0 2 API calls 9147->9148 9149 cf8e5b 9148->9149 9150 cfa430 2 API calls 9149->9150 9151 cf8e91 9150->9151 9152 d17870 9 API calls 9151->9152 9153 cf8eb1 9152->9153 9154 cfa430 2 API calls 9153->9154 9155 cf8ed0 9154->9155 9156 cf70d0 5 API calls 9155->9156 9157 cf8f1d 9156->9157 9158 cf8f28 GetTempPathA 9157->9158 9157->9163 9159 cf8f68 9158->9159 9160 d231e0 2 API calls 9159->9160 9161 cf8fdd 9160->9161 9162 cfa430 2 API calls 9161->9162 9162->9163 9163->9105 9515 d12260 lstrlen 9164->9515 9166 cf3ebd 9166->8896 9167->8899 9169 d18a40 lstrlen 9168->9169 9171 d18aa4 9169->9171 9171->8904 9173 d11c9b 9172->9173 9516 cfb1d0 9173->9516 9176 d05eb0 3 API calls 9177 d11d10 9176->9177 9177->8933 9179 cf3778 9178->9179 9188 cf3b0c 9178->9188 9558 d12260 lstrlen 9179->9558 9181 cf385d Sleep 9183 cf3911 9181->9183 9184 d231e0 2 API calls 9183->9184 9185 cf393c 9184->9185 9186 cfa430 2 API calls 9185->9186 9187 cf397e FindFirstFileA 9186->9187 9187->9188 9190 cf39c2 9187->9190 9188->8942 9189 cf3ab2 DeleteFileA FindNextFileA 9189->9190 9191 cf3adf FindClose 9189->9191 9190->9189 9191->9188 9192->8950 9559 cfa640 9193->9559 9195 cfc9ca ExitProcess 9197 d15dc3 9196->9197 9198 cf75a0 lstrlen 9197->9198 9199 d15de1 9198->9199 9200 d15e4a 9199->9200 9561 d12260 lstrlen 9199->9561 9200->8915 9203 d1029f CreateToolhelp32Snapshot 9202->9203 9205 d10392 Process32First 9203->9205 9208 d105c8 9203->9208 9207 d105a0 CloseHandle 9205->9207 9210 d10405 9205->9210 9207->9208 9208->8946 9209 d18a10 lstrlen 9209->9210 9210->9209 9211 d1048c Process32Next 9210->9211 9212 d104f1 9210->9212 9211->9210 9211->9212 9212->9207 9214 d14a25 9213->9214 9215 d14a37 GetFileTime 9213->9215 9214->8946 9216 d14a83 __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z 9215->9216 9217 d14a58 CloseHandle 9215->9217 9218 d14aca GetFileSize CloseHandle 9216->9218 9217->8946 9219 d14b6e 9218->9219 9219->8946 9221 cf7b0d __aulldiv 9220->9221 9221->8946 9223 cf2079 9222->9223 9224 cf2443 9223->9224 9225 cf2151 Process32First 9223->9225 9224->8968 9226 cf23de CloseHandle 9225->9226 9231 cf217b 9225->9231 9226->9224 9228 d18a10 lstrlen 9228->9231 9229 cf236a Process32Next 9229->9226 9229->9231 9230 cf223a OpenProcess 9230->9231 9231->9228 9231->9229 9231->9230 9232 cf22d6 TerminateProcess 9231->9232 9233 cf233e CloseHandle 9231->9233 9232->9231 9233->9231 9235 d05f1a 9234->9235 9236 d05f9b CreateProcessA 9235->9236 9237 d06090 9236->9237 9238 d06035 CloseHandle CloseHandle 9236->9238 9237->8998 9238->8998 9240 d0578d 9239->9240 9241 d15d80 lstrlen 9240->9241 9242 d05893 9241->9242 9243 d231e0 2 API calls 9242->9243 9244 d058c3 9243->9244 9245 cfa430 2 API calls 9244->9245 9246 d058ff CreateFileA 9245->9246 9247 d05951 9246->9247 9247->8919 9249 d0097c 9248->9249 9250 d00af9 GetComputerNameA 9249->9250 9251 d00b4b 9250->9251 9252 d00bf1 9250->9252 9253 d231e0 2 API calls 9251->9253 9254 d231e0 2 API calls 9252->9254 9256 d00b67 9253->9256 9255 d00c80 9254->9255 9257 cfa430 2 API calls 9255->9257 9259 cfa430 2 API calls 9256->9259 9258 d00cbd 9257->9258 9260 d17870 9 API calls 9258->9260 9259->9252 9261 d00cf7 9260->9261 9562 cf7a50 9261->9562 9263 d00d0b 9565 d236d0 9263->9565 9265 d00e0a 9605 d12260 lstrlen 9265->9605 9267 d00e9c 9606 cffdf0 9267->9606 9271 d00ef4 9272 cf7a50 8 API calls 9271->9272 9273 d00f21 9272->9273 9274 cffdf0 9 API calls 9273->9274 9275 d00fa9 9274->9275 9276 cfc3e0 8 API calls 9275->9276 9277 d00fb8 9276->9277 9278 cf7a50 8 API calls 9277->9278 9279 d01009 9278->9279 9280 cffdf0 9 API calls 9279->9280 9281 d0102e 9280->9281 9282 cfc3e0 8 API calls 9281->9282 9283 d0103d 9282->9283 9284 cf7a50 8 API calls 9283->9284 9285 d01072 9284->9285 9286 cffdf0 9 API calls 9285->9286 9287 d010b1 9286->9287 9288 cfc3e0 8 API calls 9287->9288 9289 d010bd 9288->9289 9290 cf7a50 8 API calls 9289->9290 9291 d010ea 9290->9291 9292 cffdf0 9 API calls 9291->9292 9293 d0112e 9292->9293 9294 cfc3e0 8 API calls 9293->9294 9295 d0113d 9294->9295 9296 cf7a50 8 API calls 9295->9296 9297 d011c0 9296->9297 9298 d231e0 2 API calls 9297->9298 9299 d011f1 9298->9299 9300 cffdf0 9 API calls 9299->9300 9301 d0120c 9300->9301 9302 cfc3e0 8 API calls 9301->9302 9303 d0121b 9302->9303 9304 cfa430 2 API calls 9303->9304 9305 d01255 9304->9305 9306 cf7a50 8 API calls 9305->9306 9307 d0127e 9306->9307 9308 cffdf0 9 API calls 9307->9308 9309 d012e1 9308->9309 9310 cfc3e0 8 API calls 9309->9310 9311 d012ed 9310->9311 9312 cf7a50 8 API calls 9311->9312 9313 d01351 9312->9313 9314 cffdf0 9 API calls 9313->9314 9315 d01388 9314->9315 9316 cfc3e0 8 API calls 9315->9316 9317 d01397 9316->9317 9318 cf7a50 8 API calls 9317->9318 9319 d013de 9318->9319 9613 d21d80 9319->9613 9323 d01443 9324 cffdf0 9 API calls 9323->9324 9325 d0144f 9324->9325 9326 cfc3e0 8 API calls 9325->9326 9327 d0145e 9326->9327 9328 cf7a50 8 API calls 9327->9328 9329 d01483 9328->9329 9330 cffdf0 9 API calls 9329->9330 9331 d014dc 9330->9331 9332 cfc3e0 8 API calls 9331->9332 9333 d014eb 9332->9333 9622 cfd1f0 9333->9622 9335 d01519 9649 d12070 9335->9649 9337 d0152e 9652 d060d0 9337->9652 9339 d0154f 9656 d22b00 9339->9656 9341 d015b2 9664 cfb670 9341->9664 9430 d156e8 GetProcessHeap RtlAllocateHeap 9429->9430 9431 d156be 9429->9431 9430->9047 9431->9430 9432->9051 9434 d11531 9433->9434 9435 d1153b AllocateAndInitializeSid 9433->9435 9434->9435 9436 d115b2 9435->9436 9437 d11623 CheckTokenMembership 9436->9437 9438 cf80ae 9436->9438 9437->9438 9439 d228c0 9438->9439 9440 d231e0 2 API calls 9439->9440 9441 d22925 GetProcAddress 9440->9441 9442 cfa430 2 API calls 9441->9442 9443 d2297e 9442->9443 9444 d229a3 GetCurrentProcess 9443->9444 9445 cf80c4 9443->9445 9444->9445 9445->9068 9446 cff420 GetWindowsDirectoryA 9445->9446 9447 cff469 9446->9447 9448 cff564 9447->9448 9449 d231e0 2 API calls 9447->9449 9448->9072 9450 cff507 9449->9450 9451 cfa430 2 API calls 9450->9451 9452 cff548 9451->9452 9477 d12260 lstrlen 9452->9477 9455 d178ae 9454->9455 9478 d16d90 9455->9478 9459 cf70dd 9458->9459 9460 d18570 WaitForSingleObject 9459->9460 9461 cf714e 9460->9461 9462 cf716d 9461->9462 9463 cf71d0 CreateFileA 9461->9463 9511 d12290 9462->9511 9464 cf7221 9463->9464 9470 cf72ad 9463->9470 9466 d12290 ReleaseMutex 9464->9466 9468 cf724a 9466->9468 9468->9082 9469 cf73ea WriteFile 9469->9470 9470->9469 9471 cf748e CloseHandle 9470->9471 9474 d12290 ReleaseMutex 9471->9474 9475 cf7551 9474->9475 9475->9082 9476->9143 9477->9448 9479 d16dae 9478->9479 9484 d12260 lstrlen 9479->9484 9481 d16e21 9485 d0fd30 9481->9485 9483 cf8358 9483->9076 9484->9481 9488 d17bb0 9485->9488 9487 d0fd52 9487->9483 9489 d17bd9 9488->9489 9490 d17be0 9489->9490 9493 cfdf30 9489->9493 9490->9487 9492 d17c49 9492->9487 9494 cfdf62 9493->9494 9495 cfdf78 9494->9495 9497 d0f910 9494->9497 9495->9492 9498 d0f930 9497->9498 9499 d0faaf 9498->9499 9501 d0fa17 9498->9501 9504 d0fa98 9498->9504 9507 d13790 9499->9507 9502 d156a0 2 API calls 9501->9502 9503 d0fa27 9502->9503 9506 d259b0 GetProcessHeap RtlFreeHeap 9503->9506 9504->9495 9506->9504 9508 d137b1 9507->9508 9509 d1382c GetProcessHeap HeapAlloc 9508->9509 9510 d1380c GetProcessHeap RtlReAllocateHeap 9508->9510 9509->9504 9510->9504 9512 d122ad ReleaseMutex 9511->9512 9514 cf71b3 9512->9514 9514->9082 9515->9166 9517 cfb1fa 9516->9517 9518 cfb2dc CreateFileA 9517->9518 9519 cfb313 ReadFile CloseHandle 9518->9519 9535 cfb5e3 9518->9535 9544 cfb9f0 9519->9544 9522 cfb367 GetTickCount 9546 cfc640 9522->9546 9525 cfb389 9550 d12260 lstrlen 9525->9550 9527 cfb3b9 9528 d231e0 2 API calls 9527->9528 9529 cfb415 9528->9529 9530 cfa430 2 API calls 9529->9530 9531 cfb488 9530->9531 9532 cfb53e CreateFileA 9531->9532 9534 d231e0 2 API calls 9531->9534 9533 cfb57b 9532->9533 9533->9535 9536 cfb592 WriteFile CloseHandle 9533->9536 9537 cfb4be 9534->9537 9552 d06c10 9535->9552 9536->9535 9551 d12260 lstrlen 9537->9551 9539 cfb4db 9540 d10cf0 wvsprintfA 9539->9540 9541 cfb4e6 9540->9541 9542 cfa430 2 API calls 9541->9542 9543 cfb4f8 9542->9543 9543->9532 9545 cfba19 9544->9545 9545->9522 9547 cfc65d 9546->9547 9556 d12260 lstrlen 9547->9556 9549 cfc67c 9549->9525 9550->9527 9551->9539 9554 d22a80 9552->9554 9553 cfb60a 9553->9176 9554->9553 9557 d259b0 GetProcessHeap RtlFreeHeap 9554->9557 9556->9549 9557->9553 9558->9181 9560 cfa652 9559->9560 9560->9195 9561->9200 9563 d060d0 8 API calls 9562->9563 9564 cf7a7b 9563->9564 9564->9263 9566 d236f6 9565->9566 9567 d231e0 2 API calls 9566->9567 9568 d238c3 9567->9568 9569 cfa430 2 API calls 9568->9569 9570 d2392e GetProcessHeap 9569->9570 9572 d2396a 9570->9572 9571 d23986 9571->9265 9572->9571 9573 d231e0 2 API calls 9572->9573 9574 d239f7 LoadLibraryA 9573->9574 9575 cfa430 2 API calls 9574->9575 9577 d23a30 9575->9577 9576 d23a4f 9576->9265 9577->9576 9578 d231e0 2 API calls 9577->9578 9579 d23ac7 GetProcAddress 9578->9579 9580 cfa430 2 API calls 9579->9580 9581 d23b14 9580->9581 9582 d23b2e FreeLibrary 9581->9582 9583 d23b8d HeapAlloc 9581->9583 9584 d23b70 9582->9584 9586 d23c16 9583->9586 9584->9265 9587 d23c2c FreeLibrary 9586->9587 9588 d23c63 9586->9588 9587->9265 9589 d23d07 HeapFree 9588->9589 9590 d23e5c 9588->9590 9591 d23d73 9589->9591 9592 d23d8d HeapAlloc 9589->9592 9595 d231e0 2 API calls 9590->9595 9604 d2419a 9590->9604 9591->9592 9593 d23dc9 9592->9593 9593->9590 9594 d23e00 FreeLibrary 9593->9594 9596 d23e2e 9594->9596 9598 d23f22 9595->9598 9596->9265 9597 d2449e HeapFree FreeLibrary 9597->9265 9599 cfa430 2 API calls 9598->9599 9600 d23f62 9599->9600 9601 d231e0 2 API calls 9600->9601 9600->9604 9602 d241b5 9601->9602 9603 cfa430 2 API calls 9602->9603 9603->9604 9604->9597 9605->9267 9668 d14c80 9606->9668 9609 cfc3e0 9610 cfc3f8 9609->9610 9611 d060d0 8 API calls 9610->9611 9612 cfc406 9611->9612 9612->9271 9614 d21da8 9613->9614 9615 d231e0 2 API calls 9614->9615 9616 d21dcc 9615->9616 9617 cfa430 2 API calls 9616->9617 9618 d01419 9617->9618 9619 d18000 9618->9619 9675 d12260 lstrlen 9619->9675 9621 d1802b 9621->9323 9623 cfd22c 9622->9623 9624 d231e0 2 API calls 9623->9624 9625 cfd2cb 9624->9625 9626 d231e0 2 API calls 9625->9626 9627 cfd2ec 9626->9627 9628 d231e0 2 API calls 9627->9628 9629 cfd322 9628->9629 9630 cfa430 2 API calls 9629->9630 9631 cfd33e 9630->9631 9632 d231e0 2 API calls 9631->9632 9633 cfd372 9632->9633 9634 cfa430 2 API calls 9633->9634 9635 cfd395 9634->9635 9636 cfa430 2 API calls 9635->9636 9637 cfd406 9636->9637 9640 cfd87c 9637->9640 9643 cfc2d0 9 API calls 9637->9643 9676 d11a50 9637->9676 9638 cfa430 2 API calls 9639 cfddda 9638->9639 9639->9335 9642 cfdd9a 9640->9642 9644 d11a50 8 API calls 9640->9644 9645 cfc2d0 9 API calls 9640->9645 9646 cfdc6c 9640->9646 9642->9638 9643->9637 9644->9640 9645->9640 9646->9642 9647 d11a50 8 API calls 9646->9647 9679 cfc2d0 9646->9679 9647->9646 9650 d17bb0 8 API calls 9649->9650 9651 d12077 9650->9651 9651->9337 9653 d060f1 9652->9653 9654 d17bb0 8 API calls 9653->9654 9655 d06113 9654->9655 9655->9339 9657 d22b1b 9656->9657 9690 d245e0 9657->9690 9659 d22c5f 9659->9341 9660 d22b5d 9660->9659 9661 d060d0 8 API calls 9660->9661 9662 d22c47 9661->9662 9663 d06c10 2 API calls 9662->9663 9663->9659 9665 d17370 9664->9665 9714 d176e0 9665->9714 9669 d14c8c 9668->9669 9674 d12260 lstrlen 9669->9674 9671 d14d63 9672 d0fd30 8 API calls 9671->9672 9673 cffdff 9672->9673 9673->9609 9674->9671 9675->9621 9685 cfc8b0 9676->9685 9678 d11a5e 9678->9637 9680 d181b0 9679->9680 9689 d12260 lstrlen 9680->9689 9682 d18209 9683 d060d0 8 API calls 9682->9683 9684 d18215 9683->9684 9684->9646 9686 cfc8cf 9685->9686 9687 d17bb0 8 API calls 9686->9687 9688 cfc8da 9687->9688 9688->9678 9689->9682 9695 cfe370 9690->9695 9692 d245f2 9693 d2463b 9692->9693 9699 cf2510 9692->9699 9693->9660 9696 cfe395 9695->9696 9697 cfe3d7 9695->9697 9698 d12070 8 API calls 9696->9698 9697->9692 9698->9697 9700 cf252f 9699->9700 9701 d18570 WaitForSingleObject 9700->9701 9702 cf264e 9701->9702 9703 d231e0 2 API calls 9702->9703 9713 cf27d1 9702->9713 9704 cf2703 GetProcAddress 9703->9704 9705 cf275c 9704->9705 9706 d231e0 2 API calls 9705->9706 9708 cf2777 9706->9708 9707 d12290 ReleaseMutex 9709 cf2a8b 9707->9709 9710 cfa430 2 API calls 9708->9710 9709->9692 9711 cf278b GetProcAddress 9710->9711 9712 cfa430 2 API calls 9711->9712 9712->9713 9713->9707 9715 d1770e 9714->9715 9716 d176ea 9714->9716 9718 d259b0 GetProcessHeap RtlFreeHeap 9716->9718 9718->9715 10085 cfe210 10086 cfe24d 10085->10086 10087 d12070 8 API calls 10086->10087 10088 cfe287 10087->10088 10093 cff090 10088->10093 10090 cfe2bc 10091 d12070 8 API calls 10090->10091 10092 cfe34b 10091->10092 10094 cff0a1 10093->10094 10095 cf91b0 8 API calls 10094->10095 10096 cff0b1 10095->10096 10096->10090 10817 cf3710 10822 d17370 10817->10822 10823 d176e0 2 API calls 10822->10823 10824 d1737e 10823->10824 10215 d10db0 10216 d10ddc 10215->10216 10275 cf4fc0 10216->10275 10218 d10eb8 10219 d18830 4 API calls 10218->10219 10221 d113af 10218->10221 10220 d10f24 10219->10220 10222 d231e0 2 API calls 10220->10222 10223 cfb670 2 API calls 10221->10223 10224 d10f6a 10222->10224 10225 d11443 10223->10225 10226 d17870 9 API calls 10224->10226 10227 d10f8a 10226->10227 10228 cfa430 2 API calls 10227->10228 10229 d10fa6 10228->10229 10279 d17250 10229->10279 10234 cfc3e0 8 API calls 10235 d10ff4 10234->10235 10236 cfb670 2 API calls 10235->10236 10237 d11007 10236->10237 10238 d231e0 2 API calls 10237->10238 10239 d11065 10238->10239 10240 cffdf0 9 API calls 10239->10240 10241 d1107d 10240->10241 10242 cfc3e0 8 API calls 10241->10242 10243 d11089 10242->10243 10244 cfa430 2 API calls 10243->10244 10245 d110ab 10244->10245 10246 cf6e40 8 API calls 10245->10246 10247 d110e3 10246->10247 10248 cfc3e0 8 API calls 10247->10248 10249 d110ec 10248->10249 10250 d12510 8 API calls 10249->10250 10251 d1112c 10250->10251 10285 d16030 10251->10285 10253 d1114f 10254 cfd1f0 9 API calls 10253->10254 10255 d11175 10254->10255 10342 cf5ee0 10255->10342 10258 d231e0 2 API calls 10259 d111b7 10258->10259 10260 cffdf0 9 API calls 10259->10260 10261 d111e1 10260->10261 10262 cfc3e0 8 API calls 10261->10262 10263 d111ed 10262->10263 10264 cfa430 2 API calls 10263->10264 10265 d1122b 10264->10265 10266 d060d0 8 API calls 10265->10266 10267 d11297 10266->10267 10268 d12070 8 API calls 10267->10268 10269 d1131b 10268->10269 10270 d231e0 2 API calls 10269->10270 10271 d1133e 10270->10271 10346 d06c30 10271->10346 10273 d1137a 10274 cfa430 2 API calls 10273->10274 10274->10221 10276 d060d0 8 API calls 10275->10276 10277 cf4fe0 SetEvent 10276->10277 10277->10218 10450 d13f00 10279->10450 10282 cf9170 10283 d16a90 8 API calls 10282->10283 10284 cf917f 10283->10284 10284->10234 10286 d1606c 10285->10286 10287 d231e0 2 API calls 10286->10287 10292 d16195 10286->10292 10288 d1615d 10287->10288 10289 d17870 9 API calls 10288->10289 10290 d16183 10289->10290 10291 cfa430 2 API calls 10290->10291 10291->10292 10293 d16297 10292->10293 10294 d16369 10292->10294 10295 d231e0 2 API calls 10293->10295 10297 d231e0 2 API calls 10294->10297 10296 d162b5 10295->10296 10298 d17870 9 API calls 10296->10298 10302 d163bf 10297->10302 10299 d162cc 10298->10299 10300 cfa430 2 API calls 10299->10300 10301 d162de 10300->10301 10301->10253 10458 d13860 10302->10458 10304 d1641b 10305 cfa430 2 API calls 10304->10305 10306 d16484 10305->10306 10307 d164c3 10306->10307 10308 d16562 10306->10308 10309 d231e0 2 API calls 10307->10309 10471 d1fff0 GetModuleFileNameA 10308->10471 10311 d16505 10309->10311 10313 d17870 9 API calls 10311->10313 10316 d16534 10313->10316 10314 d16613 10318 cf75a0 lstrlen 10314->10318 10315 d165aa 10317 d231e0 2 API calls 10315->10317 10319 cfa430 2 API calls 10316->10319 10320 d165c0 10317->10320 10321 d16647 10318->10321 10322 d1654e 10319->10322 10323 d17870 9 API calls 10320->10323 10473 d11a70 10321->10473 10322->10253 10325 d165e7 10323->10325 10327 cfa430 2 API calls 10325->10327 10329 d165f9 10327->10329 10329->10253 10331 d231e0 2 API calls 10332 d166b7 10331->10332 10333 cfa430 2 API calls 10332->10333 10334 d16708 10333->10334 10481 d12260 lstrlen 10334->10481 10336 d16720 10337 cf70d0 5 API calls 10336->10337 10338 d16756 10337->10338 10482 cfca00 10338->10482 10341 d1684c 10341->10253 10343 cf5efd 10342->10343 10344 cf91b0 8 API calls 10343->10344 10345 cf5f3d 10344->10345 10345->10258 10347 d06c76 10346->10347 10348 cf7a90 GetSystemTimeAsFileTime 10347->10348 10349 d06e0e 10348->10349 10666 d12260 lstrlen 10349->10666 10351 d06eaf 10351->10273 10353 d07015 10668 d12260 lstrlen 10353->10668 10354 d06e6e 10354->10351 10667 d12260 lstrlen 10354->10667 10356 d07023 10357 d231e0 2 API calls 10356->10357 10435 d07740 10356->10435 10358 d070cb 10357->10358 10359 d17870 9 API calls 10358->10359 10360 d070fd 10359->10360 10361 cfa430 2 API calls 10360->10361 10362 d07119 10361->10362 10363 d0736a 10362->10363 10365 d231e0 2 API calls 10362->10365 10364 cffdf0 9 API calls 10363->10364 10366 d073e2 10364->10366 10367 d0719a 10365->10367 10368 cfc3e0 8 API calls 10366->10368 10369 d14c80 9 API calls 10367->10369 10370 d073ee 10368->10370 10371 d071b7 10369->10371 10372 d231e0 2 API calls 10370->10372 10373 cfb670 2 API calls 10371->10373 10374 d07429 10372->10374 10375 d071d5 10373->10375 10376 cffdf0 9 API calls 10374->10376 10379 cfa430 2 API calls 10375->10379 10377 d07441 10376->10377 10378 cfc3e0 8 API calls 10377->10378 10380 d0744d 10378->10380 10383 d0724f 10379->10383 10381 cfa430 2 API calls 10380->10381 10382 d0748d 10381->10382 10384 cffdf0 9 API calls 10382->10384 10383->10363 10387 d12510 8 API calls 10383->10387 10385 d074ca 10384->10385 10386 cfc3e0 8 API calls 10385->10386 10391 d074d9 10386->10391 10388 d07304 10387->10388 10389 d231e0 2 API calls 10388->10389 10390 d07324 10389->10390 10392 d17870 9 API calls 10390->10392 10396 d231e0 2 API calls 10391->10396 10433 d0764e 10391->10433 10394 d07348 10392->10394 10393 d231e0 2 API calls 10395 d0769c 10393->10395 10397 cfa430 2 API calls 10394->10397 10398 cffdf0 9 API calls 10395->10398 10399 d07534 10396->10399 10397->10363 10400 d076be 10398->10400 10401 cffdf0 9 API calls 10399->10401 10403 cfc3e0 8 API calls 10400->10403 10402 d0755b 10401->10402 10404 cfc3e0 8 API calls 10402->10404 10405 d076ca 10403->10405 10406 d0756a 10404->10406 10407 cfa430 2 API calls 10405->10407 10409 d231e0 2 API calls 10406->10409 10408 d076ea 10407->10408 10410 d0770c socket 10408->10410 10412 cfc3e0 8 API calls 10408->10412 10411 d0758b 10409->10411 10413 d077b0 10410->10413 10410->10435 10414 cfa430 2 API calls 10411->10414 10412->10410 10415 d077c2 setsockopt 10413->10415 10416 d07805 gethostbyname 10413->10416 10422 d075aa 10414->10422 10415->10416 10417 d077fb 10415->10417 10418 d0784a inet_ntoa inet_addr 10416->10418 10416->10435 10417->10416 10419 d078b1 10418->10419 10420 d07913 htons connect 10418->10420 10419->10420 10421 d07958 10420->10421 10424 d07984 10420->10424 10421->10273 10423 d10cf0 wvsprintfA 10422->10423 10425 d07604 10423->10425 10427 d079b3 send 10424->10427 10426 cfa430 2 API calls 10425->10426 10428 d07620 10426->10428 10431 d079ed 10427->10431 10429 cffdf0 9 API calls 10428->10429 10430 d0763f 10429->10430 10432 cfc3e0 8 API calls 10430->10432 10434 d12070 8 API calls 10431->10434 10431->10435 10432->10433 10433->10393 10449 d07a89 10434->10449 10435->10273 10436 d07afb recv 10437 d07f76 closesocket 10436->10437 10436->10449 10439 d07fbf 10437->10439 10439->10435 10440 d12510 8 API calls 10439->10440 10440->10435 10441 d0f910 8 API calls 10441->10449 10442 d060d0 8 API calls 10442->10449 10443 d231e0 GetProcessHeap RtlAllocateHeap 10443->10449 10444 d14c80 9 API calls 10444->10449 10445 d07f6c 10445->10437 10446 cfa430 GetProcessHeap RtlFreeHeap 10446->10449 10448 cfb670 GetProcessHeap RtlFreeHeap 10448->10449 10449->10436 10449->10437 10449->10441 10449->10442 10449->10443 10449->10444 10449->10445 10449->10446 10449->10448 10669 d21b00 10449->10669 10673 cf4400 10449->10673 10451 d13f0b 10450->10451 10454 d11e10 10451->10454 10455 d11e2c 10454->10455 10456 cf91b0 8 API calls 10455->10456 10457 d10fdf 10456->10457 10457->10282 10460 d13880 10458->10460 10459 d1397c 10459->10304 10460->10459 10508 cfaf10 10460->10508 10464 d13a9b 10465 d13a5a 10464->10465 10518 d15b30 10464->10518 10537 d22fb0 10465->10537 10467 d13b5d 10525 d12f30 10467->10525 10472 d165a3 10471->10472 10472->10314 10472->10315 10474 d11aa2 10473->10474 10475 d11b87 10474->10475 10476 cf2510 8 API calls 10474->10476 10477 d23010 10475->10477 10476->10475 10478 d16699 10477->10478 10480 d2305b 10477->10480 10478->10331 10479 d11a70 8 API calls 10479->10480 10480->10478 10480->10479 10481->10336 10483 cfca1d 10482->10483 10484 cfcb28 CreatePipe 10483->10484 10485 cfcba9 SetHandleInformation 10484->10485 10492 cfcb94 10484->10492 10486 cfcc1e CreatePipe 10485->10486 10487 cfcbf9 10485->10487 10488 cfcc4d SetHandleInformation 10486->10488 10489 cfcc36 10486->10489 10487->10486 10496 cfccca 10488->10496 10491 cfce9c CloseHandle 10489->10491 10490 d12070 8 API calls 10495 cfcf1f DeleteFileA 10490->10495 10491->10492 10493 cfceb4 CloseHandle 10491->10493 10492->10490 10492->10495 10493->10492 10495->10341 10497 cfcdf2 CreateProcessA 10496->10497 10498 cfcf4e WriteFile 10497->10498 10499 cfce32 CloseHandle 10497->10499 10503 cfcfbb CloseHandle CloseHandle 10498->10503 10504 cfcfaa 10498->10504 10501 cfce6c CloseHandle 10499->10501 10502 cfce62 10499->10502 10501->10491 10502->10501 10505 cfd01e 10503->10505 10504->10503 10506 d146f0 10 API calls 10505->10506 10507 cfd063 WaitForSingleObject CloseHandle CloseHandle 10506->10507 10509 cfaf45 10508->10509 10510 d173c0 4 API calls 10509->10510 10511 cfaf89 10510->10511 10512 cfafca 10511->10512 10513 cfeeb0 4 API calls 10511->10513 10512->10465 10514 cfeeb0 10512->10514 10513->10512 10515 cfeef7 10514->10515 10516 d173c0 4 API calls 10515->10516 10517 cfef55 10516->10517 10517->10464 10540 cf3bc0 10518->10540 10522 d15b8e 10553 d1f790 10522->10553 10524 d15bb0 10524->10467 10527 d12f3d 10525->10527 10526 d130f9 10526->10465 10527->10526 10565 d0bfc0 10527->10565 10529 d13039 10529->10526 10530 d231e0 2 API calls 10529->10530 10536 d13320 10529->10536 10533 d132c5 10530->10533 10531 d231e0 2 API calls 10532 d132e3 10531->10532 10532->10465 10533->10532 10534 cfa430 2 API calls 10533->10534 10534->10536 10535 d134af 10535->10465 10536->10531 10536->10535 10538 cfe980 2 API calls 10537->10538 10539 d13c6c 10538->10539 10539->10304 10541 cf3be5 10540->10541 10542 d231e0 2 API calls 10541->10542 10543 cf3c6e 10542->10543 10544 cfa430 2 API calls 10543->10544 10545 cf3ca0 10544->10545 10546 cf5800 10545->10546 10549 cf5826 10546->10549 10547 cf5d00 10547->10522 10548 cf5bc3 10548->10522 10549->10547 10550 cf5a72 10549->10550 10559 d202f0 10549->10559 10550->10548 10551 d202f0 4 API calls 10550->10551 10551->10550 10554 d1f817 10553->10554 10555 cf5800 4 API calls 10554->10555 10556 d1fbac 10555->10556 10557 cf5800 4 API calls 10556->10557 10558 d1fbc2 10557->10558 10558->10524 10560 d20378 10559->10560 10561 d231e0 2 API calls 10560->10561 10562 d204cc 10561->10562 10563 cfa430 2 API calls 10562->10563 10564 d208a5 10563->10564 10564->10550 10566 d0bffb 10565->10566 10567 cfaf10 4 API calls 10566->10567 10569 d0c050 10567->10569 10568 cfe980 2 API calls 10575 d0c1c3 10568->10575 10570 d0c0d6 10569->10570 10571 d0c09e 10569->10571 10576 d0c129 10569->10576 10577 d248f0 10570->10577 10572 cfe980 2 API calls 10571->10572 10574 d0c0b6 10572->10574 10574->10529 10575->10529 10576->10568 10579 d24968 10577->10579 10578 d25845 10578->10576 10579->10578 10580 d173c0 4 API calls 10579->10580 10581 d24aaf 10580->10581 10583 d173c0 4 API calls 10581->10583 10612 d25039 10581->10612 10582 d257da 10585 d25809 10582->10585 10586 d257fd 10582->10586 10584 d24af7 10583->10584 10591 d173c0 4 API calls 10584->10591 10584->10612 10587 cfe980 2 API calls 10585->10587 10589 cfe980 2 API calls 10586->10589 10590 d25804 10587->10590 10588 cfe980 2 API calls 10588->10612 10589->10590 10590->10576 10592 d24b20 10591->10592 10593 cfeeb0 4 API calls 10592->10593 10596 d24b66 10592->10596 10592->10612 10594 d24b8f 10593->10594 10594->10612 10613 d05a60 10594->10613 10598 d24cfb 10596->10598 10599 d24ce8 10596->10599 10596->10612 10600 cf4260 4 API calls 10598->10600 10602 d1fe90 4 API calls 10599->10602 10603 d24cf6 10600->10603 10602->10603 10604 cf4260 4 API calls 10603->10604 10605 d24d7b 10604->10605 10606 d173c0 4 API calls 10605->10606 10605->10612 10607 d24e34 10606->10607 10608 cf4260 4 API calls 10607->10608 10607->10612 10609 d24e59 10608->10609 10610 d173c0 4 API calls 10609->10610 10611 cf4260 4 API calls 10609->10611 10609->10612 10610->10609 10611->10609 10612->10582 10612->10588 10614 d05aad 10613->10614 10615 d173c0 4 API calls 10614->10615 10616 d05bb8 10614->10616 10615->10616 10616->10612 10617 d1fe90 10616->10617 10624 d20930 10617->10624 10619 d1fecd 10620 cf6850 4 API calls 10619->10620 10621 d1ff9f 10619->10621 10623 d1ff23 10619->10623 10620->10619 10621->10596 10622 cfe4f0 4 API calls 10622->10623 10623->10621 10623->10622 10626 d2099e 10624->10626 10625 d209a5 10625->10619 10626->10625 10627 d20ac1 10626->10627 10628 d20a17 10626->10628 10630 cf4260 4 API calls 10627->10630 10629 d20a5b 10628->10629 10631 cfeeb0 4 API calls 10628->10631 10632 d20a99 10629->10632 10634 cf4260 4 API calls 10629->10634 10659 d20a8c 10629->10659 10633 d20b0d 10630->10633 10631->10629 10632->10619 10636 cf4260 4 API calls 10633->10636 10633->10659 10634->10659 10635 cfe980 2 API calls 10638 d21a37 10635->10638 10637 d20b2e 10636->10637 10639 d173c0 4 API calls 10637->10639 10637->10659 10638->10619 10640 d20b6a 10639->10640 10641 cfeeb0 4 API calls 10640->10641 10640->10659 10642 d20b8b 10641->10642 10643 d173c0 4 API calls 10642->10643 10642->10659 10644 d20bb3 10643->10644 10645 d173c0 4 API calls 10644->10645 10644->10659 10646 d20bfa 10645->10646 10647 d05a60 4 API calls 10646->10647 10649 d20cc9 10646->10649 10646->10659 10648 d20c94 10647->10648 10650 d05a60 4 API calls 10648->10650 10648->10659 10651 d05a60 4 API calls 10649->10651 10649->10659 10650->10649 10653 d20ddb 10651->10653 10652 cfe4f0 4 API calls 10652->10653 10653->10652 10660 d20eaa 10653->10660 10654 d217b9 10655 cf4260 4 API calls 10654->10655 10657 d2183c 10654->10657 10655->10657 10656 cfeeb0 GetProcessHeap RtlAllocateHeap GetProcessHeap RtlFreeHeap 10656->10660 10658 cf4260 4 API calls 10657->10658 10657->10659 10658->10659 10659->10632 10659->10635 10660->10654 10660->10656 10660->10659 10661 cf66a0 GetProcessHeap RtlAllocateHeap GetProcessHeap RtlFreeHeap 10660->10661 10662 d05a60 GetProcessHeap RtlAllocateHeap GetProcessHeap RtlFreeHeap 10660->10662 10663 cfe4f0 4 API calls 10660->10663 10664 cf4260 4 API calls 10660->10664 10665 cf6850 4 API calls 10660->10665 10661->10660 10662->10660 10663->10660 10664->10660 10665->10660 10666->10354 10667->10353 10668->10356 10670 d21b1f 10669->10670 10672 d21b30 10669->10672 10671 cf7a90 GetSystemTimeAsFileTime 10670->10671 10671->10672 10672->10449 10674 cf4436 10673->10674 10675 d231e0 2 API calls 10674->10675 10676 cf4470 10675->10676 10677 d14c80 9 API calls 10676->10677 10678 cf4488 10677->10678 10679 cfb670 2 API calls 10678->10679 10680 cf44a2 10679->10680 10681 cfa430 2 API calls 10680->10681 10683 cf44b4 10681->10683 10682 cf44cd 10682->10449 10683->10682 10684 d231e0 2 API calls 10683->10684 10685 cf44ee 10684->10685 10686 d14c80 9 API calls 10685->10686 10687 cf4506 10686->10687 10688 cfb670 2 API calls 10687->10688 10689 cf451d 10688->10689 10690 cfa430 2 API calls 10689->10690 10691 cf4538 10690->10691 10691->10449 8807 d15535 8808 d15546 8807->8808 8815 cfb890 8808->8815 8810 d1554b 8820 d16be0 GetStdHandle 8810->8820 8812 d15560 8813 d155f4 8812->8813 8814 d15605 ExitProcess 8813->8814 8816 cfb8df 8815->8816 8817 cfb8c1 8815->8817 8816->8817 8825 d21d20 8817->8825 8819 cfb910 8819->8810 8821 d16c49 GetStdHandle 8820->8821 8822 d16c3f 8820->8822 8824 d16c82 GetStdHandle 8821->8824 8822->8821 8824->8812 8826 d21d4b GetProcessHeap HeapAlloc 8825->8826 8827 d21d3b 8825->8827 8826->8819 8827->8826 9962 cf16a5 ExitProcess 10692 d213b9 10703 d20f06 10692->10703 10693 cfeeb0 GetProcessHeap RtlAllocateHeap GetProcessHeap RtlFreeHeap 10693->10703 10694 cfe980 2 API calls 10695 d21a37 10694->10695 10696 cf66a0 GetProcessHeap RtlAllocateHeap GetProcessHeap RtlFreeHeap 10696->10703 10697 d05a60 GetProcessHeap RtlAllocateHeap GetProcessHeap RtlFreeHeap 10697->10703 10698 cfe4f0 4 API calls 10698->10703 10699 cf4260 4 API calls 10699->10703 10700 d217b9 10702 cf4260 4 API calls 10700->10702 10704 d2183c 10700->10704 10701 cf6850 4 API calls 10701->10703 10702->10704 10703->10693 10703->10696 10703->10697 10703->10698 10703->10699 10703->10700 10703->10701 10706 d21949 10703->10706 10705 cf4260 4 API calls 10704->10705 10704->10706 10705->10706 10706->10694 9963 cf5ea0 9966 d12260 lstrlen 9963->9966 9965 cf5ecf 9966->9965 10101 cf9220 10102 d26470 lstrlen 10101->10102 10103 cf922f 10102->10103 10104 d14e20 10105 d14e3a 10104->10105 10108 d15c30 10105->10108 10107 d14e94 10109 d15c57 10108->10109 10112 d006b0 10109->10112 10111 d15c6c 10111->10107 10113 d006d5 10112->10113 10114 cfdf30 8 API calls 10113->10114 10115 d00720 10114->10115 10115->10111 10711 cf6bb9 10713 cf6bc0 10711->10713 10712 cf6c0d Sleep 10712->10713 10713->10712 10714 cf7a90 GetSystemTimeAsFileTime 10713->10714 10715 cf6c95 10713->10715 10714->10713 10116 cf1c30 10117 cffe60 8 API calls 10116->10117 10118 cf1c43 10117->10118 10119 cfbc30 10120 d25b90 8 API calls 10119->10120 10121 cfbc55 10120->10121 10122 cfc3e0 8 API calls 10121->10122 10123 cfbc72 10122->10123
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                • Part of subcall function 00D259B0: GetProcessHeap.KERNEL32(00000000,00000000,?,00D0FA98,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00D259C3
                                                                                                                                                                                                                • Part of subcall function 00D259B0: RtlFreeHeap.NTDLL(00000000,?,00D0FA98,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00D259CA
                                                                                                                                                                                                                • Part of subcall function 00D24650: GetSystemTime.KERNEL32(00CF2C4A,00000001,?,?,00CF2C4A), ref: 00D2473C
                                                                                                                                                                                                              • GetEnvironmentVariableA.KERNEL32(00000000,C:\Users\user,00000104), ref: 00D1D651
                                                                                                                                                                                                              • CreateMutexA.KERNELBASE(00000000,00000000,00000000), ref: 00D1D721
                                                                                                                                                                                                              • CreateMutexA.KERNELBASE(00000000,00000000,00000000), ref: 00D1D76D
                                                                                                                                                                                                              • CreateMutexA.KERNEL32(00000000,00000000,00000000), ref: 00D1D7A4
                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 00D1D82E
                                                                                                                                                                                                              • Sleep.KERNEL32(00000D05), ref: 00D1DE9B
                                                                                                                                                                                                              • Sleep.KERNEL32(000003E8), ref: 00D1E039
                                                                                                                                                                                                              • GetCommandLineA.KERNEL32 ref: 00D1D9EB
                                                                                                                                                                                                                • Part of subcall function 00CFC9B0: ExitProcess.KERNEL32 ref: 00CFC9E8
                                                                                                                                                                                                                • Part of subcall function 00D14990: CreateFileA.KERNEL32(?,00000000,00000000,00000000,00000003,00000000,00000000), ref: 00D14A04
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.1769524357.0000000000CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CF0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769509730.0000000000CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769557833.0000000000D27000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D61000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D70000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769632749.0000000000D72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_cf0000_YiqjcLlhew.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Create$Mutex$HeapProcessSleep$CommandCountEnvironmentExitFileFreeLineSystemTickTimeVariable
                                                                                                                                                                                                              • String ID: C:\Users\user$Qt$[$U"Kd$f$l
                                                                                                                                                                                                              • API String ID: 2753435600-1281664809
                                                                                                                                                                                                              • Opcode ID: 3ab625ea44d49a4246854ba36981933d89eb0e02b8f3a171ebfa0ddfbba180f7
                                                                                                                                                                                                              • Instruction ID: 563c5b863180c9e36662cf6bb212354ea44bd1adc584601227030880825209c4
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3ab625ea44d49a4246854ba36981933d89eb0e02b8f3a171ebfa0ddfbba180f7
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9313FEB5A00301DFD704EF24FD8A6A53BB1FBA4311B11411AE942D63B9EBB089A1CF75

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 437 cf7fa0-cf7fec call cff680 440 cf7fee 437->440 441 cf7ff8-cf8058 437->441 440->441 442 cf805a-cf806c 441->442 443 cf8072-cf80da GetVersionExA call d11510 call d228c0 441->443 442->443 448 cf8270-cf82c9 443->448 449 cf80e0-cf80f4 443->449 450 cf82cb-cf82db 448->450 451 cf82e1-cf8370 call d231e0 call d17870 448->451 452 cf8108-cf8147 call cff420 449->452 453 cf80f6-cf8102 449->453 450->451 463 cf8384-cf83d0 call cfa430 call d26190 call d14c70 call cf70d0 451->463 464 cf8372-cf837e 451->464 459 cf815d-cf8208 call cf7650 CreateDirectoryA call d231e0 452->459 460 cf8149-cf8156 452->460 453->452 469 cf820d-cf826e call cf7650 call cfa430 459->469 460->459 480 cf8443-cf84fc call cff420 call cf7650 CreateDirectoryA 463->480 481 cf83d2-cf8439 DeleteFileA RemoveDirectoryA 463->481 464->463 469->451 486 cf84fe 480->486 487 cf8508-cf8537 call d201f0 480->487 481->480 486->487 490 cf855b-cf85bc call d15d80 487->490 491 cf8539-cf8551 487->491 494 cf85be 490->494 495 cf85c8-cf85fd CreateDirectoryA 490->495 491->490 494->495 496 cf863f-cf864b 495->496 497 cf85ff-cf863d 495->497 498 cf8651-cf8678 call d231e0 496->498 497->498 501 cf867a-cf869e 498->501 502 cf86a0-cf86da 498->502 503 cf86e7-cf8790 call cf7650 call d231e0 call cfa430 call d17870 call cfa430 call d26190 call d14c70 call cf70d0 501->503 502->503 504 cf86dc-cf86e2 502->504 521 cf90cb-cf914d call d15d80 SetFileAttributesA call cf96f0 call d17720 503->521 522 cf8796-cf87a7 503->522 504->503 523 cf883d-cf88cd call d231e0 call d10cf0 call cfa430 522->523 524 cf87ad-cf8838 call d231e0 call d10cf0 call cfa430 522->524 543 cf88d3-cf88e8 523->543 524->543 544 cf88ea-cf88f9 543->544 545 cf8921 543->545 544->545 546 cf88fb-cf891f 544->546 547 cf8923-cf8989 call cf7650 CreateDirectoryA 545->547 546->547 550 cf898b 547->550 551 cf8995-cf89df call d201f0 call d15d80 547->551 550->551 556 cf8a11-cf8a44 CreateDirectoryA 551->556 557 cf89e1-cf8a0b 551->557 558 cf8a46-cf8a5e 556->558 559 cf8a64-cf8a96 call d231e0 556->559 557->556 558->559 562 cf8abd-cf8b1f call cf7650 call d231e0 559->562 563 cf8a98-cf8ab6 559->563 568 cf8b66-cf8b88 call cfa430 562->568 569 cf8b21-cf8b4e 562->569 563->562 574 cf8b9c-cf8bf4 call d17870 call cfa430 call d26190 call d14c70 call cf70d0 568->574 575 cf8b8a-cf8b96 568->575 570 cf8b5c 569->570 571 cf8b50-cf8b5a 569->571 570->568 571->568 586 cf8bfa-cf8c0f 574->586 587 cf90c1 574->587 575->574 588 cf8c22-cf8c94 GetTempPathA call d12260 586->588 589 cf8c11-cf8c1c 586->589 587->521 592 cf8cba-cf8cbe 588->592 593 cf8c96-cf8cb4 588->593 589->588 594 cf8cc4 592->594 595 cf8d80-cf8f22 call d201f0 call d15d80 CreateDirectoryA call d231e0 call cf7650 call d231e0 call cfa430 call d17870 call cfa430 call d26190 call d14c70 call cf70d0 592->595 593->592 597 cf8cc9-cf8ce3 594->597 625 cf8f28-cf8f7f GetTempPathA call d201f0 595->625 626 cf90a6-cf90bb 595->626 599 cf8ce5-cf8cef 597->599 600 cf8d31-cf8d7a 597->600 602 cf8d29-cf8d2d 599->602 603 cf8cf1-cf8d21 599->603 600->595 602->597 604 cf8d2f 602->604 603->602 606 cf8d23 603->606 604->595 606->602 629 cf8fd1-cf9033 call d231e0 call cf7650 call cfa430 625->629 630 cf8f81-cf8fab 625->630 626->587 638 cf907d-cf909f 629->638 639 cf9035-cf9051 629->639 630->629 631 cf8fad-cf8fcb 630->631 631->629 638->626 642 cf90a1 638->642 640 cf9067-cf907b 639->640 641 cf9053-cf9065 639->641 640->626 641->626 642->626
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetVersionExA.KERNEL32(00D70FB0), ref: 00CF808B
                                                                                                                                                                                                              • CreateDirectoryA.KERNELBASE(0000005C,00000000), ref: 00CF81E4
                                                                                                                                                                                                              • DeleteFileA.KERNELBASE(?,?,?,?,?,?,00000000), ref: 00CF8408
                                                                                                                                                                                                              • RemoveDirectoryA.KERNELBASE(?,?,?,?,?,?,00000000), ref: 00CF8433
                                                                                                                                                                                                              • CreateDirectoryA.KERNELBASE(?,00000000,?,?,?,?,?,?,?,?,00000000), ref: 00CF84CC
                                                                                                                                                                                                              • CreateDirectoryA.KERNELBASE(?,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00CF85D1
                                                                                                                                                                                                              • CreateDirectoryA.KERNEL32(?,00000000), ref: 00CF896A
                                                                                                                                                                                                              • CreateDirectoryA.KERNEL32(?,00000000), ref: 00CF8A1A
                                                                                                                                                                                                                • Part of subcall function 00D10CF0: wvsprintfA.USER32(00001237,0066E0B8,0066DE48), ref: 00D10D77
                                                                                                                                                                                                              • GetTempPathA.KERNEL32(00000104,?,?,?,?,?,?,00000000), ref: 00CF8C2E
                                                                                                                                                                                                                • Part of subcall function 00D12260: lstrlen.KERNEL32(?,?,00CF7614,?,?,C:\vdjmzgowdzhfmld\,?,?,00CF17C4,?), ref: 00D12283
                                                                                                                                                                                                              • CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 00CF8DEE
                                                                                                                                                                                                              • GetTempPathA.KERNEL32(00000104,?,?,?,?,?,?,00000000), ref: 00CF8F47
                                                                                                                                                                                                              • SetFileAttributesA.KERNELBASE(?,00000002,?,?,?,?,?,?,00000000), ref: 00CF90F7
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.1769524357.0000000000CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CF0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769509730.0000000000CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769557833.0000000000D27000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D61000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D70000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769632749.0000000000D72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_cf0000_YiqjcLlhew.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Directory$Create$FilePathTemp$AttributesDeleteRemoveVersionlstrlenwvsprintf
                                                                                                                                                                                                              • String ID: C:\Users\user$C:\vdjmzgowdzhfmld\$\$f
                                                                                                                                                                                                              • API String ID: 2935959199-3557268133
                                                                                                                                                                                                              • Opcode ID: 466a05d944b26e54131973d1362f6d6f90c7394a8f1a4b7f8bee7f8984b2e1d4
                                                                                                                                                                                                              • Instruction ID: 483db1a9d8a645eb1396b76c312755370b2204f00522584eb54cf444821971f0
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 466a05d944b26e54131973d1362f6d6f90c7394a8f1a4b7f8bee7f8984b2e1d4
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 189257B5A00309DFD704AF24FD896B53B70FBA4311B118156E642D23B9EBB049A9CF76

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 694 cf3740-cf3772 695 cf3b7f-cf3b82 694->695 696 cf3778-cf37a8 694->696 697 cf37ca-cf3800 696->697 698 cf37aa-cf37c4 696->698 699 cf3816 697->699 700 cf3802-cf3814 697->700 698->697 701 cf3820-cf3871 call cfb9f0 call d12260 699->701 700->701 706 cf38a8-cf39bc Sleep call cf7650 call d231e0 call cf7650 call cfa430 FindFirstFileA 701->706 707 cf3873-cf388e 701->707 718 cf3b0c-cf3b6b call cf96f0 706->718 719 cf39c2-cf39d7 706->719 708 cf389e 707->708 709 cf3890-cf389c 707->709 708->706 709->706 718->695 727 cf3b6d-cf3b79 718->727 720 cf39d9-cf39ef 719->720 721 cf3a00-cf3a2d 719->721 720->721 723 cf39f1-cf39fb 720->723 724 cf3a2f-cf3a44 721->724 725 cf3a4a-cf3a79 call cf7650 721->725 723->721 724->725 730 cf3a7b-cf3a9e 725->730 731 cf3ab2-cf3ad9 DeleteFileA FindNextFileA 725->731 727->695 730->731 732 cf3aa0-cf3aac 730->732 731->721 733 cf3adf-cf3b05 FindClose 731->733 732->731 733->718
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • Sleep.KERNELBASE(000003E8,?,00000001), ref: 00CF38AD
                                                                                                                                                                                                              • FindFirstFileA.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 00CF39A7
                                                                                                                                                                                                              • DeleteFileA.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 00CF3AB9
                                                                                                                                                                                                              • FindNextFileA.KERNELBASE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 00CF3AD1
                                                                                                                                                                                                              • FindClose.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 00CF3AF2
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.1769524357.0000000000CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CF0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769509730.0000000000CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769557833.0000000000D27000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D61000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D70000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769632749.0000000000D72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_cf0000_YiqjcLlhew.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: FileFind$CloseDeleteFirstNextSleep
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1528862845-0
                                                                                                                                                                                                              • Opcode ID: 85162c1fe2df38c336e450c386d8c48dc91f4f7a0b976ecffac01e9365f6ce07
                                                                                                                                                                                                              • Instruction ID: 5fbac63b920f03abb4744ae7744cc983c51b60059a823a934bccd08e90786001
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 85162c1fe2df38c336e450c386d8c48dc91f4f7a0b976ecffac01e9365f6ce07
                                                                                                                                                                                                              • Instruction Fuzzy Hash: D1A10375500305DBD358DF25FC965B93BB4FB94311B01411AE982DB3B8EBB49AA0CBB2

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 842 d11510-d1152f 843 d11531 842->843 844 d1153b-d115b0 AllocateAndInitializeSid 842->844 843->844 845 d115c0-d11608 844->845 846 d115b2-d115be 844->846 847 d1161e-d11621 845->847 848 d1160a-d11617 845->848 846->847 849 d11623-d11646 CheckTokenMembership 847->849 850 d11697-d116a8 847->850 848->847 851 d11667-d11691 849->851 852 d11648-d11661 849->852 851->850 852->851
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • AllocateAndInitializeSid.ADVAPI32(00CF80AE,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00CF80AE), ref: 00D11592
                                                                                                                                                                                                              • CheckTokenMembership.KERNELBASE(00000000,?,?), ref: 00D1163E
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.1769524357.0000000000CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CF0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769509730.0000000000CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769557833.0000000000D27000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D61000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D70000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769632749.0000000000D72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_cf0000_YiqjcLlhew.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: AllocateCheckInitializeMembershipToken
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1663163955-0
                                                                                                                                                                                                              • Opcode ID: d8c8dd7bf0f38b334e88a10d5d7ee1eef3272692cf170ab2e7bb4d6f5b5a16f6
                                                                                                                                                                                                              • Instruction ID: 2bee8c8cf6984189c60411b00eda32855f8f916f48e20eb2406102216ecb89dc
                                                                                                                                                                                                              • Opcode Fuzzy Hash: d8c8dd7bf0f38b334e88a10d5d7ee1eef3272692cf170ab2e7bb4d6f5b5a16f6
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5041C7B6A02344EFCB048FA4FD888A87B74FB64301B55859AD841D7379DBB085A4DF30

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 854 d259b0-d259db GetProcessHeap RtlFreeHeap
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetProcessHeap.KERNEL32(00000000,00000000,?,00D0FA98,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00D259C3
                                                                                                                                                                                                              • RtlFreeHeap.NTDLL(00000000,?,00D0FA98,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00D259CA
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.1769524357.0000000000CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CF0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769509730.0000000000CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769557833.0000000000D27000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D61000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D70000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769632749.0000000000D72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_cf0000_YiqjcLlhew.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Heap$FreeProcess
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3859560861-0
                                                                                                                                                                                                              • Opcode ID: b080412d9db733b3d3aef37b6f97007f32032ab3e7a144a9fe94742e58846dea
                                                                                                                                                                                                              • Instruction ID: e2ad24b8c0767756d7ff8c93999bf35c0169a731933f403bc4f2b08d878315eb
                                                                                                                                                                                                              • Opcode Fuzzy Hash: b080412d9db733b3d3aef37b6f97007f32032ab3e7a144a9fe94742e58846dea
                                                                                                                                                                                                              • Instruction Fuzzy Hash: EED0C9B10493489FC7205BA9EC09A167BACEB18616F054040F54ACA660C7B168518E75

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 873 d0b387-d0b3ca 874 d0b3d6-d0b48a 873->874 875 d0b3cc 873->875 878 d0b4ac-d0b54a 874->878 879 d0b48c-d0b4a6 874->879 875->874 882 d0b556-d0b623 878->882 883 d0b54c 878->883 879->878 884 d0b625-d0b655 882->884 885 d0b65b-d0b7d0 882->885 883->882 884->885 888 d0b7f2-d0b89a 885->888 889 d0b7d2-d0b7ec 885->889 892 d0b89c-d0b8a8 888->892 893 d0b8ae-d0baca 888->893 889->888 892->893 898 d0bae2-d0bba2 893->898 899 d0bacc-d0badb 893->899 902 d0bba4-d0bbc3 898->902 903 d0bbca-d0bc40 898->903 899->898 902->903 904 d0bc42-d0bc62 903->904 905 d0bc68-d0bc99 903->905 904->905 906 d0bca5-d0bcce 905->906 907 d0bc9b 905->907 908 d0bcd0-d0bce2 906->908 909 d0bce8-d0bd2a 906->909 907->906 908->909 910 d0bd2c-d0bd38 909->910 911 d0bd3e-d0bd94 909->911 910->911 912 d0bd96-d0bda8 911->912 913 d0bdad-d0be42 911->913 912->913 914 d0be44-d0be50 913->914 915 d0be56-d0be88 913->915 914->915 916 d0bec3-d0bed8 915->916 917 d0be8a-d0beae 915->917 920 d0beda-d0bee6 916->920 921 d0beec-d0bf00 call d1d0eb 916->921 917->916 920->921 922 d0bf02-d0bf0d 921->922
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.1769524357.0000000000CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CF0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769509730.0000000000CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769557833.0000000000D27000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D61000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D70000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769632749.0000000000D72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_cf0000_YiqjcLlhew.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                              • String ID: `14
                                                                                                                                                                                                              • API String ID: 0-772651746
                                                                                                                                                                                                              • Opcode ID: 77780991774c49171145f72848bc79c6c99d8c4810a15537bd935ed85a10e57c
                                                                                                                                                                                                              • Instruction ID: e04b2c51438d8dbb74c473ff2c42a878e3f244ca5570317b1f40aaffc246b158
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 77780991774c49171145f72848bc79c6c99d8c4810a15537bd935ed85a10e57c
                                                                                                                                                                                                              • Instruction Fuzzy Hash: D842E076A11701CFC3449F28FD8A2613BB0FBA5361312451AE886D73B8E7B588A1CF75

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 643 cfb1d0-cfb1f8 644 cfb23a-cfb2a7 call cff410 643->644 645 cfb1fa-cfb214 643->645 650 cfb2bd-cfb2d6 644->650 651 cfb2a9-cfb2bb 644->651 646 cfb216-cfb220 645->646 647 cfb222-cfb234 645->647 646->644 647->644 652 cfb2dc-cfb30d CreateFileA 650->652 651->652 653 cfb313-cfb39d ReadFile CloseHandle call cfb9f0 GetTickCount call cfc640 652->653 654 cfb5f0-cfb644 call d06c10 652->654 663 cfb39f-cfb3ac 653->663 664 cfb3b3-cfb3d3 call d12260 653->664 660 cfb65c-cfb669 654->660 661 cfb646-cfb65b 654->661 663->664 667 cfb3df-cfb45a call cf7650 call d231e0 664->667 668 cfb3d5 664->668 673 cfb45c 667->673 674 cfb466-cfb49a call cf7650 call cfa430 667->674 668->667 673->674 679 cfb53e-cfb579 CreateFileA 674->679 680 cfb4a0-cfb52a call d231e0 call d12260 call d10cf0 call cfa430 674->680 681 cfb58d-cfb590 679->681 682 cfb57b-cfb587 679->682 680->679 693 cfb52c-cfb538 680->693 684 cfb5e3-cfb5e6 681->684 685 cfb592-cfb5dd WriteFile CloseHandle 681->685 682->681 684->654 685->684 693->679
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00CFB2EE
                                                                                                                                                                                                              • ReadFile.KERNELBASE(00000000,00000000,?,?,00000000), ref: 00CFB326
                                                                                                                                                                                                              • CloseHandle.KERNELBASE(00000000), ref: 00CFB33F
                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 00CFB37C
                                                                                                                                                                                                              • CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00CFB558
                                                                                                                                                                                                              • WriteFile.KERNELBASE(00000000,00000000,?,?,00000000), ref: 00CFB5AB
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 00CFB5BC
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.1769524357.0000000000CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CF0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769509730.0000000000CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769557833.0000000000D27000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D61000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D70000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769632749.0000000000D72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_cf0000_YiqjcLlhew.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: File$CloseCreateHandle$CountReadTickWrite
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3478262135-0
                                                                                                                                                                                                              • Opcode ID: c4825ff9f0cb3f99b3ad211ce1a1d6f1bd32add79e605f71a419cfd629260f53
                                                                                                                                                                                                              • Instruction ID: a1b1affd5e7ad0fae4e7b31454212989b80b799157a95b9adb6d031a3765c720
                                                                                                                                                                                                              • Opcode Fuzzy Hash: c4825ff9f0cb3f99b3ad211ce1a1d6f1bd32add79e605f71a419cfd629260f53
                                                                                                                                                                                                              • Instruction Fuzzy Hash: DFB1EDB1A013049FD308AF28FD96B7A7BB5FB94311F104019E941DA3B1E7B49952CBB6

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 734 d05eb0-d05f2f call cf96f0 737 d05f31-d05f44 734->737 738 d05f4b-d05f83 call cf96f0 734->738 737->738 741 d05f91 738->741 742 d05f85-d05f8f 738->742 743 d05f9b-d06033 CreateProcessA 741->743 742->743 744 d06090-d060bf 743->744 745 d06035-d0608f CloseHandle * 2 743->745
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CreateProcessA.KERNELBASE(00001237,0066E0B8,00000000,00000000,00000000,00000008,00000000,00000000,00000044,0066DE48), ref: 00D0602B
                                                                                                                                                                                                              • CloseHandle.KERNEL32(0066E0B8), ref: 00D06043
                                                                                                                                                                                                              • CloseHandle.KERNEL32(0066DE48), ref: 00D06072
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.1769524357.0000000000CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CF0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769509730.0000000000CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769557833.0000000000D27000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D61000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D70000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769632749.0000000000D72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_cf0000_YiqjcLlhew.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CloseHandle$CreateProcess
                                                                                                                                                                                                              • String ID: D
                                                                                                                                                                                                              • API String ID: 2922976086-2746444292
                                                                                                                                                                                                              • Opcode ID: 8acb57419c4fb4c2fd4b824a7e9b3caf53506634850b8728cb5e0fad1d9d2303
                                                                                                                                                                                                              • Instruction ID: f440b4d0c4246f368c7220b587ae07995a6bd7e14b3340ee17ad9233824646b3
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8acb57419c4fb4c2fd4b824a7e9b3caf53506634850b8728cb5e0fad1d9d2303
                                                                                                                                                                                                              • Instruction Fuzzy Hash: F051CC766007018BD708CF68ED92BBA77B4F754712F14842AE906CB7B4EBB89905CB71

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 746 d156a0-d156bc 747 d156e8-d156fc GetProcessHeap RtlAllocateHeap 746->747 748 d156be-d156d4 746->748 748->747 749 d156d6-d156e2 748->749 749->747
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetProcessHeap.KERNEL32(00000000,?,?,00D08C4F,02053FC0,?,?,?,?,00D155F4), ref: 00D156EE
                                                                                                                                                                                                              • RtlAllocateHeap.NTDLL(00000000,?,00D08C4F,02053FC0,?,?,?,?,00D155F4), ref: 00D156F5
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.1769524357.0000000000CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CF0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769509730.0000000000CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769557833.0000000000D27000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D61000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D70000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769632749.0000000000D72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_cf0000_YiqjcLlhew.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Heap$AllocateProcess
                                                                                                                                                                                                              • String ID: |Q.H
                                                                                                                                                                                                              • API String ID: 1357844191-517162033
                                                                                                                                                                                                              • Opcode ID: 200c66922a40aec61cda95c9d9b2a9af9649a758eee35af5793dc06d2070a1bf
                                                                                                                                                                                                              • Instruction ID: ee5fa975ea043aa37b8ef910263b9395f1059883f868a770ded76bf20079fa16
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 200c66922a40aec61cda95c9d9b2a9af9649a758eee35af5793dc06d2070a1bf
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 63E0ED3010974AEFD7148F58FD88AAA3B34F358B227004000F00ACA320CA7894948731

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 750 cf70d0-cf716b call d26810 call d18570 755 cf716d-cf7190 750->755 756 cf71d0-cf721b CreateFileA 750->756 759 cf71a8-cf71cf call d12290 755->759 760 cf7192-cf71a2 755->760 757 cf72ad-cf72e9 756->757 758 cf7221-cf7269 call d12290 756->758 763 cf72fd-cf7305 757->763 764 cf72eb-cf72f7 757->764 768 cf727c-cf7298 758->768 769 cf726b-cf727b 758->769 760->759 767 cf7312-cf7330 763->767 764->763 770 cf7355-cf7389 767->770 771 cf7332-cf7353 767->771 774 cf729a-cf729f 768->774 775 cf72a6-cf72ac 768->775 772 cf7395-cf745d call cff1c0 call cfb680 WriteFile 770->772 773 cf738b 770->773 771->772 780 cf745f-cf746b 772->780 781 cf7471-cf7488 772->781 773->772 774->775 780->781 782 cf748e-cf74b6 781->782 783 cf7310 781->783 784 cf74b8-cf74f8 782->784 785 cf7522 782->785 783->767 786 cf750e-cf7520 784->786 787 cf74fa-cf750c 784->787 788 cf7524-cf7564 CloseHandle call d12290 785->788 786->788 787->788 791 cf758f-cf7597 788->791 792 cf7566-cf7574 788->792 792->791 793 cf7576-cf7589 792->793 793->791
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                • Part of subcall function 00D18570: WaitForSingleObject.KERNEL32(?,00004E20,?,00CF264E,0000012C,00000000,00000001,?,?,00D11B87,00CF17D5,?), ref: 00D185D7
                                                                                                                                                                                                              • CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000000,00000000,?,00000000,?,?,?,?,?,?,00000000), ref: 00CF71F7
                                                                                                                                                                                                              • WriteFile.KERNELBASE(00000000,?,00005000,00005000,00000000,?,?,?,?,?,?), ref: 00CF740F
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.1769524357.0000000000CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CF0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769509730.0000000000CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769557833.0000000000D27000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D61000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D70000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769632749.0000000000D72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_cf0000_YiqjcLlhew.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: File$CreateObjectSingleWaitWrite
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3285871581-0
                                                                                                                                                                                                              • Opcode ID: 7a318d56065eef5daf2269a3ea58845d03d7a9c703cdde4f913fd42202a7227b
                                                                                                                                                                                                              • Instruction ID: 2e41a3bdb90e1ae8cb2a04a167dcac85f45d548c8d18cf64b7e92f6413ceedc6
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7a318d56065eef5daf2269a3ea58845d03d7a9c703cdde4f913fd42202a7227b
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 72C110B2A04304DFD704DF25FD8566537B5F798312B21412AE946D63B8EBB099A0CFB2

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 818 cf7309 819 cf7310-cf7330 818->819 821 cf7355-cf7389 819->821 822 cf7332-cf7353 819->822 823 cf7395-cf745d call cff1c0 call cfb680 WriteFile 821->823 824 cf738b 821->824 822->823 829 cf745f-cf746b 823->829 830 cf7471-cf7488 823->830 824->823 829->830 830->819 831 cf748e-cf74b6 830->831 832 cf74b8-cf74f8 831->832 833 cf7522 831->833 834 cf750e-cf7520 832->834 835 cf74fa-cf750c 832->835 836 cf7524-cf7564 CloseHandle call d12290 833->836 834->836 835->836 839 cf758f-cf7597 836->839 840 cf7566-cf7574 836->840 840->839 841 cf7576-cf7589 840->841 841->839
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • WriteFile.KERNELBASE(00000000,?,00005000,00005000,00000000,?,?,?,?,?,?), ref: 00CF740F
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00CF7525
                                                                                                                                                                                                                • Part of subcall function 00D12290: ReleaseMutex.KERNEL32(00CF2A8B,?,00CF2A8B,0000012C), ref: 00D122E7
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.1769524357.0000000000CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CF0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769509730.0000000000CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769557833.0000000000D27000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D61000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D70000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769632749.0000000000D72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_cf0000_YiqjcLlhew.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CloseFileHandleMutexReleaseWrite
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 157576396-0
                                                                                                                                                                                                              • Opcode ID: 1cb5e12f5c2f0f36389ab0c8597505ff11d4a5d90d86a2bba440a291ae19bafc
                                                                                                                                                                                                              • Instruction ID: c6c7186538ce55416a04ac1445ba0fddeaac07ea07f2dcffcb98eededb1555b7
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1cb5e12f5c2f0f36389ab0c8597505ff11d4a5d90d86a2bba440a291ae19bafc
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 87510EB2A00304CBC744DF28FD846693BB5F794312B215156E946D63B8EB719AA0CFB2

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 794 cf7307 795 cf7310-cf7330 794->795 797 cf7355-cf7389 795->797 798 cf7332-cf7353 795->798 799 cf7395-cf745d call cff1c0 call cfb680 WriteFile 797->799 800 cf738b 797->800 798->799 805 cf745f-cf746b 799->805 806 cf7471-cf7488 799->806 800->799 805->806 806->795 807 cf748e-cf74b6 806->807 808 cf74b8-cf74f8 807->808 809 cf7522 807->809 810 cf750e-cf7520 808->810 811 cf74fa-cf750c 808->811 812 cf7524-cf7564 CloseHandle call d12290 809->812 810->812 811->812 815 cf758f-cf7597 812->815 816 cf7566-cf7574 812->816 816->815 817 cf7576-cf7589 816->817 817->815
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • WriteFile.KERNELBASE(00000000,?,00005000,00005000,00000000,?,?,?,?,?,?), ref: 00CF740F
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00CF7525
                                                                                                                                                                                                                • Part of subcall function 00D12290: ReleaseMutex.KERNEL32(00CF2A8B,?,00CF2A8B,0000012C), ref: 00D122E7
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.1769524357.0000000000CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CF0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769509730.0000000000CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769557833.0000000000D27000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D61000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D70000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769632749.0000000000D72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_cf0000_YiqjcLlhew.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CloseFileHandleMutexReleaseWrite
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 157576396-0
                                                                                                                                                                                                              • Opcode ID: 18e13a0fc127c2a3bb8dc0a86d5694833033c95d7ff69527165d00f2f0765246
                                                                                                                                                                                                              • Instruction ID: b83814ebfc3177df72a84f1c5de37ea916bb8184a6b88a983412c381d7548af0
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 18e13a0fc127c2a3bb8dc0a86d5694833033c95d7ff69527165d00f2f0765246
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6351F0B2E00304CBC744DF28FD846653BB5F794352B215156E946D63B8EB7199A0CFB2

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                • Part of subcall function 00D16BE0: GetStdHandle.KERNEL32(000000F6,?,?,00D15560), ref: 00D16C12
                                                                                                                                                                                                                • Part of subcall function 00D16BE0: GetStdHandle.KERNEL32(000000F5,?,?,00D15560), ref: 00D16C6A
                                                                                                                                                                                                                • Part of subcall function 00D16BE0: GetStdHandle.KERNEL32(000000F4,?,?,00D15560), ref: 00D16D53
                                                                                                                                                                                                              • ExitProcess.KERNEL32 ref: 00D1561B
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.1769524357.0000000000CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CF0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769509730.0000000000CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769557833.0000000000D27000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D61000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D70000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769632749.0000000000D72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_cf0000_YiqjcLlhew.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Handle$ExitProcess
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 256993070-0
                                                                                                                                                                                                              • Opcode ID: c0c480f0890a880d5f85982a028916b8f09157c860f9752e60f01db49528aee4
                                                                                                                                                                                                              • Instruction ID: c36326da482298cdc453613f24bdd8c3a9b41b9b540b35ec4c8ce6af88f54f9c
                                                                                                                                                                                                              • Opcode Fuzzy Hash: c0c480f0890a880d5f85982a028916b8f09157c860f9752e60f01db49528aee4
                                                                                                                                                                                                              • Instruction Fuzzy Hash: CE113A76A11700DFEB10AF30FD8605937B9F7643823168415E442CA775EBB4C865DB71

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 939 cfc9b0-cfc9e8 call cfa640 ExitProcess
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.1769524357.0000000000CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CF0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769509730.0000000000CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769557833.0000000000D27000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D61000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D70000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769632749.0000000000D72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_cf0000_YiqjcLlhew.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ExitProcess
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 621844428-0
                                                                                                                                                                                                              • Opcode ID: 364097ced119dc05dfea20aad787726a46003837b5ce1baf46e37a65fb0bacec
                                                                                                                                                                                                              • Instruction ID: f7b715e75615c190fe3287586ca9642d110880dde0a2861abf5ce2ef7e996b91
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 364097ced119dc05dfea20aad787726a46003837b5ce1baf46e37a65fb0bacec
                                                                                                                                                                                                              • Instruction Fuzzy Hash: EBE0E2B8210308CFD304EF69FC854297B78FB947503118016E849CA371C7B4A880CFBA

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 942 d18a10-d18a3e 943 d18a40-d18a56 942->943 944 d18a58-d18a76 942->944 945 d18a7c-d18a9d lstrlen 943->945 944->945 946 d18aa4-d18ac9 945->946 947 d18acb-d18adf 946->947 948 d18aee-d18b09 946->948 949 d18b39-d18b3b 947->949 951 d18ae1-d18aed 947->951 948->949 950 d18b0b-d18b33 948->950 950->949
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • lstrlen.KERNEL32(?,00000000,?,00CF220B,?,?,?), ref: 00D18A81
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.1769524357.0000000000CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CF0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769509730.0000000000CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769557833.0000000000D27000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D61000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D70000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769632749.0000000000D72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_cf0000_YiqjcLlhew.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlen
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1659193697-0
                                                                                                                                                                                                              • Opcode ID: b0a5831f0b97c1e286d7e05590d449c149f9a6413b3c8dd1bbd6db36bc725e19
                                                                                                                                                                                                              • Instruction ID: c621767f85bc8ab7c50ddcf1c6b17bdaeced97873ff6f4d3b15ba8350dcc3f15
                                                                                                                                                                                                              • Opcode Fuzzy Hash: b0a5831f0b97c1e286d7e05590d449c149f9a6413b3c8dd1bbd6db36bc725e19
                                                                                                                                                                                                              • Instruction Fuzzy Hash: CB210675A05714DFD318EF68FC591B53BB4F7993223114426D58AC23B8EB7098A1CB70
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.1769524357.0000000000CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CF0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769509730.0000000000CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769557833.0000000000D27000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D61000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D70000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769632749.0000000000D72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_cf0000_YiqjcLlhew.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                              • String ID: /$]:8$y.n$~~w
                                                                                                                                                                                                              • API String ID: 0-3013001717
                                                                                                                                                                                                              • Opcode ID: fc1957cc658f282a18e8bac8543b1a597c2f420cbe043e16fe26dd6793eeb690
                                                                                                                                                                                                              • Instruction ID: b5ce3a9ed7b1c0349c7aad3976da6b8782bf2f96d604c270fc01510d8fe0c356
                                                                                                                                                                                                              • Opcode Fuzzy Hash: fc1957cc658f282a18e8bac8543b1a597c2f420cbe043e16fe26dd6793eeb690
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 05A21171A00305DFD704EF24FC866A93BB5FB94301B11402AE986D63B4EBB199A5CF76
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetProcessHeap.KERNEL32(?,?,?,?,?,00000000,?,?,?,?,?,?,?,?,00D00E0A,?), ref: 00D23945
                                                                                                                                                                                                              • LoadLibraryA.KERNEL32(00000000,?,00000001,?,?,?,?,?,00000000), ref: 00D23A07
                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,00000000), ref: 00D23AF2
                                                                                                                                                                                                              • FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,00000001,?,?,?,?,?,00000000), ref: 00D23B50
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000000,00000288,?,?,?,?,?,?,?,00000001), ref: 00D23BF7
                                                                                                                                                                                                              • FreeLibrary.KERNEL32(00000100,?,?,?,?,?,?,?,00000001,?,?,?,?,?,00000000), ref: 00D23C42
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,00000001), ref: 00D23D56
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000000,00000288,?,?,?,?,?,?,?,00000001), ref: 00D23D94
                                                                                                                                                                                                              • FreeLibrary.KERNEL32(00000100,?,?,?,?,?,?,?,00000001,?,?,?,?,?,00000000), ref: 00D23E0E
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,00000001), ref: 00D244A5
                                                                                                                                                                                                              • FreeLibrary.KERNEL32(00000100,?,?,?,?,?,?,?,00000001,?,?,?,?,?,00000000), ref: 00D244CF
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.1769524357.0000000000CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CF0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769509730.0000000000CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769557833.0000000000D27000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D61000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D70000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769632749.0000000000D72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_cf0000_YiqjcLlhew.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Free$HeapLibrary$Alloc$AddressLoadProcProcess
                                                                                                                                                                                                              • String ID: V\v(
                                                                                                                                                                                                              • API String ID: 1560921867-3864276540
                                                                                                                                                                                                              • Opcode ID: dbf4cfeee60377426ce0ff2e9069906ef9085e9b297e556e5dffd709714f0441
                                                                                                                                                                                                              • Instruction ID: 06e0095bf552aaa98aa81e23f7b763fd1a36400fff78bbd7986e1b67355fbacf
                                                                                                                                                                                                              • Opcode Fuzzy Hash: dbf4cfeee60377426ce0ff2e9069906ef9085e9b297e556e5dffd709714f0441
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 13720CB5A00310CFC7089F25FD965657BB5FBA8311B11811AE882D63B8EBB489A1CF75
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • OpenSCManagerA.ADVAPI32(00000000,00000000,00000002), ref: 00CF546E
                                                                                                                                                                                                              • CreateServiceA.ADVAPI32(00000000,00660EF0,00660EF0,000F01FF,00000110,00000002,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00CF54BD
                                                                                                                                                                                                              • ChangeServiceConfig2A.ADVAPI32(00000000,00000001,?), ref: 00CF5503
                                                                                                                                                                                                              • StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00CF5533
                                                                                                                                                                                                              • CloseServiceHandle.ADVAPI32(00000000), ref: 00CF5593
                                                                                                                                                                                                              • OpenServiceA.ADVAPI32(00000000,00660EF0,00000010), ref: 00CF55DE
                                                                                                                                                                                                              • StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00CF566C
                                                                                                                                                                                                              • CloseServiceHandle.ADVAPI32(00000000), ref: 00CF567D
                                                                                                                                                                                                              • CloseServiceHandle.ADVAPI32(00000000), ref: 00CF56CC
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.1769524357.0000000000CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CF0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769509730.0000000000CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769557833.0000000000D27000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D61000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D70000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769632749.0000000000D72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_cf0000_YiqjcLlhew.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Service$CloseHandle$OpenStart$ChangeConfig2CreateManager
                                                                                                                                                                                                              • String ID: |Sxz
                                                                                                                                                                                                              • API String ID: 3525021261-962673421
                                                                                                                                                                                                              • Opcode ID: 7ccf55467c950ed314591b85669f4315f1a70849bf8c43f3f007b6c2f75cb76b
                                                                                                                                                                                                              • Instruction ID: 2c8afdcd2890471b6c735dac5b8d2ec25cd7edf120138b76c03aa50ec86d52ef
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7ccf55467c950ed314591b85669f4315f1a70849bf8c43f3f007b6c2f75cb76b
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7881DA71A01B05DBD314DF24FE85A663BB1F7A4312F114026EA82D63B8E7B09891CF76
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.1769524357.0000000000CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CF0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769509730.0000000000CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769557833.0000000000D27000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D61000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D70000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769632749.0000000000D72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_cf0000_YiqjcLlhew.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: wvsprintf
                                                                                                                                                                                                              • String ID: %$0$0$awwr$d$l$l$o$p$EsY
                                                                                                                                                                                                              • API String ID: 2795597889-1724666621
                                                                                                                                                                                                              • Opcode ID: 6a9338af74eb82edc2f374bb42eef0fa84d1f14be92ee75fa6c84c42c7c0f2a0
                                                                                                                                                                                                              • Instruction ID: c5169e881e6bbc6f7cefecfa566482ed1dabe28f159551e40e2ee56d72c3240f
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6a9338af74eb82edc2f374bb42eef0fa84d1f14be92ee75fa6c84c42c7c0f2a0
                                                                                                                                                                                                              • Instruction Fuzzy Hash: E98210B6A10305CBD714DF68FD852683BB1F7A4300B258926D486D73B8E7B188A5CFB5
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000,?,00000000), ref: 00D1035F
                                                                                                                                                                                                              • Process32First.KERNEL32(00000000,?), ref: 00D103DB
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.1769524357.0000000000CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CF0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769509730.0000000000CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769557833.0000000000D27000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D61000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D70000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769632749.0000000000D72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_cf0000_YiqjcLlhew.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CreateFirstProcess32SnapshotToolhelp32
                                                                                                                                                                                                              • String ID: i*Vd
                                                                                                                                                                                                              • API String ID: 2353314856-4103011120
                                                                                                                                                                                                              • Opcode ID: 9d703689f8afa059f3864b9e64cc40c76b33323ef2fb4baddd6bc50ab529824d
                                                                                                                                                                                                              • Instruction ID: eff8d5986bcec4e683bd77144468b40578906ec160edea491e62e5e06a94e9ba
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9d703689f8afa059f3864b9e64cc40c76b33323ef2fb4baddd6bc50ab529824d
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4CA10FB5A10304DBD314AF24FD956B63BB0FB94312B114419D886D63B4EBB099E1CFB5
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • OpenSCManagerA.ADVAPI32(00000000,00000000,80000000), ref: 00D0643A
                                                                                                                                                                                                              • EnumServicesStatusA.ADVAPI32(00000000,00000030,00000003,?,00000024,?,?,00000000), ref: 00D064AC
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 00D064C1
                                                                                                                                                                                                              • EnumServicesStatusA.ADVAPI32(00000000,00000030,00000003,00000000,?,?,?,00000000), ref: 00D065D1
                                                                                                                                                                                                              • CloseServiceHandle.ADVAPI32(00000000), ref: 00D06829
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.1769524357.0000000000CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CF0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769509730.0000000000CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769557833.0000000000D27000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D61000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D70000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769632749.0000000000D72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_cf0000_YiqjcLlhew.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: EnumServicesStatus$CloseErrorHandleLastManagerOpenService
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1579346331-0
                                                                                                                                                                                                              • Opcode ID: 6208b57f84bd3660c16ba9c3da87967fcee300058df1403c8e06dde6efcb52cf
                                                                                                                                                                                                              • Instruction ID: 9ea339f9ab476070ccaf963eb0ca4e05b00ea16a77e517d25dcb58bcd11e63ea
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6208b57f84bd3660c16ba9c3da87967fcee300058df1403c8e06dde6efcb52cf
                                                                                                                                                                                                              • Instruction Fuzzy Hash: E70233B6A00701DBC7049F65FD896A53BB0FB95311B22411AD486D33B8EBB089A5CFB5
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.1769524357.0000000000CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CF0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769509730.0000000000CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769557833.0000000000D27000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D61000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D70000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769632749.0000000000D72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_cf0000_YiqjcLlhew.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                              • String ID: P$`U$c!N|$e!Y
                                                                                                                                                                                                              • API String ID: 0-1342610667
                                                                                                                                                                                                              • Opcode ID: 2b9e8826e664b88ce7c46d29b9b119256bb62e9ce01ead5ffe792c9805217083
                                                                                                                                                                                                              • Instruction ID: c796de4ca049bce12b80a56b6301475b03027d737617b6e7306ab8b98340acfb
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2b9e8826e664b88ce7c46d29b9b119256bb62e9ce01ead5ffe792c9805217083
                                                                                                                                                                                                              • Instruction Fuzzy Hash: AFB2B6BAA10705CBC318DF28FD956657BB0FB68312316451AD886C73B4E7B498A1CFB4
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.1769524357.0000000000CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CF0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769509730.0000000000CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769557833.0000000000D27000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D61000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D70000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769632749.0000000000D72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_cf0000_YiqjcLlhew.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                              • String ID: Ip!$U!qV$p66
                                                                                                                                                                                                              • API String ID: 0-2622703595
                                                                                                                                                                                                              • Opcode ID: 3e16bac401a7874b6be6b5f0b2a1ee19dc7a5aec249190dcebd0e243a2d9e119
                                                                                                                                                                                                              • Instruction ID: e60dd92ed9d946e210e0c90aed80c324baaea2c6c4e41843ed15bfb654107a9f
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3e16bac401a7874b6be6b5f0b2a1ee19dc7a5aec249190dcebd0e243a2d9e119
                                                                                                                                                                                                              • Instruction Fuzzy Hash: A6A2FC76A01315CBCB14DF68FD815AA7BB1FBA8311B15821AE841E7378E7709991CFB0
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.1769524357.0000000000CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CF0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769509730.0000000000CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769557833.0000000000D27000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D61000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D70000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769632749.0000000000D72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_cf0000_YiqjcLlhew.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                              • String ID: #DK`$<n$=t
                                                                                                                                                                                                              • API String ID: 0-4127147426
                                                                                                                                                                                                              • Opcode ID: 8f2e793516a0515522fc032da2c5612d78735a6594900ad4ed8ae22501c602bd
                                                                                                                                                                                                              • Instruction ID: 29f39d46c09a1e6eee22556520210da79542b3a9791d7ee1b8fa2e4b877b8ba7
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8f2e793516a0515522fc032da2c5612d78735a6594900ad4ed8ae22501c602bd
                                                                                                                                                                                                              • Instruction Fuzzy Hash: FF820F75A00716DBCB14DF24FD85ABA7BB5FBA4304B15801AE842D3368E7B09991CFB1
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.1769524357.0000000000CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CF0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769509730.0000000000CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769557833.0000000000D27000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D61000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D70000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769632749.0000000000D72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_cf0000_YiqjcLlhew.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                              • String ID: 0$o$EsY
                                                                                                                                                                                                              • API String ID: 0-2620701410
                                                                                                                                                                                                              • Opcode ID: aa5d0305c3a059a014a3626ed083f31ab646bb7e7dc1a713d170902dbf89ebdf
                                                                                                                                                                                                              • Instruction ID: c35b6507d3658bf31510531930ad08031feca35e9909a66486eef1b6d74eda7f
                                                                                                                                                                                                              • Opcode Fuzzy Hash: aa5d0305c3a059a014a3626ed083f31ab646bb7e7dc1a713d170902dbf89ebdf
                                                                                                                                                                                                              • Instruction Fuzzy Hash: FA52FEB5A00305CBC714DF28FD892687BB1FBA4300B264526D486D73B8E7B198A5CFB4
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetComputerNameA.KERNEL32(?,?), ref: 00D00B3D
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.1769524357.0000000000CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CF0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769509730.0000000000CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769557833.0000000000D27000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D61000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D70000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769632749.0000000000D72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_cf0000_YiqjcLlhew.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ComputerName
                                                                                                                                                                                                              • String ID: f
                                                                                                                                                                                                              • API String ID: 3545744682-3739981918
                                                                                                                                                                                                              • Opcode ID: a9e122473977282a22a5389c04ab5eaad4591298cd153a116f303a9a8859fb67
                                                                                                                                                                                                              • Instruction ID: f79a524ec247b341b003499c2408248b7af7f5b00c8c7e5f62e0a1e9d12dd703
                                                                                                                                                                                                              • Opcode Fuzzy Hash: a9e122473977282a22a5389c04ab5eaad4591298cd153a116f303a9a8859fb67
                                                                                                                                                                                                              • Instruction Fuzzy Hash: CF621171900309DBC704EF24FD96AAA3BB5FB64311F10411AE546D23B5EBB09A95CF72
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.1769524357.0000000000CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CF0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769509730.0000000000CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769557833.0000000000D27000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D61000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D70000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769632749.0000000000D72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_cf0000_YiqjcLlhew.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Sleep
                                                                                                                                                                                                              • String ID: m%X
                                                                                                                                                                                                              • API String ID: 3472027048-509761171
                                                                                                                                                                                                              • Opcode ID: a7b70e754f0e3205a04b53fcf06c5d385ab9afb9a76c921ba7ae013bd473ac87
                                                                                                                                                                                                              • Instruction ID: ce645f1e9a6c7df680bf626195306e2db2f3255637b98b0c8166b2443c501f15
                                                                                                                                                                                                              • Opcode Fuzzy Hash: a7b70e754f0e3205a04b53fcf06c5d385ab9afb9a76c921ba7ae013bd473ac87
                                                                                                                                                                                                              • Instruction Fuzzy Hash: DE5232B6A00304DBC744DF64FD966B93BB1FB54311B11411AE942E23B4EBB08AA5CF76
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CreateThread.KERNEL32(00000000,00000000,00D14EB0,00000000,00000000,00000000), ref: 00CF9FA3
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 00CF9FD2
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.1769524357.0000000000CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CF0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769509730.0000000000CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769557833.0000000000D27000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D61000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D70000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769632749.0000000000D72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_cf0000_YiqjcLlhew.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CloseCreateHandleThread
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3032276028-0
                                                                                                                                                                                                              • Opcode ID: dc161a735bbaf5502a478ee078e1ba2c302f9bc3046f315ac2b95508caebeaa7
                                                                                                                                                                                                              • Instruction ID: ce1d6a69d5474b575af96081dfd2a1f9f14963763ccad2a5bbdf9f6460e5e414
                                                                                                                                                                                                              • Opcode Fuzzy Hash: dc161a735bbaf5502a478ee078e1ba2c302f9bc3046f315ac2b95508caebeaa7
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9B5231B1A10305DBCB44EF25FC856793BB5FBA5301B11811AE982D63B4EBB08961CF76
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetSystemTimeAsFileTime.KERNEL32(?,?,?,00CF2C4A), ref: 00CF7AD5
                                                                                                                                                                                                              • __aulldiv.LIBCMT ref: 00CF7B08
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.1769524357.0000000000CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CF0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769509730.0000000000CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769557833.0000000000D27000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D61000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D70000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769632749.0000000000D72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_cf0000_YiqjcLlhew.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Time$FileSystem__aulldiv
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 2838486344-0
                                                                                                                                                                                                              • Opcode ID: 85bf38d4fabfc35e345fed5f45e3e2d23bcf1f6b89eec30f5b51a1fcbaff6c43
                                                                                                                                                                                                              • Instruction ID: 899cefade8f1b01d4cd3c36b40654cb1d356e86e76cbc47d4f041413817eeefd
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 85bf38d4fabfc35e345fed5f45e3e2d23bcf1f6b89eec30f5b51a1fcbaff6c43
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 24310D76909314CBC348CF64FDA11787BB1FB99326712422AE982D77B0E7744880DBB5
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.1769524357.0000000000CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CF0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769509730.0000000000CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769557833.0000000000D27000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D61000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D70000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769632749.0000000000D72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_cf0000_YiqjcLlhew.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                              • String ID: h4_[
                                                                                                                                                                                                              • API String ID: 0-1026458715
                                                                                                                                                                                                              • Opcode ID: a7d63dc74d06f3e028065f2de8c4cdd0036d4b6cee6139214f2768058cfa2fac
                                                                                                                                                                                                              • Instruction ID: 93d66531a8518f07971e1d24a08e6c509bb95705a2cb00cc7ce36ff2efa3b9b9
                                                                                                                                                                                                              • Opcode Fuzzy Hash: a7d63dc74d06f3e028065f2de8c4cdd0036d4b6cee6139214f2768058cfa2fac
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0B6253B5A00309CFC744EF65FC952B83BB2FB65311B11411AD982D63B8E7B14961CBB6
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.1769524357.0000000000CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CF0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769509730.0000000000CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769557833.0000000000D27000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D61000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D70000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769632749.0000000000D72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_cf0000_YiqjcLlhew.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                              • String ID: EsY
                                                                                                                                                                                                              • API String ID: 0-1269534008
                                                                                                                                                                                                              • Opcode ID: d30f58531018115368bef2eef71bd923f626bfd4f002a67961fa943dba54bbce
                                                                                                                                                                                                              • Instruction ID: 74e69ea13bc90722088e77a6b3992e6709cb80b930ccb2e1bafb0aa9605ff143
                                                                                                                                                                                                              • Opcode Fuzzy Hash: d30f58531018115368bef2eef71bd923f626bfd4f002a67961fa943dba54bbce
                                                                                                                                                                                                              • Instruction Fuzzy Hash: AB6210B5A00305CFC7149F68FD892643BB2FBA43117268516D886D73B8E7B188A5CFB5
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.1769524357.0000000000CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CF0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769509730.0000000000CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769557833.0000000000D27000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D61000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D70000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769632749.0000000000D72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_cf0000_YiqjcLlhew.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                              • String ID: EsY
                                                                                                                                                                                                              • API String ID: 0-1269534008
                                                                                                                                                                                                              • Opcode ID: 91cf1534286079bd25abba3c56671f52af1cbadcbe4f010c53ae2ea5047dece3
                                                                                                                                                                                                              • Instruction ID: 6e6092d43540799ff82afcabfa797cf87ed247c67dec1741211f83f01ea0ecf7
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 91cf1534286079bd25abba3c56671f52af1cbadcbe4f010c53ae2ea5047dece3
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 782210B6A10305CFC7149F68FD892643BB2F794301B264516C886D33B8E7B198A5CFB5
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.1769524357.0000000000CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CF0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769509730.0000000000CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769557833.0000000000D27000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D61000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D70000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769632749.0000000000D72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_cf0000_YiqjcLlhew.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                              • String ID: h4_[
                                                                                                                                                                                                              • API String ID: 0-1026458715
                                                                                                                                                                                                              • Opcode ID: 6e81f4c94b8f340229337ec75bd88a9715b6398e3ccea6bfa793fa43e40f10c3
                                                                                                                                                                                                              • Instruction ID: 6290e7f976ba28d17d83d7cb1bc400d46fd49696cda824a498fe481a3a4e0676
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6e81f4c94b8f340229337ec75bd88a9715b6398e3ccea6bfa793fa43e40f10c3
                                                                                                                                                                                                              • Instruction Fuzzy Hash: B22241B5900309CFDB449F64FC952B83BB2FB61310B11815AD982DB3B8E7B14956CBB2
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 00CF645B
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.1769524357.0000000000CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CF0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769509730.0000000000CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769557833.0000000000D27000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D61000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D70000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769632749.0000000000D72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_cf0000_YiqjcLlhew.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CtrlDispatcherServiceStart
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3789849863-0
                                                                                                                                                                                                              • Opcode ID: bec80fc0db82ab81dbcdfc8980795a63a9863e334e9f093adcdc6780f3657771
                                                                                                                                                                                                              • Instruction ID: 71f279480cc2d79cee8da49419fcc6334efe45d4783e89e242a8a16cb9e537bc
                                                                                                                                                                                                              • Opcode Fuzzy Hash: bec80fc0db82ab81dbcdfc8980795a63a9863e334e9f093adcdc6780f3657771
                                                                                                                                                                                                              • Instruction Fuzzy Hash: A4E046B2C14308EFCB00DFA4EC440AABBB4FB04310B108AAAE909E7310EB7046048FA1
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.1769524357.0000000000CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CF0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769509730.0000000000CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769557833.0000000000D27000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D61000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D70000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769632749.0000000000D72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_cf0000_YiqjcLlhew.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                              • Opcode ID: a6e1982480381805c8eaedd5c3fe7a328d9545fededd6cfaa01a79e003fa751f
                                                                                                                                                                                                              • Instruction ID: f0864fc1b04ea5330ce43748d81455f11b663325e3a1710bb9c67dfe3f61da75
                                                                                                                                                                                                              • Opcode Fuzzy Hash: a6e1982480381805c8eaedd5c3fe7a328d9545fededd6cfaa01a79e003fa751f
                                                                                                                                                                                                              • Instruction Fuzzy Hash: BC120EB6A11705CBC344AF29FD891647BB1F794311322811AD886C73B8E77098A1CFB6
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.1769524357.0000000000CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CF0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769509730.0000000000CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769557833.0000000000D27000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D61000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D70000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769632749.0000000000D72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_cf0000_YiqjcLlhew.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                              • Opcode ID: a03086340f74aac1feaed27645c99fd3749a065738c1b65c25117e88ee6be209
                                                                                                                                                                                                              • Instruction ID: e43d1dc443d4b1472d34a73ec227a5e0d49d0c65cbada049b76b41f6444f60c6
                                                                                                                                                                                                              • Opcode Fuzzy Hash: a03086340f74aac1feaed27645c99fd3749a065738c1b65c25117e88ee6be209
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2E0221B2A00315EFC704AF64FD956693BB5FBA43107114429E882D33B5EBB588A1CFB5
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.1769524357.0000000000CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CF0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769509730.0000000000CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769557833.0000000000D27000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D61000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D70000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769632749.0000000000D72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_cf0000_YiqjcLlhew.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                              • Opcode ID: 1bf447446b9a64fd4ed73ef8b9cdf7951a575d50c2ea33e434f125860470aeac
                                                                                                                                                                                                              • Instruction ID: 276bab301818af51c997ac79a17f754acbc202739efed9273d3a47d2dd339627
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1bf447446b9a64fd4ed73ef8b9cdf7951a575d50c2ea33e434f125860470aeac
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 45F1EC75A11724CBCB18DF28FCA51687BB1FBA8311705812AE842E73B4D7B49891CBB4
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.1769524357.0000000000CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CF0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769509730.0000000000CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769557833.0000000000D27000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D61000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D70000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769632749.0000000000D72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_cf0000_YiqjcLlhew.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                              • Opcode ID: 8d4d193c33e54bef50bb9c2ba59d1c6af104fe5ce3b24204b077b9315dab59ab
                                                                                                                                                                                                              • Instruction ID: 150dabef2f2fb11f4ce7119eb1d667f9e46344b47b75f01e79f040f5c1443364
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8d4d193c33e54bef50bb9c2ba59d1c6af104fe5ce3b24204b077b9315dab59ab
                                                                                                                                                                                                              • Instruction Fuzzy Hash: F5F12FB5A01700CFC308DF28FD952A87BB1FBA9311715812AD881D73B5E7B49896CBB5
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.1769524357.0000000000CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CF0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769509730.0000000000CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769557833.0000000000D27000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D61000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D70000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769632749.0000000000D72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_cf0000_YiqjcLlhew.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                              • Opcode ID: 88671b78f30fd3207a8c171f1b91e9db25c1738073756b9c60ba23b39347a94b
                                                                                                                                                                                                              • Instruction ID: aeb2581a3e6db3467996e96470d6757dca63f870499095a41260b43aed8e1712
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 88671b78f30fd3207a8c171f1b91e9db25c1738073756b9c60ba23b39347a94b
                                                                                                                                                                                                              • Instruction Fuzzy Hash: E6F1DB76A14311DFC708AF29FDA11A47BB0FB64311316401AD882DB375EBB498A5CFB5
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.1769524357.0000000000CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CF0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769509730.0000000000CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769557833.0000000000D27000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D61000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D70000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769632749.0000000000D72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_cf0000_YiqjcLlhew.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                              • Opcode ID: d1e03d215476e2bfb7245ee24f2a499d7e0e5c2b0ce0a05eaaba5c2f21bff991
                                                                                                                                                                                                              • Instruction ID: 2d1942a66e5a9c52f578a10eea1701a5f2537c077968b45c8a61f5bf2be2a92b
                                                                                                                                                                                                              • Opcode Fuzzy Hash: d1e03d215476e2bfb7245ee24f2a499d7e0e5c2b0ce0a05eaaba5c2f21bff991
                                                                                                                                                                                                              • Instruction Fuzzy Hash: B6D10D76A01B15CFD7489F28FC961763BB0FB95312711811AE881C63B5EBB488A2CF75
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.1769524357.0000000000CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CF0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769509730.0000000000CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769557833.0000000000D27000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D61000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D70000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769632749.0000000000D72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_cf0000_YiqjcLlhew.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                              • Opcode ID: 37b57d18070a31887d3d72c6e205d3f3958561ae843cff03da40d2fcf9a8972c
                                                                                                                                                                                                              • Instruction ID: 28754f7998bbe792f9ff4998d9be51e3178e607fe30ab4da88bd8ff1543a23ad
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 37b57d18070a31887d3d72c6e205d3f3958561ae843cff03da40d2fcf9a8972c
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 85B1EE72A10714EBD724CF68FD81AA637B5FB58310F148506E806DB378EB709A91CBB5
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.1769524357.0000000000CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CF0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769509730.0000000000CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769557833.0000000000D27000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D61000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D70000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769632749.0000000000D72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_cf0000_YiqjcLlhew.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID:
                                                                                                                                                                                                              • Opcode ID: 3134f4651de5fe023c63dc79e0cd8536b791e3a76b057ad304140b19f7030f17
                                                                                                                                                                                                              • Instruction ID: 23bbcac0c8f0a55162a58f603e8b70865ca5a62c1534122df79e063bf26371f0
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3134f4651de5fe023c63dc79e0cd8536b791e3a76b057ad304140b19f7030f17
                                                                                                                                                                                                              • Instruction Fuzzy Hash: EF91DE76900716DBC714CF29FC8146177B6FB98321755822AD855C7338EB75A982CFB0
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00CFCB8A
                                                                                                                                                                                                              • SetHandleInformation.KERNEL32(?,00000001,00000000), ref: 00CFCBD0
                                                                                                                                                                                                              • CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00CFCC2C
                                                                                                                                                                                                              • SetHandleInformation.KERNEL32(?,00000001,00000000), ref: 00CFCCA8
                                                                                                                                                                                                              • CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,?,00000044,?), ref: 00CFCE0D
                                                                                                                                                                                                              • CloseHandle.KERNEL32(?), ref: 00CFCE48
                                                                                                                                                                                                              • CloseHandle.KERNEL32(?), ref: 00CFCE70
                                                                                                                                                                                                              • CloseHandle.KERNEL32(?), ref: 00CFCEA0
                                                                                                                                                                                                              • CloseHandle.KERNEL32(?), ref: 00CFCEB8
                                                                                                                                                                                                              • WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00CFCFA0
                                                                                                                                                                                                              • CloseHandle.KERNEL32(?), ref: 00CFCFD3
                                                                                                                                                                                                              • CloseHandle.KERNEL32(?), ref: 00CFCFEE
                                                                                                                                                                                                              • WaitForSingleObject.KERNEL32(?,00002710), ref: 00CFD09F
                                                                                                                                                                                                              • CloseHandle.KERNEL32(?), ref: 00CFD0B3
                                                                                                                                                                                                              • CloseHandle.KERNEL32(?), ref: 00CFD0EB
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.1769524357.0000000000CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CF0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769509730.0000000000CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769557833.0000000000D27000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D61000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D70000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769632749.0000000000D72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_cf0000_YiqjcLlhew.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Handle$Close$Create$InformationPipe$FileObjectProcessSingleWaitWrite
                                                                                                                                                                                                              • String ID: D$S')G
                                                                                                                                                                                                              • API String ID: 1130065513-1494146028
                                                                                                                                                                                                              • Opcode ID: bde45243aea8fcf66ece09b430e96342ba37b8dba5f15bd31b6ee55ca7672e12
                                                                                                                                                                                                              • Instruction ID: 654260f9b043f4eb1892c3fcd2bba48762ec0801f90bb32f0d1fbb36eb3eba11
                                                                                                                                                                                                              • Opcode Fuzzy Hash: bde45243aea8fcf66ece09b430e96342ba37b8dba5f15bd31b6ee55ca7672e12
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2E02FCB5A00308DFD704DF65FD89AA93BB5FB98311B11811AE542D63B8E7B08860CF75
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00D140AF
                                                                                                                                                                                                              • Process32First.KERNEL32(00000000,?), ref: 00D14187
                                                                                                                                                                                                              • CreateToolhelp32Snapshot.KERNEL32(00000008,?), ref: 00D143B2
                                                                                                                                                                                                              • Module32First.KERNEL32(00000000,?), ref: 00D143F6
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000,0000000A,?,00000000), ref: 00D1454D
                                                                                                                                                                                                              • Process32Next.KERNEL32(?,00000128), ref: 00D14584
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 00D145FA
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.1769524357.0000000000CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CF0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769509730.0000000000CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769557833.0000000000D27000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D61000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D70000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769632749.0000000000D72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_cf0000_YiqjcLlhew.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32$Module32Next
                                                                                                                                                                                                              • String ID: "L=/
                                                                                                                                                                                                              • API String ID: 930127669-2479274474
                                                                                                                                                                                                              • Opcode ID: 118012c613f6746d8a73bd006fd4b0ff8fe1feaaf89641b0c32cee692aa4b6ad
                                                                                                                                                                                                              • Instruction ID: c233a29ed2ca50cdb94bf5684d8895dcffb6c755d3b8b743dd80dfe9540339a2
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 118012c613f6746d8a73bd006fd4b0ff8fe1feaaf89641b0c32cee692aa4b6ad
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5FF146B5A00704DFD714EF20FD896A53BB4FBA4311B11405AE486D63B8EBB189A1CFB5
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • RegisterServiceCtrlHandlerA.ADVAPI32(00660EF0,Function_00001140), ref: 00CF611E
                                                                                                                                                                                                              • SetServiceStatus.ADVAPI32(00000000,00D59C20), ref: 00CF617F
                                                                                                                                                                                                              • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00CF6193
                                                                                                                                                                                                              • SetServiceStatus.ADVAPI32(00000000,00D59C20), ref: 00CF6200
                                                                                                                                                                                                              • WaitForSingleObject.KERNEL32(00000000,00001388), ref: 00CF626C
                                                                                                                                                                                                              • SetServiceStatus.ADVAPI32(00000000,00D59C20), ref: 00CF6322
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 00CF6341
                                                                                                                                                                                                              • SetServiceStatus.ADVAPI32(00000000,00D59C20), ref: 00CF63F1
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.1769524357.0000000000CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CF0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769509730.0000000000CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769557833.0000000000D27000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D61000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D70000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769632749.0000000000D72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_cf0000_YiqjcLlhew.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Service$Status$CloseCreateCtrlEventHandleHandlerObjectRegisterSingleWait
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3399922960-0
                                                                                                                                                                                                              • Opcode ID: b4454421b4e802ae80a31bec75462a46f303cb75050c66d1c14f90a461690152
                                                                                                                                                                                                              • Instruction ID: a8e320fabb07e02fc8c06bbe28b71629e86cff186f288fa12b6f6a627cc475b6
                                                                                                                                                                                                              • Opcode Fuzzy Hash: b4454421b4e802ae80a31bec75462a46f303cb75050c66d1c14f90a461690152
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 1DA165B5601300CFC344CF29FDAA4257BB5F799722705841AE986C67B4DBB48894CF39
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000,00000001), ref: 00CF204F
                                                                                                                                                                                                              • Process32First.KERNEL32(00000000,00000128), ref: 00CF2159
                                                                                                                                                                                                              • OpenProcess.KERNEL32(00000001,00000000,?), ref: 00CF224D
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.1769524357.0000000000CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CF0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769509730.0000000000CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769557833.0000000000D27000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D61000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D70000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769632749.0000000000D72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_cf0000_YiqjcLlhew.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CreateFirstOpenProcessProcess32SnapshotToolhelp32
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3397401024-0
                                                                                                                                                                                                              • Opcode ID: 9df98761e307c1c783febc6db6741da9347bcec5f266a091c745bcc75956380f
                                                                                                                                                                                                              • Instruction ID: 5fbb1e88ea40c1aa4810615f616f6a7428b18cf4656b8c37684d075af4ec3ee6
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9df98761e307c1c783febc6db6741da9347bcec5f266a091c745bcc75956380f
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 30B153B6A00709DBD714DF24FD895763BB5FB50310B15411AEA82D63B8E7B089A0CFB5
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CreateFileA.KERNEL32(?,00000000,00000000,00000000,00000003,00000000,00000000), ref: 00D14A04
                                                                                                                                                                                                              • GetFileTime.KERNEL32(00000000,?,?,?), ref: 00D14A4E
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 00D14A6B
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.1769524357.0000000000CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CF0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769509730.0000000000CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769557833.0000000000D27000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D61000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D70000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769632749.0000000000D72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_cf0000_YiqjcLlhew.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: File$CloseCreateHandleTime
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3397143404-0
                                                                                                                                                                                                              • Opcode ID: 4dda0ec1b25c02ad3bae3d50a973138eb1b2fbb87e887e1a6c40997da2f446aa
                                                                                                                                                                                                              • Instruction ID: 7031933c4c59481996cdb7dca73448f97e5fb24c0cc3e0d79b02a56deae09bfa
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4dda0ec1b25c02ad3bae3d50a973138eb1b2fbb87e887e1a6c40997da2f446aa
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 1761EF36601304DFD710CF69FD8566AB7B9FB98721B10826AE806C67B0D7B09891CF75
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000001,?,00CF9ED1,00D10DB0,00000001,?), ref: 00D1873E
                                                                                                                                                                                                              • CreateThread.KERNEL32(00000000,00000000,00000001,?,00000000,00000000), ref: 00D1876D
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000,?,00CF9ED1,00D10DB0,00000001,?), ref: 00D1877E
                                                                                                                                                                                                              • WaitForSingleObject.KERNEL32(?,000000FF,?,00CF9ED1,00D10DB0,00000001,?), ref: 00D18793
                                                                                                                                                                                                              • CloseHandle.KERNEL32(?,?,000000FF,?,00CF9ED1,00D10DB0,00000001,?), ref: 00D187B7
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.1769524357.0000000000CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CF0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769509730.0000000000CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769557833.0000000000D27000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D61000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D70000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769632749.0000000000D72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_cf0000_YiqjcLlhew.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CloseCreateHandle$EventObjectSingleThreadWait
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1404307249-0
                                                                                                                                                                                                              • Opcode ID: 5bf7b1a3a3d0114b8a58b1a6b9c664bf738342235cf79af7a58b15b6ff73a601
                                                                                                                                                                                                              • Instruction ID: 9450b3e86ca58e54c24dba8781ba7b6622e610ad63b6a7dd01bc793fae755d4d
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5bf7b1a3a3d0114b8a58b1a6b9c664bf738342235cf79af7a58b15b6ff73a601
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 8441C2B9A00701EBD300AF25FD49B503BB0F794351F22440AE985E63B5EBB284A4CFB5
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00D12807
                                                                                                                                                                                                              • ReadFile.KERNEL32(00000000,?,00005000,?,00000000), ref: 00D128C5
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000,?,?,?,00000000), ref: 00D129CC
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.1769524357.0000000000CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CF0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769509730.0000000000CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769557833.0000000000D27000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D61000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D70000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769632749.0000000000D72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_cf0000_YiqjcLlhew.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: File$CloseCreateHandleRead
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1035965006-0
                                                                                                                                                                                                              • Opcode ID: 7c3a0c87fb07c969232a1481444329f4b4953ffac2489edd0dfaf5244833edc2
                                                                                                                                                                                                              • Instruction ID: 750828ca2eb1943e3785b265a1dc56b9b693842e0a77baf63bdabbb268dcbd34
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7c3a0c87fb07c969232a1481444329f4b4953ffac2489edd0dfaf5244833edc2
                                                                                                                                                                                                              • Instruction Fuzzy Hash: FDB10F75A00705EBD7189F24FC866B53BB1F798311B10441AE842DA3B4EBB599A1CFB4
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetProcessHeap.KERNEL32(00000000,00000000,?,?,00D0FAC0,00000000,?), ref: 00D1381D
                                                                                                                                                                                                              • RtlReAllocateHeap.NTDLL(00000000,?,00D0FAC0,00000000), ref: 00D13824
                                                                                                                                                                                                              • GetProcessHeap.KERNEL32(00000000,?,?,00D0FAC0,00000000,?), ref: 00D13842
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(00000000,?,00D0FAC0,00000000,?), ref: 00D13849
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000000.00000002.1769524357.0000000000CF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00CF0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769509730.0000000000CF0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769557833.0000000000D27000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D2C000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D61000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769576849.0000000000D70000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000000.00000002.1769632749.0000000000D72000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_0_2_cf0000_YiqjcLlhew.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Heap$Process$AllocAllocate
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1154092256-0
                                                                                                                                                                                                              • Opcode ID: dbdfae78f3f2b1a44d22ca4390cdb48839b85261a85725679c23bb88a9cff563
                                                                                                                                                                                                              • Instruction ID: cf4ae159b0967995265db9f2a4605c2af89a14a0b41d44e8bc2953e92db9df26
                                                                                                                                                                                                              • Opcode Fuzzy Hash: dbdfae78f3f2b1a44d22ca4390cdb48839b85261a85725679c23bb88a9cff563
                                                                                                                                                                                                              • Instruction Fuzzy Hash: A311E5B1B04704DBC704AFA4FDA9AA63BB8FB543507024005F446CA774EB718891CB75

                                                                                                                                                                                                              Execution Graph

                                                                                                                                                                                                              Execution Coverage:11.1%
                                                                                                                                                                                                              Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                              Signature Coverage:2.5%
                                                                                                                                                                                                              Total number of Nodes:1708
                                                                                                                                                                                                              Total number of Limit Nodes:34
                                                                                                                                                                                                              execution_graph 10673 da6ad0 10676 dcffd0 10673->10676 10679 dd6470 10676->10679 10678 da6adf 10680 dd647e 10679->10680 10683 dc2260 lstrlen 10680->10683 10682 dd6489 10682->10678 10683->10682 10841 dbd243 10842 dbd250 10841->10842 10844 dbd2eb 10842->10844 10845 dc2260 lstrlen 10842->10845 10845->10844 10684 da40c0 10685 da40dc 10684->10685 10686 da6850 4 API calls 10685->10686 10687 da41df 10686->10687 11502 da1140 11503 da1162 11502->11503 11507 da1169 SetServiceStatus 11502->11507 11504 da1219 SetServiceStatus SetEvent 11503->11504 11505 da1180 11503->11505 11503->11507 11505->11504 11508 da1356 11507->11508 10846 dad446 10847 dad450 10846->10847 10849 dc1a50 8 API calls 10847->10849 10850 dac2d0 9 API calls 10847->10850 10854 dad87c 10847->10854 10848 daa430 2 API calls 10851 daddda 10848->10851 10849->10847 10850->10847 10852 dadd9a 10852->10848 10853 dc1a50 8 API calls 10853->10854 10854->10852 10854->10853 10856 dac2d0 9 API calls 10854->10856 10857 dadc6c 10854->10857 10855 dc1a50 8 API calls 10855->10857 10856->10854 10857->10852 10857->10855 10858 dac2d0 9 API calls 10857->10858 10858->10857 10977 dd55c3 10979 dd55d0 10977->10979 10978 dd57da 10980 dd57fd 10978->10980 10981 dd5809 10978->10981 10979->10978 10982 dae980 2 API calls 10979->10982 10983 dae980 2 API calls 10980->10983 10984 dae980 2 API calls 10981->10984 10982->10979 10985 dd5804 10983->10985 10984->10985 11509 dbb37f 11510 dbb3cc 11509->11510 11512 dcd0eb 135 API calls 11510->11512 11511 dbbf02 11512->11511 11529 da9770 11530 dc56a0 2 API calls 11529->11530 11531 da978e 11530->11531 10868 dc2868 10870 dc2870 10868->10870 10869 dc28b2 ReadFile 10869->10870 10870->10869 10871 dbf910 8 API calls 10870->10871 10872 dc2a7e CloseHandle 10870->10872 10874 db60d0 8 API calls 10870->10874 10876 dc29c1 CloseHandle 10870->10876 10871->10870 10873 dc2abb 10872->10873 10875 dc2290 ReleaseMutex 10873->10875 10874->10870 10878 dc2ac6 10875->10878 10877 dc2290 ReleaseMutex 10876->10877 10879 dc29f1 10877->10879 10990 dac9ef 10991 daca00 10990->10991 10992 dacb28 CreatePipe 10991->10992 10993 dacba9 SetHandleInformation 10992->10993 11002 dacb94 10992->11002 10994 dacbf9 10993->10994 10995 dacc1e CreatePipe 10993->10995 10994->10995 10996 dacc4d SetHandleInformation 10995->10996 10997 dacc36 10995->10997 11004 daccca 10996->11004 10999 dace9c CloseHandle 10997->10999 10998 dc2070 8 API calls 11001 dacf1f 10998->11001 10999->11002 11003 daceb4 CloseHandle 10999->11003 11002->10998 11002->11001 11003->11002 11005 dacdf2 CreateProcessA 11004->11005 11006 dacf4e WriteFile 11005->11006 11007 dace32 CloseHandle 11005->11007 11011 dacfaa 11006->11011 11012 dacfbb CloseHandle CloseHandle 11006->11012 11009 dace6c CloseHandle 11007->11009 11010 dace62 11007->11010 11009->10999 11010->11009 11011->11012 11013 dad01e 11012->11013 11016 dc46f0 11013->11016 11017 dc46fd 11016->11017 11018 dc2070 8 API calls 11017->11018 11019 dc4759 ReadFile 11018->11019 11021 dc47a4 11019->11021 11022 dad063 WaitForSingleObject CloseHandle CloseHandle 11019->11022 11021->11022 11023 db60d0 8 API calls 11021->11023 11024 dc47e4 ReadFile 11023->11024 11024->11021 11024->11022 10696 da24ec 10697 dc8570 WaitForSingleObject 10696->10697 10698 da24f5 10697->10698 10699 dac9b0 ExitProcess 10698->10699 10700 da2509 10699->10700 10711 da2ae0 10712 da2b16 10711->10712 10713 dd4650 3 API calls 10712->10713 10714 da2c4a 10713->10714 10715 da3740 10 API calls 10714->10715 10716 da2c7a 10715->10716 10717 dc5d80 lstrlen 10716->10717 10718 da2ca0 10717->10718 10719 dd31e0 2 API calls 10718->10719 10720 da2cbe 10719->10720 10721 daa430 2 API calls 10720->10721 10737 da2d41 10721->10737 10722 da7a90 GetSystemTimeAsFileTime 10722->10737 10723 dc2ba0 12 API calls 10723->10737 10724 dc2070 8 API calls 10725 da35ad Sleep 10724->10725 10758 da1d60 10725->10758 10727 dc0250 5 API calls 10727->10737 10729 db5eb0 3 API calls 10729->10737 10730 db6c30 21 API calls 10730->10737 10731 daa430 GetProcessHeap RtlFreeHeap 10731->10737 10732 dc7870 9 API calls 10732->10737 10733 da7a50 8 API calls 10733->10737 10735 dac3e0 8 API calls 10735->10737 10736 dd31e0 GetProcessHeap RtlAllocateHeap 10736->10737 10737->10722 10737->10723 10737->10724 10737->10727 10737->10729 10737->10730 10737->10731 10737->10732 10737->10733 10737->10735 10737->10736 10738 dd2170 50 API calls 10737->10738 10739 da1700 31 API calls 10737->10739 10740 dc8830 10737->10740 10752 da6e40 10737->10752 10738->10737 10739->10737 10741 dc8853 10740->10741 10742 dd31e0 2 API calls 10741->10742 10743 dc88eb 10742->10743 10744 dd31e0 2 API calls 10743->10744 10745 dc890e 10744->10745 10767 da45c0 10745->10767 10748 daa430 2 API calls 10749 dc8983 10748->10749 10750 daa430 2 API calls 10749->10750 10751 dc89b5 10750->10751 10751->10737 10754 da6e5a 10752->10754 10753 da7011 10753->10737 10754->10753 10755 db60d0 8 API calls 10754->10755 10756 da6fbb 10755->10756 10757 db6c10 2 API calls 10756->10757 10757->10753 10761 da1d8c 10758->10761 10759 da1f9f 10759->10737 10760 da1ee9 10762 da1f8d 10760->10762 10779 db61f0 10760->10779 10761->10759 10761->10760 10763 da1e8f DeleteFileA 10761->10763 10773 daf3c0 10761->10773 10783 daf220 10762->10783 10763->10761 10768 da45e5 10767->10768 10769 dd31e0 2 API calls 10768->10769 10770 da4a9d 10769->10770 10771 daa430 2 API calls 10770->10771 10772 da4ac4 10771->10772 10772->10748 10774 daf3d2 10773->10774 10787 dabed0 10774->10787 10776 daf3e9 10791 da4230 10776->10791 10780 db6216 10779->10780 10782 db625c 10780->10782 10806 dc7970 10780->10806 10782->10760 10784 daf228 10783->10784 10785 dc76e0 2 API calls 10784->10785 10786 dc737e 10785->10786 10788 dabf12 10787->10788 10789 dbf910 8 API calls 10788->10789 10790 dabf1a 10789->10790 10790->10776 10792 da423e 10791->10792 10793 da4250 10792->10793 10795 dd5b90 10792->10795 10793->10761 10798 dc6a90 10795->10798 10797 dd5b9f 10797->10793 10799 dc6aa1 10798->10799 10802 dafe60 10799->10802 10801 dc6ab7 10801->10797 10803 dafe6b 10802->10803 10804 dadf30 8 API calls 10803->10804 10805 dafeee 10804->10805 10805->10801 10809 dc5e80 10806->10809 10810 dc5ed2 10809->10810 10813 dc7730 10810->10813 10812 dc6026 10812->10782 10814 dc7750 10813->10814 10815 dbf910 8 API calls 10814->10815 10816 dc778e 10815->10816 10816->10812 11532 dabb60 11533 dabb88 11532->11533 11542 dc2260 lstrlen 11533->11542 11535 dabbc1 11536 dbf910 8 API calls 11535->11536 11537 dabbd7 11536->11537 11538 dac2d0 9 API calls 11537->11538 11539 dabbe9 11538->11539 11540 da1380 8 API calls 11539->11540 11541 dabbfe 11540->11541 11542->11535 10817 dabce1 10819 dabd0b 10817->10819 10818 dabdb3 10819->10818 10820 dc3790 4 API calls 10819->10820 10820->10818 11543 dc1760 11544 dc176b 11543->11544 11545 dc1777 11544->11545 11546 db08b0 2 API calls 11544->11546 11546->11545 11550 dadb18 11551 dadb20 11550->11551 11552 dc1a50 8 API calls 11551->11552 11553 dac2d0 9 API calls 11551->11553 11557 dadc6c 11551->11557 11552->11551 11553->11551 11554 dadd9a 11555 daa430 2 API calls 11554->11555 11559 daddda 11555->11559 11556 dc1a50 8 API calls 11556->11557 11557->11554 11557->11556 11558 dac2d0 9 API calls 11557->11558 11558->11557 11560 da1f19 11562 da1f20 11560->11562 11561 db61f0 8 API calls 11561->11562 11562->11561 11563 da1f8d 11562->11563 11564 daf220 2 API calls 11563->11564 11565 da1f9f 11564->11565 10883 dae210 10884 dae24d 10883->10884 10885 dc2070 8 API calls 10884->10885 10886 dae287 10885->10886 10891 daf090 10886->10891 10888 dae2bc 10889 dc2070 8 API calls 10888->10889 10890 dae34b 10889->10890 10892 daf0a1 10891->10892 10895 da91b0 10892->10895 10896 da91c4 10895->10896 10897 dbfd30 8 API calls 10896->10897 10898 da91d0 10897->10898 10898->10888 11566 da3710 11571 dc7370 11566->11571 11572 dc76e0 2 API calls 11571->11572 11573 dc737e 11572->11573 10899 dc7610 10904 dae490 10899->10904 10913 dbfbe0 10904->10913 10914 dae370 8 API calls 10913->10914 10915 dbfc0c 10914->10915 11045 dc0190 11046 dc01b3 11045->11046 11047 da1530 8 API calls 11046->11047 11048 dc01e5 11047->11048 11051 da1380 11048->11051 11052 da138e 11051->11052 11053 db60d0 8 API calls 11052->11053 11054 da139c 11053->11054 11574 dc5510 11575 dc5546 11574->11575 11576 dab890 2 API calls 11575->11576 11577 dc554b 11576->11577 11578 dc6be0 3 API calls 11577->11578 11579 dc5560 11578->11579 11580 dc5605 ExitProcess 11579->11580 11581 dd0110 11582 dd45e0 12 API calls 11581->11582 11583 dd012d 11582->11583 11584 db60d0 8 API calls 11583->11584 11585 dd01b2 11584->11585 11586 dd2d10 11587 dd2d24 11586->11587 11590 dd2d46 11586->11590 11588 dd2d70 11589 dd2e65 ReadFile 11591 dd2ea3 11589->11591 11590->11588 11590->11589 11592 dd4510 11593 dab670 2 API calls 11592->11593 11594 dd451b 11593->11594 11595 db08b0 2 API calls 11594->11595 11596 dd4527 11594->11596 11595->11596 11597 dbd716 11598 dbd75a 11597->11598 11599 dbe35f 11598->11599 11600 dbe3a7 11598->11600 11612 dbe1ef 11598->11612 11601 dc0cf0 wvsprintfA 11599->11601 11602 dbe4f3 11600->11602 11603 dbe3b0 11600->11603 11601->11612 11604 dbe593 11602->11604 11606 dbe50e 11602->11606 11605 dbe441 11603->11605 11607 dbe3dd 11603->11607 11608 dc0cf0 wvsprintfA 11604->11608 11609 dc0cf0 wvsprintfA 11605->11609 11611 dc0cf0 wvsprintfA 11606->11611 11606->11612 11610 dc0cf0 wvsprintfA 11607->11610 11607->11612 11608->11612 11609->11612 11610->11612 11611->11612 11613 da5b09 11614 da5b10 11613->11614 11615 dd02f0 4 API calls 11614->11615 11616 da5bc3 11614->11616 11615->11614 9556 dbbf0e 9557 dbbece 9556->9557 9558 dbbf1f 9556->9558 9573 dcd0eb 135 API calls 9557->9573 9560 dbbefc 9558->9560 9561 dbbf3e 9558->9561 9559 dbbf02 9560->9559 9574 dcd0eb 9560->9574 9788 daaf10 9561->9788 9563 dae980 2 API calls 9570 dbc1c3 9563->9570 9564 dbc050 9565 dbc09e 9564->9565 9566 dbc0d6 9564->9566 9571 dbc129 9564->9571 9794 dae980 9565->9794 9798 dd48f0 9566->9798 9571->9563 9573->9559 9575 dcd0f0 9574->9575 9834 dd31e0 9575->9834 9577 dcd130 9838 daa430 9577->9838 9580 dd31e0 2 API calls 9581 dcd1ff 9580->9581 9582 daa430 2 API calls 9581->9582 9583 dcd225 9582->9583 9584 dd31e0 2 API calls 9583->9584 9585 dcd2d7 9584->9585 9586 daa430 2 API calls 9585->9586 9587 dcd2f8 9586->9587 9588 dd31e0 2 API calls 9587->9588 9589 dcd3b3 9588->9589 9590 daa430 2 API calls 9589->9590 9591 dcd3d5 9590->9591 9592 dd31e0 2 API calls 9591->9592 9593 dcd425 9592->9593 9594 daa430 2 API calls 9593->9594 9595 dcd46b 9594->9595 9596 dd31e0 2 API calls 9595->9596 9597 dcd4d9 9596->9597 9598 daa430 2 API calls 9597->9598 9599 dcd4ed 9598->9599 9600 dd31e0 2 API calls 9599->9600 9601 dcd541 9600->9601 9602 daa430 2 API calls 9601->9602 9603 dcd555 9602->9603 9604 daa430 2 API calls 9603->9604 9605 dcd58b 9604->9605 9842 dd59b0 GetProcessHeap RtlFreeHeap 9605->9842 9607 dcd5f4 9843 dd4650 9607->9843 9609 dcd603 9610 dd31e0 2 API calls 9609->9610 9611 dcd628 GetEnvironmentVariableA 9610->9611 9612 dcd67c 9611->9612 9613 daa430 2 API calls 9612->9613 9614 dcd6c4 CreateMutexA CreateMutexA CreateMutexA 9613->9614 9616 dcd7c6 9614->9616 9617 dcd81b GetTickCount 9616->9617 9618 dcd954 9616->9618 9619 dcd83a 9617->9619 9851 da7fa0 9618->9851 9621 dd31e0 2 API calls 9619->9621 9624 dcd86a 9621->9624 9622 dcd9c1 GetCommandLineA 9623 dcda10 9622->9623 9625 dd31e0 2 API calls 9623->9625 9626 daa430 2 API calls 9624->9626 9628 dcda7b 9625->9628 9627 dcd8ff 9626->9627 9627->9618 9629 daa430 2 API calls 9628->9629 9630 dcdad8 9629->9630 9631 dce64f GetCommandLineA 9630->9631 9632 dd31e0 2 API calls 9630->9632 9954 da3e80 9631->9954 9634 dcdb4c 9632->9634 9635 daa430 2 API calls 9634->9635 9637 dcdb98 9635->9637 9636 dce66d 9957 dc2260 lstrlen 9636->9957 9640 dcdbfa 9637->9640 9642 dac9b0 ExitProcess 9637->9642 9639 dce6d4 GetModuleFileNameA 9958 dc8a10 9639->9958 9643 dd31e0 2 API calls 9640->9643 9642->9640 9646 dcdc36 9643->9646 9644 dce750 9645 dc8a10 lstrlen 9644->9645 9647 dce7cf 9645->9647 9648 daa430 2 API calls 9646->9648 9650 dc8a10 lstrlen 9647->9650 9649 dcdccc 9648->9649 9651 dcdcfb 9649->9651 9652 dac9b0 ExitProcess 9649->9652 9668 dce842 9650->9668 10109 dc5d80 9651->10109 9652->9651 9654 dcead8 9962 db5770 9654->9962 9655 dcdd2a 9656 dd31e0 2 API calls 9655->9656 9657 dcdd40 9656->9657 9661 daa430 2 API calls 9657->9661 9659 dceb30 9660 dceb58 9659->9660 9662 dac9b0 ExitProcess 9659->9662 9971 db0950 9660->9971 9664 dcdd73 9661->9664 9662->9660 9687 dcddd4 9664->9687 9667 dceb8e 10069 da75a0 9667->10069 9668->9654 10145 dc1c40 9668->10145 9672 dce8ff 10151 da3740 9672->10151 9676 dcebc9 9681 dcec2a WSAStartup 9676->9681 9677 da7a90 GetSystemTimeAsFileTime 9677->9687 9678 dcde8c Sleep 9680 dc4990 5 API calls 9678->9680 9679 dceaad 9683 dac9b0 ExitProcess 9679->9683 9680->9687 9682 dcec59 9681->9682 9692 dcecb5 9681->9692 9689 dd31e0 2 API calls 9682->9689 9683->9654 9684 dce92b 9684->9679 9685 dd31e0 2 API calls 9684->9685 9686 dce9cf 9685->9686 10165 dc2260 lstrlen 9686->10165 9687->9677 9687->9678 9688 dce014 Sleep 9687->9688 9701 dce07c 9687->9701 10115 dc0250 9687->10115 10126 dc4990 CreateFileA 9687->10126 9688->9687 9690 dceca2 9689->9690 10166 da24e0 9690->10166 9691 dcee2e 9697 dcf126 9691->9697 9698 dcee62 CloseHandle 9691->9698 9692->9691 10073 dc8240 9692->10073 9695 dcea28 MessageBoxA 9700 daa430 2 API calls 9695->9700 9696 dc0250 5 API calls 9696->9701 9729 dcf154 9697->9729 9702 dceecb 9698->9702 9703 dceed5 SetFileAttributesA CopyFileA 9698->9703 9705 dcea8b 9700->9705 9701->9696 9706 dce16f 9701->9706 10133 da1fe0 CreateToolhelp32Snapshot 9701->10133 9702->9703 9707 dcf0b9 9703->9707 9708 dcef41 SetFileAttributesA 9703->9708 9704 dced6b 9709 dced87 9704->9709 9716 dac9b0 ExitProcess 9704->9716 9710 dac9b0 ExitProcess 9705->9710 9713 dc4990 5 API calls 9706->9713 10102 dc8570 9707->10102 9714 dcef98 9708->9714 9715 dcefda 9708->9715 10171 da6af0 9709->10171 9710->9679 9721 dce1c9 9713->9721 10084 da53b0 9714->10084 9726 dcf051 Sleep 9715->9726 10180 dabff0 9715->10180 9716->9709 9718 dc0250 5 API calls 9718->9729 9719 dce12b Sleep 9719->9701 9719->9706 9725 dce5bd 9721->9725 9733 dce25e GetModuleFileNameA 9721->9733 9738 db5eb0 3 API calls 9725->9738 9736 dcf09b 9726->9736 9729->9718 9730 dcf204 SetFileAttributesA CopyFileA 9729->9730 9735 da1fe0 8 API calls 9729->9735 9731 dcf2ac SetFileAttributesA 9730->9731 9732 dcf28c 9730->9732 9743 dcf2cd 9731->9743 9732->9731 9739 dce2b8 SetFileAttributesA 9733->9739 9740 dce294 9733->9740 9734 dcf044 9734->9726 9741 dcf1ba Sleep 9735->9741 10097 db5eb0 9736->10097 9742 dce627 9738->9742 9744 dce304 CopyFileA 9739->9744 9745 dce2d5 9739->9745 9740->9739 9741->9697 9741->9730 9747 dac9b0 ExitProcess 9742->9747 9748 dc5d80 lstrlen 9743->9748 9746 dd31e0 2 API calls 9744->9746 9745->9744 9751 dce353 9746->9751 9747->9631 9749 dcf347 9748->9749 9750 dd31e0 2 API calls 9749->9750 9753 dcf382 9750->9753 9752 daa430 2 API calls 9751->9752 9754 dce3a9 9752->9754 9755 dd31e0 2 API calls 9753->9755 9757 dce4a2 9754->9757 9761 dd31e0 2 API calls 9754->9761 9756 dcf41d 9755->9756 9758 daa430 2 API calls 9756->9758 9759 dce53c SetFileAttributesA 9757->9759 9760 dce574 SetFileAttributesA 9757->9760 9762 dcf443 9758->9762 9759->9725 9760->9725 9764 dce410 9761->9764 10190 dc6f70 9762->10190 9767 daa430 2 API calls 9764->9767 9765 dcf47b 9766 daa430 2 API calls 9765->9766 9768 dcf4a7 9766->9768 9767->9757 10194 dc2ba0 9768->10194 9771 dd31e0 2 API calls 9772 dcf4ea 9771->9772 9773 dd31e0 2 API calls 9772->9773 9774 dcf516 9773->9774 10215 dc0cf0 9774->10215 9776 dcf58a 9777 daa430 2 API calls 9776->9777 9778 dcf5b8 9777->9778 9779 daa430 2 API calls 9778->9779 9780 dcf5de 9779->9780 9781 db5eb0 3 API calls 9780->9781 9782 dcf610 9781->9782 9783 dcf69b CreateThread 9782->9783 9784 dcf71a 9783->9784 9785 dcf6e1 9783->9785 9786 dcf770 Sleep 9784->9786 10218 da6430 StartServiceCtrlDispatcherA 9785->10218 9786->9786 9789 daaf45 9788->9789 10545 dc73c0 9789->10545 9791 daaf89 9793 daafca 9791->9793 10552 daeeb0 9791->10552 9793->9564 9796 dae9b9 9794->9796 9795 daec11 9796->9795 10557 dd59b0 GetProcessHeap RtlFreeHeap 9796->10557 9800 dd4968 9798->9800 9799 dd5845 9799->9571 9800->9799 9801 dc73c0 4 API calls 9800->9801 9802 dd4aaf 9801->9802 9804 dc73c0 4 API calls 9802->9804 9832 dd5039 9802->9832 9803 dd57da 9806 dd57fd 9803->9806 9807 dd5809 9803->9807 9805 dd4af7 9804->9805 9811 dc73c0 4 API calls 9805->9811 9805->9832 9809 dae980 2 API calls 9806->9809 9810 dae980 2 API calls 9807->9810 9808 dae980 2 API calls 9808->9832 9812 dd5804 9809->9812 9810->9812 9813 dd4b20 9811->9813 9812->9571 9814 daeeb0 4 API calls 9813->9814 9823 dd4b66 9813->9823 9813->9832 9815 dd4b8f 9814->9815 9815->9832 10558 db5a60 9815->10558 9818 dd4ce8 9820 dcfe90 4 API calls 9818->9820 9819 dd4cfb 10569 da4260 9819->10569 9824 dd4cf6 9820->9824 9823->9818 9823->9819 9823->9832 9825 da4260 4 API calls 9824->9825 9826 dd4d7b 9825->9826 9827 dc73c0 4 API calls 9826->9827 9826->9832 9828 dd4e34 9827->9828 9829 da4260 4 API calls 9828->9829 9828->9832 9830 dd4e59 9829->9830 9831 dc73c0 4 API calls 9830->9831 9830->9832 9833 da4260 4 API calls 9830->9833 9831->9830 9832->9803 9832->9808 9833->9830 9835 dd320c 9834->9835 10219 dc56a0 9835->10219 9837 dd32e3 9837->9577 9839 daa450 9838->9839 10222 dd59b0 GetProcessHeap RtlFreeHeap 9839->10222 9841 daa48a 9841->9580 9842->9607 9844 dd468a 9843->9844 9845 dd4729 GetSystemTime 9844->9845 9846 dd4705 9844->9846 9847 dd476a 9845->9847 9846->9845 9848 da7a90 GetSystemTimeAsFileTime 9847->9848 9849 dd4831 GetTickCount 9848->9849 9850 dd486a 9849->9850 9850->9609 9852 da7fbe 9851->9852 9853 da8072 GetVersionExA 9852->9853 10223 dc1510 9853->10223 9858 da824c 9859 dd31e0 2 API calls 9858->9859 9861 da830a 9859->9861 10244 dc7870 9861->10244 9862 da8114 9865 da81ba CreateDirectoryA 9862->9865 9867 dd31e0 2 API calls 9865->9867 9866 daa430 2 API calls 9869 da838c 9866->9869 9868 da820d 9867->9868 9870 daa430 2 API calls 9868->9870 10248 da70d0 9869->10248 9870->9858 9872 da83cb 9873 da83d2 DeleteFileA RemoveDirectoryA 9872->9873 9874 da8443 9872->9874 9873->9874 9875 daf420 6 API calls 9874->9875 9876 da8459 9875->9876 9877 da849f CreateDirectoryA 9876->9877 9878 da84fe 9877->9878 9879 dc5d80 lstrlen 9878->9879 9880 da859b CreateDirectoryA 9879->9880 9882 da85ff 9880->9882 9883 dd31e0 2 API calls 9882->9883 9884 da865d 9883->9884 9885 dd31e0 2 API calls 9884->9885 9886 da8712 9885->9886 9887 daa430 2 API calls 9886->9887 9888 da8726 9887->9888 9889 dc7870 9 API calls 9888->9889 9890 da8742 9889->9890 9891 daa430 2 API calls 9890->9891 9892 da875e 9891->9892 9893 da70d0 5 API calls 9892->9893 9894 da878b 9893->9894 9895 da90cb 9894->9895 9897 da883d 9894->9897 9898 da87ad 9894->9898 9896 dc5d80 lstrlen 9895->9896 9900 da90e1 SetFileAttributesA 9896->9900 9901 dd31e0 2 API calls 9897->9901 9899 dd31e0 2 API calls 9898->9899 9902 da87c3 9899->9902 9909 da912f 9900->9909 9903 da8861 9901->9903 9904 dc0cf0 wvsprintfA 9902->9904 9905 dc0cf0 wvsprintfA 9903->9905 9906 da87fb 9904->9906 9907 da887f 9905->9907 9908 daa430 2 API calls 9906->9908 9910 daa430 2 API calls 9907->9910 9911 da882c 9908->9911 9909->9622 9910->9911 9912 da88fb 9911->9912 9913 da894c CreateDirectoryA 9912->9913 9914 da898b 9913->9914 9915 dc5d80 lstrlen 9914->9915 9916 da89ca CreateDirectoryA 9915->9916 9918 da8a46 9916->9918 9919 dd31e0 2 API calls 9918->9919 9920 da8a70 9919->9920 9921 dd31e0 2 API calls 9920->9921 9922 da8ae6 9921->9922 9923 daa430 2 API calls 9922->9923 9924 da8b6e 9923->9924 9925 dc7870 9 API calls 9924->9925 9926 da8ba5 9925->9926 9927 daa430 2 API calls 9926->9927 9928 da8bb9 9927->9928 9929 da70d0 5 API calls 9928->9929 9930 da8bef 9929->9930 9931 da8c22 GetTempPathA 9930->9931 9953 da9012 9930->9953 10265 dc2260 lstrlen 9931->10265 9933 da8c52 9934 dc5d80 lstrlen 9933->9934 9935 da8dd8 CreateDirectoryA 9934->9935 9936 dd31e0 2 API calls 9935->9936 9937 da8e12 9936->9937 9938 dd31e0 2 API calls 9937->9938 9939 da8e5b 9938->9939 9940 daa430 2 API calls 9939->9940 9941 da8e91 9940->9941 9942 dc7870 9 API calls 9941->9942 9943 da8eb1 9942->9943 9944 daa430 2 API calls 9943->9944 9945 da8ed0 9944->9945 9946 da70d0 5 API calls 9945->9946 9947 da8f1d 9946->9947 9948 da8f28 GetTempPathA 9947->9948 9947->9953 9949 da8f68 9948->9949 9950 dd31e0 2 API calls 9949->9950 9951 da8fdd 9950->9951 9952 daa430 2 API calls 9951->9952 9952->9953 9953->9895 10304 dc2260 lstrlen 9954->10304 9956 da3ebd 9956->9636 9957->9639 9959 dc8a40 lstrlen 9958->9959 9961 dc8aa4 9959->9961 9961->9644 9963 db578d 9962->9963 9964 dc5d80 lstrlen 9963->9964 9965 db5893 9964->9965 9966 dd31e0 2 API calls 9965->9966 9967 db58c3 9966->9967 9968 daa430 2 API calls 9967->9968 9969 db58ff CreateFileA 9968->9969 9970 db5951 9969->9970 9970->9659 9972 db097c 9971->9972 9973 db0af9 GetComputerNameA 9972->9973 9974 db0b4b 9973->9974 9975 db0bf1 9973->9975 9976 dd31e0 2 API calls 9974->9976 9977 dd31e0 2 API calls 9975->9977 9979 db0b67 9976->9979 9978 db0c80 9977->9978 9980 daa430 2 API calls 9978->9980 9983 daa430 2 API calls 9979->9983 9981 db0cbd 9980->9981 9982 dc7870 9 API calls 9981->9982 9984 db0cf7 9982->9984 9983->9975 10305 da7a50 9984->10305 9986 db0d0b 10308 dd36d0 9986->10308 9988 db0e0a 10351 dc2260 lstrlen 9988->10351 9990 db0e9c 10352 dafdf0 9990->10352 9994 db0ef4 9995 da7a50 8 API calls 9994->9995 9996 db0f21 9995->9996 9997 dafdf0 9 API calls 9996->9997 9998 db0fa9 9997->9998 9999 dac3e0 8 API calls 9998->9999 10000 db0fb8 9999->10000 10001 da7a50 8 API calls 10000->10001 10002 db1009 10001->10002 10003 dafdf0 9 API calls 10002->10003 10004 db102e 10003->10004 10005 dac3e0 8 API calls 10004->10005 10006 db103d 10005->10006 10007 da7a50 8 API calls 10006->10007 10008 db1072 10007->10008 10009 dafdf0 9 API calls 10008->10009 10010 db10b1 10009->10010 10011 dac3e0 8 API calls 10010->10011 10012 db10bd 10011->10012 10013 da7a50 8 API calls 10012->10013 10014 db10ea 10013->10014 10015 dafdf0 9 API calls 10014->10015 10016 db112e 10015->10016 10017 dac3e0 8 API calls 10016->10017 10018 db113d 10017->10018 10019 da7a50 8 API calls 10018->10019 10020 db11c0 10019->10020 10021 dd31e0 2 API calls 10020->10021 10022 db11f1 10021->10022 10023 dafdf0 9 API calls 10022->10023 10024 db120c 10023->10024 10025 dac3e0 8 API calls 10024->10025 10026 db121b 10025->10026 10027 daa430 2 API calls 10026->10027 10028 db1255 10027->10028 10029 da7a50 8 API calls 10028->10029 10030 db127e 10029->10030 10031 dafdf0 9 API calls 10030->10031 10032 db12e1 10031->10032 10033 dac3e0 8 API calls 10032->10033 10034 db12ed 10033->10034 10035 da7a50 8 API calls 10034->10035 10036 db1351 10035->10036 10037 dafdf0 9 API calls 10036->10037 10038 db1388 10037->10038 10039 dac3e0 8 API calls 10038->10039 10040 db1397 10039->10040 10041 da7a50 8 API calls 10040->10041 10042 db13de 10041->10042 10359 dd1d80 10042->10359 10046 db1443 10047 dafdf0 9 API calls 10046->10047 10048 db144f 10047->10048 10049 dac3e0 8 API calls 10048->10049 10050 db145e 10049->10050 10051 da7a50 8 API calls 10050->10051 10052 db1483 10051->10052 10053 dafdf0 9 API calls 10052->10053 10054 db14dc 10053->10054 10055 dac3e0 8 API calls 10054->10055 10056 db14eb 10055->10056 10368 dad1f0 10056->10368 10058 db1519 10395 dc2070 10058->10395 10060 db152e 10398 db60d0 10060->10398 10062 db154f 10402 dd2b00 10062->10402 10064 db15b2 10410 dab670 10064->10410 10066 db1677 10067 da7a90 GetSystemTimeAsFileTime 10066->10067 10068 da7b0d __aulldiv 10067->10068 10068->9667 10070 da75ea 10069->10070 10470 dc2260 lstrlen 10070->10470 10072 da7614 10072->9676 10074 dc826b 10073->10074 10075 dc5d80 lstrlen 10074->10075 10076 dc831b 10075->10076 10077 dd31e0 2 API calls 10076->10077 10078 dc832c 10076->10078 10079 dc83ac 10077->10079 10078->9704 10080 daa430 2 API calls 10079->10080 10081 dc8424 10080->10081 10471 dc26b0 10081->10471 10083 dc8456 10083->9704 10085 da53dd OpenSCManagerA 10084->10085 10087 da56e8 10085->10087 10088 da5488 CreateServiceA 10085->10088 10087->9715 10089 da55a8 OpenServiceA 10088->10089 10090 da54df ChangeServiceConfig2A StartServiceA 10088->10090 10094 da5618 10089->10094 10091 da5592 CloseServiceHandle 10090->10091 10092 da5581 10090->10092 10093 da56bc CloseServiceHandle 10091->10093 10092->10091 10093->10087 10095 da569e 10094->10095 10096 da565d StartServiceA CloseServiceHandle 10094->10096 10095->10093 10096->10095 10098 db5f1a 10097->10098 10099 db5f9b CreateProcessA 10098->10099 10100 db6090 10099->10100 10101 db6035 CloseHandle CloseHandle 10099->10101 10100->9707 10101->9707 10103 dc8585 WaitForSingleObject 10102->10103 10105 dc85eb 10103->10105 10106 dac9b0 10105->10106 10489 daa640 10106->10489 10108 dac9ca ExitProcess 10110 dc5dc3 10109->10110 10111 da75a0 lstrlen 10110->10111 10112 dc5de1 10111->10112 10113 dc5e4a 10112->10113 10491 dc2260 lstrlen 10112->10491 10113->9655 10116 dc029f CreateToolhelp32Snapshot 10115->10116 10118 dc0392 Process32First 10116->10118 10121 dc05c8 10116->10121 10120 dc05a0 CloseHandle 10118->10120 10123 dc0405 10118->10123 10120->10121 10121->9687 10122 dc8a10 lstrlen 10122->10123 10123->10122 10124 dc048c Process32Next 10123->10124 10125 dc04f1 10123->10125 10124->10123 10124->10125 10125->10120 10127 dc4a25 10126->10127 10128 dc4a37 GetFileTime 10126->10128 10127->9687 10129 dc4a58 CloseHandle 10128->10129 10130 dc4a83 __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z 10128->10130 10129->9687 10131 dc4aca GetFileSize CloseHandle 10130->10131 10132 dc4b6e 10131->10132 10132->9687 10134 da2079 10133->10134 10135 da2443 10134->10135 10136 da2151 Process32First 10134->10136 10135->9719 10137 da23de CloseHandle 10136->10137 10143 da217b 10136->10143 10137->10135 10139 dc8a10 lstrlen 10139->10143 10140 da236a Process32Next 10140->10137 10140->10143 10141 da223a OpenProcess 10141->10143 10142 da22d6 TerminateProcess 10142->10143 10143->10139 10143->10140 10143->10141 10143->10142 10144 da233e CloseHandle 10143->10144 10144->10143 10146 dc1c9b 10145->10146 10492 dab1d0 10146->10492 10149 db5eb0 3 API calls 10150 dc1d10 10149->10150 10150->9672 10152 da3778 10151->10152 10161 da3b0c 10151->10161 10529 dc2260 lstrlen 10152->10529 10155 da385d Sleep 10156 da3911 10155->10156 10157 dd31e0 2 API calls 10156->10157 10158 da393c 10157->10158 10159 daa430 2 API calls 10158->10159 10160 da397e FindFirstFileA 10159->10160 10160->10161 10164 da39c2 10160->10164 10161->9684 10162 da3ab2 DeleteFileA FindNextFileA 10163 da3adf FindClose 10162->10163 10162->10164 10163->10161 10164->10162 10165->9695 10167 da24f5 10166->10167 10168 dc8570 WaitForSingleObject 10166->10168 10169 dac9b0 ExitProcess 10167->10169 10168->10167 10170 da2509 10169->10170 10172 da6b1c 10171->10172 10173 da7a90 GetSystemTimeAsFileTime 10172->10173 10174 da6b5a 10173->10174 10175 da6c95 10174->10175 10176 da7a90 GetSystemTimeAsFileTime 10174->10176 10175->9691 10178 da6b9e 10176->10178 10177 da6c0d Sleep 10177->10178 10178->10175 10178->10177 10179 da7a90 GetSystemTimeAsFileTime 10178->10179 10179->10178 10181 dac055 10180->10181 10182 dd31e0 2 API calls 10181->10182 10183 dac0e6 10182->10183 10184 daa430 2 API calls 10183->10184 10187 dac11f 10184->10187 10185 dac1d4 RegCloseKey 10185->9734 10187->10185 10530 dc2260 lstrlen 10187->10530 10189 dac1a7 RegSetValueExA 10189->10185 10192 dc6fa5 10190->10192 10191 dc70cf CreateFileA 10193 dc710a 10191->10193 10192->10191 10193->9765 10196 dc2bcb 10194->10196 10195 dc2c3c 10197 dd31e0 2 API calls 10195->10197 10196->10195 10199 da2510 8 API calls 10196->10199 10198 dc2c85 10197->10198 10200 dc6f70 CreateFileA 10198->10200 10199->10195 10201 dc2cb3 10200->10201 10202 daa430 2 API calls 10201->10202 10203 dc2cf3 10202->10203 10204 dc2d55 Sleep 10203->10204 10214 dc2df0 10203->10214 10206 dd31e0 2 API calls 10204->10206 10205 dc2ec4 10205->9771 10208 dc2d95 10206->10208 10211 dc6f70 CreateFileA 10208->10211 10209 dc2ea2 10536 dadfb0 CloseHandle 10209->10536 10212 dc2dce 10211->10212 10213 daa430 2 API calls 10212->10213 10213->10214 10214->10205 10531 db69e0 10214->10531 10216 dc0d47 wvsprintfA 10215->10216 10216->9776 10218->9784 10220 dc56be 10219->10220 10221 dc56e8 GetProcessHeap RtlAllocateHeap 10219->10221 10220->10221 10221->9837 10222->9841 10224 dc153b AllocateAndInitializeSid 10223->10224 10225 dc1531 10223->10225 10226 dc15b2 10224->10226 10225->10224 10227 dc1623 CheckTokenMembership 10226->10227 10228 da80ae 10226->10228 10227->10228 10229 dd28c0 10228->10229 10230 dd31e0 2 API calls 10229->10230 10231 dd2925 GetProcAddress 10230->10231 10232 daa430 2 API calls 10231->10232 10233 dd297e 10232->10233 10234 da80c4 10233->10234 10235 dd29a3 GetCurrentProcess 10233->10235 10234->9858 10236 daf420 GetWindowsDirectoryA 10234->10236 10235->10234 10237 daf469 10236->10237 10238 dd31e0 2 API calls 10237->10238 10243 daf564 10237->10243 10239 daf507 10238->10239 10240 daa430 2 API calls 10239->10240 10241 daf548 10240->10241 10266 dc2260 lstrlen 10241->10266 10243->9862 10245 dc78ae 10244->10245 10267 dc6d90 10245->10267 10249 da70dd 10248->10249 10250 dc8570 WaitForSingleObject 10249->10250 10251 da714e 10250->10251 10252 da716d 10251->10252 10253 da71d0 CreateFileA 10251->10253 10256 dc2290 ReleaseMutex 10252->10256 10254 da7221 10253->10254 10260 da72ad 10253->10260 10255 dc2290 ReleaseMutex 10254->10255 10257 da724a 10255->10257 10258 da71b3 10256->10258 10257->9872 10258->9872 10259 da73ea WriteFile 10259->10260 10260->10259 10261 da748e CloseHandle 10260->10261 10300 dc2290 10261->10300 10265->9933 10266->10243 10268 dc6dae 10267->10268 10273 dc2260 lstrlen 10268->10273 10270 dc6e21 10274 dbfd30 10270->10274 10272 da8358 10272->9866 10273->10270 10277 dc7bb0 10274->10277 10276 dbfd52 10276->10272 10278 dc7bd9 10277->10278 10279 dc7be0 10278->10279 10282 dadf30 10278->10282 10279->10276 10281 dc7c49 10281->10276 10283 dadf62 10282->10283 10284 dadf78 10283->10284 10286 dbf910 10283->10286 10284->10281 10287 dbf930 10286->10287 10288 dbfaaf 10287->10288 10290 dbfa17 10287->10290 10292 dbfa98 10287->10292 10296 dc3790 10288->10296 10291 dc56a0 2 API calls 10290->10291 10293 dbfa27 10291->10293 10292->10284 10295 dd59b0 GetProcessHeap RtlFreeHeap 10293->10295 10295->10292 10297 dc37b1 10296->10297 10298 dc382c GetProcessHeap HeapAlloc 10297->10298 10299 dc380c GetProcessHeap RtlReAllocateHeap 10297->10299 10298->10292 10299->10292 10301 dc22ad ReleaseMutex 10300->10301 10303 da7551 10301->10303 10303->9872 10304->9956 10306 db60d0 8 API calls 10305->10306 10307 da7a7b 10306->10307 10307->9986 10309 dd36f6 10308->10309 10310 dd31e0 2 API calls 10309->10310 10311 dd38c3 10310->10311 10312 daa430 2 API calls 10311->10312 10313 dd392e GetProcessHeap 10312->10313 10315 dd396a 10313->10315 10314 dd3986 10314->9988 10315->10314 10316 dd31e0 2 API calls 10315->10316 10317 dd39f7 LoadLibraryA 10316->10317 10318 daa430 2 API calls 10317->10318 10320 dd3a30 10318->10320 10319 dd3a4f 10319->9988 10320->10319 10321 dd31e0 2 API calls 10320->10321 10322 dd3ac7 GetProcAddress 10321->10322 10323 daa430 2 API calls 10322->10323 10324 dd3b14 10323->10324 10325 dd3b8d HeapAlloc 10324->10325 10326 dd3b2e FreeLibrary 10324->10326 10329 dd3c16 10325->10329 10327 dd3b70 10326->10327 10327->9988 10330 dd3c2c FreeLibrary 10329->10330 10331 dd3c63 GetAdaptersInfo 10329->10331 10330->9988 10332 dd3c84 10331->10332 10333 dd3e7b GetAdaptersInfo 10332->10333 10334 dd3d07 HeapFree 10332->10334 10335 dd3eb8 10333->10335 10350 dd419a 10333->10350 10336 dd3d8d HeapAlloc 10334->10336 10337 dd3d73 10334->10337 10338 dd31e0 2 API calls 10335->10338 10339 dd3dc9 10336->10339 10337->10336 10340 dd3f22 10338->10340 10342 dd3e5c 10339->10342 10343 dd3e00 FreeLibrary 10339->10343 10345 daa430 2 API calls 10340->10345 10341 dd449e HeapFree FreeLibrary 10341->9988 10342->10333 10344 dd3e2e 10343->10344 10344->9988 10346 dd3f62 10345->10346 10347 dd31e0 2 API calls 10346->10347 10346->10350 10348 dd41b5 10347->10348 10349 daa430 2 API calls 10348->10349 10349->10350 10350->10341 10351->9990 10414 dc4c80 10352->10414 10355 dac3e0 10356 dac3f8 10355->10356 10357 db60d0 8 API calls 10356->10357 10358 dac406 10357->10358 10358->9994 10360 dd1da8 10359->10360 10361 dd31e0 2 API calls 10360->10361 10362 dd1dcc 10361->10362 10363 daa430 2 API calls 10362->10363 10364 db1419 10363->10364 10365 dc8000 10364->10365 10421 dc2260 lstrlen 10365->10421 10367 dc802b 10367->10046 10369 dad22c 10368->10369 10370 dd31e0 2 API calls 10369->10370 10371 dad2cb 10370->10371 10372 dd31e0 2 API calls 10371->10372 10373 dad2ec 10372->10373 10374 dd31e0 2 API calls 10373->10374 10375 dad322 10374->10375 10376 daa430 2 API calls 10375->10376 10377 dad33e 10376->10377 10378 dd31e0 2 API calls 10377->10378 10379 dad372 10378->10379 10380 daa430 2 API calls 10379->10380 10381 dad395 10380->10381 10382 daa430 2 API calls 10381->10382 10383 dad406 10382->10383 10386 dad87c 10383->10386 10388 dac2d0 9 API calls 10383->10388 10422 dc1a50 10383->10422 10384 daa430 2 API calls 10385 daddda 10384->10385 10385->10058 10389 dadd9a 10386->10389 10390 dc1a50 8 API calls 10386->10390 10392 dac2d0 9 API calls 10386->10392 10393 dadc6c 10386->10393 10388->10383 10389->10384 10390->10386 10391 dc1a50 8 API calls 10391->10393 10392->10386 10393->10389 10393->10391 10425 dac2d0 10393->10425 10396 dc7bb0 8 API calls 10395->10396 10397 dc2077 10396->10397 10397->10060 10399 db60f1 10398->10399 10400 dc7bb0 8 API calls 10399->10400 10401 db6113 10400->10401 10401->10062 10403 dd2b1b 10402->10403 10436 dd45e0 10403->10436 10405 dd2b5d 10406 db60d0 8 API calls 10405->10406 10409 dd2c5f 10405->10409 10407 dd2c47 10406->10407 10441 db6c10 10407->10441 10409->10064 10411 dc7370 10410->10411 10465 dc76e0 10411->10465 10415 dc4c8c 10414->10415 10420 dc2260 lstrlen 10415->10420 10417 dc4d63 10418 dbfd30 8 API calls 10417->10418 10419 dafdff 10418->10419 10419->10355 10420->10417 10421->10367 10431 dac8b0 10422->10431 10424 dc1a5e 10424->10383 10426 dc81b0 10425->10426 10435 dc2260 lstrlen 10426->10435 10428 dc8209 10429 db60d0 8 API calls 10428->10429 10430 dc8215 10429->10430 10430->10393 10432 dac8cf 10431->10432 10433 dc7bb0 8 API calls 10432->10433 10434 dac8da 10433->10434 10434->10424 10435->10428 10445 dae370 10436->10445 10438 dd45f2 10439 dd463b 10438->10439 10449 da2510 10438->10449 10439->10405 10442 dd2a80 10441->10442 10443 dd2a90 10442->10443 10464 dd59b0 GetProcessHeap RtlFreeHeap 10442->10464 10443->10409 10446 dae395 10445->10446 10447 dae3d7 10445->10447 10448 dc2070 8 API calls 10446->10448 10447->10438 10448->10447 10450 da252f 10449->10450 10451 dc8570 WaitForSingleObject 10450->10451 10452 da264e 10451->10452 10453 dd31e0 2 API calls 10452->10453 10463 da27d1 10452->10463 10454 da2703 GetProcAddress 10453->10454 10455 da275c 10454->10455 10457 dd31e0 2 API calls 10455->10457 10456 dc2290 ReleaseMutex 10458 da2a8b 10456->10458 10459 da2777 10457->10459 10458->10438 10460 daa430 2 API calls 10459->10460 10461 da278b GetProcAddress 10460->10461 10462 daa430 2 API calls 10461->10462 10462->10463 10463->10456 10464->10443 10466 dc76ea 10465->10466 10468 dc770e 10465->10468 10469 dd59b0 GetProcessHeap RtlFreeHeap 10466->10469 10469->10468 10470->10072 10472 dc26bd 10471->10472 10473 dc2070 8 API calls 10472->10473 10474 dc2769 10473->10474 10475 dc8570 WaitForSingleObject 10474->10475 10476 dc27de CreateFileA 10475->10476 10477 dc282e 10476->10477 10478 dc284b 10476->10478 10479 dc2290 ReleaseMutex 10477->10479 10480 dc28b2 ReadFile 10478->10480 10483 dc28a0 10478->10483 10481 dc2ac6 10479->10481 10480->10483 10481->10083 10482 dbf910 8 API calls 10482->10483 10483->10478 10483->10480 10483->10482 10484 dc2a7e CloseHandle 10483->10484 10485 db60d0 8 API calls 10483->10485 10486 dc29c1 CloseHandle 10483->10486 10484->10477 10485->10483 10487 dc2290 ReleaseMutex 10486->10487 10488 dc29f1 10487->10488 10488->10083 10490 daa652 10489->10490 10490->10108 10491->10113 10493 dab1fa 10492->10493 10494 dab2dc CreateFileA 10493->10494 10495 dab313 ReadFile CloseHandle 10494->10495 10512 dab5e3 10494->10512 10520 dab9f0 10495->10520 10497 db6c10 2 API calls 10499 dab60a 10497->10499 10498 dab367 GetTickCount 10522 dac640 10498->10522 10499->10149 10501 dab389 10526 dc2260 lstrlen 10501->10526 10503 dab3b9 10504 dd31e0 2 API calls 10503->10504 10505 dab415 10504->10505 10506 daa430 2 API calls 10505->10506 10507 dab488 10506->10507 10508 dab53e CreateFileA 10507->10508 10510 dd31e0 2 API calls 10507->10510 10509 dab57b 10508->10509 10511 dab592 WriteFile CloseHandle 10509->10511 10509->10512 10513 dab4be 10510->10513 10511->10512 10512->10497 10527 dc2260 lstrlen 10513->10527 10515 dab4db 10516 dc0cf0 wvsprintfA 10515->10516 10517 dab4e6 10516->10517 10518 daa430 2 API calls 10517->10518 10519 dab4f8 10518->10519 10519->10508 10521 daba19 10520->10521 10521->10498 10523 dac65d 10522->10523 10528 dc2260 lstrlen 10523->10528 10525 dac67c 10525->10501 10526->10503 10527->10515 10528->10525 10529->10155 10530->10189 10532 db6a45 10531->10532 10534 db6a9f 10531->10534 10532->10209 10533 db6af2 10533->10209 10534->10533 10535 db6bb1 WriteFile 10534->10535 10535->10209 10537 dadffe 10536->10537 10540 db08b0 10537->10540 10541 dd2a80 10540->10541 10543 dae01c 10541->10543 10544 dd59b0 GetProcessHeap RtlFreeHeap 10541->10544 10543->10205 10544->10543 10546 dc73ef 10545->10546 10547 dc56a0 2 API calls 10546->10547 10549 dc7581 10546->10549 10550 dc745e 10547->10550 10548 dc7467 10548->9791 10549->9791 10550->10548 10550->10549 10556 dd59b0 GetProcessHeap RtlFreeHeap 10550->10556 10553 daeef7 10552->10553 10554 dc73c0 4 API calls 10553->10554 10555 daef55 10554->10555 10555->9793 10556->10549 10557->9796 10559 db5aad 10558->10559 10560 dc73c0 4 API calls 10559->10560 10561 db5bb8 10559->10561 10560->10561 10561->9832 10562 dcfe90 10561->10562 10574 dd0930 10562->10574 10564 dcff9f 10564->9823 10566 dcfecd 10566->10564 10568 dcff23 10566->10568 10616 da6850 10566->10616 10568->10564 10626 dae4f0 10568->10626 10570 da42b2 10569->10570 10572 da42b8 10569->10572 10570->9824 10571 dc73c0 4 API calls 10573 da435d 10571->10573 10572->10571 10573->9824 10576 dd099e 10574->10576 10575 dd09a5 10575->10566 10576->10575 10577 dd0a17 10576->10577 10578 dd0ac1 10576->10578 10580 dd0a5b 10577->10580 10583 daeeb0 4 API calls 10577->10583 10579 da4260 4 API calls 10578->10579 10582 dd0b0d 10579->10582 10581 dd0a99 10580->10581 10584 da4260 4 API calls 10580->10584 10585 dd0a8c 10580->10585 10581->10566 10582->10585 10587 da4260 4 API calls 10582->10587 10583->10580 10584->10585 10585->10581 10586 dae980 2 API calls 10585->10586 10588 dd1a37 10586->10588 10589 dd0b2e 10587->10589 10588->10566 10589->10585 10590 dc73c0 4 API calls 10589->10590 10591 dd0b6a 10590->10591 10591->10585 10592 daeeb0 4 API calls 10591->10592 10593 dd0b8b 10592->10593 10593->10585 10594 dc73c0 4 API calls 10593->10594 10595 dd0bb3 10594->10595 10595->10585 10596 dc73c0 4 API calls 10595->10596 10597 dd0bfa 10596->10597 10597->10585 10598 db5a60 4 API calls 10597->10598 10601 dd0cc9 10597->10601 10599 dd0c94 10598->10599 10599->10585 10600 db5a60 4 API calls 10599->10600 10600->10601 10601->10585 10602 db5a60 4 API calls 10601->10602 10605 dd0ddb 10602->10605 10603 dd0eaa 10603->10585 10606 dd17b9 10603->10606 10607 daeeb0 GetProcessHeap RtlAllocateHeap GetProcessHeap RtlFreeHeap 10603->10607 10611 da66a0 GetProcessHeap RtlAllocateHeap GetProcessHeap RtlFreeHeap 10603->10611 10612 db5a60 GetProcessHeap RtlAllocateHeap GetProcessHeap RtlFreeHeap 10603->10612 10613 dae4f0 4 API calls 10603->10613 10614 da4260 4 API calls 10603->10614 10615 da6850 4 API calls 10603->10615 10604 dae4f0 4 API calls 10604->10605 10605->10603 10605->10604 10608 dd183c 10606->10608 10609 da4260 4 API calls 10606->10609 10607->10603 10608->10585 10610 da4260 4 API calls 10608->10610 10609->10608 10610->10585 10611->10603 10612->10603 10613->10603 10614->10603 10615->10603 10617 da6887 10616->10617 10618 da6a3f 10617->10618 10620 da68a1 10617->10620 10644 dc5710 10618->10644 10621 da68e9 10620->10621 10622 da6982 10620->10622 10635 db0420 10621->10635 10624 db0420 4 API calls 10622->10624 10625 da690c 10624->10625 10625->10566 10627 dae67f 10626->10627 10630 dae542 10626->10630 10628 dc5710 4 API calls 10627->10628 10629 dae591 10628->10629 10629->10568 10631 dae57c 10630->10631 10632 dae5e5 10630->10632 10633 db0420 4 API calls 10631->10633 10634 db0420 4 API calls 10632->10634 10633->10629 10634->10629 10637 db0464 10635->10637 10636 db046b 10636->10625 10637->10636 10638 db0502 10637->10638 10639 da4260 4 API calls 10637->10639 10640 da4260 4 API calls 10638->10640 10641 db0566 10638->10641 10639->10638 10640->10641 10642 dae980 2 API calls 10641->10642 10643 db061a 10642->10643 10643->10625 10645 dc5753 10644->10645 10646 dc582b 10645->10646 10647 da4260 4 API calls 10645->10647 10648 dc73c0 4 API calls 10646->10648 10649 dc5aa8 10646->10649 10647->10646 10651 dc587c 10648->10651 10649->10625 10650 dc73c0 4 API calls 10650->10651 10651->10649 10651->10650 11624 dd1d0a 11625 dd1d4b GetProcessHeap HeapAlloc 11624->11625 11626 dd1d3b 11624->11626 11626->11625 10824 da2480 10825 da2498 10824->10825 10828 dc2510 10825->10828 10827 da24c0 10829 dc252f 10828->10829 10830 dc7730 8 API calls 10829->10830 10831 dc2607 10830->10831 10831->10827 10832 daee80 10833 daee8b 10832->10833 10834 daee97 10833->10834 10835 db08b0 2 API calls 10833->10835 10835->10834 10916 da6000 10917 da6085 RegisterServiceCtrlHandlerA 10916->10917 10919 da613b SetServiceStatus CreateEventA SetServiceStatus 10917->10919 10920 da6410 10917->10920 10921 da6220 WaitForSingleObject 10919->10921 10923 da6279 10921->10923 10924 dc8570 WaitForSingleObject 10923->10924 10925 da62b9 SetServiceStatus CloseHandle 10924->10925 10927 da6388 SetServiceStatus 10925->10927 10928 da637c 10925->10928 10927->10920 10928->10927 10929 dd0e07 10931 dd0e10 10929->10931 10930 dae4f0 4 API calls 10930->10931 10931->10930 10940 dd0eaa 10931->10940 10932 dd17b9 10934 da4260 4 API calls 10932->10934 10937 dd183c 10932->10937 10933 daeeb0 GetProcessHeap RtlAllocateHeap GetProcessHeap RtlFreeHeap 10933->10940 10934->10937 10935 dae980 2 API calls 10936 dd1a37 10935->10936 10938 da4260 4 API calls 10937->10938 10939 dd1949 10937->10939 10938->10939 10939->10935 10940->10932 10940->10933 10940->10939 10941 da66a0 GetProcessHeap RtlAllocateHeap GetProcessHeap RtlFreeHeap 10940->10941 10942 db5a60 GetProcessHeap RtlAllocateHeap GetProcessHeap RtlFreeHeap 10940->10942 10943 dae4f0 4 API calls 10940->10943 10944 da4260 4 API calls 10940->10944 10945 da6850 4 API calls 10940->10945 10941->10940 10942->10940 10943->10940 10944->10940 10945->10940 11627 da4f00 11628 da4f0b 11627->11628 11629 da7c20 8 API calls 11628->11629 11630 da4f38 11629->11630 11059 db0780 11060 db07a0 11059->11060 11065 dc2260 lstrlen 11060->11065 11062 db07d1 11066 dc7fc0 11062->11066 11065->11062 11069 da1560 11066->11069 11068 db07e7 11070 da158d 11069->11070 11071 da161a 11070->11071 11072 da160d 11070->11072 11074 db06b0 8 API calls 11071->11074 11075 da1618 11071->11075 11073 dc7730 8 API calls 11072->11073 11073->11075 11074->11075 11075->11068 11635 da7307 11636 da7310 11635->11636 11637 da73ea WriteFile 11636->11637 11638 da748e CloseHandle 11636->11638 11637->11636 11640 dc2290 ReleaseMutex 11638->11640 11641 da7551 11640->11641 11076 da6bb9 11079 da6bc0 11076->11079 11077 da6c0d Sleep 11077->11079 11078 da7a90 GetSystemTimeAsFileTime 11078->11079 11079->11077 11079->11078 11080 da6c95 11079->11080 11081 dd13b9 11086 dd0f06 11081->11086 11082 daeeb0 GetProcessHeap RtlAllocateHeap GetProcessHeap RtlFreeHeap 11082->11086 11083 dae980 2 API calls 11084 dd1a37 11083->11084 11085 da66a0 GetProcessHeap RtlAllocateHeap GetProcessHeap RtlFreeHeap 11085->11086 11086->11082 11086->11085 11087 dae4f0 4 API calls 11086->11087 11088 da4260 4 API calls 11086->11088 11089 dd17b9 11086->11089 11090 db5a60 GetProcessHeap RtlAllocateHeap GetProcessHeap RtlFreeHeap 11086->11090 11091 da6850 4 API calls 11086->11091 11095 dd1949 11086->11095 11087->11086 11088->11086 11092 da4260 4 API calls 11089->11092 11093 dd183c 11089->11093 11090->11086 11091->11086 11092->11093 11094 da4260 4 API calls 11093->11094 11093->11095 11094->11095 11095->11083 10652 dc5535 10653 dc5546 10652->10653 10660 dab890 10653->10660 10655 dc554b 10665 dc6be0 GetStdHandle 10655->10665 10657 dc5560 10658 dc55f4 10657->10658 10659 dc5605 ExitProcess 10658->10659 10661 dab8df 10660->10661 10662 dab8c1 10660->10662 10661->10662 10670 dd1d20 10662->10670 10664 dab910 10664->10655 10666 dc6c3f 10665->10666 10667 dc6c49 GetStdHandle 10665->10667 10666->10667 10668 dc6c82 GetStdHandle 10667->10668 10668->10657 10671 dd1d4b GetProcessHeap HeapAlloc 10670->10671 10672 dd1d3b 10670->10672 10671->10664 10672->10671 10946 da1c30 10947 dafe60 8 API calls 10946->10947 10948 da1c43 10947->10948 10949 dabc30 10950 dd5b90 8 API calls 10949->10950 10951 dabc55 10950->10951 10952 dac3e0 8 API calls 10951->10952 10953 dabc72 10952->10953 11100 dc0db0 11101 dc0ddc 11100->11101 11160 da4fc0 11101->11160 11103 dc0eb8 11104 dc8830 4 API calls 11103->11104 11106 dc13af 11103->11106 11105 dc0f24 11104->11105 11107 dd31e0 2 API calls 11105->11107 11108 dab670 2 API calls 11106->11108 11109 dc0f6a 11107->11109 11110 dc1443 11108->11110 11111 dc7870 9 API calls 11109->11111 11112 dc0f8a 11111->11112 11113 daa430 2 API calls 11112->11113 11114 dc0fa6 11113->11114 11164 dc7250 11114->11164 11119 dac3e0 8 API calls 11120 dc0ff4 11119->11120 11121 dab670 2 API calls 11120->11121 11122 dc1007 11121->11122 11123 dd31e0 2 API calls 11122->11123 11124 dc1065 11123->11124 11125 dafdf0 9 API calls 11124->11125 11126 dc107d 11125->11126 11127 dac3e0 8 API calls 11126->11127 11128 dc1089 11127->11128 11129 daa430 2 API calls 11128->11129 11130 dc10ab 11129->11130 11131 da6e40 8 API calls 11130->11131 11132 dc10e3 11131->11132 11133 dac3e0 8 API calls 11132->11133 11134 dc10ec 11133->11134 11135 dc2510 8 API calls 11134->11135 11136 dc112c 11135->11136 11170 dc6030 11136->11170 11138 dc114f 11139 dad1f0 9 API calls 11138->11139 11140 dc1175 11139->11140 11227 da5ee0 11140->11227 11143 dd31e0 2 API calls 11144 dc11b7 11143->11144 11145 dafdf0 9 API calls 11144->11145 11146 dc11e1 11145->11146 11147 dac3e0 8 API calls 11146->11147 11148 dc11ed 11147->11148 11149 daa430 2 API calls 11148->11149 11150 dc122b 11149->11150 11151 db60d0 8 API calls 11150->11151 11152 dc1297 11151->11152 11153 dc2070 8 API calls 11152->11153 11154 dc131b 11153->11154 11155 dd31e0 2 API calls 11154->11155 11156 dc133e 11155->11156 11231 db6c30 11156->11231 11158 dc137a 11159 daa430 2 API calls 11158->11159 11159->11106 11161 db60d0 8 API calls 11160->11161 11162 da4fe0 SetEvent 11161->11162 11162->11103 11335 dc3f00 11164->11335 11167 da9170 11168 dc6a90 8 API calls 11167->11168 11169 da917f 11168->11169 11169->11119 11171 dc606c 11170->11171 11172 dd31e0 2 API calls 11171->11172 11177 dc6195 11171->11177 11173 dc615d 11172->11173 11174 dc7870 9 API calls 11173->11174 11175 dc6183 11174->11175 11176 daa430 2 API calls 11175->11176 11176->11177 11178 dc6369 11177->11178 11179 dc6297 11177->11179 11182 dd31e0 2 API calls 11178->11182 11180 dd31e0 2 API calls 11179->11180 11181 dc62b5 11180->11181 11183 dc7870 9 API calls 11181->11183 11187 dc63bf 11182->11187 11184 dc62cc 11183->11184 11185 daa430 2 API calls 11184->11185 11186 dc62de 11185->11186 11186->11138 11343 dc3860 11187->11343 11189 dc641b 11190 daa430 2 API calls 11189->11190 11191 dc6484 11190->11191 11192 dc6562 11191->11192 11193 dc64c3 11191->11193 11356 dcfff0 GetModuleFileNameA 11192->11356 11194 dd31e0 2 API calls 11193->11194 11195 dc6505 11194->11195 11197 dc7870 9 API calls 11195->11197 11199 dc6534 11197->11199 11204 daa430 2 API calls 11199->11204 11200 dc65aa 11202 dd31e0 2 API calls 11200->11202 11201 dc6613 11203 da75a0 lstrlen 11201->11203 11205 dc65c0 11202->11205 11206 dc6647 11203->11206 11207 dc654e 11204->11207 11208 dc7870 9 API calls 11205->11208 11358 dc1a70 11206->11358 11207->11138 11210 dc65e7 11208->11210 11212 daa430 2 API calls 11210->11212 11213 dc65f9 11212->11213 11213->11138 11216 dd31e0 2 API calls 11217 dc66b7 11216->11217 11218 daa430 2 API calls 11217->11218 11219 dc6708 11218->11219 11366 dc2260 lstrlen 11219->11366 11221 dc6720 11222 da70d0 5 API calls 11221->11222 11223 dc6756 11222->11223 11367 daca00 11223->11367 11226 dc684c 11226->11138 11228 da5efd 11227->11228 11229 da91b0 8 API calls 11228->11229 11230 da5f3d 11229->11230 11230->11143 11232 db6c76 11231->11232 11233 da7a90 GetSystemTimeAsFileTime 11232->11233 11234 db6e0e 11233->11234 11452 dc2260 lstrlen 11234->11452 11236 db6eaf 11236->11158 11238 db7015 11454 dc2260 lstrlen 11238->11454 11240 db6e6e 11240->11236 11453 dc2260 lstrlen 11240->11453 11241 db7023 11242 dd31e0 2 API calls 11241->11242 11320 db7740 11241->11320 11243 db70cb 11242->11243 11244 dc7870 9 API calls 11243->11244 11245 db70fd 11244->11245 11246 daa430 2 API calls 11245->11246 11248 db7119 11246->11248 11247 db736a 11249 dafdf0 9 API calls 11247->11249 11248->11247 11251 dd31e0 2 API calls 11248->11251 11250 db73e2 11249->11250 11252 dac3e0 8 API calls 11250->11252 11253 db719a 11251->11253 11254 db73ee 11252->11254 11255 dc4c80 9 API calls 11253->11255 11257 dd31e0 2 API calls 11254->11257 11256 db71b7 11255->11256 11258 dab670 2 API calls 11256->11258 11259 db7429 11257->11259 11260 db71d5 11258->11260 11261 dafdf0 9 API calls 11259->11261 11264 daa430 2 API calls 11260->11264 11262 db7441 11261->11262 11263 dac3e0 8 API calls 11262->11263 11265 db744d 11263->11265 11268 db724f 11264->11268 11266 daa430 2 API calls 11265->11266 11267 db748d 11266->11267 11269 dafdf0 9 API calls 11267->11269 11268->11247 11272 dc2510 8 API calls 11268->11272 11270 db74ca 11269->11270 11271 dac3e0 8 API calls 11270->11271 11276 db74d9 11271->11276 11273 db7304 11272->11273 11274 dd31e0 2 API calls 11273->11274 11275 db7324 11274->11275 11277 dc7870 9 API calls 11275->11277 11281 dd31e0 2 API calls 11276->11281 11318 db764e 11276->11318 11279 db7348 11277->11279 11278 dd31e0 2 API calls 11280 db769c 11278->11280 11282 daa430 2 API calls 11279->11282 11283 dafdf0 9 API calls 11280->11283 11284 db7534 11281->11284 11282->11247 11285 db76be 11283->11285 11286 dafdf0 9 API calls 11284->11286 11287 dac3e0 8 API calls 11285->11287 11288 db755b 11286->11288 11289 db76ca 11287->11289 11290 dac3e0 8 API calls 11288->11290 11292 daa430 2 API calls 11289->11292 11291 db756a 11290->11291 11293 dd31e0 2 API calls 11291->11293 11294 db76ea 11292->11294 11295 db758b 11293->11295 11296 db770c socket 11294->11296 11299 dac3e0 8 API calls 11294->11299 11298 daa430 2 API calls 11295->11298 11297 db77b0 11296->11297 11296->11320 11300 db77c2 setsockopt 11297->11300 11301 db7805 gethostbyname 11297->11301 11306 db75aa 11298->11306 11299->11296 11300->11301 11302 db77fb 11300->11302 11303 db784a inet_ntoa inet_addr 11301->11303 11301->11320 11302->11301 11304 db7913 htons connect 11303->11304 11305 db78b1 11303->11305 11307 db7958 11304->11307 11309 db7984 11304->11309 11305->11304 11308 dc0cf0 wvsprintfA 11306->11308 11307->11158 11310 db7604 11308->11310 11311 db79b3 send 11309->11311 11312 daa430 2 API calls 11310->11312 11316 db79ed 11311->11316 11313 db7620 11312->11313 11314 dafdf0 9 API calls 11313->11314 11315 db763f 11314->11315 11317 dac3e0 8 API calls 11315->11317 11319 dc2070 8 API calls 11316->11319 11316->11320 11317->11318 11318->11278 11334 db7a89 11319->11334 11320->11158 11321 db7afb recv 11322 db7f76 closesocket 11321->11322 11321->11334 11324 db7fbf 11322->11324 11324->11320 11325 dc2510 8 API calls 11324->11325 11325->11320 11326 dbf910 8 API calls 11326->11334 11327 db60d0 8 API calls 11327->11334 11328 dd31e0 GetProcessHeap RtlAllocateHeap 11328->11334 11329 db7f6c 11329->11322 11330 daa430 GetProcessHeap RtlFreeHeap 11330->11334 11332 dc4c80 9 API calls 11332->11334 11333 dab670 GetProcessHeap RtlFreeHeap 11333->11334 11334->11321 11334->11322 11334->11326 11334->11327 11334->11328 11334->11329 11334->11330 11334->11332 11334->11333 11455 dd1b00 11334->11455 11459 da4400 11334->11459 11336 dc3f0b 11335->11336 11339 dc1e10 11336->11339 11340 dc1e2c 11339->11340 11341 da91b0 8 API calls 11340->11341 11342 dc0fdf 11341->11342 11342->11167 11345 dc3880 11343->11345 11344 dc397c 11344->11189 11345->11344 11346 daaf10 4 API calls 11345->11346 11347 dc3a12 11346->11347 11348 daeeb0 4 API calls 11347->11348 11355 dc3a5a 11347->11355 11349 dc3a9b 11348->11349 11349->11355 11393 dc5b30 11349->11393 11351 dc3b5d 11400 dc2f30 11351->11400 11412 dd2fb0 11355->11412 11357 dc65a3 11356->11357 11357->11200 11357->11201 11359 dc1aa2 11358->11359 11360 dc1b87 11359->11360 11361 da2510 8 API calls 11359->11361 11362 dd3010 11360->11362 11361->11360 11363 dc6699 11362->11363 11365 dd305b 11362->11365 11363->11216 11364 dc1a70 8 API calls 11364->11365 11365->11363 11365->11364 11366->11221 11368 daca1d 11367->11368 11369 dacb28 CreatePipe 11368->11369 11370 dacba9 SetHandleInformation 11369->11370 11379 dacb94 11369->11379 11371 dacbf9 11370->11371 11372 dacc1e CreatePipe 11370->11372 11371->11372 11373 dacc4d SetHandleInformation 11372->11373 11374 dacc36 11372->11374 11381 daccca 11373->11381 11376 dace9c CloseHandle 11374->11376 11375 dc2070 8 API calls 11378 dacf1f DeleteFileA 11375->11378 11376->11379 11380 daceb4 CloseHandle 11376->11380 11378->11226 11379->11375 11379->11378 11380->11379 11382 dacdf2 CreateProcessA 11381->11382 11383 dacf4e WriteFile 11382->11383 11384 dace32 CloseHandle 11382->11384 11388 dacfaa 11383->11388 11389 dacfbb CloseHandle CloseHandle 11383->11389 11386 dace6c CloseHandle 11384->11386 11387 dace62 11384->11387 11386->11376 11387->11386 11388->11389 11390 dad01e 11389->11390 11391 dc46f0 10 API calls 11390->11391 11392 dad063 WaitForSingleObject CloseHandle CloseHandle 11391->11392 11415 da3bc0 11393->11415 11397 dc5b8e 11428 dcf790 11397->11428 11399 dc5bb0 11399->11351 11401 dc2f3d 11400->11401 11404 dc30f9 11401->11404 11440 dbbfc0 11401->11440 11403 dc3039 11403->11404 11405 dd31e0 2 API calls 11403->11405 11411 dc3320 11403->11411 11404->11355 11407 dc32c5 11405->11407 11406 dd31e0 2 API calls 11408 dc32e3 11406->11408 11407->11408 11410 daa430 2 API calls 11407->11410 11408->11355 11409 dc34af 11409->11355 11410->11411 11411->11406 11411->11409 11413 dae980 2 API calls 11412->11413 11414 dc3c6c 11413->11414 11414->11189 11416 da3be5 11415->11416 11417 dd31e0 2 API calls 11416->11417 11418 da3c6e 11417->11418 11419 daa430 2 API calls 11418->11419 11420 da3ca0 11419->11420 11421 da5800 11420->11421 11425 da5826 11421->11425 11422 da5d00 11422->11397 11423 da5a72 11424 dd02f0 4 API calls 11423->11424 11426 da5bc3 11423->11426 11424->11423 11425->11422 11425->11423 11434 dd02f0 11425->11434 11426->11397 11429 dcf817 11428->11429 11430 da5800 4 API calls 11429->11430 11431 dcfbac 11430->11431 11432 da5800 4 API calls 11431->11432 11433 dcfbc2 11432->11433 11433->11399 11435 dd0378 11434->11435 11436 dd31e0 2 API calls 11435->11436 11437 dd04cc 11436->11437 11438 daa430 2 API calls 11437->11438 11439 dd08a5 11438->11439 11439->11423 11441 dbbffb 11440->11441 11442 daaf10 4 API calls 11441->11442 11444 dbc050 11442->11444 11443 dae980 2 API calls 11445 dbc1c3 11443->11445 11446 dbc09e 11444->11446 11447 dbc0d6 11444->11447 11451 dbc129 11444->11451 11445->11403 11448 dae980 2 API calls 11446->11448 11449 dd48f0 4 API calls 11447->11449 11450 dbc0b6 11448->11450 11449->11451 11450->11403 11451->11443 11452->11240 11453->11238 11454->11241 11456 dd1b1f 11455->11456 11458 dd1b30 11455->11458 11457 da7a90 GetSystemTimeAsFileTime 11456->11457 11457->11458 11458->11334 11460 da4436 11459->11460 11461 dd31e0 2 API calls 11460->11461 11462 da4470 11461->11462 11463 dc4c80 9 API calls 11462->11463 11464 da4488 11463->11464 11465 dab670 2 API calls 11464->11465 11466 da44a2 11465->11466 11467 daa430 2 API calls 11466->11467 11468 da44b4 11467->11468 11469 da44cd 11468->11469 11470 dd31e0 2 API calls 11468->11470 11469->11334 11471 da44ee 11470->11471 11472 dc4c80 9 API calls 11471->11472 11473 da4506 11472->11473 11474 dab670 2 API calls 11473->11474 11475 da451d 11474->11475 11476 daa430 2 API calls 11475->11476 11477 da4538 11476->11477 11477->11334 10836 da5ea0 10839 dc2260 lstrlen 10836->10839 10838 da5ecf 10839->10838 10958 da9220 10959 dd6470 lstrlen 10958->10959 10960 da922f 10959->10960 10961 dc4e20 10962 dc4e3a 10961->10962 10965 dc5c30 10962->10965 10964 dc4e94 10966 dc5c57 10965->10966 10969 db06b0 10966->10969 10968 dc5c6c 10968->10964 10970 db06d5 10969->10970 10971 dadf30 8 API calls 10970->10971 10972 db0720 10971->10972 10972->10968 10840 da16a5 ExitProcess
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                • Part of subcall function 00DD59B0: GetProcessHeap.KERNEL32(00000000,00000000,?,00DBFA98,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00DD59C3
                                                                                                                                                                                                                • Part of subcall function 00DD59B0: RtlFreeHeap.NTDLL(00000000,?,00DBFA98,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00DD59CA
                                                                                                                                                                                                                • Part of subcall function 00DD4650: GetSystemTime.KERNEL32(00DA2C4A,00000001,?,?,00DA2C4A), ref: 00DD473C
                                                                                                                                                                                                              • GetEnvironmentVariableA.KERNEL32(00000000,C:\Users\user,00000104), ref: 00DCD651
                                                                                                                                                                                                              • CreateMutexA.KERNELBASE(00000000,00000000,00000000), ref: 00DCD721
                                                                                                                                                                                                              • CreateMutexA.KERNELBASE(00000000,00000000,00000000), ref: 00DCD76D
                                                                                                                                                                                                              • CreateMutexA.KERNEL32(00000000,00000000,00000000), ref: 00DCD7A4
                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 00DCD82E
                                                                                                                                                                                                              • Sleep.KERNEL32(00000D05), ref: 00DCDE9B
                                                                                                                                                                                                              • Sleep.KERNEL32(000003E8), ref: 00DCE039
                                                                                                                                                                                                              • GetCommandLineA.KERNEL32 ref: 00DCD9EB
                                                                                                                                                                                                                • Part of subcall function 00DAC9B0: ExitProcess.KERNEL32 ref: 00DAC9E8
                                                                                                                                                                                                                • Part of subcall function 00DC4990: CreateFileA.KERNEL32(?,00000000,00000000,00000000,00000003,00000000,00000000), ref: 00DC4A04
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000001.00000002.1744307248.0000000000DA1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00DA0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744293045.0000000000DA0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744332373.0000000000DD7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000DDC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E0D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E10000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E20000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744417618.0000000000E22000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_da0000_kfdag3aedbkjqfngi9xbw.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Create$Mutex$HeapProcessSleep$CommandCountEnvironmentExitFileFreeLineSystemTickTimeVariable
                                                                                                                                                                                                              • String ID: C:\Users\user$C:\vdjmzgowdzhfmld\xmjofjnkdlv.exe$Qt$[$U"Kd$l
                                                                                                                                                                                                              • API String ID: 2753435600-2303715064
                                                                                                                                                                                                              • Opcode ID: a3f2709c41b9d95f04cede858d234527b150b8c028f4a07a81bf181b3f04e2e8
                                                                                                                                                                                                              • Instruction ID: b0eb5fcfe2aff8877d3b0f496a26a21d277c1dc3c7c4a5b29a006e62d2fee40e
                                                                                                                                                                                                              • Opcode Fuzzy Hash: a3f2709c41b9d95f04cede858d234527b150b8c028f4a07a81bf181b3f04e2e8
                                                                                                                                                                                                              • Instruction Fuzzy Hash: AB1301B1A01342CFD704AF26FC85AA53BB5FB84300B15811AE442EB3B5EB719899CF71

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 436 da7fa0-da7fec call daf680 439 da7ff8-da8058 436->439 440 da7fee 436->440 441 da805a-da806c 439->441 442 da8072-da80da GetVersionExA call dc1510 call dd28c0 439->442 440->439 441->442 447 da8270-da82c9 442->447 448 da80e0-da80f4 442->448 449 da82cb-da82db 447->449 450 da82e1-da8370 call dd31e0 call dc7870 447->450 451 da8108-da8147 call daf420 448->451 452 da80f6-da8102 448->452 449->450 462 da8372-da837e 450->462 463 da8384-da83d0 call daa430 call dd6190 call dc4c70 call da70d0 450->463 458 da8149-da8156 451->458 459 da815d-da8208 call da7650 CreateDirectoryA call dd31e0 451->459 452->451 458->459 468 da820d-da826e call da7650 call daa430 459->468 462->463 479 da83d2-da8439 DeleteFileA RemoveDirectoryA 463->479 480 da8443-da84fc call daf420 call da7650 CreateDirectoryA 463->480 468->450 479->480 485 da8508-da8537 call dd01f0 480->485 486 da84fe 480->486 489 da855b-da85bc call dc5d80 485->489 490 da8539-da8551 485->490 486->485 493 da85c8-da85fd CreateDirectoryA 489->493 494 da85be 489->494 490->489 495 da863f-da864b 493->495 496 da85ff-da863d 493->496 494->493 497 da8651-da8678 call dd31e0 495->497 496->497 500 da867a-da869e 497->500 501 da86a0-da86da 497->501 502 da86e7-da8790 call da7650 call dd31e0 call daa430 call dc7870 call daa430 call dd6190 call dc4c70 call da70d0 500->502 501->502 503 da86dc-da86e2 501->503 520 da90cb-da914d call dc5d80 SetFileAttributesA call da96f0 call dc7720 502->520 521 da8796-da87a7 502->521 503->502 523 da883d-da88cd call dd31e0 call dc0cf0 call daa430 521->523 524 da87ad-da8838 call dd31e0 call dc0cf0 call daa430 521->524 542 da88d3-da88e8 523->542 524->542 543 da88ea-da88f9 542->543 544 da8921 542->544 543->544 546 da88fb-da891f 543->546 545 da8923-da8989 call da7650 CreateDirectoryA 544->545 549 da898b 545->549 550 da8995-da89df call dd01f0 call dc5d80 545->550 546->545 549->550 555 da8a11-da8a44 CreateDirectoryA 550->555 556 da89e1-da8a0b 550->556 557 da8a46-da8a5e 555->557 558 da8a64-da8a96 call dd31e0 555->558 556->555 557->558 561 da8a98-da8ab6 558->561 562 da8abd-da8b1f call da7650 call dd31e0 558->562 561->562 567 da8b21-da8b4e 562->567 568 da8b66-da8b88 call daa430 562->568 569 da8b5c 567->569 570 da8b50-da8b5a 567->570 573 da8b8a-da8b96 568->573 574 da8b9c-da8bf4 call dc7870 call daa430 call dd6190 call dc4c70 call da70d0 568->574 569->568 570->568 573->574 585 da8bfa-da8c0f 574->585 586 da90c1 574->586 587 da8c22-da8c94 GetTempPathA call dc2260 585->587 588 da8c11-da8c1c 585->588 586->520 591 da8cba-da8cbe 587->591 592 da8c96-da8cb4 587->592 588->587 593 da8d80-da8f22 call dd01f0 call dc5d80 CreateDirectoryA call dd31e0 call da7650 call dd31e0 call daa430 call dc7870 call daa430 call dd6190 call dc4c70 call da70d0 591->593 594 da8cc4 591->594 592->591 624 da8f28-da8f7f GetTempPathA call dd01f0 593->624 625 da90a6-da90bb 593->625 595 da8cc9-da8ce3 594->595 597 da8d31-da8d7a 595->597 598 da8ce5-da8cef 595->598 597->593 600 da8d29-da8d2d 598->600 601 da8cf1-da8d21 598->601 600->595 604 da8d2f 600->604 601->600 603 da8d23 601->603 603->600 604->593 628 da8fd1-da9033 call dd31e0 call da7650 call daa430 624->628 629 da8f81-da8fab 624->629 625->586 637 da907d-da909f 628->637 638 da9035-da9051 628->638 629->628 630 da8fad-da8fcb 629->630 630->628 637->625 641 da90a1 637->641 639 da9053-da9065 638->639 640 da9067-da907b 638->640 639->625 640->625 641->625
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetVersionExA.KERNEL32(00E20FB0), ref: 00DA808B
                                                                                                                                                                                                              • CreateDirectoryA.KERNELBASE(0000005C,00000000), ref: 00DA81E4
                                                                                                                                                                                                              • DeleteFileA.KERNELBASE(?,?,?,?,?,?,00000000), ref: 00DA8408
                                                                                                                                                                                                              • RemoveDirectoryA.KERNELBASE(?,?,?,?,?,?,00000000), ref: 00DA8433
                                                                                                                                                                                                              • CreateDirectoryA.KERNELBASE(?,00000000,?,?,?,?,?,?,?,?,00000000), ref: 00DA84CC
                                                                                                                                                                                                              • CreateDirectoryA.KERNELBASE(?,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00DA85D1
                                                                                                                                                                                                              • CreateDirectoryA.KERNEL32(?,00000000), ref: 00DA896A
                                                                                                                                                                                                              • CreateDirectoryA.KERNEL32(?,00000000), ref: 00DA8A1A
                                                                                                                                                                                                                • Part of subcall function 00DC0CF0: wvsprintfA.USER32(00001237,013BDA10,013AFC80), ref: 00DC0D77
                                                                                                                                                                                                              • GetTempPathA.KERNEL32(00000104,?,?,?,?,?,?,00000000), ref: 00DA8C2E
                                                                                                                                                                                                                • Part of subcall function 00DC2260: lstrlen.KERNEL32(?,?,00DA7614,?,?,C:\vdjmzgowdzhfmld\,?,?,00DA17C4,?), ref: 00DC2283
                                                                                                                                                                                                              • CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 00DA8DEE
                                                                                                                                                                                                              • GetTempPathA.KERNEL32(00000104,?,?,?,?,?,?,00000000), ref: 00DA8F47
                                                                                                                                                                                                              • SetFileAttributesA.KERNELBASE(?,00000002,?,?,?,?,?,?,00000000), ref: 00DA90F7
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000001.00000002.1744307248.0000000000DA1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00DA0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744293045.0000000000DA0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744332373.0000000000DD7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000DDC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E0D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E10000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E20000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744417618.0000000000E22000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_da0000_kfdag3aedbkjqfngi9xbw.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Directory$Create$FilePathTemp$AttributesDeleteRemoveVersionlstrlenwvsprintf
                                                                                                                                                                                                              • String ID: C:\Users\user$C:\vdjmzgowdzhfmld\$\
                                                                                                                                                                                                              • API String ID: 2935959199-4240323064
                                                                                                                                                                                                              • Opcode ID: d5abc87946d764cdbe47c99ddb28db96210d5c19574fa837a2afb26eeba0b154
                                                                                                                                                                                                              • Instruction ID: b73eea89fce0071436fa141947ad0385a2691b609a84fe3afdc4798c14a955cf
                                                                                                                                                                                                              • Opcode Fuzzy Hash: d5abc87946d764cdbe47c99ddb28db96210d5c19574fa837a2afb26eeba0b154
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 829222B1A01305CFD700AF22FD89AA53BB4FB94310B15C15AE542E63B9EB3149A9CF75

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 642 dd36d0-dd36f4 643 dd3728-dd3739 642->643 644 dd36f6-dd371c 642->644 646 dd375c-dd3850 643->646 647 dd373b-dd3755 643->647 644->643 645 dd371e 644->645 645->643 648 dd386c 646->648 649 dd3852-dd386a 646->649 647->646 650 dd3876-dd38ab 648->650 649->650 651 dd38ad 650->651 652 dd38b7-dd3912 call dd31e0 call dd01f0 650->652 651->652 657 dd3914-dd3920 652->657 658 dd3926-dd3968 call daa430 GetProcessHeap 652->658 657->658 661 dd396a-dd397c 658->661 662 dd3982-dd3984 658->662 661->662 663 dd3998-dd39b2 662->663 664 dd3986-dd3997 662->664 665 dd39ea-dd3a4d call dd31e0 LoadLibraryA call daa430 663->665 666 dd39b4-dd39c4 663->666 672 dd3a7f-dd3a9b 665->672 673 dd3a4f-dd3a7e 665->673 666->665 667 dd39c6-dd39e4 666->667 667->665 674 dd3a9d-dd3aaf 672->674 675 dd3ab1 672->675 676 dd3abb-dd3b2c call dd31e0 GetProcAddress call daa430 674->676 675->676 681 dd3b8d-dd3bb7 676->681 682 dd3b2e-dd3b6e FreeLibrary 676->682 685 dd3bb9 681->685 686 dd3bc3-dd3c14 HeapAlloc 681->686 683 dd3b84-dd3b8c 682->683 684 dd3b70-dd3b7d 682->684 684->683 685->686 687 dd3c28-dd3c2a 686->687 688 dd3c16-dd3c22 686->688 689 dd3c2c-dd3c62 FreeLibrary 687->689 690 dd3c63-dd3c82 GetAdaptersInfo 687->690 688->687 691 dd3cfc 690->691 692 dd3c84-dd3cc0 690->692 695 dd3cfe-dd3d01 691->695 693 dd3cf0-dd3cfa 692->693 694 dd3cc2-dd3cee 692->694 693->695 694->695 696 dd3e7b-dd3eb2 GetAdaptersInfo 695->696 697 dd3d07-dd3d71 HeapFree 695->697 698 dd3eb8-dd3f8b call dd31e0 call dd01f0 call daa430 696->698 699 dd4466 696->699 700 dd3d8d-dd3dc7 HeapAlloc 697->700 701 dd3d73-dd3d87 697->701 718 dd3f90-dd3fd1 call dc4860 698->718 705 dd4470-dd4492 699->705 703 dd3dc9-dd3de8 700->703 704 dd3dea-dd3df7 700->704 701->700 707 dd3dfc-dd3dfe 703->707 704->707 708 dd449e-dd44e8 HeapFree FreeLibrary 705->708 709 dd4494 705->709 711 dd3e5c-dd3e75 707->711 712 dd3e00-dd3e2c FreeLibrary 707->712 709->708 711->696 713 dd3e2e-dd3e40 712->713 714 dd3e41-dd3e5b 712->714 721 dd3fd7-dd402d call dc4860 718->721 722 dd4142-dd4162 718->722 729 dd402f-dd4042 721->729 730 dd4044 721->730 723 dd417a-dd418c 722->723 724 dd4164-dd4178 722->724 726 dd4192-dd4194 723->726 724->726 726->718 728 dd419a 726->728 731 dd442c-dd4464 call da96f0 728->731 732 dd404e-dd4050 729->732 730->732 731->705 733 dd4056-dd4074 732->733 734 dd4130-dd413c 732->734 736 dd409b-dd40af 733->736 737 dd4076-dd408b 733->737 734->722 740 dd40b5-dd4107 736->740 739 dd408d-dd4099 737->739 737->740 739->740 741 dd4109-dd4115 740->741 742 dd411b-dd4122 740->742 741->742 743 dd419f-dd4209 call dd31e0 call dd01f0 call daa430 742->743 744 dd4124-dd412e 742->744 751 dd420b-dd4221 743->751 752 dd4235-dd424f 743->752 744->726 751->752 753 dd4223-dd422f 751->753 754 dd439d-dd4416 call da96f0 752->754 755 dd4255-dd425a 752->755 753->752 754->731 762 dd4418-dd4425 754->762 757 dd4260-dd426f 755->757 759 dd4285-dd4291 757->759 760 dd4271-dd4283 757->760 761 dd4297-dd4316 759->761 760->761 763 dd4318-dd432a 761->763 764 dd4330-dd434a 761->764 762->731 763->764 765 dd434c-dd4350 764->765 766 dd4351-dd438f 764->766 765->766 766->757 767 dd4395-dd4398 766->767 767->754
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetProcessHeap.KERNEL32(?,?,?,?,?,00000000,?,?,?,?,?,?,?,?,00DB0E0A,?), ref: 00DD3945
                                                                                                                                                                                                              • LoadLibraryA.KERNELBASE(00000000,?,00000001,?,?,?,?,?,00000000), ref: 00DD3A07
                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,00000000), ref: 00DD3AF2
                                                                                                                                                                                                              • FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,00000001,?,?,?,?,?,00000000), ref: 00DD3B50
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000000,00000288,?,?,?,?,?,?,?,00000001), ref: 00DD3BF7
                                                                                                                                                                                                              • FreeLibrary.KERNEL32(00000100,?,?,?,?,?,?,?,00000001,?,?,?,?,?,00000000), ref: 00DD3C42
                                                                                                                                                                                                              • GetAdaptersInfo.IPHLPAPI(00000000,00000288,?,?,?,?,?,?,?,00000001,?,?,?,?,?,00000000), ref: 00DD3C72
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,00000001), ref: 00DD3D56
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000000,00000288,?,?,?,?,?,?,?,00000001), ref: 00DD3D94
                                                                                                                                                                                                              • FreeLibrary.KERNEL32(00000100,?,?,?,?,?,?,?,00000001,?,?,?,?,?,00000000), ref: 00DD3E0E
                                                                                                                                                                                                              • GetAdaptersInfo.IPHLPAPI(00000000,00000288,?,?,?,?,?,?,?,00000001,?,?,?,?,?,00000000), ref: 00DD3EA4
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,00000001), ref: 00DD44A5
                                                                                                                                                                                                              • FreeLibrary.KERNEL32(00000100,?,?,?,?,?,?,?,00000001,?,?,?,?,?,00000000), ref: 00DD44CF
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000001.00000002.1744307248.0000000000DA1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00DA0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744293045.0000000000DA0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744332373.0000000000DD7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000DDC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E0D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E10000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E20000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744417618.0000000000E22000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_da0000_kfdag3aedbkjqfngi9xbw.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Free$HeapLibrary$AdaptersAllocInfo$AddressLoadProcProcess
                                                                                                                                                                                                              • String ID: V\v(
                                                                                                                                                                                                              • API String ID: 2633798829-3864276540
                                                                                                                                                                                                              • Opcode ID: d951f7c8379fff28118222afeec81669e1e7100db7c5ca6cfcae16f110dbe1f7
                                                                                                                                                                                                              • Instruction ID: 8f0a1da2f9bf1275e044230f7fabe9f5ff24d8883131262cb4b1a0b807bfd0d0
                                                                                                                                                                                                              • Opcode Fuzzy Hash: d951f7c8379fff28118222afeec81669e1e7100db7c5ca6cfcae16f110dbe1f7
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 85720EB1A01341CFC708AF26FD955A53BB5FB98310B15C11AE442EA3B8E77189A9CF71

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 768 da53b0-da53db 769 da541c-da5448 768->769 770 da53dd-da53f0 768->770 772 da544a-da545c 769->772 773 da545e 769->773 770->769 771 da53f2-da5416 770->771 771->769 774 da5468-da5482 OpenSCManagerA 772->774 773->774 775 da56e8-da570d 774->775 776 da5488-da54d9 CreateServiceA 774->776 777 da55a8-da5616 OpenServiceA 776->777 778 da54df-da557f ChangeServiceConfig2A StartServiceA 776->778 779 da5618-da5647 777->779 780 da5659-da565b 777->780 781 da5592-da55a3 CloseServiceHandle 778->781 782 da5581-da558c 778->782 779->780 784 da5649-da5654 779->784 785 da569e-da56b6 780->785 786 da565d-da5698 StartServiceA CloseServiceHandle 780->786 783 da56bc-da56e7 CloseServiceHandle 781->783 782->781 783->775 784->780 785->783 786->785
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • OpenSCManagerA.SECHOST(00000000,00000000,00000002), ref: 00DA546E
                                                                                                                                                                                                              • CreateServiceA.ADVAPI32(00000000,013B0580,013B0580,000F01FF,00000110,00000002,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 00DA54BD
                                                                                                                                                                                                              • ChangeServiceConfig2A.ADVAPI32(00000000,00000001,?), ref: 00DA5503
                                                                                                                                                                                                              • StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00DA5533
                                                                                                                                                                                                              • CloseServiceHandle.ADVAPI32(00000000), ref: 00DA5593
                                                                                                                                                                                                              • OpenServiceA.ADVAPI32(00000000,013B0580,00000010), ref: 00DA55DE
                                                                                                                                                                                                              • StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00DA566C
                                                                                                                                                                                                              • CloseServiceHandle.ADVAPI32(00000000), ref: 00DA567D
                                                                                                                                                                                                              • CloseServiceHandle.ADVAPI32(00000000), ref: 00DA56CC
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000001.00000002.1744307248.0000000000DA1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00DA0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744293045.0000000000DA0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744332373.0000000000DD7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000DDC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E0D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E10000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E20000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744417618.0000000000E22000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_da0000_kfdag3aedbkjqfngi9xbw.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Service$CloseHandle$OpenStart$ChangeConfig2CreateManager
                                                                                                                                                                                                              • String ID: |Sxz
                                                                                                                                                                                                              • API String ID: 3525021261-962673421
                                                                                                                                                                                                              • Opcode ID: de07c6f168443cd0930c3036b5f469936d4f6cb53e3bfe424af3e94cbd0c1315
                                                                                                                                                                                                              • Instruction ID: 480bbca9e366e092170645b9f6826aa04ad5a275470936711dfbd3be21c21379
                                                                                                                                                                                                              • Opcode Fuzzy Hash: de07c6f168443cd0930c3036b5f469936d4f6cb53e3bfe424af3e94cbd0c1315
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2D811E71A02700DFD314EF26FDC96A53BB1F794311B50802AE881EB3B8E7719899CB65

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 1057 db0950-db097a 1058 db098a-db099a 1057->1058 1059 db097c-db0988 1057->1059 1061 db099c-db09ae 1058->1061 1062 db09b0 1058->1062 1060 db09b6-db0a2d 1059->1060 1063 db0a4b 1060->1063 1064 db0a2f-db0a49 1060->1064 1061->1060 1062->1060 1065 db0a55-db0a80 call dd00f0 call daf680 1063->1065 1064->1065 1070 db0ad3-db0adf call dd6100 1065->1070 1071 db0a82-db0aaa 1065->1071 1076 db0aef 1070->1076 1077 db0ae1-db0aed call da5300 1070->1077 1072 db0ab9-db0acc 1071->1072 1073 db0aac-db0ab7 1071->1073 1072->1070 1073->1070 1079 db0af9-db0b45 GetComputerNameA 1076->1079 1077->1079 1081 db0b4b-db0b7b call dd31e0 1079->1081 1082 db0c0e-db0c52 1079->1082 1089 db0b8f-db0baf call dd01f0 1081->1089 1090 db0b7d-db0b89 1081->1090 1083 db0c74-db0d23 call dd31e0 call dd01f0 call daa430 call dc7870 call da7a50 1082->1083 1084 db0c54-db0c6e 1082->1084 1107 db0d37-db0d59 call dd01f0 1083->1107 1108 db0d25-db0d31 1083->1108 1084->1083 1095 db0bbd-db0be1 1089->1095 1096 db0bb1-db0bbb 1089->1096 1090->1089 1099 db0be9-db0c07 call daa430 1095->1099 1100 db0be3 1095->1100 1096->1099 1099->1082 1100->1099 1111 db0d5b-db0d65 1107->1111 1112 db0d67-db0d73 1107->1112 1108->1107 1113 db0d79-db0e30 call da7650 call da96f0 call dd36d0 1111->1113 1112->1113 1120 db0e32-db0e45 1113->1120 1121 db0e47-db0e75 1113->1121 1122 db0e90-db0f74 call dc2260 call dafdf0 call dac3e0 call dc7720 call da7a50 1120->1122 1121->1122 1123 db0e77-db0e8a 1121->1123 1134 db0f8e 1122->1134 1135 db0f76-db0f8c 1122->1135 1123->1122 1136 db0f98-db0fde call dafdf0 call dac3e0 call dc7720 1134->1136 1135->1136 1143 db0fff-db116e call da7a50 call dafdf0 call dac3e0 call dc7720 call da7a50 call dafdf0 call dac3e0 call dc7720 call da7a50 call dafdf0 call dac3e0 call dc7720 1136->1143 1144 db0fe0-db0ff8 1136->1144 1169 db1170-db118d 1143->1169 1170 db11b6-db11cf call da7a50 1143->1170 1144->1143 1169->1170 1171 db118f-db11af 1169->1171 1174 db11d1-db11de 1170->1174 1175 db11e5-db123b call dd31e0 call dafdf0 call dac3e0 call dc7720 1170->1175 1171->1170 1174->1175 1184 db124d-db1268 call daa430 1175->1184 1185 db123d-db1247 1175->1185 1188 db126a 1184->1188 1189 db1274-db12ac call da7a50 1184->1189 1185->1184 1188->1189 1192 db12ae-db12ce 1189->1192 1193 db12d5-db1327 call dafdf0 call dac3e0 call dc7720 1189->1193 1192->1193 1200 db1329-db1341 1193->1200 1201 db1347-db1623 call da7a50 call dafdf0 call dac3e0 call dc7720 call da7a50 call dd1d80 call dc8000 call dafdf0 call dac3e0 call dc7720 call da7a50 call dc1920 call dafdf0 call dac3e0 call dc7720 call dd6190 call dc4c70 call dad1f0 call dc2070 call dd6190 call dc4c70 call db60d0 call dd1a70 call dd2b00 call da96f0 * 2 1193->1201 1200->1201 1254 db163d-db167a call da96f0 call dc7720 call dab670 1201->1254 1255 db1625-db1637 1201->1255 1255->1254
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetComputerNameA.KERNEL32(?,?), ref: 00DB0B3D
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000001.00000002.1744307248.0000000000DA1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00DA0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744293045.0000000000DA0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744332373.0000000000DD7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000DDC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E0D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E10000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E20000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744417618.0000000000E22000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_da0000_kfdag3aedbkjqfngi9xbw.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ComputerName
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3545744682-0
                                                                                                                                                                                                              • Opcode ID: 8acc75f845420cb3ea6efa3aeecd23272fb53b7b0ca37b4c8a3faf1c90d43d5e
                                                                                                                                                                                                              • Instruction ID: 31cbdd57aa7a79b48c98c33b4fd920eb8d38f44a87c0aa93c59464d019005513
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8acc75f845420cb3ea6efa3aeecd23272fb53b7b0ca37b4c8a3faf1c90d43d5e
                                                                                                                                                                                                              • Instruction Fuzzy Hash: DA62EF71901345CFC704EF66FC96AEA37B5FB94310B50811AE446EA2B5EB309A98CF71

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 787 db5eb0-db5f2f call da96f0 790 db5f4b-db5f83 call da96f0 787->790 791 db5f31-db5f44 787->791 794 db5f91 790->794 795 db5f85-db5f8f 790->795 791->790 796 db5f9b-db6033 CreateProcessA 794->796 795->796 797 db6090-db60bf 796->797 798 db6035-db608f CloseHandle * 2 796->798
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CreateProcessA.KERNELBASE(00001237,013BDA10,00000000,00000000,00000000,00000008,00000000,00000000,00000044,013AFC80), ref: 00DB602B
                                                                                                                                                                                                              • CloseHandle.KERNEL32(013BDA10), ref: 00DB6043
                                                                                                                                                                                                              • CloseHandle.KERNEL32(013AFC80), ref: 00DB6072
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000001.00000002.1744307248.0000000000DA1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00DA0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744293045.0000000000DA0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744332373.0000000000DD7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000DDC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E0D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E10000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E20000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744417618.0000000000E22000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_da0000_kfdag3aedbkjqfngi9xbw.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CloseHandle$CreateProcess
                                                                                                                                                                                                              • String ID: D
                                                                                                                                                                                                              • API String ID: 2922976086-2746444292
                                                                                                                                                                                                              • Opcode ID: 5574ee6bd3189bc52f2c934edf6f6cc506abe407170fe3844eca504986746587
                                                                                                                                                                                                              • Instruction ID: 161da1e88c37ce126c29735669d7819dff3168e3a7d394503e1b1d4b600056dd
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5574ee6bd3189bc52f2c934edf6f6cc506abe407170fe3844eca504986746587
                                                                                                                                                                                                              • Instruction Fuzzy Hash: E751BD756013418FC708EF69ED92BBA73B4F744711F14802AE902DB7A4E779A989C721

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 799 dc26b0-dc26f3 call dd6810 802 dc26f5-dc26fb 799->802 803 dc2701-dc2739 799->803 802->803 804 dc275c-dc2797 call dc2070 803->804 805 dc273b-dc2750 803->805 809 dc2799-dc27cb 804->809 810 dc27d2-dc282c call dc8570 CreateFileA 804->810 805->804 806 dc2752 805->806 806->804 809->810 813 dc282e-dc2846 810->813 814 dc284b-dc2866 810->814 815 dc2abb-dc2aff call dc2290 813->815 816 dc2870-dc289e 814->816 822 dc2b01-dc2b0d 815->822 823 dc2b13-dc2b3b call da96f0 815->823 818 dc28a0-dc28ac 816->818 819 dc28b2-dc2946 ReadFile call dab680 call dd6190 call dbf910 816->819 818->819 831 dc295e-dc296d 819->831 832 dc2948-dc295c 819->832 822->823 833 dc2973-dc297c call dbfc90 831->833 832->833 836 dc2a7e-dc2ab5 CloseHandle 833->836 837 dc2982-dc29bb call db60d0 833->837 836->815 837->816 840 dc29c1-dc2a35 CloseHandle call dc2290 call da96f0 837->840 845 dc2b3c-dc2b49 840->845 846 dc2a3b-dc2a62 840->846 848 dc2b50-dc2b5b 845->848 847 dc2a68-dc2a7d 846->847 846->848
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00DC2807
                                                                                                                                                                                                              • ReadFile.KERNEL32(00000000,?,00005000,?,00000000), ref: 00DC28C5
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000,?,?,?,00000000), ref: 00DC29CC
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000001.00000002.1744307248.0000000000DA1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00DA0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744293045.0000000000DA0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744332373.0000000000DD7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000DDC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E0D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E10000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E20000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744417618.0000000000E22000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_da0000_kfdag3aedbkjqfngi9xbw.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: File$CloseCreateHandleRead
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1035965006-0
                                                                                                                                                                                                              • Opcode ID: c67662799f95dafbd81c005ff615cfd4e8b5c630ec05d623cec2dd4a564a7259
                                                                                                                                                                                                              • Instruction ID: d83a5addd22d955d71bd04a26ee41083254e54a2cee97bdc0e6710a90ac0f6d3
                                                                                                                                                                                                              • Opcode Fuzzy Hash: c67662799f95dafbd81c005ff615cfd4e8b5c630ec05d623cec2dd4a564a7259
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 69B1DE75A01701DFD704AF26FCC6AA537B1F798310B11841AE402EB3B4EB7199A9CFA4

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 849 da2510-da252d 850 da253b-da25d6 849->850 851 da252f-da2535 849->851 852 da25d8-da25f1 850->852 853 da25f7-da2611 850->853 851->850 852->853 854 da2613-da263f 853->854 855 da2641 853->855 856 da2643-da2665 call dc8570 854->856 855->856 859 da26b9-da26c0 856->859 860 da2667-da269b 856->860 862 da292b-da2937 859->862 863 da26c6-da275a call dd31e0 GetProcAddress 859->863 860->859 861 da269d-da26b2 860->861 861->859 864 da2939-da2967 862->864 865 da296d-da2973 862->865 872 da276b-da27fd call dd31e0 call daa430 GetProcAddress call daa430 863->872 873 da275c-da2765 863->873 864->865 867 da29c9-da29f9 865->867 868 da2975-da298a 865->868 870 da29fb-da2a44 call db5e60 * 2 867->870 871 da2a75-da2aaf call dc2290 867->871 868->867 879 da298c-da29c3 868->879 889 da2a50-da2a6f call db5e60 * 2 870->889 890 da2a46 870->890 883 da2abb-da2ac1 871->883 884 da2ab1 871->884 894 da2803-da280a 872->894 895 da28e0-da28fe 872->895 873->872 879->867 884->883 889->871 890->889 894->895 897 da2810-da2818 894->897 898 da2908-da2928 895->898 900 da281f-da2821 897->900 898->862 900->895 901 da2827-da2837 900->901 902 da2839-da2851 901->902 903 da2857-da2878 901->903 902->903 904 da287a-da2896 903->904 905 da28d2-da28de 903->905 904->898 906 da2898-da28d0 904->906 905->898 906->898
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetProcAddress.KERNEL32(75A70000,00000000), ref: 00DA272B
                                                                                                                                                                                                              • GetProcAddress.KERNEL32(75A70000,00000000), ref: 00DA27B0
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000001.00000002.1744307248.0000000000DA1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00DA0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744293045.0000000000DA0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744332373.0000000000DD7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000DDC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E0D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E10000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E20000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744417618.0000000000E22000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_da0000_kfdag3aedbkjqfngi9xbw.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: AddressProc
                                                                                                                                                                                                              • String ID: %Uj*
                                                                                                                                                                                                              • API String ID: 190572456-2557879984
                                                                                                                                                                                                              • Opcode ID: 59f0cb8500a30548a66ced01518b411043f736d5dea716459d77f94f397c38f9
                                                                                                                                                                                                              • Instruction ID: 3be1684973804aa386f194470680af6125a56f318f5648ec7e6fe2056f9ced7c
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 59f0cb8500a30548a66ced01518b411043f736d5dea716459d77f94f397c38f9
                                                                                                                                                                                                              • Instruction Fuzzy Hash: A3D122B1A01345DFD300AF27FD88AA13BB1F794750B55851AE082F63B8E73588A9CF65

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 907 dc56a0-dc56bc 908 dc56be-dc56d4 907->908 909 dc56e8-dc56fc GetProcessHeap RtlAllocateHeap 907->909 908->909 910 dc56d6-dc56e2 908->910 910->909
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetProcessHeap.KERNEL32(00000000,?,?,00DB8C4F,02053FC0,?,?,?,?,00DC55F4), ref: 00DC56EE
                                                                                                                                                                                                              • RtlAllocateHeap.NTDLL(00000000,?,00DB8C4F,02053FC0,?,?,?,?,00DC55F4), ref: 00DC56F5
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000001.00000002.1744307248.0000000000DA1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00DA0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744293045.0000000000DA0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744332373.0000000000DD7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000DDC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E0D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E10000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E20000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744417618.0000000000E22000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_da0000_kfdag3aedbkjqfngi9xbw.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Heap$AllocateProcess
                                                                                                                                                                                                              • String ID: |Q.H
                                                                                                                                                                                                              • API String ID: 1357844191-517162033
                                                                                                                                                                                                              • Opcode ID: 0a888fd1f2e9f7d0db7848132a05507da7eebb911bb45ae013938e6c992e4300
                                                                                                                                                                                                              • Instruction ID: 975519dad12f73c5fdfa3ae421d8835e18be14c9b2057f0caa6514b2f188a906
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 0a888fd1f2e9f7d0db7848132a05507da7eebb911bb45ae013938e6c992e4300
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 0BE0397114978B9FD7046F58FC88ABA3B74F358B517408049F506DB7B4DA74A494C731

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 911 da70d0-da716b call dd6810 call dc8570 916 da716d-da7190 911->916 917 da71d0-da721b CreateFileA 911->917 920 da71a8-da71cf call dc2290 916->920 921 da7192-da71a2 916->921 918 da72ad-da72e9 917->918 919 da7221-da7269 call dc2290 917->919 923 da72eb-da72f7 918->923 924 da72fd-da7305 918->924 929 da726b-da727b 919->929 930 da727c-da7298 919->930 921->920 923->924 927 da7312-da7330 924->927 931 da7332-da7353 927->931 932 da7355-da7389 927->932 933 da729a-da729f 930->933 934 da72a6-da72ac 930->934 935 da7395-da745d call daf1c0 call dab680 WriteFile 931->935 932->935 936 da738b 932->936 933->934 941 da745f-da746b 935->941 942 da7471-da7488 935->942 936->935 941->942 943 da748e-da74b6 942->943 944 da7310 942->944 945 da74b8-da74f8 943->945 946 da7522 943->946 944->927 947 da74fa-da750c 945->947 948 da750e-da7520 945->948 949 da7524-da754c CloseHandle call dc2290 946->949 947->949 948->949 951 da7551-da7564 949->951 952 da758f-da7597 951->952 953 da7566-da7574 951->953 953->952 954 da7576-da7589 953->954 954->952
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                • Part of subcall function 00DC8570: WaitForSingleObject.KERNEL32(?,00004E20,?,00DA264E,00000134,00000000,00000001,?,?,00DC1B87,00DA17D5,?), ref: 00DC85D7
                                                                                                                                                                                                              • CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000000,00000000,?,00000000,?,?,?,?,?,?,00000000), ref: 00DA71F7
                                                                                                                                                                                                              • WriteFile.KERNELBASE(00000000,?,00005000,00005000,00000000,?,?,?,?,?,?), ref: 00DA740F
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000001.00000002.1744307248.0000000000DA1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00DA0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744293045.0000000000DA0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744332373.0000000000DD7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000DDC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E0D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E10000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E20000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744417618.0000000000E22000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_da0000_kfdag3aedbkjqfngi9xbw.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: File$CreateObjectSingleWaitWrite
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3285871581-0
                                                                                                                                                                                                              • Opcode ID: fe12f9b2f87a037d5ec73a25941eeb4e515366644fe5043f4e8aa1e745d1a262
                                                                                                                                                                                                              • Instruction ID: 1acdf6634526945c2fd84d4419cc8212606460469c96386393397d3156c4fc2a
                                                                                                                                                                                                              • Opcode Fuzzy Hash: fe12f9b2f87a037d5ec73a25941eeb4e515366644fe5043f4e8aa1e745d1a262
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3EC101B2A05301CFD704EF66FDC56A537B5F798310B11842AE446EB3B4E73198A8CBA5

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 979 da7309 980 da7310-da7330 979->980 982 da7332-da7353 980->982 983 da7355-da7389 980->983 984 da7395-da745d call daf1c0 call dab680 WriteFile 982->984 983->984 985 da738b 983->985 990 da745f-da746b 984->990 991 da7471-da7488 984->991 985->984 990->991 991->980 992 da748e-da74b6 991->992 993 da74b8-da74f8 992->993 994 da7522 992->994 995 da74fa-da750c 993->995 996 da750e-da7520 993->996 997 da7524-da7564 CloseHandle call dc2290 994->997 995->997 996->997 1000 da758f-da7597 997->1000 1001 da7566-da7574 997->1001 1001->1000 1002 da7576-da7589 1001->1002 1002->1000
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • WriteFile.KERNELBASE(00000000,?,00005000,00005000,00000000,?,?,?,?,?,?), ref: 00DA740F
                                                                                                                                                                                                              • CloseHandle.KERNELBASE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00DA7525
                                                                                                                                                                                                                • Part of subcall function 00DC2290: ReleaseMutex.KERNEL32(00DA2A8B,?,00DA2A8B,00000134), ref: 00DC22E7
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000001.00000002.1744307248.0000000000DA1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00DA0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744293045.0000000000DA0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744332373.0000000000DD7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000DDC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E0D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E10000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E20000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744417618.0000000000E22000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_da0000_kfdag3aedbkjqfngi9xbw.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CloseFileHandleMutexReleaseWrite
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 157576396-0
                                                                                                                                                                                                              • Opcode ID: 82ac91a2f4d099357a83ec74a07bcf877ab8940ff8a02db83897ada937b18c25
                                                                                                                                                                                                              • Instruction ID: f460543f457641fdc67db488188ca14941c55a3f23049f86f724f94d9d2646b4
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 82ac91a2f4d099357a83ec74a07bcf877ab8940ff8a02db83897ada937b18c25
                                                                                                                                                                                                              • Instruction Fuzzy Hash: A0510FB2A01340CFC704EF55FDC46A57BB5F784311B268026E446EA3B9EB3199A4CFA1

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 955 da7307 956 da7310-da7330 955->956 958 da7332-da7353 956->958 959 da7355-da7389 956->959 960 da7395-da745d call daf1c0 call dab680 WriteFile 958->960 959->960 961 da738b 959->961 966 da745f-da746b 960->966 967 da7471-da7488 960->967 961->960 966->967 967->956 968 da748e-da74b6 967->968 969 da74b8-da74f8 968->969 970 da7522 968->970 971 da74fa-da750c 969->971 972 da750e-da7520 969->972 973 da7524-da7564 CloseHandle call dc2290 970->973 971->973 972->973 976 da758f-da7597 973->976 977 da7566-da7574 973->977 977->976 978 da7576-da7589 977->978 978->976
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • WriteFile.KERNELBASE(00000000,?,00005000,00005000,00000000,?,?,?,?,?,?), ref: 00DA740F
                                                                                                                                                                                                              • CloseHandle.KERNELBASE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00DA7525
                                                                                                                                                                                                                • Part of subcall function 00DC2290: ReleaseMutex.KERNEL32(00DA2A8B,?,00DA2A8B,00000134), ref: 00DC22E7
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000001.00000002.1744307248.0000000000DA1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00DA0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744293045.0000000000DA0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744332373.0000000000DD7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000DDC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E0D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E10000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E20000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744417618.0000000000E22000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_da0000_kfdag3aedbkjqfngi9xbw.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CloseFileHandleMutexReleaseWrite
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 157576396-0
                                                                                                                                                                                                              • Opcode ID: 0b25240883511805e33f77d90e3ec0011d76dc06ac3bd81d0dd249a0f6c1270c
                                                                                                                                                                                                              • Instruction ID: 8a17273af70cfd2888d8e6a085314c216e0b95cf885e203b143f42d30dcc6248
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 0b25240883511805e33f77d90e3ec0011d76dc06ac3bd81d0dd249a0f6c1270c
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 735121B2A01340CFC704EF55FDC45A53BB5F784311B268026E446EA3B9EB3199A4CFA1

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 1003 dc1510-dc152f 1004 dc153b-dc15b0 AllocateAndInitializeSid 1003->1004 1005 dc1531 1003->1005 1006 dc15c0-dc1608 1004->1006 1007 dc15b2-dc15be 1004->1007 1005->1004 1008 dc161e-dc1621 1006->1008 1009 dc160a-dc1617 1006->1009 1007->1008 1010 dc1697-dc16a8 1008->1010 1011 dc1623-dc1646 CheckTokenMembership 1008->1011 1009->1008 1012 dc1648-dc1661 1011->1012 1013 dc1667-dc1691 1011->1013 1012->1013 1013->1010
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • AllocateAndInitializeSid.ADVAPI32(00DA80AE,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00DA80AE), ref: 00DC1592
                                                                                                                                                                                                              • CheckTokenMembership.KERNELBASE(00000000,?,?), ref: 00DC163E
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000001.00000002.1744307248.0000000000DA1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00DA0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744293045.0000000000DA0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744332373.0000000000DD7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000DDC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E0D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E10000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E20000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744417618.0000000000E22000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_da0000_kfdag3aedbkjqfngi9xbw.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: AllocateCheckInitializeMembershipToken
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1663163955-0
                                                                                                                                                                                                              • Opcode ID: 1f477e4f0af619f4b02dc4958446a9a593a808c39670c8a72a9805bbe206aa7b
                                                                                                                                                                                                              • Instruction ID: d425f6629ae31f4d1e3359f77e2b36701d61a88a4ea6aa628f031ad52ed054ba
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1f477e4f0af619f4b02dc4958446a9a593a808c39670c8a72a9805bbe206aa7b
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3741BB72A02345EFCB049FA6EDC89E8BB74FB50300B55C49AD441A72BADB314568CF64

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 1015 dd59b0-dd59db GetProcessHeap RtlFreeHeap
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetProcessHeap.KERNEL32(00000000,00000000,?,00DBFA98,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00DD59C3
                                                                                                                                                                                                              • RtlFreeHeap.NTDLL(00000000,?,00DBFA98,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00DD59CA
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000001.00000002.1744307248.0000000000DA1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00DA0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744293045.0000000000DA0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744332373.0000000000DD7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000DDC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E0D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E10000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E20000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744417618.0000000000E22000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_da0000_kfdag3aedbkjqfngi9xbw.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Heap$FreeProcess
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3859560861-0
                                                                                                                                                                                                              • Opcode ID: 0b3414522824b0debb01c33287190ed91350d94529b5782dacf4e7eb5d37461a
                                                                                                                                                                                                              • Instruction ID: 9f8946914f5e1c6fdaf9a72f6c959b522dd09999bd0063381e56001926b8c71a
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 0b3414522824b0debb01c33287190ed91350d94529b5782dacf4e7eb5d37461a
                                                                                                                                                                                                              • Instruction Fuzzy Hash: FBD012700493859FC7506FA9FC49B963BACEF1861AF018081F60ACD6B0C7315850CF74
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CreateFileA.KERNELBASE(?,C0000000,00000000,00000000,00000002,00000000,00000000), ref: 00DB5933
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000001.00000002.1744307248.0000000000DA1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00DA0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744293045.0000000000DA0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744332373.0000000000DD7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000DDC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E0D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E10000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E20000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744417618.0000000000E22000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_da0000_kfdag3aedbkjqfngi9xbw.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CreateFile
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 823142352-0
                                                                                                                                                                                                              • Opcode ID: 9e4b3686ca3cb0cb98599657433772aa0fd3de13bd3890c437e16f30f4e3ff89
                                                                                                                                                                                                              • Instruction ID: 86584e222301d44dbe5053c432d43d779c49fc5ea169eaf9dd8e0822dacef3a5
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9e4b3686ca3cb0cb98599657433772aa0fd3de13bd3890c437e16f30f4e3ff89
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2D710572A01709CFD7146F26FC897E03BB0F759310B628045D546EA3B9EB3155A8CFA5
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                • Part of subcall function 00DC6BE0: GetStdHandle.KERNEL32(000000F6,?,?,00DC5560), ref: 00DC6C12
                                                                                                                                                                                                                • Part of subcall function 00DC6BE0: GetStdHandle.KERNEL32(000000F5,?,?,00DC5560), ref: 00DC6C6A
                                                                                                                                                                                                                • Part of subcall function 00DC6BE0: GetStdHandle.KERNEL32(000000F4,?,?,00DC5560), ref: 00DC6D53
                                                                                                                                                                                                              • ExitProcess.KERNEL32 ref: 00DC561B
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000001.00000002.1744307248.0000000000DA1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00DA0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744293045.0000000000DA0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744332373.0000000000DD7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000DDC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E0D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E10000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E20000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744417618.0000000000E22000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_da0000_kfdag3aedbkjqfngi9xbw.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Handle$ExitProcess
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 256993070-0
                                                                                                                                                                                                              • Opcode ID: 4f707b511e4296a5fe4c80987091c4805262b536c737ffa006d6f5154f917246
                                                                                                                                                                                                              • Instruction ID: 95b286ae49b15388c6e6b46c78f78a5ddf0ed31ef05a5460c044ee86e57fe257
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4f707b511e4296a5fe4c80987091c4805262b536c737ffa006d6f5154f917246
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 81110472A11741CFDB10AF34FD8659937A5FB643903168127D002EB7B6EA34C899CB70
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000001.00000002.1744307248.0000000000DA1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00DA0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744293045.0000000000DA0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744332373.0000000000DD7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000DDC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E0D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E10000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E20000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744417618.0000000000E22000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_da0000_kfdag3aedbkjqfngi9xbw.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ExitProcess
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 621844428-0
                                                                                                                                                                                                              • Opcode ID: b792e3e5ee95b085133b28307912d71ea1819036374ee4c698aacb75e5ac8e4e
                                                                                                                                                                                                              • Instruction ID: 0370dc86ad9efa02c3821a3e407f2acf1a412d364bec665934f1075b47c17518
                                                                                                                                                                                                              • Opcode Fuzzy Hash: b792e3e5ee95b085133b28307912d71ea1819036374ee4c698aacb75e5ac8e4e
                                                                                                                                                                                                              • Instruction Fuzzy Hash: EEE0E278210389CFC304EF6AFC854693B79FBA97103119115E845AAB75C734A899CFAA
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • lstrlen.KERNEL32(?,00000000,?,00DA220B,?,?,?), ref: 00DC8A81
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000001.00000002.1744307248.0000000000DA1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00DA0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744293045.0000000000DA0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744332373.0000000000DD7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000DDC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E0D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E10000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E20000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744417618.0000000000E22000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_da0000_kfdag3aedbkjqfngi9xbw.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlen
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1659193697-0
                                                                                                                                                                                                              • Opcode ID: b520f1bfc17147316bc16cec46c90daa41559a3600037ccebfd5964d17b2eac2
                                                                                                                                                                                                              • Instruction ID: 71325c504acc3f02c7bafc7bf29788a7d04eb440e365d48523ab0210da01f189
                                                                                                                                                                                                              • Opcode Fuzzy Hash: b520f1bfc17147316bc16cec46c90daa41559a3600037ccebfd5964d17b2eac2
                                                                                                                                                                                                              • Instruction Fuzzy Hash: E6212775601755CFD318BF69FC985B53BA5F389320321812FD186EA7B9EB3048A5CB60
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • OpenSCManagerA.ADVAPI32(00000000,00000000,80000000), ref: 00DB643A
                                                                                                                                                                                                              • EnumServicesStatusA.ADVAPI32(00000000,00000030,00000003,?,00000024,?,?,00000000), ref: 00DB64AC
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 00DB64C1
                                                                                                                                                                                                              • EnumServicesStatusA.ADVAPI32(00000000,00000030,00000003,00000000,?,?,?,00000000), ref: 00DB65D1
                                                                                                                                                                                                              • CloseServiceHandle.ADVAPI32(00000000), ref: 00DB6829
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000001.00000002.1744307248.0000000000DA1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00DA0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744293045.0000000000DA0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744332373.0000000000DD7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000DDC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E0D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E10000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E20000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744417618.0000000000E22000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_da0000_kfdag3aedbkjqfngi9xbw.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: EnumServicesStatus$CloseErrorHandleLastManagerOpenService
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1579346331-0
                                                                                                                                                                                                              • Opcode ID: a5fe90f45e9996e809e9c0d00e78155e906639442e273ba6a7d99b268c846027
                                                                                                                                                                                                              • Instruction ID: 549fcb7fd1c3e5d16e73737fae50098e7f76cd67f1012d2df100d23333129de0
                                                                                                                                                                                                              • Opcode Fuzzy Hash: a5fe90f45e9996e809e9c0d00e78155e906639442e273ba6a7d99b268c846027
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7C02F7B2A01305DFC704AF66FD896E53BB0F784310B25811AD486F63B4EB3585A9CF65
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • Sleep.KERNEL32(000003E8,?,00000001), ref: 00DA38AD
                                                                                                                                                                                                              • FindFirstFileA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 00DA39A7
                                                                                                                                                                                                              • DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 00DA3AB9
                                                                                                                                                                                                              • FindNextFileA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 00DA3AD1
                                                                                                                                                                                                              • FindClose.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 00DA3AF2
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000001.00000002.1744307248.0000000000DA1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00DA0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744293045.0000000000DA0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744332373.0000000000DD7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000DDC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E0D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E10000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E20000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744417618.0000000000E22000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_da0000_kfdag3aedbkjqfngi9xbw.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: FileFind$CloseDeleteFirstNextSleep
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1528862845-0
                                                                                                                                                                                                              • Opcode ID: 0575678f582fb57bc4d0d4aa744f8c9524853275db89ee1575194188bc633e2f
                                                                                                                                                                                                              • Instruction ID: 491f2a924e2f4f61f337c9280ef0d63606d5da9f5ebe77d32efee89337d18c6b
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 0575678f582fb57bc4d0d4aa744f8c9524853275db89ee1575194188bc633e2f
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4CA1EF71501355CFD714EF22FC9A5B937B6FB95300B04811AE442EA3B5EB708AA9CBB1
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00DACB8A
                                                                                                                                                                                                              • SetHandleInformation.KERNEL32(?,00000001,00000000), ref: 00DACBD0
                                                                                                                                                                                                              • CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00DACC2C
                                                                                                                                                                                                              • SetHandleInformation.KERNEL32(?,00000001,00000000), ref: 00DACCA8
                                                                                                                                                                                                              • CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,?,00000044,?), ref: 00DACE0D
                                                                                                                                                                                                              • CloseHandle.KERNEL32(?), ref: 00DACE48
                                                                                                                                                                                                              • CloseHandle.KERNEL32(?), ref: 00DACE70
                                                                                                                                                                                                              • CloseHandle.KERNEL32(?), ref: 00DACEA0
                                                                                                                                                                                                              • CloseHandle.KERNEL32(?), ref: 00DACEB8
                                                                                                                                                                                                              • WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00DACFA0
                                                                                                                                                                                                              • CloseHandle.KERNEL32(?), ref: 00DACFD3
                                                                                                                                                                                                              • CloseHandle.KERNEL32(?), ref: 00DACFEE
                                                                                                                                                                                                              • WaitForSingleObject.KERNEL32(?,00002710), ref: 00DAD09F
                                                                                                                                                                                                              • CloseHandle.KERNEL32(?), ref: 00DAD0B3
                                                                                                                                                                                                              • CloseHandle.KERNEL32(?), ref: 00DAD0EB
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000001.00000002.1744307248.0000000000DA1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00DA0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744293045.0000000000DA0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744332373.0000000000DD7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000DDC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E0D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E10000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E20000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744417618.0000000000E22000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_da0000_kfdag3aedbkjqfngi9xbw.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Handle$Close$Create$InformationPipe$FileObjectProcessSingleWaitWrite
                                                                                                                                                                                                              • String ID: D$S')G
                                                                                                                                                                                                              • API String ID: 1130065513-1494146028
                                                                                                                                                                                                              • Opcode ID: 841ec494fa96e7f629e34ed8ac17571dc5171df1bca42cda62a1a186019c7f64
                                                                                                                                                                                                              • Instruction ID: 4be41fecbf04076c4e2d1c061252c1ac7d0fdee2d50436bae706e350176be01e
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 841ec494fa96e7f629e34ed8ac17571dc5171df1bca42cda62a1a186019c7f64
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5802F1B1611345DFD714EF66FD886A93BB5FB88310B118119E142EA3B8E73188A9CF64
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00DC40AF
                                                                                                                                                                                                              • Process32First.KERNEL32(00000000,?), ref: 00DC4187
                                                                                                                                                                                                              • CreateToolhelp32Snapshot.KERNEL32(00000008,?), ref: 00DC43B2
                                                                                                                                                                                                              • Module32First.KERNEL32(00000000,?), ref: 00DC43F6
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000,0000000A,?,00000000), ref: 00DC454D
                                                                                                                                                                                                              • Process32Next.KERNEL32(?,00000128), ref: 00DC4584
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 00DC45FA
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000001.00000002.1744307248.0000000000DA1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00DA0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744293045.0000000000DA0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744332373.0000000000DD7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000DDC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E0D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E10000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E20000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744417618.0000000000E22000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_da0000_kfdag3aedbkjqfngi9xbw.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32$Module32Next
                                                                                                                                                                                                              • String ID: "L=/
                                                                                                                                                                                                              • API String ID: 930127669-2479274474
                                                                                                                                                                                                              • Opcode ID: f7a833396d2e13497cc31a524b8fd0426a6cec1fec411bcf68035128cd45161e
                                                                                                                                                                                                              • Instruction ID: b1ca1dbeb0af6fbb49aed711a28a80931db77b06d4dd3c8b7b1b56d5d51172a2
                                                                                                                                                                                                              • Opcode Fuzzy Hash: f7a833396d2e13497cc31a524b8fd0426a6cec1fec411bcf68035128cd45161e
                                                                                                                                                                                                              • Instruction Fuzzy Hash: B0F12771A00341CFD704AF22FD896A53BB4F794310B51815AE486EB3B4EB7189A9CFB5
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • RegisterServiceCtrlHandlerA.ADVAPI32(013B0580,Function_00001140), ref: 00DA611E
                                                                                                                                                                                                              • SetServiceStatus.ADVAPI32(00000000,00E09C20), ref: 00DA617F
                                                                                                                                                                                                              • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00DA6193
                                                                                                                                                                                                              • SetServiceStatus.ADVAPI32(00000000,00E09C20), ref: 00DA6200
                                                                                                                                                                                                              • WaitForSingleObject.KERNEL32(00000000,00001388), ref: 00DA626C
                                                                                                                                                                                                              • SetServiceStatus.ADVAPI32(00000000,00E09C20), ref: 00DA6322
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 00DA6341
                                                                                                                                                                                                              • SetServiceStatus.ADVAPI32(00000000,00E09C20), ref: 00DA63F1
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000001.00000002.1744307248.0000000000DA1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00DA0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744293045.0000000000DA0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744332373.0000000000DD7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000DDC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E0D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E10000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E20000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744417618.0000000000E22000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_da0000_kfdag3aedbkjqfngi9xbw.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Service$Status$CloseCreateCtrlEventHandleHandlerObjectRegisterSingleWait
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3399922960-0
                                                                                                                                                                                                              • Opcode ID: abe39ed34368b8a749cda8fb18e4692db4f9e524aafb947d9a2e1d99ba553fe5
                                                                                                                                                                                                              • Instruction ID: 589ab07bb8c8097b818cee91a2e3591f3eab3410fc4cb5dfdae1f677981273f8
                                                                                                                                                                                                              • Opcode Fuzzy Hash: abe39ed34368b8a749cda8fb18e4692db4f9e524aafb947d9a2e1d99ba553fe5
                                                                                                                                                                                                              • Instruction Fuzzy Hash: A7A177B1A01340CFD304EF26FDD94A57BB5F7A9720305841AE046EA7B6DB7194A8CF28
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00DAB2EE
                                                                                                                                                                                                              • ReadFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 00DAB326
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 00DAB33F
                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 00DAB37C
                                                                                                                                                                                                              • CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 00DAB558
                                                                                                                                                                                                              • WriteFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 00DAB5AB
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 00DAB5BC
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000001.00000002.1744307248.0000000000DA1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00DA0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744293045.0000000000DA0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744332373.0000000000DD7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000DDC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E0D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E10000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E20000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744417618.0000000000E22000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_da0000_kfdag3aedbkjqfngi9xbw.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: File$CloseCreateHandle$CountReadTickWrite
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3478262135-0
                                                                                                                                                                                                              • Opcode ID: ac3894fcedc804479f214ab179f974fcaf46945f1143e1fb6ff36b49e25702c6
                                                                                                                                                                                                              • Instruction ID: 8a0376671b3d5e34ca1ec0909f69cd56489bb8216887218ac2e07faf1b12ef6e
                                                                                                                                                                                                              • Opcode Fuzzy Hash: ac3894fcedc804479f214ab179f974fcaf46945f1143e1fb6ff36b49e25702c6
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 75B10071A01341DFD304AF26FD96BAA37B4EB95310F14801AE801EE3B1E7719856CB76
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000,00000001), ref: 00DA204F
                                                                                                                                                                                                              • Process32First.KERNEL32(00000000,00000128), ref: 00DA2159
                                                                                                                                                                                                              • OpenProcess.KERNEL32(00000001,00000000,?), ref: 00DA224D
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000001.00000002.1744307248.0000000000DA1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00DA0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744293045.0000000000DA0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744332373.0000000000DD7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000DDC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E0D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E10000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E20000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744417618.0000000000E22000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_da0000_kfdag3aedbkjqfngi9xbw.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CreateFirstOpenProcessProcess32SnapshotToolhelp32
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3397401024-0
                                                                                                                                                                                                              • Opcode ID: e5446e06ee61ea559cd78dd44295d208a8b2401d399d1d1942b89569771dcb3e
                                                                                                                                                                                                              • Instruction ID: be4abf652605bd24c2d82e9d23b8dcc5eee4588d38c406738d6f27e40a6b524f
                                                                                                                                                                                                              • Opcode Fuzzy Hash: e5446e06ee61ea559cd78dd44295d208a8b2401d399d1d1942b89569771dcb3e
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3FB1F0B2A01345CFD714AF26FCC95B53BB5FB94300B15851AD542EA3B8E7318968CFA4
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CreateFileA.KERNEL32(?,00000000,00000000,00000000,00000003,00000000,00000000), ref: 00DC4A04
                                                                                                                                                                                                              • GetFileTime.KERNEL32(00000000,?,?,?), ref: 00DC4A4E
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 00DC4A6B
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000001.00000002.1744307248.0000000000DA1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00DA0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744293045.0000000000DA0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744332373.0000000000DD7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000DDC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E0D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E10000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E20000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744417618.0000000000E22000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_da0000_kfdag3aedbkjqfngi9xbw.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: File$CloseCreateHandleTime
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3397143404-0
                                                                                                                                                                                                              • Opcode ID: bee0fb75726d950ef32aa89b3973af54ff4e72c21dfabde19af8dde264de4902
                                                                                                                                                                                                              • Instruction ID: 5052867781895c24ab627b76a971d37baac55a14bd73dc5365ed7a29d2082dcf
                                                                                                                                                                                                              • Opcode Fuzzy Hash: bee0fb75726d950ef32aa89b3973af54ff4e72c21dfabde19af8dde264de4902
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7461E131602304CFD714DF66FDC56B9B7B5FB88724B10826AE806EA770D7308898CB65
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000,?,00000000), ref: 00DC035F
                                                                                                                                                                                                              • Process32First.KERNEL32(00000000,?), ref: 00DC03DB
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000001.00000002.1744307248.0000000000DA1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00DA0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744293045.0000000000DA0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744332373.0000000000DD7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000DDC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E0D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E10000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E20000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744417618.0000000000E22000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_da0000_kfdag3aedbkjqfngi9xbw.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CreateFirstProcess32SnapshotToolhelp32
                                                                                                                                                                                                              • String ID: i*Vd
                                                                                                                                                                                                              • API String ID: 2353314856-4103011120
                                                                                                                                                                                                              • Opcode ID: b033d1110bc435b0cf18c5545634471a96affa3ba9942c4cd3ac06e0a3179c83
                                                                                                                                                                                                              • Instruction ID: 9e4d495f5ec9cfc3c441e49b5d32969a36562a51825a1f53bf2b41d6d36caff0
                                                                                                                                                                                                              • Opcode Fuzzy Hash: b033d1110bc435b0cf18c5545634471a96affa3ba9942c4cd3ac06e0a3179c83
                                                                                                                                                                                                              • Instruction Fuzzy Hash: F8A110B1A11345CFD704AF66FC99AB53BB0F784311B51841AD486EA3B4E73089A9CFB4
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000001,?,00DA9ED1,00DC0DB0,00000001,?), ref: 00DC873E
                                                                                                                                                                                                              • CreateThread.KERNEL32(00000000,00000000,00000001,?,00000000,00000000), ref: 00DC876D
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000,?,00DA9ED1,00DC0DB0,00000001,?), ref: 00DC877E
                                                                                                                                                                                                              • WaitForSingleObject.KERNEL32(?,000000FF,?,00DA9ED1,00DC0DB0,00000001,?), ref: 00DC8793
                                                                                                                                                                                                              • CloseHandle.KERNEL32(?,?,000000FF,?,00DA9ED1,00DC0DB0,00000001,?), ref: 00DC87B7
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000001.00000002.1744307248.0000000000DA1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00DA0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744293045.0000000000DA0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744332373.0000000000DD7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000DDC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E0D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E10000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E20000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744417618.0000000000E22000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_da0000_kfdag3aedbkjqfngi9xbw.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CloseCreateHandle$EventObjectSingleThreadWait
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1404307249-0
                                                                                                                                                                                                              • Opcode ID: 5c4e5b61f201e016c57f16803c53a57a03db0554b6b552cee442f73b7d0d4e95
                                                                                                                                                                                                              • Instruction ID: 88d7cf6d04c5d110b6fd367bf0bb72486fdccc21deed429a4c99338a307e7984
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5c4e5b61f201e016c57f16803c53a57a03db0554b6b552cee442f73b7d0d4e95
                                                                                                                                                                                                              • Instruction Fuzzy Hash: A741D2B1601345EFC7046F26ED88B913BB0F754750F21C40AE585EA3B4EB3698A8CFA5
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetProcessHeap.KERNEL32(00000000,00000000,?,?,00DBFAC0,00000000,?), ref: 00DC381D
                                                                                                                                                                                                              • RtlReAllocateHeap.NTDLL(00000000,?,00DBFAC0,00000000), ref: 00DC3824
                                                                                                                                                                                                              • GetProcessHeap.KERNEL32(00000000,?,?,00DBFAC0,00000000,?), ref: 00DC3842
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(00000000,?,00DBFAC0,00000000,?), ref: 00DC3849
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000001.00000002.1744307248.0000000000DA1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00DA0000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744293045.0000000000DA0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744332373.0000000000DD7000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000DDC000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E0D000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E10000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744349684.0000000000E20000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000001.00000002.1744417618.0000000000E22000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_1_2_da0000_kfdag3aedbkjqfngi9xbw.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Heap$Process$AllocAllocate
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1154092256-0
                                                                                                                                                                                                              • Opcode ID: 2d7b093e659ae86242ecee80bfbb274ba86bd71ef2c0e3085353dd94ea3064cf
                                                                                                                                                                                                              • Instruction ID: 822c1ca66214847300023c570b66cd4e6031c4691ae234d5ad94c0d7687f2767
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2d7b093e659ae86242ecee80bfbb274ba86bd71ef2c0e3085353dd94ea3064cf
                                                                                                                                                                                                              • Instruction Fuzzy Hash: C111CEB1A04345CFC704BF64FC98A763B74EB44710701800AF006DABB4E7319950CBB5

                                                                                                                                                                                                              Execution Graph

                                                                                                                                                                                                              Execution Coverage:12.8%
                                                                                                                                                                                                              Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                              Signature Coverage:0%
                                                                                                                                                                                                              Total number of Nodes:1693
                                                                                                                                                                                                              Total number of Limit Nodes:54
                                                                                                                                                                                                              execution_graph 11638 47d446 11641 47d450 11638->11641 11639 47dd9a 11640 47a430 2 API calls 11639->11640 11644 47ddda 11640->11644 11642 491a50 8 API calls 11641->11642 11643 47c2d0 9 API calls 11641->11643 11646 47d87c 11641->11646 11642->11641 11643->11641 11645 491a50 8 API calls 11645->11646 11646->11639 11646->11645 11648 47dc6c 11646->11648 11649 47c2d0 9 API calls 11646->11649 11647 491a50 8 API calls 11647->11648 11648->11639 11648->11647 11650 47c2d0 9 API calls 11648->11650 11649->11646 11650->11648 11822 4740c0 11823 4740dc 11822->11823 11824 476850 4 API calls 11823->11824 11825 4741df 11824->11825 11868 471140 11869 471162 11868->11869 11873 471169 SetServiceStatus 11868->11873 11870 471180 11869->11870 11871 471219 SetServiceStatus SetEvent 11869->11871 11869->11873 11870->11871 11874 471356 11873->11874 11651 494640 11652 49466b 11651->11652 11655 480640 11652->11655 11654 4946b3 11656 47df30 8 API calls 11655->11656 11657 48065c 11656->11657 11657->11654 12066 4a55c3 12068 4a55d0 12066->12068 12067 4a57da 12069 4a5809 12067->12069 12070 4a57fd 12067->12070 12068->12067 12071 47e980 2 API calls 12068->12071 12073 47e980 2 API calls 12069->12073 12072 47e980 2 API calls 12070->12072 12071->12068 12074 4a5804 12072->12074 12073->12074 11830 476ad0 11833 49ffd0 11830->11833 11834 4a6470 lstrlen 11833->11834 11835 476adf 11834->11835 11658 492868 11661 492870 11658->11661 11659 4928b2 ReadFile 11659->11661 11660 48f910 8 API calls 11660->11661 11661->11659 11661->11660 11662 492a7e CloseHandle 11661->11662 11663 4860d0 8 API calls 11661->11663 11666 4929c1 CloseHandle 11661->11666 11664 492abb 11662->11664 11663->11661 11665 492290 ReleaseMutex 11664->11665 11668 492ac6 11665->11668 11667 492290 ReleaseMutex 11666->11667 11669 4929f1 11667->11669 11836 47bce1 11837 47bd0b 11836->11837 11838 493790 4 API calls 11837->11838 11839 47bdb3 11837->11839 11838->11839 11898 47bb60 11899 47bb88 11898->11899 11908 492260 lstrlen 11899->11908 11901 47bbc1 11902 48f910 8 API calls 11901->11902 11903 47bbd7 11902->11903 11904 47c2d0 9 API calls 11903->11904 11905 47bbe9 11904->11905 11909 471380 11905->11909 11908->11901 11910 47138e 11909->11910 11911 4860d0 8 API calls 11910->11911 11912 47139c 11911->11912 11913 491760 11914 49176b 11913->11914 11915 491777 11914->11915 11916 4808b0 2 API calls 11914->11916 11916->11915 11843 4724ec 11844 4724f5 11843->11844 11845 498570 WaitForSingleObject 11843->11845 11846 47c9b0 ExitProcess 11844->11846 11845->11844 11847 472509 11846->11847 11848 4958f8 11851 495900 11848->11851 11849 495aa8 11850 4973c0 4 API calls 11850->11851 11851->11849 11851->11850 11920 48b37d 11921 48b385 11920->11921 11923 49d0eb 169 API calls 11921->11923 11922 48bf02 11923->11922 11924 479770 11925 4956a0 2 API calls 11924->11925 11926 47978e 11925->11926 11946 4a1d0a 11947 4a1d4b GetProcessHeap HeapAlloc 11946->11947 11948 4a1d3b 11946->11948 11948->11947 11949 477307 11950 477310 11949->11950 11951 4773ea WriteFile 11950->11951 11952 47748e CloseHandle 11950->11952 11951->11950 11954 492290 ReleaseMutex 11952->11954 11955 477551 11954->11955 10420 48bf0e 10421 48bece 10420->10421 10422 48befc 10420->10422 10426 49d0eb 10421->10426 10423 48bf02 10422->10423 10425 49d0eb 169 API calls 10422->10425 10425->10423 10427 49d0f0 10426->10427 10647 4a31e0 10427->10647 10429 49d130 10651 47a430 10429->10651 10432 4a31e0 2 API calls 10433 49d1ff 10432->10433 10434 47a430 2 API calls 10433->10434 10435 49d225 10434->10435 10436 4a31e0 2 API calls 10435->10436 10437 49d2d7 10436->10437 10438 47a430 2 API calls 10437->10438 10439 49d2f8 10438->10439 10440 4a31e0 2 API calls 10439->10440 10441 49d3b3 10440->10441 10442 47a430 2 API calls 10441->10442 10443 49d3d5 10442->10443 10444 4a31e0 2 API calls 10443->10444 10445 49d425 10444->10445 10446 47a430 2 API calls 10445->10446 10447 49d46b 10446->10447 10448 4a31e0 2 API calls 10447->10448 10449 49d4d9 10448->10449 10450 47a430 2 API calls 10449->10450 10451 49d4ed 10450->10451 10452 4a31e0 2 API calls 10451->10452 10453 49d541 10452->10453 10454 47a430 2 API calls 10453->10454 10455 49d555 10454->10455 10456 47a430 2 API calls 10455->10456 10457 49d58b 10456->10457 10655 4a59b0 GetProcessHeap RtlFreeHeap 10457->10655 10459 49d5f4 10656 4a4650 10459->10656 10461 49d603 10462 4a31e0 2 API calls 10461->10462 10463 49d628 GetEnvironmentVariableA 10462->10463 10464 49d67c 10463->10464 10465 47a430 2 API calls 10464->10465 10466 49d6c4 CreateMutexA CreateMutexA CreateMutexA 10465->10466 10468 49d7c6 10466->10468 10469 49d81b GetTickCount 10468->10469 10470 49d954 10468->10470 10471 49d83a 10469->10471 10664 477fa0 10470->10664 10473 4a31e0 2 API calls 10471->10473 10476 49d86a 10473->10476 10474 49d9c1 GetCommandLineA 10475 49da10 10474->10475 10477 4a31e0 2 API calls 10475->10477 10478 47a430 2 API calls 10476->10478 10480 49da7b 10477->10480 10479 49d8ff 10478->10479 10479->10470 10481 47a430 2 API calls 10480->10481 10482 49dad8 10481->10482 10483 49e64f GetCommandLineA 10482->10483 10484 4a31e0 2 API calls 10482->10484 10767 473e80 10483->10767 10486 49db4c 10484->10486 10487 47a430 2 API calls 10486->10487 10489 49db98 10487->10489 10488 49e66d 10770 492260 lstrlen 10488->10770 10492 49dbfa 10489->10492 10493 49dbea 10489->10493 10491 49e6d4 GetModuleFileNameA 10771 498a10 10491->10771 10496 4a31e0 2 API calls 10492->10496 10939 47c9b0 10493->10939 10499 49dc36 10496->10499 10497 49e750 10498 498a10 lstrlen 10497->10498 10500 49e7cf 10498->10500 10501 47a430 2 API calls 10499->10501 10503 498a10 lstrlen 10500->10503 10502 49dccc 10501->10502 10504 49dcfb 10502->10504 10505 49dce5 10502->10505 10522 49e842 10503->10522 10507 495d80 lstrlen 10504->10507 10506 47c9b0 ExitProcess 10505->10506 10506->10504 10509 49dd2a 10507->10509 10508 49ead8 10775 485770 10508->10775 10510 4a31e0 2 API calls 10509->10510 10511 49dd40 10510->10511 10516 47a430 2 API calls 10511->10516 10513 49eb30 10514 49eb58 10513->10514 10515 49eb37 10513->10515 10784 480950 10514->10784 10517 47c9b0 ExitProcess 10515->10517 10541 49dd73 10516->10541 10517->10514 10521 49eb8e 10882 4775a0 10521->10882 10522->10508 10961 491c40 10522->10961 10525 490250 5 API calls 10525->10541 10526 49e8ff 10967 473740 10526->10967 10527 49de71 10532 49de8c Sleep 10527->10532 10527->10541 10942 494990 CreateFileA 10527->10942 10530 49ebc9 10535 49ec2a WSAStartup 10530->10535 10531 477a90 GetSystemTimeAsFileTime 10531->10541 10534 494990 5 API calls 10532->10534 10533 49eaad 10538 47c9b0 ExitProcess 10533->10538 10534->10527 10537 49ec59 10535->10537 10552 49ecb5 10535->10552 10544 4a31e0 2 API calls 10537->10544 10538->10508 10539 49e92b 10539->10533 10540 4a31e0 2 API calls 10539->10540 10542 49e9cf 10540->10542 10541->10525 10541->10527 10541->10531 10543 49e014 Sleep 10541->10543 10556 49e07c 10541->10556 10981 492260 lstrlen 10542->10981 10543->10541 10546 49eca2 10544->10546 10982 4724e0 10546->10982 10547 49ee2e 10553 49ee62 CloseHandle 10547->10553 10582 49f126 10547->10582 10550 49ea28 MessageBoxA 10555 47a430 2 API calls 10550->10555 10551 490250 5 API calls 10551->10556 10552->10547 10987 498240 10552->10987 10557 49eecb 10553->10557 10558 49eed5 SetFileAttributesA CopyFileA 10553->10558 10560 49ea8b 10555->10560 10556->10551 10561 49e11a 10556->10561 10562 49e16f 10556->10562 10557->10558 10564 49ef41 SetFileAttributesA 10558->10564 10565 49f0b9 10558->10565 10559 49ed6b 10566 49ed6f 10559->10566 10567 49ed87 10559->10567 10568 47c9b0 ExitProcess 10560->10568 10949 471fe0 CreateToolhelp32Snapshot 10561->10949 10571 494990 5 API calls 10562->10571 10572 49ef98 10564->10572 10573 49efda 10564->10573 11030 498570 10565->11030 10574 47c9b0 ExitProcess 10566->10574 10998 476af0 10567->10998 10568->10533 10579 49e1c9 10571->10579 11007 4753b0 10572->11007 10585 49f051 Sleep 10573->10585 11020 47bff0 10573->11020 10574->10567 10577 49e12b Sleep 10577->10556 10577->10562 10584 49e5bd 10579->10584 10592 49e25e GetModuleFileNameA 10579->10592 10588 49f19b 10582->10588 10589 49f204 SetFileAttributesA CopyFileA 10582->10589 10886 490250 10582->10886 10583 47c9b0 ExitProcess 10583->10582 10597 485eb0 3 API calls 10584->10597 10595 49f09b 10585->10595 10594 471fe0 8 API calls 10588->10594 10590 49f2ac SetFileAttributesA 10589->10590 10591 49f28c 10589->10591 10598 49f2cd 10590->10598 10591->10590 10599 49e2b8 SetFileAttributesA 10592->10599 10600 49e294 10592->10600 10593 49f044 10593->10585 10601 49f1ba Sleep 10594->10601 10596 485eb0 3 API calls 10595->10596 10596->10565 10602 49e627 10597->10602 10897 495d80 10598->10897 10603 49e2d5 10599->10603 10604 49e304 CopyFileA 10599->10604 10600->10599 10601->10582 10601->10589 10606 47c9b0 ExitProcess 10602->10606 10603->10604 10605 4a31e0 2 API calls 10604->10605 10610 49e353 10605->10610 10606->10483 10609 4a31e0 2 API calls 10612 49f382 10609->10612 10611 47a430 2 API calls 10610->10611 10613 49e3a9 10611->10613 10614 4a31e0 2 API calls 10612->10614 10616 49e4a2 10613->10616 10620 4a31e0 2 API calls 10613->10620 10615 49f41d 10614->10615 10617 47a430 2 API calls 10615->10617 10618 49e53c SetFileAttributesA 10616->10618 10619 49e574 SetFileAttributesA 10616->10619 10621 49f443 10617->10621 10618->10584 10619->10584 10623 49e410 10620->10623 10903 496f70 10621->10903 10626 47a430 2 API calls 10623->10626 10624 49f47b 10625 47a430 2 API calls 10624->10625 10627 49f4a7 10625->10627 10626->10616 10907 492ba0 10627->10907 10630 4a31e0 2 API calls 10631 49f4ea 10630->10631 10632 4a31e0 2 API calls 10631->10632 10633 49f516 10632->10633 10930 490cf0 10633->10930 10635 49f58a 10636 47a430 2 API calls 10635->10636 10637 49f5b8 10636->10637 10638 47a430 2 API calls 10637->10638 10639 49f5de 10638->10639 10933 485eb0 10639->10933 10641 49f610 10642 49f69b CreateThread 10641->10642 10643 49f71a 10642->10643 10644 49f6e1 10642->10644 11359 472ae0 10642->11359 10645 49f770 Sleep 10643->10645 10938 476430 StartServiceCtrlDispatcherA 10644->10938 10645->10645 10648 4a320c 10647->10648 11034 4956a0 10648->11034 10650 4a32e3 10650->10429 10652 47a450 10651->10652 11037 4a59b0 GetProcessHeap RtlFreeHeap 10652->11037 10654 47a48a 10654->10432 10655->10459 10657 4a468a 10656->10657 10658 4a4729 GetSystemTime 10657->10658 10659 4a4705 10657->10659 10660 4a476a 10658->10660 10659->10658 10661 477a90 GetSystemTimeAsFileTime 10660->10661 10662 4a4831 GetTickCount 10661->10662 10663 4a486a 10662->10663 10663->10461 10666 477fbe 10664->10666 10665 478072 GetVersionExA 11038 491510 10665->11038 10666->10665 10671 47824c 10672 4a31e0 2 API calls 10671->10672 10674 47830a 10672->10674 11059 497870 10674->11059 10675 478114 10678 4781ba CreateDirectoryA 10675->10678 10680 4a31e0 2 API calls 10678->10680 10679 47a430 2 API calls 10682 47838c 10679->10682 10681 47820d 10680->10681 10683 47a430 2 API calls 10681->10683 11063 4770d0 10682->11063 10683->10671 10685 4783cb 10686 478443 10685->10686 10687 4783d2 DeleteFileA RemoveDirectoryA 10685->10687 10688 47f420 6 API calls 10686->10688 10687->10686 10689 478459 10688->10689 10690 47849f CreateDirectoryA 10689->10690 10691 4784fe 10690->10691 10692 495d80 lstrlen 10691->10692 10693 47859b CreateDirectoryA 10692->10693 10695 4785ff 10693->10695 10696 4a31e0 2 API calls 10695->10696 10697 47865d 10696->10697 10698 4a31e0 2 API calls 10697->10698 10699 478712 10698->10699 10700 47a430 2 API calls 10699->10700 10701 478726 10700->10701 10702 497870 9 API calls 10701->10702 10703 478742 10702->10703 10704 47a430 2 API calls 10703->10704 10705 47875e 10704->10705 10706 4770d0 5 API calls 10705->10706 10707 47878b 10706->10707 10708 4790cb 10707->10708 10710 47883d 10707->10710 10711 4787ad 10707->10711 10709 495d80 lstrlen 10708->10709 10713 4790e1 SetFileAttributesA 10709->10713 10714 4a31e0 2 API calls 10710->10714 10712 4a31e0 2 API calls 10711->10712 10715 4787c3 10712->10715 10722 47912f 10713->10722 10716 478861 10714->10716 10717 490cf0 wvsprintfA 10715->10717 10718 490cf0 wvsprintfA 10716->10718 10719 4787fb 10717->10719 10720 47887f 10718->10720 10721 47a430 2 API calls 10719->10721 10723 47a430 2 API calls 10720->10723 10724 47882c 10721->10724 10722->10474 10723->10724 10725 4788ea 10724->10725 10726 47894c CreateDirectoryA 10725->10726 10727 47898b 10726->10727 10728 495d80 lstrlen 10727->10728 10729 4789ca CreateDirectoryA 10728->10729 10731 478a46 10729->10731 10732 4a31e0 2 API calls 10731->10732 10733 478a70 10732->10733 10734 4a31e0 2 API calls 10733->10734 10735 478ae6 10734->10735 10736 47a430 2 API calls 10735->10736 10737 478b6e 10736->10737 10738 497870 9 API calls 10737->10738 10739 478ba5 10738->10739 10740 47a430 2 API calls 10739->10740 10741 478bb9 10740->10741 10742 4770d0 5 API calls 10741->10742 10743 478bef 10742->10743 10744 478c22 GetTempPathA 10743->10744 10766 479012 10743->10766 11080 492260 lstrlen 10744->11080 10746 478c52 10747 495d80 lstrlen 10746->10747 10748 478dd8 CreateDirectoryA 10747->10748 10749 4a31e0 2 API calls 10748->10749 10750 478e12 10749->10750 10751 4a31e0 2 API calls 10750->10751 10752 478e5b 10751->10752 10753 47a430 2 API calls 10752->10753 10754 478e91 10753->10754 10755 497870 9 API calls 10754->10755 10756 478eb1 10755->10756 10757 47a430 2 API calls 10756->10757 10758 478ed0 10757->10758 10759 4770d0 5 API calls 10758->10759 10760 478f1d 10759->10760 10761 478f28 GetTempPathA 10760->10761 10760->10766 10762 478f68 10761->10762 10763 4a31e0 2 API calls 10762->10763 10764 478fdd 10763->10764 10765 47a430 2 API calls 10764->10765 10765->10766 10766->10708 11119 492260 lstrlen 10767->11119 10769 473ebd 10769->10488 10769->10769 10770->10491 10772 498a40 lstrlen 10771->10772 10774 498aa4 10772->10774 10774->10497 10776 48578d 10775->10776 10777 495d80 lstrlen 10776->10777 10778 485893 10777->10778 10779 4a31e0 2 API calls 10778->10779 10780 4858c3 10779->10780 10781 47a430 2 API calls 10780->10781 10782 4858ff CreateFileA 10781->10782 10783 485951 10782->10783 10783->10513 10785 48097c 10784->10785 10786 480af9 GetComputerNameA 10785->10786 10787 480b4b 10786->10787 10788 480bf1 10786->10788 10789 4a31e0 2 API calls 10787->10789 10790 4a31e0 2 API calls 10788->10790 10792 480b67 10789->10792 10791 480c80 10790->10791 10793 47a430 2 API calls 10791->10793 10795 47a430 2 API calls 10792->10795 10794 480cbd 10793->10794 10796 497870 9 API calls 10794->10796 10795->10788 10797 480cf7 10796->10797 11120 477a50 10797->11120 10799 480d0b 11123 4a36d0 10799->11123 10801 480e0a 11166 492260 lstrlen 10801->11166 10803 480e9c 11167 47fdf0 10803->11167 10807 480ef4 10808 477a50 8 API calls 10807->10808 10809 480f21 10808->10809 10810 47fdf0 9 API calls 10809->10810 10811 480fa9 10810->10811 10812 47c3e0 8 API calls 10811->10812 10813 480fb8 10812->10813 10814 477a50 8 API calls 10813->10814 10815 481009 10814->10815 10816 47fdf0 9 API calls 10815->10816 10817 48102e 10816->10817 10818 47c3e0 8 API calls 10817->10818 10819 48103d 10818->10819 10820 477a50 8 API calls 10819->10820 10821 481072 10820->10821 10822 47fdf0 9 API calls 10821->10822 10823 4810b1 10822->10823 10824 47c3e0 8 API calls 10823->10824 10825 4810bd 10824->10825 10826 477a50 8 API calls 10825->10826 10827 4810ea 10826->10827 10828 47fdf0 9 API calls 10827->10828 10829 48112e 10828->10829 10830 47c3e0 8 API calls 10829->10830 10831 48113d 10830->10831 10832 477a50 8 API calls 10831->10832 10833 4811c0 10832->10833 10834 4a31e0 2 API calls 10833->10834 10835 4811f1 10834->10835 10836 47fdf0 9 API calls 10835->10836 10837 48120c 10836->10837 10838 47c3e0 8 API calls 10837->10838 10839 48121b 10838->10839 10840 47a430 2 API calls 10839->10840 10841 481255 10840->10841 10842 477a50 8 API calls 10841->10842 10843 48127e 10842->10843 10844 47fdf0 9 API calls 10843->10844 10845 4812e1 10844->10845 10846 47c3e0 8 API calls 10845->10846 10847 4812ed 10846->10847 10848 477a50 8 API calls 10847->10848 10849 481351 10848->10849 10850 47fdf0 9 API calls 10849->10850 10851 481388 10850->10851 10852 47c3e0 8 API calls 10851->10852 10853 481397 10852->10853 10854 477a50 8 API calls 10853->10854 10855 4813de 10854->10855 11174 4a1d80 10855->11174 10859 481443 10860 47fdf0 9 API calls 10859->10860 10861 48144f 10860->10861 10862 47c3e0 8 API calls 10861->10862 10863 48145e 10862->10863 10864 477a50 8 API calls 10863->10864 10865 481483 10864->10865 10866 47fdf0 9 API calls 10865->10866 10867 4814dc 10866->10867 10868 47c3e0 8 API calls 10867->10868 10869 4814eb 10868->10869 11183 47d1f0 10869->11183 10871 481519 11210 492070 10871->11210 10873 48152e 11213 4860d0 10873->11213 10875 48154f 11217 4a2b00 10875->11217 10877 4815b2 11225 47b670 10877->11225 10879 481677 10880 477a90 GetSystemTimeAsFileTime 10879->10880 10881 477b0d __aulldiv 10880->10881 10881->10521 10883 4775ea 10882->10883 11285 492260 lstrlen 10883->11285 10885 477614 10885->10530 10887 49029f CreateToolhelp32Snapshot 10886->10887 10889 490392 Process32First 10887->10889 10892 4905c8 10887->10892 10891 4905a0 CloseHandle 10889->10891 10894 490405 10889->10894 10891->10892 10892->10582 10893 498a10 lstrlen 10893->10894 10894->10893 10895 49048c Process32Next 10894->10895 10896 4904f1 10894->10896 10895->10894 10895->10896 10896->10891 10898 495dc3 10897->10898 10899 4775a0 lstrlen 10898->10899 10900 495de1 10899->10900 10902 495e4a 10900->10902 11286 492260 lstrlen 10900->11286 10902->10609 10905 496fa5 10903->10905 10904 4970cf CreateFileA 10906 49710a 10904->10906 10905->10904 10906->10624 10909 492bcb 10907->10909 10908 492c3c 10910 4a31e0 2 API calls 10908->10910 10909->10908 10912 472510 8 API calls 10909->10912 10911 492c85 10910->10911 10913 496f70 CreateFileA 10911->10913 10912->10908 10914 492cb3 10913->10914 10915 47a430 2 API calls 10914->10915 10916 492cf3 10915->10916 10917 492df0 10916->10917 10918 492d55 Sleep 10916->10918 10919 492ed9 10917->10919 10920 492e7b 10917->10920 10921 4a31e0 2 API calls 10918->10921 10919->10630 11287 4869e0 10920->11287 10923 492d95 10921->10923 10926 496f70 CreateFileA 10923->10926 10924 492ea2 11292 47dfb0 CloseHandle 10924->11292 10928 492dce 10926->10928 10929 47a430 2 API calls 10928->10929 10929->10917 10931 490d47 wvsprintfA 10930->10931 10931->10635 10934 485f1a 10933->10934 10935 485f9b CreateProcessA 10934->10935 10936 486090 10935->10936 10937 486035 CloseHandle CloseHandle 10935->10937 10936->10641 10937->10641 10938->10643 11301 47a640 10939->11301 10941 47c9ca ExitProcess 10943 494a25 10942->10943 10944 494a37 GetFileTime 10942->10944 10943->10527 10945 494a58 CloseHandle 10944->10945 10946 494a83 __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z 10944->10946 10945->10527 10947 494aca GetFileSize CloseHandle 10946->10947 10948 494b6e 10947->10948 10948->10527 10950 472079 10949->10950 10951 472443 10950->10951 10952 472151 Process32First 10950->10952 10951->10577 10953 4723de CloseHandle 10952->10953 10959 47217b 10952->10959 10953->10951 10955 498a10 lstrlen 10955->10959 10956 47236a Process32Next 10956->10953 10956->10959 10957 47223a OpenProcess 10957->10959 10958 4722d6 TerminateProcess 10958->10959 10959->10955 10959->10956 10959->10957 10959->10958 10960 47233e CloseHandle 10959->10960 10960->10959 10962 491c9b 10961->10962 11303 47b1d0 10962->11303 10964 491cd9 10965 485eb0 3 API calls 10964->10965 10966 491d10 10965->10966 10966->10526 10968 473778 10967->10968 10977 473b0c 10967->10977 11340 492260 lstrlen 10968->11340 10970 47385d Sleep 10972 473911 10970->10972 10973 4a31e0 2 API calls 10972->10973 10974 47393c 10973->10974 10975 47a430 2 API calls 10974->10975 10976 47397e FindFirstFileA 10975->10976 10976->10977 10979 4739c2 10976->10979 10977->10539 10978 473ab2 DeleteFileA FindNextFileA 10978->10979 10980 473adf FindClose 10978->10980 10979->10978 10980->10977 10981->10550 10983 498570 WaitForSingleObject 10982->10983 10984 4724f5 10983->10984 10985 47c9b0 ExitProcess 10984->10985 10986 472509 10985->10986 10988 49826b 10987->10988 10989 495d80 lstrlen 10988->10989 10990 49831b 10989->10990 10991 4a31e0 2 API calls 10990->10991 10993 49832c 10990->10993 10992 4983ac 10991->10992 10994 47a430 2 API calls 10992->10994 10993->10559 10995 498424 10994->10995 11341 4926b0 10995->11341 10997 498456 10997->10559 10999 476b1c 10998->10999 11000 477a90 GetSystemTimeAsFileTime 10999->11000 11001 476b5a 11000->11001 11002 476c95 11001->11002 11003 477a90 GetSystemTimeAsFileTime 11001->11003 11002->10547 11005 476b9e 11003->11005 11004 476c0d Sleep 11004->11005 11005->11002 11005->11004 11006 477a90 GetSystemTimeAsFileTime 11005->11006 11006->11005 11008 4753dd OpenSCManagerA 11007->11008 11010 4756e8 11008->11010 11011 475488 CreateServiceA 11008->11011 11010->10573 11012 4754df ChangeServiceConfig2A StartServiceA 11011->11012 11013 4755a8 OpenServiceA 11011->11013 11014 475592 CloseServiceHandle 11012->11014 11015 475581 11012->11015 11016 475618 11013->11016 11017 4756bc CloseServiceHandle 11014->11017 11015->11014 11018 47569e 11016->11018 11019 47565d StartServiceA CloseServiceHandle 11016->11019 11017->11010 11018->11017 11019->11018 11021 47c055 11020->11021 11022 4a31e0 2 API calls 11021->11022 11023 47c0e6 11022->11023 11024 47a430 2 API calls 11023->11024 11027 47c11f 11024->11027 11025 47c1d4 RegCloseKey 11025->10593 11027->11025 11358 492260 lstrlen 11027->11358 11029 47c1a7 RegSetValueExA 11029->11025 11031 498585 WaitForSingleObject 11030->11031 11033 4985eb 11031->11033 11033->10583 11035 4956e8 GetProcessHeap RtlAllocateHeap 11034->11035 11036 4956be 11034->11036 11035->10650 11036->11035 11037->10654 11039 49153b AllocateAndInitializeSid 11038->11039 11040 491531 11038->11040 11041 4915b2 11039->11041 11040->11039 11042 491623 CheckTokenMembership 11041->11042 11043 4780ae 11041->11043 11042->11043 11044 4a28c0 11043->11044 11045 4a31e0 2 API calls 11044->11045 11046 4a2925 GetProcAddress 11045->11046 11047 47a430 2 API calls 11046->11047 11048 4a297e 11047->11048 11049 4a29a3 GetCurrentProcess 11048->11049 11050 4780c4 11048->11050 11049->11050 11050->10671 11051 47f420 GetWindowsDirectoryA 11050->11051 11052 47f469 11051->11052 11053 47f564 11052->11053 11054 4a31e0 2 API calls 11052->11054 11053->10675 11055 47f507 11054->11055 11056 47a430 2 API calls 11055->11056 11057 47f548 11056->11057 11081 492260 lstrlen 11057->11081 11060 4978ae 11059->11060 11082 496d90 11060->11082 11064 4770dd 11063->11064 11065 498570 WaitForSingleObject 11064->11065 11066 47714e 11065->11066 11067 4771d0 CreateFileA 11066->11067 11068 47716d 11066->11068 11069 477221 11067->11069 11075 4772ad 11067->11075 11070 492290 ReleaseMutex 11068->11070 11071 492290 ReleaseMutex 11069->11071 11072 4771b3 11070->11072 11073 47724a 11071->11073 11072->10685 11073->10685 11074 4773ea WriteFile 11074->11075 11075->11074 11076 47748e CloseHandle 11075->11076 11115 492290 11076->11115 11080->10746 11081->11053 11083 496dae 11082->11083 11088 492260 lstrlen 11083->11088 11085 496e21 11089 48fd30 11085->11089 11087 478358 11087->10679 11088->11085 11092 497bb0 11089->11092 11091 48fd52 11091->11087 11093 497bd9 11092->11093 11094 497be0 11093->11094 11097 47df30 11093->11097 11094->11091 11096 497c49 11096->11091 11098 47df62 11097->11098 11099 47df78 11098->11099 11101 48f910 11098->11101 11099->11096 11102 48f930 11101->11102 11103 48faaf 11102->11103 11105 48fa17 11102->11105 11108 48fa98 11102->11108 11111 493790 11103->11111 11106 4956a0 2 API calls 11105->11106 11107 48fa27 11106->11107 11110 4a59b0 GetProcessHeap RtlFreeHeap 11107->11110 11108->11099 11110->11108 11112 4937b1 11111->11112 11113 49382c GetProcessHeap HeapAlloc 11112->11113 11114 49380c GetProcessHeap RtlReAllocateHeap 11112->11114 11113->11108 11114->11108 11116 4922ad ReleaseMutex 11115->11116 11118 477551 11116->11118 11118->10685 11119->10769 11121 4860d0 8 API calls 11120->11121 11122 477a7b 11121->11122 11122->10799 11124 4a36f6 11123->11124 11125 4a31e0 2 API calls 11124->11125 11126 4a38c3 11125->11126 11127 47a430 2 API calls 11126->11127 11128 4a392e GetProcessHeap 11127->11128 11130 4a396a 11128->11130 11129 4a3986 11129->10801 11130->11129 11131 4a31e0 2 API calls 11130->11131 11132 4a39f7 LoadLibraryA 11131->11132 11133 47a430 2 API calls 11132->11133 11135 4a3a30 11133->11135 11134 4a3a4f 11134->10801 11135->11134 11136 4a31e0 2 API calls 11135->11136 11137 4a3ac7 GetProcAddress 11136->11137 11138 47a430 2 API calls 11137->11138 11139 4a3b14 11138->11139 11140 4a3b2e FreeLibrary 11139->11140 11141 4a3b8d HeapAlloc 11139->11141 11142 4a3b70 11140->11142 11144 4a3c16 11141->11144 11142->10801 11145 4a3c2c FreeLibrary 11144->11145 11146 4a3c63 GetAdaptersInfo 11144->11146 11145->10801 11147 4a3c84 11146->11147 11148 4a3e7b GetAdaptersInfo 11147->11148 11149 4a3d07 HeapFree 11147->11149 11150 4a3eb8 11148->11150 11165 4a419a 11148->11165 11151 4a3d8d HeapAlloc 11149->11151 11152 4a3d73 11149->11152 11153 4a31e0 2 API calls 11150->11153 11154 4a3dc9 11151->11154 11152->11151 11155 4a3f22 11153->11155 11157 4a3e5c 11154->11157 11158 4a3e00 FreeLibrary 11154->11158 11160 47a430 2 API calls 11155->11160 11156 4a449e HeapFree FreeLibrary 11156->10801 11157->11148 11159 4a3e2e 11158->11159 11159->10801 11161 4a3f62 11160->11161 11162 4a31e0 2 API calls 11161->11162 11161->11165 11163 4a41b5 11162->11163 11164 47a430 2 API calls 11163->11164 11164->11165 11165->11156 11166->10803 11229 494c80 11167->11229 11170 47c3e0 11171 47c3f8 11170->11171 11172 4860d0 8 API calls 11171->11172 11173 47c406 11172->11173 11173->10807 11175 4a1da8 11174->11175 11176 4a31e0 2 API calls 11175->11176 11177 4a1dcc 11176->11177 11178 47a430 2 API calls 11177->11178 11179 481419 11178->11179 11180 498000 11179->11180 11236 492260 lstrlen 11180->11236 11182 49802b 11182->10859 11184 47d22c 11183->11184 11185 4a31e0 2 API calls 11184->11185 11186 47d2cb 11185->11186 11187 4a31e0 2 API calls 11186->11187 11188 47d2ec 11187->11188 11189 4a31e0 2 API calls 11188->11189 11190 47d322 11189->11190 11191 47a430 2 API calls 11190->11191 11192 47d33e 11191->11192 11193 4a31e0 2 API calls 11192->11193 11194 47d372 11193->11194 11195 47a430 2 API calls 11194->11195 11196 47d395 11195->11196 11197 47a430 2 API calls 11196->11197 11200 47d406 11197->11200 11198 47dd9a 11199 47a430 2 API calls 11198->11199 11202 47ddda 11199->11202 11203 47c2d0 9 API calls 11200->11203 11205 47d87c 11200->11205 11237 491a50 11200->11237 11202->10871 11203->11200 11204 491a50 8 API calls 11204->11205 11205->11198 11205->11204 11206 47c2d0 9 API calls 11205->11206 11208 47dc6c 11205->11208 11206->11205 11207 491a50 8 API calls 11207->11208 11208->11198 11208->11207 11240 47c2d0 11208->11240 11211 497bb0 8 API calls 11210->11211 11212 492077 11211->11212 11212->10873 11214 4860f1 11213->11214 11215 497bb0 8 API calls 11214->11215 11216 486113 11215->11216 11216->10875 11218 4a2b1b 11217->11218 11251 4a45e0 11218->11251 11220 4a2b5d 11221 4860d0 8 API calls 11220->11221 11224 4a2c5f 11220->11224 11222 4a2c47 11221->11222 11256 486c10 11222->11256 11224->10877 11226 497370 11225->11226 11280 4976e0 11226->11280 11230 494c8c 11229->11230 11235 492260 lstrlen 11230->11235 11232 494d63 11233 48fd30 8 API calls 11232->11233 11234 47fdff 11233->11234 11234->11170 11235->11232 11236->11182 11246 47c8b0 11237->11246 11239 491a5e 11239->11200 11241 4981b0 11240->11241 11250 492260 lstrlen 11241->11250 11243 498209 11244 4860d0 8 API calls 11243->11244 11245 498215 11244->11245 11245->11208 11247 47c8cf 11246->11247 11248 497bb0 8 API calls 11247->11248 11249 47c8da 11248->11249 11249->11239 11250->11243 11260 47e370 11251->11260 11253 4a45f2 11254 4a463b 11253->11254 11264 472510 11253->11264 11254->11220 11257 4a2a80 11256->11257 11259 4a2a90 11257->11259 11279 4a59b0 GetProcessHeap RtlFreeHeap 11257->11279 11259->11224 11261 47e395 11260->11261 11263 47e3d7 11260->11263 11262 492070 8 API calls 11261->11262 11262->11263 11263->11253 11265 47252f 11264->11265 11266 498570 WaitForSingleObject 11265->11266 11267 47264e 11266->11267 11268 4a31e0 2 API calls 11267->11268 11276 4727d1 11267->11276 11269 472703 GetProcAddress 11268->11269 11270 47275c 11269->11270 11272 4a31e0 2 API calls 11270->11272 11271 492290 ReleaseMutex 11273 472a8b 11271->11273 11274 472777 11272->11274 11273->11253 11275 47a430 2 API calls 11274->11275 11277 47278b GetProcAddress 11275->11277 11276->11271 11278 47a430 2 API calls 11277->11278 11278->11276 11279->11259 11281 4976ea 11280->11281 11283 49770e 11280->11283 11284 4a59b0 GetProcessHeap RtlFreeHeap 11281->11284 11284->11283 11285->10885 11286->10902 11288 486a45 11287->11288 11290 486a9f 11287->11290 11288->10924 11289 486af2 11289->10924 11290->11289 11291 486bb1 WriteFile 11290->11291 11291->10924 11293 47dffe 11292->11293 11296 4808b0 11293->11296 11297 4a2a80 11296->11297 11299 47e01c 11297->11299 11300 4a59b0 GetProcessHeap RtlFreeHeap 11297->11300 11299->10919 11300->11299 11302 47a652 11301->11302 11302->10941 11304 47b1fa 11303->11304 11305 47b2dc CreateFileA 11304->11305 11306 47b313 ReadFile CloseHandle 11305->11306 11323 47b5e3 11305->11323 11331 47b9f0 11306->11331 11307 486c10 2 API calls 11309 47b60a 11307->11309 11309->10964 11310 47b367 GetTickCount 11333 47c640 11310->11333 11312 47b389 11337 492260 lstrlen 11312->11337 11314 47b3b9 11315 4a31e0 2 API calls 11314->11315 11316 47b415 11315->11316 11317 47a430 2 API calls 11316->11317 11318 47b488 11317->11318 11319 47b53e CreateFileA 11318->11319 11320 4a31e0 2 API calls 11318->11320 11321 47b57b 11319->11321 11322 47b4be 11320->11322 11321->11323 11324 47b592 WriteFile CloseHandle 11321->11324 11338 492260 lstrlen 11322->11338 11323->11307 11324->11323 11326 47b4db 11327 490cf0 wvsprintfA 11326->11327 11328 47b4e6 11327->11328 11329 47a430 2 API calls 11328->11329 11330 47b4f8 11329->11330 11330->11319 11332 47ba19 11331->11332 11332->11310 11334 47c65d 11333->11334 11339 492260 lstrlen 11334->11339 11336 47c67c 11336->11312 11337->11314 11338->11326 11339->11336 11340->10970 11342 4926bd 11341->11342 11343 492070 8 API calls 11342->11343 11344 492769 11343->11344 11345 498570 WaitForSingleObject 11344->11345 11346 4927de CreateFileA 11345->11346 11347 49282e 11346->11347 11352 49284b 11346->11352 11349 492290 ReleaseMutex 11347->11349 11348 4928b2 ReadFile 11348->11352 11350 492ac6 11349->11350 11350->10997 11351 48f910 8 API calls 11351->11352 11352->11348 11352->11351 11353 492a7e CloseHandle 11352->11353 11354 4860d0 8 API calls 11352->11354 11355 4929c1 CloseHandle 11352->11355 11353->11347 11354->11352 11356 492290 ReleaseMutex 11355->11356 11357 4929f1 11356->11357 11357->10997 11358->11029 11360 472b16 11359->11360 11361 4a4650 3 API calls 11360->11361 11362 472c4a 11361->11362 11363 473740 10 API calls 11362->11363 11364 472c7a 11363->11364 11365 495d80 lstrlen 11364->11365 11366 472ca0 11365->11366 11367 4a31e0 2 API calls 11366->11367 11368 472cbe 11367->11368 11369 47a430 2 API calls 11368->11369 11379 472d41 11369->11379 11370 477a90 GetSystemTimeAsFileTime 11370->11379 11371 492ba0 12 API calls 11371->11379 11372 492070 8 API calls 11373 4735ad Sleep 11372->11373 11507 471d60 11373->11507 11375 490250 5 API calls 11375->11379 11377 485eb0 3 API calls 11377->11379 11378 4a31e0 2 API calls 11378->11379 11379->11370 11379->11371 11379->11372 11379->11375 11379->11377 11379->11378 11391 498830 11379->11391 11403 486c30 11379->11403 11381 4a31e0 GetProcessHeap RtlAllocateHeap 11388 47313c 11381->11388 11382 497870 9 API calls 11382->11388 11383 47c3e0 8 API calls 11383->11388 11384 477a50 8 API calls 11384->11388 11386 486c30 21 API calls 11386->11388 11387 47a430 GetProcessHeap RtlFreeHeap 11387->11388 11388->11379 11388->11381 11388->11382 11388->11383 11388->11384 11388->11386 11388->11387 11389 4a2170 50 API calls 11388->11389 11390 471700 31 API calls 11388->11390 11517 476e40 11388->11517 11389->11388 11390->11388 11392 498853 11391->11392 11393 4a31e0 2 API calls 11392->11393 11394 4988eb 11393->11394 11395 4a31e0 2 API calls 11394->11395 11396 49890e 11395->11396 11523 4745c0 11396->11523 11399 47a430 2 API calls 11400 498983 11399->11400 11401 47a430 2 API calls 11400->11401 11402 4989b5 11401->11402 11402->11379 11404 486c76 11403->11404 11405 477a90 GetSystemTimeAsFileTime 11404->11405 11406 486e0e 11405->11406 11529 492260 lstrlen 11406->11529 11408 486eaf 11408->11388 11410 487015 11531 492260 lstrlen 11410->11531 11411 486e6e 11411->11408 11530 492260 lstrlen 11411->11530 11413 487023 11414 4a31e0 2 API calls 11413->11414 11492 487740 11413->11492 11415 4870cb 11414->11415 11416 497870 9 API calls 11415->11416 11417 4870fd 11416->11417 11418 47a430 2 API calls 11417->11418 11420 487119 11418->11420 11419 48736a 11421 47fdf0 9 API calls 11419->11421 11420->11419 11422 4a31e0 2 API calls 11420->11422 11423 4873e2 11421->11423 11424 48719a 11422->11424 11425 47c3e0 8 API calls 11423->11425 11426 494c80 9 API calls 11424->11426 11427 4873ee 11425->11427 11428 4871b7 11426->11428 11429 4a31e0 2 API calls 11427->11429 11431 47b670 2 API calls 11428->11431 11430 487429 11429->11430 11432 47fdf0 9 API calls 11430->11432 11433 4871d5 11431->11433 11434 487441 11432->11434 11436 47a430 2 API calls 11433->11436 11435 47c3e0 8 API calls 11434->11435 11437 48744d 11435->11437 11440 48724f 11436->11440 11438 47a430 2 API calls 11437->11438 11439 48748d 11438->11439 11441 47fdf0 9 API calls 11439->11441 11440->11419 11532 492510 11440->11532 11442 4874ca 11441->11442 11443 47c3e0 8 API calls 11442->11443 11449 4874d9 11443->11449 11445 487304 11446 4a31e0 2 API calls 11445->11446 11447 487324 11446->11447 11448 497870 9 API calls 11447->11448 11450 487348 11448->11450 11452 4a31e0 2 API calls 11449->11452 11490 48764e 11449->11490 11453 47a430 2 API calls 11450->11453 11451 4a31e0 2 API calls 11454 48769c 11451->11454 11456 487534 11452->11456 11453->11419 11455 47fdf0 9 API calls 11454->11455 11457 4876be 11455->11457 11458 47fdf0 9 API calls 11456->11458 11459 47c3e0 8 API calls 11457->11459 11460 48755b 11458->11460 11461 4876ca 11459->11461 11462 47c3e0 8 API calls 11460->11462 11464 47a430 2 API calls 11461->11464 11463 48756a 11462->11463 11466 4a31e0 2 API calls 11463->11466 11465 4876ea 11464->11465 11467 48770c socket 11465->11467 11469 47c3e0 8 API calls 11465->11469 11468 48758b 11466->11468 11470 4877b0 11467->11470 11467->11492 11471 47a430 2 API calls 11468->11471 11469->11467 11472 4877c2 setsockopt 11470->11472 11473 487805 gethostbyname 11470->11473 11478 4875aa 11471->11478 11472->11473 11474 4877fb 11472->11474 11475 48784a inet_ntoa inet_addr 11473->11475 11473->11492 11474->11473 11476 4878b1 11475->11476 11477 487913 htons connect 11475->11477 11476->11477 11479 487958 11477->11479 11482 487984 11477->11482 11480 490cf0 wvsprintfA 11478->11480 11479->11388 11481 487604 11480->11481 11484 47a430 2 API calls 11481->11484 11483 4879b3 send 11482->11483 11488 4879ed 11483->11488 11485 487620 11484->11485 11486 47fdf0 9 API calls 11485->11486 11487 48763f 11486->11487 11489 47c3e0 8 API calls 11487->11489 11491 492070 8 API calls 11488->11491 11488->11492 11489->11490 11490->11451 11506 487a89 11491->11506 11492->11388 11493 487afb recv 11494 487f76 closesocket 11493->11494 11493->11506 11496 487fbf 11494->11496 11496->11492 11497 492510 8 API calls 11496->11497 11497->11492 11498 48f910 8 API calls 11498->11506 11499 4860d0 8 API calls 11499->11506 11500 4a31e0 GetProcessHeap RtlAllocateHeap 11500->11506 11501 487f6c 11501->11494 11502 47b670 GetProcessHeap RtlFreeHeap 11502->11506 11503 47a430 GetProcessHeap RtlFreeHeap 11503->11506 11505 494c80 9 API calls 11505->11506 11506->11493 11506->11494 11506->11498 11506->11499 11506->11500 11506->11501 11506->11502 11506->11503 11506->11505 11536 4a1b00 11506->11536 11540 474400 11506->11540 11509 471d8c 11507->11509 11508 471f9f 11508->11379 11509->11508 11512 471e72 11509->11512 11516 471ee9 11509->11516 11510 471f8d 11573 47f220 11510->11573 11511 471e8f DeleteFileA 11511->11512 11512->11509 11512->11511 11512->11516 11563 47f3c0 11512->11563 11516->11510 11569 4861f0 11516->11569 11518 476e5a 11517->11518 11519 4860d0 8 API calls 11518->11519 11522 477011 11518->11522 11520 476fbb 11519->11520 11521 486c10 2 API calls 11520->11521 11521->11522 11522->11388 11524 4745e5 11523->11524 11525 4a31e0 2 API calls 11524->11525 11526 474a9d 11525->11526 11527 47a430 2 API calls 11526->11527 11528 474ac4 11527->11528 11528->11399 11529->11411 11530->11410 11531->11413 11534 49252f 11532->11534 11559 497730 11534->11559 11535 492607 11535->11445 11537 4a1b1f 11536->11537 11539 4a1b30 11536->11539 11538 477a90 GetSystemTimeAsFileTime 11537->11538 11538->11539 11539->11506 11541 474436 11540->11541 11542 4a31e0 2 API calls 11541->11542 11543 474470 11542->11543 11544 494c80 9 API calls 11543->11544 11545 474488 11544->11545 11546 47b670 2 API calls 11545->11546 11547 4744a2 11546->11547 11548 47a430 2 API calls 11547->11548 11549 4744b4 11548->11549 11550 4744cd 11549->11550 11551 4a31e0 2 API calls 11549->11551 11550->11506 11552 4744ee 11551->11552 11553 494c80 9 API calls 11552->11553 11554 474506 11553->11554 11555 47b670 2 API calls 11554->11555 11556 47451d 11555->11556 11557 47a430 2 API calls 11556->11557 11558 474538 11557->11558 11558->11506 11560 497750 11559->11560 11561 48f910 8 API calls 11560->11561 11562 49778e 11561->11562 11562->11535 11564 47f3d2 11563->11564 11577 47bed0 11564->11577 11566 47f3e9 11581 474230 11566->11581 11570 486216 11569->11570 11571 48625c 11570->11571 11596 497970 11570->11596 11571->11516 11574 47f228 11573->11574 11575 4976e0 2 API calls 11574->11575 11576 49737e 11575->11576 11578 47bf12 11577->11578 11579 48f910 8 API calls 11578->11579 11580 47bf1a 11579->11580 11580->11566 11582 47423e 11581->11582 11583 474250 11582->11583 11585 4a5b90 11582->11585 11583->11512 11588 496a90 11585->11588 11587 4a5b9f 11587->11583 11589 496aa1 11588->11589 11592 47fe60 11589->11592 11591 496ab7 11591->11587 11593 47fe6b 11592->11593 11594 47df30 8 API calls 11593->11594 11595 47feee 11594->11595 11595->11591 11599 495e80 11596->11599 11600 495ed2 11599->11600 11601 497730 8 API calls 11600->11601 11602 496026 11601->11602 11602->11571 11603 476000 11604 476085 RegisterServiceCtrlHandlerA 11603->11604 11606 476410 11604->11606 11607 47613b SetServiceStatus CreateEventA SetServiceStatus 11604->11607 11608 476220 WaitForSingleObject 11607->11608 11610 476279 11608->11610 11611 498570 WaitForSingleObject 11610->11611 11612 4762b9 SetServiceStatus CloseHandle 11611->11612 11615 47637c 11612->11615 11616 476388 SetServiceStatus 11612->11616 11615->11616 11616->11606 11852 472480 11853 472498 11852->11853 11854 492510 8 API calls 11853->11854 11855 4724c0 11854->11855 11856 47ee80 11857 47ee8b 11856->11857 11858 47ee97 11857->11858 11859 4808b0 2 API calls 11857->11859 11859->11858 12087 480780 12088 4807a0 12087->12088 12093 492260 lstrlen 12088->12093 12090 4807d1 12094 497fc0 12090->12094 12093->12090 12097 471560 12094->12097 12096 4807e7 12098 47158d 12097->12098 12099 47160d 12098->12099 12100 47161a 12098->12100 12101 497730 8 API calls 12099->12101 12102 4806b0 8 API calls 12100->12102 12103 471618 12100->12103 12101->12103 12102->12103 12103->12096 11678 4a0e07 11680 4a0e10 11678->11680 11690 4a0eaa 11680->11690 11695 47e4f0 11680->11695 11681 4a17b9 11682 474260 4 API calls 11681->11682 11685 4a183c 11681->11685 11682->11685 11683 47eeb0 GetProcessHeap RtlAllocateHeap GetProcessHeap RtlFreeHeap 11683->11690 11686 474260 4 API calls 11685->11686 11689 4a1949 11685->11689 11686->11689 11688 4766a0 GetProcessHeap RtlAllocateHeap GetProcessHeap RtlFreeHeap 11688->11690 11719 47e980 11689->11719 11690->11681 11690->11683 11690->11688 11690->11689 11691 47e4f0 4 API calls 11690->11691 11693 485a60 GetProcessHeap RtlAllocateHeap GetProcessHeap RtlFreeHeap 11690->11693 11704 474260 11690->11704 11709 476850 11690->11709 11691->11690 11693->11690 11696 47e67f 11695->11696 11698 47e542 11695->11698 11732 495710 11696->11732 11699 47e57c 11698->11699 11701 47e5e5 11698->11701 11723 480420 11699->11723 11702 480420 4 API calls 11701->11702 11703 47e591 11702->11703 11703->11680 11705 4742b2 11704->11705 11707 4742b8 11704->11707 11705->11690 11706 4973c0 4 API calls 11708 47435d 11706->11708 11707->11706 11708->11690 11710 476887 11709->11710 11711 476a3f 11710->11711 11713 4768a1 11710->11713 11712 495710 4 API calls 11711->11712 11718 47690c 11712->11718 11714 476982 11713->11714 11715 4768e9 11713->11715 11717 480420 4 API calls 11714->11717 11716 480420 4 API calls 11715->11716 11716->11718 11717->11718 11718->11690 11720 47e9b9 11719->11720 11722 47ec11 11720->11722 11747 4a59b0 GetProcessHeap RtlFreeHeap 11720->11747 11725 480464 11723->11725 11724 48046b 11724->11703 11725->11724 11726 474260 4 API calls 11725->11726 11729 480502 11725->11729 11726->11729 11727 474260 4 API calls 11728 480566 11727->11728 11730 47e980 2 API calls 11728->11730 11729->11727 11729->11728 11731 48061a 11730->11731 11731->11703 11733 495753 11732->11733 11734 49582b 11733->11734 11735 474260 4 API calls 11733->11735 11737 495aa8 11734->11737 11740 4973c0 11734->11740 11735->11734 11737->11703 11738 4973c0 4 API calls 11739 49587c 11738->11739 11739->11737 11739->11738 11741 4973ef 11740->11741 11742 497467 11741->11742 11743 4956a0 2 API calls 11741->11743 11742->11739 11744 49745e 11743->11744 11744->11742 11746 4a59b0 GetProcessHeap RtlFreeHeap 11744->11746 11746->11742 11747->11720 11964 475b09 11965 475b10 11964->11965 11967 475bc3 11965->11967 11968 4a02f0 11965->11968 11969 4a0378 11968->11969 11970 4a31e0 2 API calls 11969->11970 11971 4a04cc 11970->11971 11972 47a430 2 API calls 11971->11972 11973 4a08a5 11972->11973 11973->11965 11748 48c41c 11751 48c433 11748->11751 11750 48f678 11751->11750 11752 492260 lstrlen 11751->11752 11752->11751 11753 47e210 11754 47e24d 11753->11754 11755 492070 8 API calls 11754->11755 11756 47e287 11755->11756 11761 47f090 11756->11761 11758 47e2bc 11759 492070 8 API calls 11758->11759 11760 47e34b 11759->11760 11762 47f0a1 11761->11762 11765 4791b0 11762->11765 11766 4791c4 11765->11766 11767 48fd30 8 API calls 11766->11767 11768 4791d0 11767->11768 11768->11758 11981 473710 11986 497370 11981->11986 11987 4976e0 2 API calls 11986->11987 11988 49737e 11987->11988 11769 497610 11774 47e490 11769->11774 11783 48fbe0 11774->11783 11784 47e370 8 API calls 11783->11784 11785 48fc0c 11784->11785 11989 495510 11990 495546 11989->11990 11991 47b890 2 API calls 11990->11991 11992 49554b 11991->11992 11993 496be0 3 API calls 11992->11993 11994 495560 11993->11994 11995 495605 ExitProcess 11994->11995 12123 490190 12124 4901b3 12123->12124 12125 471530 8 API calls 12124->12125 12126 4901e5 12125->12126 12127 471380 8 API calls 12126->12127 12128 490204 12127->12128 11996 4a0110 11997 4a45e0 12 API calls 11996->11997 11998 4a012d 11997->11998 11999 4860d0 8 API calls 11998->11999 12000 4a01b2 11999->12000 12001 4a2d10 12002 4a2d24 12001->12002 12004 4a2d46 12001->12004 12003 4a2d70 12004->12003 12005 4a2e65 ReadFile 12004->12005 12006 4a2ea3 12005->12006 12007 4a4510 12008 47b670 2 API calls 12007->12008 12009 4a451b 12008->12009 12010 4808b0 2 API calls 12009->12010 12011 4a4527 12009->12011 12010->12011 12012 471f19 12013 471f20 12012->12013 12014 4861f0 8 API calls 12013->12014 12015 471f8d 12013->12015 12014->12013 12016 47f220 2 API calls 12015->12016 12017 471f9f 12016->12017 12018 48d716 12019 48d75a 12018->12019 12020 48e35f 12019->12020 12021 48e3a7 12019->12021 12035 48c433 12019->12035 12022 490cf0 wvsprintfA 12020->12022 12023 48e3b0 12021->12023 12024 48e4f3 12021->12024 12022->12035 12026 48e441 12023->12026 12028 48e3dd 12023->12028 12025 48e593 12024->12025 12027 48e50e 12024->12027 12030 490cf0 wvsprintfA 12025->12030 12029 490cf0 wvsprintfA 12026->12029 12032 490cf0 wvsprintfA 12027->12032 12027->12035 12031 490cf0 wvsprintfA 12028->12031 12028->12035 12029->12035 12030->12035 12031->12035 12032->12035 12033 48f678 12035->12033 12036 492260 lstrlen 12035->12036 12036->12035 12037 47db18 12039 47db20 12037->12039 12038 491a50 8 API calls 12038->12039 12039->12038 12040 47c2d0 9 API calls 12039->12040 12044 47dc6c 12039->12044 12040->12039 12041 47dd9a 12042 47a430 2 API calls 12041->12042 12046 47ddda 12042->12046 12043 491a50 8 API calls 12043->12044 12044->12041 12044->12043 12045 47c2d0 9 API calls 12044->12045 12045->12044 11863 4716a5 ExitProcess 11786 479220 11789 4a6470 11786->11789 11788 47922f 11790 4a647e 11789->11790 11793 492260 lstrlen 11790->11793 11792 4a6489 11792->11788 11793->11792 11864 475ea0 11867 492260 lstrlen 11864->11867 11866 475ecf 11867->11866 11794 494e20 11795 494e3a 11794->11795 11798 495c30 11795->11798 11797 494e94 11799 495c57 11798->11799 11802 4806b0 11799->11802 11801 495c6c 11801->11797 11803 4806d5 11802->11803 11804 47df30 8 API calls 11803->11804 11805 480720 11804->11805 11805->11801 12133 4a13b9 12139 4a0f06 12133->12139 12134 47eeb0 GetProcessHeap RtlAllocateHeap GetProcessHeap RtlFreeHeap 12134->12139 12135 4a1949 12136 47e980 2 API calls 12135->12136 12137 4a1a37 12136->12137 12138 4766a0 GetProcessHeap RtlAllocateHeap GetProcessHeap RtlFreeHeap 12138->12139 12139->12134 12139->12135 12139->12138 12140 47e4f0 4 API calls 12139->12140 12141 474260 4 API calls 12139->12141 12142 485a60 GetProcessHeap RtlAllocateHeap GetProcessHeap RtlFreeHeap 12139->12142 12143 4a17b9 12139->12143 12144 476850 4 API calls 12139->12144 12140->12139 12141->12139 12142->12139 12145 474260 4 API calls 12143->12145 12146 4a183c 12143->12146 12144->12139 12145->12146 12146->12135 12147 474260 4 API calls 12146->12147 12147->12135 11806 471c30 11807 47fe60 8 API calls 11806->11807 11808 471c43 11807->11808 11809 47bc30 11810 4a5b90 8 API calls 11809->11810 11811 47bc55 11810->11811 11812 47c3e0 8 API calls 11811->11812 11813 47bc72 11812->11813 12152 490db0 12153 490ddc 12152->12153 12212 474fc0 12153->12212 12155 490eb8 12156 498830 4 API calls 12155->12156 12158 4913af 12155->12158 12157 490f24 12156->12157 12159 4a31e0 2 API calls 12157->12159 12161 47b670 2 API calls 12158->12161 12160 490f6a 12159->12160 12162 497870 9 API calls 12160->12162 12163 491443 12161->12163 12164 490f8a 12162->12164 12165 47a430 2 API calls 12164->12165 12166 490fa6 12165->12166 12216 497250 12166->12216 12171 47c3e0 8 API calls 12172 490ff4 12171->12172 12173 47b670 2 API calls 12172->12173 12174 491007 12173->12174 12175 4a31e0 2 API calls 12174->12175 12176 491065 12175->12176 12177 47fdf0 9 API calls 12176->12177 12178 49107d 12177->12178 12179 47c3e0 8 API calls 12178->12179 12180 491089 12179->12180 12181 47a430 2 API calls 12180->12181 12182 4910ab 12181->12182 12183 476e40 8 API calls 12182->12183 12184 4910e3 12183->12184 12185 47c3e0 8 API calls 12184->12185 12186 4910ec 12185->12186 12187 492510 8 API calls 12186->12187 12188 49112c 12187->12188 12222 496030 12188->12222 12190 49114f 12191 47d1f0 9 API calls 12190->12191 12192 491175 12191->12192 12279 475ee0 12192->12279 12195 4a31e0 2 API calls 12196 4911b7 12195->12196 12197 47fdf0 9 API calls 12196->12197 12198 4911e1 12197->12198 12199 47c3e0 8 API calls 12198->12199 12200 4911ed 12199->12200 12201 47a430 2 API calls 12200->12201 12202 49122b 12201->12202 12203 4860d0 8 API calls 12202->12203 12204 491297 12203->12204 12205 492070 8 API calls 12204->12205 12206 49131b 12205->12206 12207 4a31e0 2 API calls 12206->12207 12208 49133e 12207->12208 12209 486c30 21 API calls 12208->12209 12210 49137a 12209->12210 12211 47a430 2 API calls 12210->12211 12211->12158 12213 4860d0 8 API calls 12212->12213 12214 474fe0 SetEvent 12213->12214 12214->12155 12283 493f00 12216->12283 12219 479170 12220 496a90 8 API calls 12219->12220 12221 47917f 12220->12221 12221->12171 12223 49606c 12222->12223 12224 4a31e0 2 API calls 12223->12224 12229 496195 12223->12229 12225 49615d 12224->12225 12226 497870 9 API calls 12225->12226 12227 496183 12226->12227 12228 47a430 2 API calls 12227->12228 12228->12229 12230 496369 12229->12230 12231 496297 12229->12231 12235 4a31e0 2 API calls 12230->12235 12232 4a31e0 2 API calls 12231->12232 12233 4962b5 12232->12233 12234 497870 9 API calls 12233->12234 12236 4962cc 12234->12236 12239 4963bf 12235->12239 12237 47a430 2 API calls 12236->12237 12238 4962de 12237->12238 12238->12190 12291 493860 12239->12291 12241 49641b 12242 47a430 2 API calls 12241->12242 12243 496484 12242->12243 12244 4964c3 12243->12244 12245 496562 12243->12245 12246 4a31e0 2 API calls 12244->12246 12304 49fff0 GetModuleFileNameA 12245->12304 12248 496505 12246->12248 12250 497870 9 API calls 12248->12250 12253 496534 12250->12253 12251 4965aa 12254 4a31e0 2 API calls 12251->12254 12252 496613 12255 4775a0 lstrlen 12252->12255 12256 47a430 2 API calls 12253->12256 12258 4965c0 12254->12258 12259 496647 12255->12259 12257 49654e 12256->12257 12257->12190 12261 497870 9 API calls 12258->12261 12306 491a70 12259->12306 12263 4965e7 12261->12263 12264 47a430 2 API calls 12263->12264 12266 4965f9 12264->12266 12266->12190 12268 4a31e0 2 API calls 12269 4966b7 12268->12269 12270 47a430 2 API calls 12269->12270 12271 496708 12270->12271 12314 492260 lstrlen 12271->12314 12273 496720 12274 4770d0 5 API calls 12273->12274 12275 496756 12274->12275 12315 47ca00 12275->12315 12278 49684c 12278->12190 12280 475efd 12279->12280 12281 4791b0 8 API calls 12280->12281 12282 475f3d 12281->12282 12282->12195 12284 493f0b 12283->12284 12287 491e10 12284->12287 12288 491e2c 12287->12288 12289 4791b0 8 API calls 12288->12289 12290 490fdf 12289->12290 12290->12219 12293 493880 12291->12293 12292 49397c 12292->12241 12293->12292 12341 47af10 12293->12341 12297 493a9b 12298 493a5a 12297->12298 12351 495b30 12297->12351 12370 4a2fb0 12298->12370 12300 493b5d 12358 492f30 12300->12358 12305 4965a3 12304->12305 12305->12251 12305->12252 12307 491aa2 12306->12307 12308 491b87 12307->12308 12309 472510 8 API calls 12307->12309 12310 4a3010 12308->12310 12309->12308 12311 496699 12310->12311 12313 4a305b 12310->12313 12311->12268 12312 491a70 8 API calls 12312->12313 12313->12311 12313->12312 12314->12273 12316 47ca1d 12315->12316 12317 47cb28 CreatePipe 12316->12317 12318 47cb94 12317->12318 12319 47cba9 SetHandleInformation 12317->12319 12324 492070 8 API calls 12318->12324 12327 47cf1f DeleteFileA 12318->12327 12320 47cc1e CreatePipe 12319->12320 12321 47cbf9 12319->12321 12322 47cc36 12320->12322 12323 47cc4d SetHandleInformation 12320->12323 12321->12320 12325 47ce9c CloseHandle 12322->12325 12329 47ccca 12323->12329 12324->12327 12325->12318 12328 47ceb4 CloseHandle 12325->12328 12327->12278 12328->12318 12330 47cdf2 CreateProcessA 12329->12330 12331 47ce32 CloseHandle 12330->12331 12332 47cf4e WriteFile 12330->12332 12334 47ce62 12331->12334 12335 47ce6c CloseHandle 12331->12335 12336 47cfbb CloseHandle CloseHandle 12332->12336 12337 47cfaa 12332->12337 12334->12335 12335->12325 12338 47d01e 12336->12338 12337->12336 12493 4946f0 12338->12493 12342 47af45 12341->12342 12343 4973c0 4 API calls 12342->12343 12344 47af89 12343->12344 12345 47eeb0 4 API calls 12344->12345 12346 47afca 12344->12346 12345->12346 12346->12298 12347 47eeb0 12346->12347 12348 47eef7 12347->12348 12349 4973c0 4 API calls 12348->12349 12350 47ef55 12349->12350 12350->12297 12373 473bc0 12351->12373 12355 495b8e 12386 49f790 12355->12386 12357 495bb0 12357->12300 12359 492f3d 12358->12359 12360 4930f9 12359->12360 12392 48bfc0 12359->12392 12360->12298 12362 4a31e0 2 API calls 12365 4932c5 12362->12365 12363 493039 12363->12360 12363->12362 12369 493320 12363->12369 12364 4a31e0 2 API calls 12366 4932e3 12364->12366 12365->12366 12368 47a430 2 API calls 12365->12368 12366->12298 12367 4934af 12367->12298 12368->12369 12369->12364 12369->12367 12371 47e980 2 API calls 12370->12371 12372 493c6c 12371->12372 12372->12241 12375 473be5 12373->12375 12374 4a31e0 2 API calls 12376 473c6e 12374->12376 12375->12374 12377 47a430 2 API calls 12376->12377 12378 473ca0 12377->12378 12379 475800 12378->12379 12380 475826 12379->12380 12381 475d00 12380->12381 12382 475a72 12380->12382 12385 4a02f0 4 API calls 12380->12385 12381->12355 12383 4a02f0 4 API calls 12382->12383 12384 475bc3 12382->12384 12383->12382 12384->12355 12385->12382 12387 49f817 12386->12387 12388 475800 4 API calls 12387->12388 12389 49fbac 12388->12389 12390 475800 4 API calls 12389->12390 12391 49fbc2 12390->12391 12391->12357 12393 48bffb 12392->12393 12394 47af10 4 API calls 12393->12394 12396 48c050 12394->12396 12395 47e980 2 API calls 12402 48c1c3 12395->12402 12397 48c09e 12396->12397 12398 48c0d6 12396->12398 12403 48c129 12396->12403 12399 47e980 2 API calls 12397->12399 12404 4a48f0 12398->12404 12401 48c0b6 12399->12401 12401->12363 12402->12363 12403->12395 12407 4a4968 12404->12407 12405 4a5845 12405->12403 12406 4973c0 4 API calls 12408 4a4aaf 12406->12408 12407->12405 12407->12406 12410 4973c0 4 API calls 12408->12410 12438 4a5039 12408->12438 12409 4a57da 12412 4a5809 12409->12412 12413 4a57fd 12409->12413 12411 4a4af7 12410->12411 12417 4973c0 4 API calls 12411->12417 12411->12438 12416 47e980 2 API calls 12412->12416 12415 47e980 2 API calls 12413->12415 12414 47e980 2 API calls 12414->12438 12418 4a5804 12415->12418 12416->12418 12419 4a4b20 12417->12419 12418->12403 12420 47eeb0 4 API calls 12419->12420 12429 4a4b66 12419->12429 12419->12438 12421 4a4b8f 12420->12421 12421->12438 12440 485a60 12421->12440 12424 4a4cfb 12427 474260 4 API calls 12424->12427 12425 4a4ce8 12426 49fe90 4 API calls 12425->12426 12430 4a4cf6 12426->12430 12427->12430 12429->12424 12429->12425 12429->12438 12431 474260 4 API calls 12430->12431 12432 4a4d7b 12431->12432 12433 4973c0 4 API calls 12432->12433 12432->12438 12434 4a4e34 12433->12434 12435 474260 4 API calls 12434->12435 12434->12438 12436 4a4e59 12435->12436 12437 4973c0 4 API calls 12436->12437 12436->12438 12439 474260 4 API calls 12436->12439 12437->12436 12438->12409 12438->12414 12439->12436 12441 485aad 12440->12441 12442 4973c0 4 API calls 12441->12442 12443 485bb8 12441->12443 12442->12443 12443->12438 12444 49fe90 12443->12444 12451 4a0930 12444->12451 12446 49fecd 12447 476850 4 API calls 12446->12447 12448 49ff9f 12446->12448 12450 49ff23 12446->12450 12447->12446 12448->12429 12449 47e4f0 4 API calls 12449->12450 12450->12448 12450->12449 12453 4a099e 12451->12453 12452 4a09a5 12452->12446 12453->12452 12454 4a0ac1 12453->12454 12455 4a0a17 12453->12455 12456 474260 4 API calls 12454->12456 12457 4a0a5b 12455->12457 12459 47eeb0 4 API calls 12455->12459 12458 4a0b0d 12456->12458 12460 4a0a99 12457->12460 12461 474260 4 API calls 12457->12461 12486 4a0a8c 12457->12486 12462 474260 4 API calls 12458->12462 12458->12486 12459->12457 12460->12446 12461->12486 12464 4a0b2e 12462->12464 12463 47e980 2 API calls 12465 4a1a37 12463->12465 12466 4973c0 4 API calls 12464->12466 12464->12486 12465->12446 12467 4a0b6a 12466->12467 12468 47eeb0 4 API calls 12467->12468 12467->12486 12469 4a0b8b 12468->12469 12470 4973c0 4 API calls 12469->12470 12469->12486 12471 4a0bb3 12470->12471 12472 4973c0 4 API calls 12471->12472 12471->12486 12473 4a0bfa 12472->12473 12474 485a60 4 API calls 12473->12474 12476 4a0cc9 12473->12476 12473->12486 12475 4a0c94 12474->12475 12477 485a60 4 API calls 12475->12477 12475->12486 12478 485a60 4 API calls 12476->12478 12476->12486 12477->12476 12480 4a0ddb 12478->12480 12479 47e4f0 4 API calls 12479->12480 12480->12479 12488 4a0eaa 12480->12488 12481 4a17b9 12482 474260 4 API calls 12481->12482 12483 4a183c 12481->12483 12482->12483 12484 474260 4 API calls 12483->12484 12483->12486 12484->12486 12485 4766a0 GetProcessHeap RtlAllocateHeap GetProcessHeap RtlFreeHeap 12485->12488 12486->12460 12486->12463 12487 47eeb0 GetProcessHeap RtlAllocateHeap GetProcessHeap RtlFreeHeap 12487->12488 12488->12481 12488->12485 12488->12486 12488->12487 12489 485a60 GetProcessHeap RtlAllocateHeap GetProcessHeap RtlFreeHeap 12488->12489 12490 47e4f0 4 API calls 12488->12490 12491 474260 4 API calls 12488->12491 12492 476850 4 API calls 12488->12492 12489->12488 12490->12488 12491->12488 12492->12488 12494 4946fd 12493->12494 12495 492070 8 API calls 12494->12495 12496 494759 ReadFile 12495->12496 12498 47d063 WaitForSingleObject CloseHandle CloseHandle 12496->12498 12499 4947a4 12496->12499 12499->12498 12500 4860d0 8 API calls 12499->12500 12501 4947e4 ReadFile 12500->12501 12501->12498 12501->12499 11814 4a2030 11815 4a203b 11814->11815 11818 477c20 11815->11818 11819 477c5c 11818->11819 11820 480640 8 API calls 11819->11820 11821 477ca2 11820->11821 11617 495535 11618 495546 11617->11618 11625 47b890 11618->11625 11620 49554b 11630 496be0 GetStdHandle 11620->11630 11622 495560 11623 4955f4 11622->11623 11624 495605 ExitProcess 11623->11624 11626 47b8df 11625->11626 11627 47b8c1 11625->11627 11626->11627 11635 4a1d20 11627->11635 11629 47b910 11629->11620 11631 496c49 GetStdHandle 11630->11631 11632 496c3f 11630->11632 11633 496c82 GetStdHandle 11631->11633 11632->11631 11633->11622 11636 4a1d4b GetProcessHeap HeapAlloc 11635->11636 11637 4a1d3b 11635->11637 11636->11629 11637->11636 12502 476bb9 12504 476bc0 12502->12504 12503 476c0d Sleep 12503->12504 12504->12503 12505 477a90 GetSystemTimeAsFileTime 12504->12505 12506 476c95 12504->12506 12505->12504
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                • Part of subcall function 004A59B0: GetProcessHeap.KERNEL32(00000000,0047A48A,?,0047A48A,00000002,00000002,?,0093B3B0,?,00000001), ref: 004A59C3
                                                                                                                                                                                                                • Part of subcall function 004A59B0: RtlFreeHeap.NTDLL(00000000,?,0047A48A,00000002,00000002,?,0093B3B0,?,00000001), ref: 004A59CA
                                                                                                                                                                                                                • Part of subcall function 004A4650: GetSystemTime.KERNEL32(J,G,00000001,?,?,00472C4A), ref: 004A473C
                                                                                                                                                                                                              • GetEnvironmentVariableA.KERNEL32(00000000,C:\Windows\system32\config\systemprofile,00000104), ref: 0049D651
                                                                                                                                                                                                              • CreateMutexA.KERNELBASE(00000000,00000000,00000000), ref: 0049D721
                                                                                                                                                                                                              • CreateMutexA.KERNELBASE(00000000,00000000,00000000), ref: 0049D76D
                                                                                                                                                                                                              • CreateMutexA.KERNEL32(00000000,00000000,00000000), ref: 0049D7A4
                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 0049D82E
                                                                                                                                                                                                              • Sleep.KERNEL32(00000D05), ref: 0049DE9B
                                                                                                                                                                                                              • Sleep.KERNEL32(000003E8), ref: 0049E039
                                                                                                                                                                                                              • GetCommandLineA.KERNEL32 ref: 0049D9EB
                                                                                                                                                                                                                • Part of subcall function 0047C9B0: ExitProcess.KERNEL32 ref: 0047C9E8
                                                                                                                                                                                                                • Part of subcall function 00494990: CreateFileA.KERNEL32(?,00000000,00000000,00000000,00000003,00000000,00000000), ref: 00494A04
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2492941459.0000000000471000.00000020.00000001.01000000.00000005.sdmp, Offset: 00470000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492924890.0000000000470000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492970593.00000000004A7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004AC000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004DB000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004DD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004F0000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2493071108.00000000004F2000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_470000_skjlipudplp.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Create$Mutex$HeapProcessSleep$CommandCountEnvironmentExitFileFreeLineSystemTickTimeVariable
                                                                                                                                                                                                              • String ID: C:\Windows\system32\config\systemprofile$C:\vdjmzgowdzhfmld\xmjofjnkdlv.exe$Qt$[$U"Kd$owwisyfkhljp "c:\vdjmzgowdzhfmld\skjlipudplp.exe"$l
                                                                                                                                                                                                              • API String ID: 2753435600-3604542358
                                                                                                                                                                                                              • Opcode ID: c3f31c6c6834bcb5315de95dd0724d484eba5a53a924e39721c0c5f15e8eb87f
                                                                                                                                                                                                              • Instruction ID: e43e344de53cc81eed97a5e20e2c0e2b7d2eb8212015e745eb9ba9c8d47d6a81
                                                                                                                                                                                                              • Opcode Fuzzy Hash: c3f31c6c6834bcb5315de95dd0724d484eba5a53a924e39721c0c5f15e8eb87f
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 531336B1A01200DFD704EF26FDC9A663BB5F794301B11823AD4429B2B6EB749861CF8D

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 436 486c30-486c74 437 486c88-486caa 436->437 438 486c76-486c82 436->438 439 486cac-486cc2 437->439 440 486ccf-486d2e call 47f680 437->440 438->437 439->440 441 486cc4-486cc9 439->441 444 486d3a-486d87 440->444 445 486d30 440->445 441->440 446 486d89-486da7 444->446 447 486dd5-486ded 444->447 445->444 448 486da9-486dbf 446->448 449 486dc1-486dd3 446->449 450 486df3-486e34 call 477a90 447->450 448->450 449->450 453 486e54-486e9e call 492260 450->453 454 486e36-486e4e 450->454 457 486eaa-486ead 453->457 458 486ea0 453->458 454->453 459 486ebd-486ed4 457->459 460 486eaf-486ebc call 497720 457->460 458->457 461 486ef6-486efb 459->461 462 486ed6-486ef0 459->462 465 486f01-486f0b 461->465 466 486ff5-48702e call 492260 * 2 461->466 462->461 467 486f10-486f39 465->467 478 48803f-48804d call 497720 466->478 479 487034-487074 call 477650 466->479 469 486f3b-486f48 467->469 470 486f4f-486f91 467->470 469->467 472 486f4a 469->472 473 486feb 470->473 474 486f93-486f9b 470->474 472->466 473->466 477 486fa0-486fe9 474->477 477->473 477->477 484 487082-487093 479->484 485 487076-487080 479->485 486 487099-4870b3 484->486 485->486 487 4870bf-4870df call 4a31e0 486->487 488 4870b5 486->488 491 4870e1-4870ee 487->491 492 4870f4-48713a call 497870 call 47a430 call 4a6190 487->492 488->487 491->492 499 48739d-4873c7 492->499 500 487140-48716e 492->500 503 4873c9 499->503 504 4873d3-4874fa call 47fdf0 call 47c3e0 call 497720 call 4a31e0 call 47fdf0 call 47c3e0 call 497720 call 47a430 call 47fdf0 call 47c3e0 call 497720 499->504 501 487170-487182 500->501 502 487184 500->502 505 48718e-48720b call 4a31e0 call 494c80 call 47e040 call 47b670 501->505 502->505 503->504 556 487500-487514 504->556 557 487677-487701 call 4a31e0 call 47fdf0 call 47c3e0 call 497720 call 47a430 504->557 524 48723d 505->524 525 48720d-487227 505->525 527 487247-48725e call 47a430 524->527 526 487229-48723b 525->526 525->527 526->527 533 487260-487288 527->533 534 4872a6-4872b2 527->534 536 4872b8-4872bc 533->536 537 48728a-4872a4 533->537 534->536 540 4872c2-48737f call 4918f0 call 492510 call 4a31e0 call 497870 call 47a430 536->540 541 487385-487391 536->541 537->536 540->541 541->499 542 487393 541->542 542->499 558 487528-4875bf call 4a31e0 call 47fdf0 call 47c3e0 call 497720 call 4a31e0 call 47a430 556->558 559 487516-487522 556->559 582 48770c-48773e socket 557->582 583 487703-487707 call 47c3e0 557->583 596 4875e1-4875e6 558->596 597 4875c1-4875df 558->597 559->558 586 4877b0-4877c0 582->586 587 487740-487768 582->587 583->582 589 4877c2-4877f9 setsockopt 586->589 590 487805-487844 gethostbyname 586->590 587->478 591 48776e-487791 587->591 589->590 593 4877fb 589->593 590->478 594 48784a-4878af inet_ntoa inet_addr 590->594 591->478 595 487797-4877af call 497720 591->595 593->590 599 4878b1-4878e5 594->599 600 487913-487956 htons connect 594->600 598 4875ec-487671 call 4a6190 call 490cf0 call 47a430 call 47fdf0 call 47c3e0 call 497720 596->598 597->598 598->557 603 487901-48790d 599->603 604 4878e7-4878ff 599->604 605 487958-487983 call 497720 600->605 606 487984-4879eb call 4a6190 call 494c70 send 600->606 603->600 604->600 618 4879f9-487a18 606->618 619 4879ed-4879f7 606->619 621 487a1e-487a28 call 4a6190 618->621 619->621 627 487a2a-487a4c 621->627 628 487a6e-487aab call 492070 621->628 627->478 630 487a52-487a6d call 497720 627->630 637 487ab0-487abc 628->637 638 487aca-487ae5 637->638 639 487abe-487ac8 637->639 640 487afb-487b32 recv 638->640 641 487ae7-487af4 638->641 639->640 642 487b38-487b4a call 4a1b00 640->642 643 487f76-487fbd closesocket 640->643 641->640 642->643 651 487b50-487b8f call 4a6190 call 48f910 call 48fc90 642->651 644 487fd9-487fdb 643->644 645 487fbf-487fd3 643->645 647 48802b-488038 644->647 648 487fdd-488017 call 4918f0 call 492510 644->648 645->644 647->478 648->647 658 488019-488025 648->658 651->643 662 487b95-487bca call 4860d0 651->662 658->647 665 487bd0-487c5f call 4a31e0 call 494c80 call 47e040 call 47b670 662->665 666 487e62-487e91 662->666 690 487c61-487c81 665->690 691 487c83-487ca2 665->691 668 487e93-487e9e call 4a6190 666->668 669 487ea4-487eb5 666->669 668->643 668->669 672 487f21-487f39 669->672 673 487eb7-487ecd call 4a6190 669->673 672->637 677 487f3f-487f57 672->677 682 487f6c 673->682 683 487ed3-487eeb 673->683 677->637 680 487f5d-487f67 677->680 680->637 682->643 685 487eed-487eff 683->685 686 487f01-487f19 683->686 685->672 686->672 688 487f1b 686->688 688->672 692 487cb0-487cc8 call 47a430 690->692 691->692 693 487ca4-487ca9 691->693 696 487e3d-487e5c 692->696 697 487cce-487d0c call 474400 692->697 693->692 696->666 700 487d12-487db1 call 4a31e0 call 494c80 call 47e040 call 47b670 697->700 701 487e33 697->701 710 487dcb-487e0d call 47a430 700->710 711 487db3-487dc5 700->711 701->696 710->643 714 487e13-487e2d 710->714 711->710 714->701
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2492941459.0000000000471000.00000020.00000001.01000000.00000005.sdmp, Offset: 00470000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492924890.0000000000470000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492970593.00000000004A7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004AC000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004DB000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004DD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004F0000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2493071108.00000000004F2000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_470000_skjlipudplp.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID:
                                                                                                                                                                                                              • String ID: /$<1G$]:8$y.n$zxf$~~w
                                                                                                                                                                                                              • API String ID: 0-2593662412
                                                                                                                                                                                                              • Opcode ID: d7e19590852d7e58d035350c14d8b3928cb112bf2d53c3ac44d720d495734d0d
                                                                                                                                                                                                              • Instruction ID: 6c6af65bdc572fbcc8d1cc8d82a9c1d6409acec77dba9ab5e018603b3891648b
                                                                                                                                                                                                              • Opcode Fuzzy Hash: d7e19590852d7e58d035350c14d8b3928cb112bf2d53c3ac44d720d495734d0d
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 1DA25471A01200CFC704EF26FCD5A693BB4FB94300F11467AE5469A2B6EB3899A5CF5D

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 715 477fa0-477fec call 47f680 718 477fee 715->718 719 477ff8-478058 715->719 718->719 720 478072-4780da GetVersionExA call 491510 call 4a28c0 719->720 721 47805a-47806c 719->721 726 478270-4782c9 720->726 727 4780e0-4780f4 720->727 721->720 728 4782e1-478370 call 4a31e0 call 497870 726->728 729 4782cb-4782db 726->729 730 4780f6-478102 727->730 731 478108-478147 call 47f420 727->731 741 478384-4783d0 call 47a430 call 4a6190 call 494c70 call 4770d0 728->741 742 478372-47837e 728->742 729->728 730->731 737 47815d-478208 call 477650 CreateDirectoryA call 4a31e0 731->737 738 478149-478156 731->738 747 47820d-47826e call 477650 call 47a430 737->747 738->737 758 478443-4784fc call 47f420 call 477650 CreateDirectoryA 741->758 759 4783d2-478439 DeleteFileA RemoveDirectoryA 741->759 742->741 747->728 764 4784fe 758->764 765 478508-478537 call 4a01f0 758->765 759->758 764->765 768 47855b-4785bc call 495d80 765->768 769 478539-478551 765->769 772 4785be 768->772 773 4785c8-4785fd CreateDirectoryA 768->773 769->768 772->773 774 47863f-47864b 773->774 775 4785ff-47863d 773->775 776 478651-478678 call 4a31e0 774->776 775->776 779 4786a0-4786da 776->779 780 47867a-47869e 776->780 781 4786e7-478790 call 477650 call 4a31e0 call 47a430 call 497870 call 47a430 call 4a6190 call 494c70 call 4770d0 779->781 782 4786dc-4786e2 779->782 780->781 799 478796-4787a7 781->799 800 4790cb-47914d call 495d80 SetFileAttributesA call 4796f0 call 497720 781->800 782->781 802 47883d-4788cd call 4a31e0 call 490cf0 call 47a430 799->802 803 4787ad-478838 call 4a31e0 call 490cf0 call 47a430 799->803 821 4788d3-4788e8 802->821 803->821 822 478921 821->822 823 4788ea-4788f9 821->823 824 478923-478989 call 477650 CreateDirectoryA 822->824 823->822 825 4788fb-47891f 823->825 828 478995-4789df call 4a01f0 call 495d80 824->828 829 47898b 824->829 825->824 834 478a11-478a44 CreateDirectoryA 828->834 835 4789e1-478a0b 828->835 829->828 836 478a46-478a5e 834->836 837 478a64-478a96 call 4a31e0 834->837 835->834 836->837 840 478abd-478b1f call 477650 call 4a31e0 837->840 841 478a98-478ab6 837->841 846 478b66-478b88 call 47a430 840->846 847 478b21-478b4e 840->847 841->840 852 478b9c-478bf4 call 497870 call 47a430 call 4a6190 call 494c70 call 4770d0 846->852 853 478b8a-478b96 846->853 848 478b50-478b5a 847->848 849 478b5c 847->849 848->846 849->846 864 4790c1 852->864 865 478bfa-478c0f 852->865 853->852 864->800 866 478c22-478c94 GetTempPathA call 492260 865->866 867 478c11-478c1c 865->867 870 478c96-478cb4 866->870 871 478cba-478cbe 866->871 867->866 870->871 872 478cc4 871->872 873 478d80-478f22 call 4a01f0 call 495d80 CreateDirectoryA call 4a31e0 call 477650 call 4a31e0 call 47a430 call 497870 call 47a430 call 4a6190 call 494c70 call 4770d0 871->873 874 478cc9-478ce3 872->874 903 4790a6-4790bb 873->903 904 478f28-478f7f GetTempPathA call 4a01f0 873->904 876 478ce5-478cef 874->876 877 478d31-478d7a 874->877 879 478cf1-478d21 876->879 880 478d29-478d2d 876->880 877->873 879->880 882 478d23 879->882 880->874 883 478d2f 880->883 882->880 883->873 903->864 907 478fd1-479033 call 4a31e0 call 477650 call 47a430 904->907 908 478f81-478fab 904->908 916 479035-479051 907->916 917 47907d-47909f 907->917 908->907 909 478fad-478fcb 908->909 909->907 918 479067-47907b 916->918 919 479053-479065 916->919 917->903 920 4790a1 917->920 918->903 919->903 920->903
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetVersionExA.KERNEL32(004F0FB0), ref: 0047808B
                                                                                                                                                                                                              • CreateDirectoryA.KERNELBASE(0000005C,00000000), ref: 004781E4
                                                                                                                                                                                                              • DeleteFileA.KERNELBASE(?,?,?,?,?,?,00000000), ref: 00478408
                                                                                                                                                                                                              • RemoveDirectoryA.KERNELBASE(?,?,?,?,?,?,00000000), ref: 00478433
                                                                                                                                                                                                              • CreateDirectoryA.KERNELBASE(?,00000000,?,?,?,?,?,?,?,?,00000000), ref: 004784CC
                                                                                                                                                                                                              • CreateDirectoryA.KERNELBASE(?,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004785D1
                                                                                                                                                                                                              • CreateDirectoryA.KERNEL32(?,00000000), ref: 0047896A
                                                                                                                                                                                                              • CreateDirectoryA.KERNEL32(?,00000000), ref: 00478A1A
                                                                                                                                                                                                                • Part of subcall function 00490CF0: wvsprintfA.USER32(0000000B,?,00487604), ref: 00490D77
                                                                                                                                                                                                              • GetTempPathA.KERNEL32(00000104,?,?,?,?,?,?,00000000), ref: 00478C2E
                                                                                                                                                                                                                • Part of subcall function 00492260: lstrlen.KERNEL32(00000001,?,0047385D,?,00000104,?,00000001), ref: 00492283
                                                                                                                                                                                                              • CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 00478DEE
                                                                                                                                                                                                              • GetTempPathA.KERNEL32(00000104,?,?,?,?,?,?,00000000), ref: 00478F47
                                                                                                                                                                                                              • SetFileAttributesA.KERNELBASE(?,00000002,?,?,?,?,?,?,00000000), ref: 004790F7
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2492941459.0000000000471000.00000020.00000001.01000000.00000005.sdmp, Offset: 00470000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492924890.0000000000470000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492970593.00000000004A7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004AC000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004DB000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004DD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004F0000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2493071108.00000000004F2000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_470000_skjlipudplp.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Directory$Create$FilePathTemp$AttributesDeleteRemoveVersionlstrlenwvsprintf
                                                                                                                                                                                                              • String ID: C:\Windows\system32\config\systemprofile$C:\vdjmzgowdzhfmld\$\
                                                                                                                                                                                                              • API String ID: 2935959199-2206088217
                                                                                                                                                                                                              • Opcode ID: 56b2f023fb90217dde5d23e80ff2769db5ffe5e5995b012fa51bad04a593de4e
                                                                                                                                                                                                              • Instruction ID: 070a715bad8d96d9d9ec3457210e6be3fa9a491e8334d43ef0714628178f25de
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 56b2f023fb90217dde5d23e80ff2769db5ffe5e5995b012fa51bad04a593de4e
                                                                                                                                                                                                              • Instruction Fuzzy Hash: E092A9B1A00245DFC700AF21FDC9AA53BB0F794304F11827AE5459A2BBEB384965CF9D

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 921 4a36d0-4a36f4 922 4a3728-4a3739 921->922 923 4a36f6-4a371c 921->923 925 4a373b-4a3755 922->925 926 4a375c-4a3850 922->926 923->922 924 4a371e 923->924 924->922 925->926 927 4a386c 926->927 928 4a3852-4a386a 926->928 929 4a3876-4a38ab 927->929 928->929 930 4a38ad 929->930 931 4a38b7-4a3912 call 4a31e0 call 4a01f0 929->931 930->931 936 4a3926-4a3968 call 47a430 GetProcessHeap 931->936 937 4a3914-4a3920 931->937 940 4a396a-4a397c 936->940 941 4a3982-4a3984 936->941 937->936 940->941 942 4a3998-4a39b2 941->942 943 4a3986-4a3997 941->943 944 4a39ea-4a3a4d call 4a31e0 LoadLibraryA call 47a430 942->944 945 4a39b4-4a39c4 942->945 951 4a3a7f-4a3a9b 944->951 952 4a3a4f-4a3a7e 944->952 945->944 946 4a39c6-4a39e4 945->946 946->944 953 4a3a9d-4a3aaf 951->953 954 4a3ab1 951->954 955 4a3abb-4a3b2c call 4a31e0 GetProcAddress call 47a430 953->955 954->955 960 4a3b2e-4a3b6e FreeLibrary 955->960 961 4a3b8d-4a3bb7 955->961 962 4a3b70-4a3b7d 960->962 963 4a3b84-4a3b8c 960->963 964 4a3bb9 961->964 965 4a3bc3-4a3c14 HeapAlloc 961->965 962->963 964->965 966 4a3c28-4a3c2a 965->966 967 4a3c16-4a3c22 965->967 968 4a3c2c-4a3c62 FreeLibrary 966->968 969 4a3c63-4a3c82 GetAdaptersInfo 966->969 967->966 970 4a3cfc 969->970 971 4a3c84-4a3cc0 969->971 974 4a3cfe-4a3d01 970->974 972 4a3cc2-4a3cee 971->972 973 4a3cf0-4a3cfa 971->973 972->974 973->974 975 4a3e7b-4a3eb2 GetAdaptersInfo 974->975 976 4a3d07-4a3d71 HeapFree 974->976 977 4a3eb8-4a3f8b call 4a31e0 call 4a01f0 call 47a430 975->977 978 4a4466 975->978 979 4a3d8d-4a3dc7 HeapAlloc 976->979 980 4a3d73-4a3d87 976->980 997 4a3f90-4a3fd1 call 494860 977->997 984 4a4470-4a4492 978->984 982 4a3dea-4a3df7 979->982 983 4a3dc9-4a3de8 979->983 980->979 986 4a3dfc-4a3dfe 982->986 983->986 987 4a449e-4a44e8 HeapFree FreeLibrary 984->987 988 4a4494 984->988 990 4a3e5c-4a3e75 986->990 991 4a3e00-4a3e2c FreeLibrary 986->991 988->987 990->975 993 4a3e2e-4a3e40 991->993 994 4a3e41-4a3e5b 991->994 1000 4a4142-4a4162 997->1000 1001 4a3fd7-4a402d call 494860 997->1001 1002 4a417a-4a418c 1000->1002 1003 4a4164-4a4178 1000->1003 1008 4a402f-4a4042 1001->1008 1009 4a4044 1001->1009 1005 4a4192-4a4194 1002->1005 1003->1005 1005->997 1007 4a419a 1005->1007 1010 4a442c-4a4464 call 4796f0 1007->1010 1011 4a404e-4a4050 1008->1011 1009->1011 1010->984 1012 4a4130-4a413c 1011->1012 1013 4a4056-4a4074 1011->1013 1012->1000 1015 4a409b-4a40af 1013->1015 1016 4a4076-4a408b 1013->1016 1019 4a40b5-4a4107 1015->1019 1018 4a408d-4a4099 1016->1018 1016->1019 1018->1019 1020 4a411b-4a4122 1019->1020 1021 4a4109-4a4115 1019->1021 1022 4a419f-4a4209 call 4a31e0 call 4a01f0 call 47a430 1020->1022 1023 4a4124-4a412e 1020->1023 1021->1020 1030 4a420b-4a4221 1022->1030 1031 4a4235-4a424f 1022->1031 1023->1005 1030->1031 1032 4a4223-4a422f 1030->1032 1033 4a439d-4a4416 call 4796f0 1031->1033 1034 4a4255-4a425a 1031->1034 1032->1031 1033->1010 1040 4a4418-4a4425 1033->1040 1036 4a4260-4a426f 1034->1036 1038 4a4271-4a4283 1036->1038 1039 4a4285-4a4291 1036->1039 1041 4a4297-4a4316 1038->1041 1039->1041 1040->1010 1042 4a4318-4a432a 1041->1042 1043 4a4330-4a434a 1041->1043 1042->1043 1044 4a434c-4a4350 1043->1044 1045 4a4351-4a438f 1043->1045 1044->1045 1045->1036 1046 4a4395-4a4398 1045->1046 1046->1033
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetProcessHeap.KERNEL32(?,?,?,?,?,00000000,?,?,?,?,?,?,?,?,00480E0A,?), ref: 004A3945
                                                                                                                                                                                                              • LoadLibraryA.KERNELBASE(00000000,?,00000001,?,?,?,?,?,00000000), ref: 004A3A07
                                                                                                                                                                                                              • GetProcAddress.KERNEL32(00000000,00000000), ref: 004A3AF2
                                                                                                                                                                                                              • FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,00000001,?,?,?,?,?,00000000), ref: 004A3B50
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000000,00000288,?,?,?,?,?,?,?,00000001), ref: 004A3BF7
                                                                                                                                                                                                              • FreeLibrary.KERNEL32(00000100,?,?,?,?,?,?,?,00000001,?,?,?,?,?,00000000), ref: 004A3C42
                                                                                                                                                                                                              • GetAdaptersInfo.IPHLPAPI(00000000,00000288,?,?,?,?,?,?,?,00000001,?,?,?,?,?,00000000), ref: 004A3C72
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,00000001), ref: 004A3D56
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(?,00000000,00000288,?,?,?,?,?,?,?,00000001), ref: 004A3D94
                                                                                                                                                                                                              • FreeLibrary.KERNEL32(00000100,?,?,?,?,?,?,?,00000001,?,?,?,?,?,00000000), ref: 004A3E0E
                                                                                                                                                                                                              • GetAdaptersInfo.IPHLPAPI(00000000,00000288,?,?,?,?,?,?,?,00000001,?,?,?,?,?,00000000), ref: 004A3EA4
                                                                                                                                                                                                              • HeapFree.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,00000001), ref: 004A44A5
                                                                                                                                                                                                              • FreeLibrary.KERNEL32(00000100,?,?,?,?,?,?,?,00000001,?,?,?,?,?,00000000), ref: 004A44CF
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2492941459.0000000000471000.00000020.00000001.01000000.00000005.sdmp, Offset: 00470000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492924890.0000000000470000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492970593.00000000004A7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004AC000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004DB000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004DD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004F0000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2493071108.00000000004F2000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_470000_skjlipudplp.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Free$HeapLibrary$AdaptersAllocInfo$AddressLoadProcProcess
                                                                                                                                                                                                              • String ID: V\v(
                                                                                                                                                                                                              • API String ID: 2633798829-3864276540
                                                                                                                                                                                                              • Opcode ID: de3526a0300f1a0324cbd9e397f36e89ba5bc83b96fd06f7eb3417eeaf4b6414
                                                                                                                                                                                                              • Instruction ID: 150e36917ab9f4a92d8f79db8de818b06f3d2477251e563834417a340a1a79e1
                                                                                                                                                                                                              • Opcode Fuzzy Hash: de3526a0300f1a0324cbd9e397f36e89ba5bc83b96fd06f7eb3417eeaf4b6414
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 22723171A01240CFC708DF25FDC95653BB4FBE9311B11827AE4429A2BAE7749961CF4D

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 1100 472ae0-472b59 call 47f680 * 2 1105 472bbb-472d02 call 4a4650 call 4a1fc0 call 473740 call 495d80 call 4a31e0 call 477650 1100->1105 1106 472b5b-472b85 1100->1106 1121 472d04-472d16 1105->1121 1122 472d39-472d68 call 47a430 1105->1122 1107 472b87-472ba7 1106->1107 1108 472ba9-472bb5 1106->1108 1107->1105 1108->1105 1123 472d2c-472d32 1121->1123 1124 472d18-472d2a 1121->1124 1127 472d7e 1122->1127 1128 472d6a-472d7c 1122->1128 1123->1122 1124->1122 1129 472d88-472dad 1127->1129 1128->1129 1130 472dc1-472e65 call 477a90 call 492ba0 1129->1130 1131 472daf-472dbb 1129->1131 1136 472e67-472e73 1130->1136 1137 472e79-472e8b 1130->1137 1131->1130 1136->1137 1138 4734f5 1137->1138 1139 472e91 1137->1139 1142 4734f8-47353a 1138->1142 1140 472e93-472e95 1139->1140 1141 472e9b-472eba 1139->1141 1140->1138 1140->1141 1145 472ebc-472ece 1141->1145 1146 472eda-472f81 call 47f1c0 1141->1146 1143 473583-47359f 1142->1143 1144 47353c-473551 1142->1144 1149 4735a5-4735f0 call 492070 Sleep call 471d60 call 490250 1143->1149 1147 473577-473581 1144->1147 1148 473553-473575 1144->1148 1145->1146 1150 472ed0 1145->1150 1154 472f87-472f89 1146->1154 1155 47349d-4734b4 1146->1155 1147->1149 1148->1149 1170 4735f5-4735fa 1149->1170 1150->1146 1157 472f90-472fa9 1154->1157 1159 4734b6-4734c0 1155->1159 1160 4734c2 1155->1160 1161 472fab-472fba 1157->1161 1162 472fd9-472ff4 1157->1162 1164 4734cc-4734f3 1159->1164 1160->1164 1165 473000-473029 call 477a90 1161->1165 1166 472fbc-472fd7 1161->1166 1162->1165 1167 472ff6 1162->1167 1164->1142 1175 47308d-4730f2 call 498830 1165->1175 1176 47302b 1165->1176 1166->1165 1167->1165 1172 473600-473646 1170->1172 1173 4736bb-4736da 1170->1173 1177 473661-473669 1172->1177 1178 473648-47365b 1172->1178 1173->1130 1174 4736e0-4736f2 1173->1174 1174->1130 1179 4736f8-473702 1174->1179 1189 4730f4 1175->1189 1190 4730fe-473137 call 4a31e0 call 486c30 1175->1190 1180 473032-473086 call 492ba0 1176->1180 1181 47302d-473030 1176->1181 1182 47369f-4736b5 1177->1182 1183 47366b-473699 call 485eb0 1177->1183 1178->1177 1179->1130 1180->1175 1181->1175 1181->1180 1182->1173 1183->1182 1189->1190 1195 47313c-4731f2 call 47a430 call 4a2170 call 471700 1190->1195 1202 4731f4-473204 1195->1202 1203 473209-47320c 1195->1203 1202->1203 1204 473212-473278 call 4a31e0 call 497870 1203->1204 1205 473430 1203->1205 1215 473296-4732ae 1204->1215 1216 47327a-473294 1204->1216 1207 473432-47346c call 4796f0 1205->1207 1213 47348e-473498 1207->1213 1214 47346e-473486 1207->1214 1218 47349b 1213->1218 1214->1157 1217 47348c 1214->1217 1219 4732b4-473327 call 47a430 call 47c3e0 call 477a50 1215->1219 1216->1219 1217->1218 1218->1155 1226 473333-4733a5 call 476e40 call 47c3e0 call 497720 call 4a31e0 call 486c30 1219->1226 1227 473329 1219->1227 1238 4733a7-4733b9 1226->1238 1239 4733bb 1226->1239 1227->1226 1240 4733c5-47342e call 47a430 call 4a2170 call 471700 1238->1240 1239->1240 1240->1207
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • Sleep.KERNELBASE(000008AE), ref: 004735BC
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2492941459.0000000000471000.00000020.00000001.01000000.00000005.sdmp, Offset: 00470000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492924890.0000000000470000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492970593.00000000004A7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004AC000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004DB000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004DD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004F0000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2493071108.00000000004F2000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_470000_skjlipudplp.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Sleep
                                                                                                                                                                                                              • String ID: m%X$m%X$C:\vdjmzgowdzhfmld\xmjofjnkdlv.exe$owwisyfkhljp "c:\vdjmzgowdzhfmld\skjlipudplp.exe"
                                                                                                                                                                                                              • API String ID: 3472027048-2138712788
                                                                                                                                                                                                              • Opcode ID: 8f4817ae213eeaf5cfd7d9f251930ddfdf0d69d77a2d76c6b5d1f6d0c40f3d31
                                                                                                                                                                                                              • Instruction ID: 09c8103d031dd12347351ec1e29d8d6ddb4b1853844ddd1d0a45ff5b8b1c8c0a
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8f4817ae213eeaf5cfd7d9f251930ddfdf0d69d77a2d76c6b5d1f6d0c40f3d31
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 1C524371A01200DFC704EF65FDC55A93BB0FB84311B11827BD446A62B6EB789AA4CF9D

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 1247 473740-473772 1248 473b7f-473b82 1247->1248 1249 473778-4737a8 1247->1249 1250 4737ca-473800 1249->1250 1251 4737aa-4737c4 1249->1251 1252 473816 1250->1252 1253 473802-473814 1250->1253 1251->1250 1254 473820-473871 call 47b9f0 call 492260 1252->1254 1253->1254 1259 473873-47388e 1254->1259 1260 4738a8-4739bc Sleep call 477650 call 4a31e0 call 477650 call 47a430 FindFirstFileA 1254->1260 1261 473890-47389c 1259->1261 1262 47389e 1259->1262 1271 4739c2-4739d7 1260->1271 1272 473b0c-473b6b call 4796f0 1260->1272 1261->1260 1262->1260 1274 473a00-473a2d 1271->1274 1275 4739d9-4739ef 1271->1275 1272->1248 1281 473b6d-473b79 1272->1281 1276 473a2f-473a44 1274->1276 1277 473a4a-473a79 call 477650 1274->1277 1275->1274 1279 4739f1-4739fb 1275->1279 1276->1277 1283 473ab2-473ad9 DeleteFileA FindNextFileA 1277->1283 1284 473a7b-473a9e 1277->1284 1279->1274 1281->1248 1283->1274 1286 473adf-473b05 FindClose 1283->1286 1284->1283 1285 473aa0-473aac 1284->1285 1285->1283 1286->1272
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • Sleep.KERNELBASE(000003E8,?,00000001), ref: 004738AD
                                                                                                                                                                                                              • FindFirstFileA.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 004739A7
                                                                                                                                                                                                              • DeleteFileA.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 00473AB9
                                                                                                                                                                                                              • FindNextFileA.KERNELBASE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 00473AD1
                                                                                                                                                                                                              • FindClose.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 00473AF2
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2492941459.0000000000471000.00000020.00000001.01000000.00000005.sdmp, Offset: 00470000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492924890.0000000000470000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492970593.00000000004A7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004AC000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004DB000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004DD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004F0000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2493071108.00000000004F2000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_470000_skjlipudplp.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: FileFind$CloseDeleteFirstNextSleep
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1528862845-0
                                                                                                                                                                                                              • Opcode ID: 1aa628be03b895451c7c1361a17cffca9b06b9e02e86fda97170e9c097ef393a
                                                                                                                                                                                                              • Instruction ID: 2c52dc62a15ef6b6637a065efc9f263ddd07bc6728fe82bbcbf4d29f47a6606a
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1aa628be03b895451c7c1361a17cffca9b06b9e02e86fda97170e9c097ef393a
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 66A13371901244CBD314DF21FCDA5BA3BB4FB94301B01867BE4468B2B6EB7499A1CB8D
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetComputerNameA.KERNEL32(?,?), ref: 00480B3D
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2492941459.0000000000471000.00000020.00000001.01000000.00000005.sdmp, Offset: 00470000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492924890.0000000000470000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492970593.00000000004A7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004AC000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004DB000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004DD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004F0000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2493071108.00000000004F2000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_470000_skjlipudplp.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ComputerName
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3545744682-0
                                                                                                                                                                                                              • Opcode ID: 17871398d07364f529a8e182e327411feaf5e42bc01e763219be0c6363e6ca9c
                                                                                                                                                                                                              • Instruction ID: 3fc0d24bb6dd7c7eb4118ee47585b1f8d2ff2c66a4ff033f469dab4ea67dbd06
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 17871398d07364f529a8e182e327411feaf5e42bc01e763219be0c6363e6ca9c
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 5D622271911204CBC704EF61FCD5AAA3BB4FBA4300F10867FE446AA1B6EB345A58CB5D
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • StartServiceCtrlDispatcherA.ADVAPI32(?), ref: 0047645B
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2492941459.0000000000471000.00000020.00000001.01000000.00000005.sdmp, Offset: 00470000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492924890.0000000000470000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492970593.00000000004A7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004AC000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004DB000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004DD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004F0000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2493071108.00000000004F2000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_470000_skjlipudplp.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CtrlDispatcherServiceStart
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3789849863-0
                                                                                                                                                                                                              • Opcode ID: f8cd8abf56c463c12cf679fde551adf52e4bebef52ea2920d8e2a23a6256d90d
                                                                                                                                                                                                              • Instruction ID: d64a6839bb7b497fa81229736b1bdb9ffcf1d8321e0f00fb644562cdf1ee2384
                                                                                                                                                                                                              • Opcode Fuzzy Hash: f8cd8abf56c463c12cf679fde551adf52e4bebef52ea2920d8e2a23a6256d90d
                                                                                                                                                                                                              • Instruction Fuzzy Hash: CEE046B2C15208AFCB00DFA8EC440AABBB4FB04304B008AAED819A7210EB704610CF99

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 1047 476000-476083 1048 4760a5-476106 1047->1048 1049 476085-47609f 1047->1049 1050 476112-476135 RegisterServiceCtrlHandlerA 1048->1050 1051 476108 1048->1051 1049->1048 1052 476410-476425 1050->1052 1053 47613b-47621c SetServiceStatus CreateEventA SetServiceStatus 1050->1053 1051->1050 1054 476220-476243 1053->1054 1055 476245-476259 1054->1055 1056 476260-476277 WaitForSingleObject 1054->1056 1055->1056 1056->1054 1057 476279-476298 1056->1057 1058 4762ae-4762e2 call 498570 1057->1058 1059 47629a-4762a7 1057->1059 1062 4762f7-476310 1058->1062 1063 4762e4-4762f5 1058->1063 1059->1058 1064 476317-47637a SetServiceStatus CloseHandle 1062->1064 1063->1064 1065 47637c-476381 1064->1065 1066 476388-47640a SetServiceStatus 1064->1066 1065->1066 1066->1052
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • RegisterServiceCtrlHandlerA.ADVAPI32(0093E648,Function_00001140), ref: 0047611E
                                                                                                                                                                                                              • SetServiceStatus.SECHOST(0094B2F0,004D9C20), ref: 0047617F
                                                                                                                                                                                                              • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00476193
                                                                                                                                                                                                              • SetServiceStatus.ADVAPI32(0094B2F0,004D9C20), ref: 00476200
                                                                                                                                                                                                              • WaitForSingleObject.KERNEL32(0000021C,00001388), ref: 0047626C
                                                                                                                                                                                                              • SetServiceStatus.ADVAPI32(0094B2F0,004D9C20), ref: 00476322
                                                                                                                                                                                                              • CloseHandle.KERNEL32(0000021C), ref: 00476341
                                                                                                                                                                                                              • SetServiceStatus.ADVAPI32(0094B2F0,004D9C20), ref: 004763F1
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2492941459.0000000000471000.00000020.00000001.01000000.00000005.sdmp, Offset: 00470000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492924890.0000000000470000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492970593.00000000004A7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004AC000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004DB000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004DD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004F0000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2493071108.00000000004F2000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_470000_skjlipudplp.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Service$Status$CloseCreateCtrlEventHandleHandlerObjectRegisterSingleWait
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3399922960-0
                                                                                                                                                                                                              • Opcode ID: 4df4c63484f2e176e27849bd20ec606fc5415ef6afe4477b6080f0d89d67852e
                                                                                                                                                                                                              • Instruction ID: 554f7ce46defaa7e4695e9163ea5d98eebc41921eb55236c536c4cfd47874167
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4df4c63484f2e176e27849bd20ec606fc5415ef6afe4477b6080f0d89d67852e
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2CA186B1A12240CFC344DF26FDD95653BF8F799710311867AD4468A6B6DB748860CF4D

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 1067 490250-49029d 1068 4902bd-490308 1067->1068 1069 49029f-4902b7 1067->1069 1070 49030a-490314 1068->1070 1071 490316-490338 1068->1071 1069->1068 1072 490344-49038c CreateToolhelp32Snapshot 1070->1072 1071->1072 1073 49033a 1071->1073 1074 4905c8-4905e0 1072->1074 1075 490392-4903a1 1072->1075 1073->1072 1078 490612-490655 call 4796f0 1074->1078 1079 4905e2-490606 1074->1079 1076 4903a3-4903b0 1075->1076 1077 4903b7-4903ff Process32First 1075->1077 1076->1077 1080 4905a0-4905c5 CloseHandle 1077->1080 1081 490405-490408 1077->1081 1087 490669-49066f 1078->1087 1088 490657-490663 1078->1088 1079->1078 1082 490608 1079->1082 1080->1074 1084 490410-49048a call 4a01f0 call 498a10 call 494860 1081->1084 1082->1078 1094 49048c-4904eb Process32Next 1084->1094 1095 4904f6-490542 1084->1095 1088->1087 1094->1084 1096 4904f1 1094->1096 1097 49059e 1095->1097 1098 490544-490570 1095->1098 1096->1080 1097->1080 1098->1097 1099 490572-49059c 1098->1099 1099->1080
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000,?,00000000), ref: 0049035F
                                                                                                                                                                                                              • Process32First.KERNEL32(00000000,?), ref: 004903DB
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2492941459.0000000000471000.00000020.00000001.01000000.00000005.sdmp, Offset: 00470000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492924890.0000000000470000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492970593.00000000004A7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004AC000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004DB000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004DD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004F0000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2493071108.00000000004F2000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_470000_skjlipudplp.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CreateFirstProcess32SnapshotToolhelp32
                                                                                                                                                                                                              • String ID: i*Vd
                                                                                                                                                                                                              • API String ID: 2353314856-4103011120
                                                                                                                                                                                                              • Opcode ID: 9979f5a9a2c7a33ae3c0b1132a1697184da7079bce0b92809f01219755db30d6
                                                                                                                                                                                                              • Instruction ID: 4392687504953acfbd7a9529f6b5580aa1bfc57fd644d3ceab7fa92a6b8bc8fd
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9979f5a9a2c7a33ae3c0b1132a1697184da7079bce0b92809f01219755db30d6
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 37A155B1A01250DFDB00EF21FDD96B63BB0FB85311B11457AD4869A2B6E77448A0CF9D

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 1287 485eb0-485f2f call 4796f0 1290 485f4b-485f83 call 4796f0 1287->1290 1291 485f31-485f44 1287->1291 1294 485f91 1290->1294 1295 485f85-485f8f 1290->1295 1291->1290 1296 485f9b-486033 CreateProcessA 1294->1296 1295->1296 1297 486090-4860bf 1296->1297 1298 486035-48608f CloseHandle * 2 1296->1298
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CreateProcessA.KERNELBASE(?,00473684,00000000,00000000,00000000,00000008,00000000,00000000,00000044,?), ref: 0048602B
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00473684), ref: 00486043
                                                                                                                                                                                                              • CloseHandle.KERNEL32(?), ref: 00486072
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2492941459.0000000000471000.00000020.00000001.01000000.00000005.sdmp, Offset: 00470000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492924890.0000000000470000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492970593.00000000004A7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004AC000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004DB000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004DD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004F0000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2493071108.00000000004F2000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_470000_skjlipudplp.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CloseHandle$CreateProcess
                                                                                                                                                                                                              • String ID: D
                                                                                                                                                                                                              • API String ID: 2922976086-2746444292
                                                                                                                                                                                                              • Opcode ID: fa3f42408af4b8a1471c49645ec729d92897ca132c99789b1a3b4841a61c164e
                                                                                                                                                                                                              • Instruction ID: 14a6dacbb3ce1a643576f4c31ad3144632958f0c5f2460aaca51620cf00e3ebe
                                                                                                                                                                                                              • Opcode Fuzzy Hash: fa3f42408af4b8a1471c49645ec729d92897ca132c99789b1a3b4841a61c164e
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4151D0716012009BC708DF64EDA2BBA77B5F794701F10863AEA06CB7B4E7B89905CB4D

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 1299 472510-47252d 1300 47252f-472535 1299->1300 1301 47253b-4725d6 1299->1301 1300->1301 1302 4725f7-472611 1301->1302 1303 4725d8-4725f1 1301->1303 1304 472613-47263f 1302->1304 1305 472641 1302->1305 1303->1302 1306 472643-472665 call 498570 1304->1306 1305->1306 1309 472667-47269b 1306->1309 1310 4726b9-4726c0 1306->1310 1309->1310 1311 47269d-4726b2 1309->1311 1312 4726c6-47275a call 4a31e0 GetProcAddress 1310->1312 1313 47292b-472937 1310->1313 1311->1310 1322 47275c-472765 1312->1322 1323 47276b-4727fd call 4a31e0 call 47a430 GetProcAddress call 47a430 1312->1323 1315 47296d-472973 1313->1315 1316 472939-472967 1313->1316 1318 472975-47298a 1315->1318 1319 4729c9-4729f9 1315->1319 1316->1315 1318->1319 1329 47298c-4729c3 1318->1329 1320 472a75-472aaf call 492290 1319->1320 1321 4729fb-472a44 call 485e60 * 2 1319->1321 1332 472ab1 1320->1332 1333 472abb-472ac1 1320->1333 1338 472a46 1321->1338 1339 472a50-472a6f call 485e60 * 2 1321->1339 1322->1323 1343 472803-47280a 1323->1343 1344 4728e0-4728fe 1323->1344 1329->1319 1332->1333 1338->1339 1339->1320 1343->1344 1346 472810-472818 1343->1346 1347 472908-472928 1344->1347 1350 47281f-472821 1346->1350 1347->1313 1350->1344 1351 472827-472837 1350->1351 1352 472857-472878 1351->1352 1353 472839-472851 1351->1353 1354 4728d2-4728de 1352->1354 1355 47287a-472896 1352->1355 1353->1352 1354->1347 1355->1347 1356 472898-4728d0 1355->1356 1356->1347
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetProcAddress.KERNEL32(75A70000,00000000), ref: 0047272B
                                                                                                                                                                                                              • GetProcAddress.KERNEL32(75A70000,00000000), ref: 004727B0
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2492941459.0000000000471000.00000020.00000001.01000000.00000005.sdmp, Offset: 00470000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492924890.0000000000470000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492970593.00000000004A7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004AC000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004DB000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004DD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004F0000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2493071108.00000000004F2000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_470000_skjlipudplp.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: AddressProc
                                                                                                                                                                                                              • String ID: %Uj*
                                                                                                                                                                                                              • API String ID: 190572456-2557879984
                                                                                                                                                                                                              • Opcode ID: ce7b3c36dcb3a86638fc40ef9c3268761ea06f09dcbe32d3ecf63daf5fa1a7d6
                                                                                                                                                                                                              • Instruction ID: 96c18920d3468ba80d279113c27b4822490097e46041abd454d86da759aca493
                                                                                                                                                                                                              • Opcode Fuzzy Hash: ce7b3c36dcb3a86638fc40ef9c3268761ea06f09dcbe32d3ecf63daf5fa1a7d6
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 03D133B1A01240CFC704EF66FEC86653BB0F784350B51863AD4429A2BAEB789870CF4C

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 1357 4956a0-4956bc 1358 4956e8-4956fc GetProcessHeap RtlAllocateHeap 1357->1358 1359 4956be-4956d4 1357->1359 1359->1358 1360 4956d6-4956e2 1359->1360 1360->1358
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetProcessHeap.KERNEL32(00000000,?,?,00488C4F,02053FC0,?,?,?,?,004955F4), ref: 004956EE
                                                                                                                                                                                                              • RtlAllocateHeap.NTDLL(00000000,?,00488C4F,02053FC0,?,?,?,?,004955F4), ref: 004956F5
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2492941459.0000000000471000.00000020.00000001.01000000.00000005.sdmp, Offset: 00470000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492924890.0000000000470000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492970593.00000000004A7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004AC000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004DB000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004DD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004F0000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2493071108.00000000004F2000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_470000_skjlipudplp.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Heap$AllocateProcess
                                                                                                                                                                                                              • String ID: |Q.H
                                                                                                                                                                                                              • API String ID: 1357844191-517162033
                                                                                                                                                                                                              • Opcode ID: 14084f497b62db1221f5a5232fa6ea34303fa807f4efeff9238973dcc81e6c68
                                                                                                                                                                                                              • Instruction ID: 8b97eadb1baadffb41c3a24944d8f99ebffc75cf093c35696c5fada2ea968b8b
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 14084f497b62db1221f5a5232fa6ea34303fa807f4efeff9238973dcc81e6c68
                                                                                                                                                                                                              • Instruction Fuzzy Hash: B0E0ED3100868ADFDB044F99FCCCA6A3F34F318B12B014024E10ACA221CA78A8A48B2D

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 1361 4770d0-47716b call 4a6810 call 498570 1366 4771d0-47721b CreateFileA 1361->1366 1367 47716d-477190 1361->1367 1370 477221-477269 call 492290 1366->1370 1371 4772ad-4772e9 1366->1371 1368 477192-4771a2 1367->1368 1369 4771a8-4771cf call 492290 1367->1369 1368->1369 1379 47727c-477298 1370->1379 1380 47726b-47727b 1370->1380 1372 4772fd-477305 1371->1372 1373 4772eb-4772f7 1371->1373 1376 477312-477330 1372->1376 1373->1372 1381 477355-477389 1376->1381 1382 477332-477353 1376->1382 1383 4772a6-4772ac 1379->1383 1384 47729a-47729f 1379->1384 1385 477395-47745d call 47f1c0 call 47b680 WriteFile 1381->1385 1386 47738b 1381->1386 1382->1385 1384->1383 1391 477471-477488 1385->1391 1392 47745f-47746b 1385->1392 1386->1385 1393 477310 1391->1393 1394 47748e-4774b6 1391->1394 1392->1391 1393->1376 1395 477522 1394->1395 1396 4774b8-4774f8 1394->1396 1399 477524-47754c CloseHandle call 492290 1395->1399 1397 47750e-477520 1396->1397 1398 4774fa-47750c 1396->1398 1397->1399 1398->1399 1401 477551-477564 1399->1401 1402 477566-477574 1401->1402 1403 47758f-477597 1401->1403 1402->1403 1404 477576-477589 1402->1404 1404->1403
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                • Part of subcall function 00498570: WaitForSingleObject.KERNEL32(00000708,00004E20,?,0047264E,00000134,00000000,00000000,00000001,?,00492C3C,00000000,?,00472E06,?,00000708,00000000), ref: 004985D7
                                                                                                                                                                                                              • CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000000,00000000,?,00000000,?,?,?,?,?,?,00000000), ref: 004771F7
                                                                                                                                                                                                              • WriteFile.KERNELBASE(00000000,?,00005000,00005000,00000000,?,?,?,?,?,?), ref: 0047740F
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2492941459.0000000000471000.00000020.00000001.01000000.00000005.sdmp, Offset: 00470000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492924890.0000000000470000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492970593.00000000004A7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004AC000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004DB000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004DD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004F0000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2493071108.00000000004F2000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_470000_skjlipudplp.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: File$CreateObjectSingleWaitWrite
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3285871581-0
                                                                                                                                                                                                              • Opcode ID: 47af5a37f03e2a03ca830d56d55a132dce529e573625d1b3d71b9b1e90660d52
                                                                                                                                                                                                              • Instruction ID: 7d3fcc3c9e3c89a549314c56b725c1f5c4318d7d3763e33fd7e5061829954a8f
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 47af5a37f03e2a03ca830d56d55a132dce529e573625d1b3d71b9b1e90660d52
                                                                                                                                                                                                              • Instruction Fuzzy Hash: B4C135B2A01200DFC704DF21FDC566637B4F798305B52857BE80A8A2B6E7749860CF8E

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 1405 477307 1406 477310-477330 1405->1406 1408 477355-477389 1406->1408 1409 477332-477353 1406->1409 1410 477395-47745d call 47f1c0 call 47b680 WriteFile 1408->1410 1411 47738b 1408->1411 1409->1410 1416 477471-477488 1410->1416 1417 47745f-47746b 1410->1417 1411->1410 1416->1406 1418 47748e-4774b6 1416->1418 1417->1416 1419 477522 1418->1419 1420 4774b8-4774f8 1418->1420 1423 477524-477564 CloseHandle call 492290 1419->1423 1421 47750e-477520 1420->1421 1422 4774fa-47750c 1420->1422 1421->1423 1422->1423 1426 477566-477574 1423->1426 1427 47758f-477597 1423->1427 1426->1427 1428 477576-477589 1426->1428 1428->1427
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • WriteFile.KERNELBASE(00000000,?,00005000,00005000,00000000,?,?,?,?,?,?), ref: 0047740F
                                                                                                                                                                                                              • CloseHandle.KERNELBASE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00477525
                                                                                                                                                                                                                • Part of subcall function 00492290: ReleaseMutex.KERNEL32(00472A8B,?,00472A8B,00000134,00000000), ref: 004922E7
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2492941459.0000000000471000.00000020.00000001.01000000.00000005.sdmp, Offset: 00470000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492924890.0000000000470000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492970593.00000000004A7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004AC000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004DB000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004DD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004F0000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2493071108.00000000004F2000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_470000_skjlipudplp.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CloseFileHandleMutexReleaseWrite
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 157576396-0
                                                                                                                                                                                                              • Opcode ID: 09456383fbcf850be41021a1f89d5bc204415ba0729e4d629078955c2e15c160
                                                                                                                                                                                                              • Instruction ID: b31bb332a8308ba26283fb8b7c2b964ae4f7085f7eec7380df7a1564777a7dc0
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 09456383fbcf850be41021a1f89d5bc204415ba0729e4d629078955c2e15c160
                                                                                                                                                                                                              • Instruction Fuzzy Hash: A35103B2E01100DFC704DF64ED845A57BB9F784305B61857BE54A8A2B9EB34A960CF8D

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 1429 477309 1430 477310-477330 1429->1430 1432 477355-477389 1430->1432 1433 477332-477353 1430->1433 1434 477395-47745d call 47f1c0 call 47b680 WriteFile 1432->1434 1435 47738b 1432->1435 1433->1434 1440 477471-477488 1434->1440 1441 47745f-47746b 1434->1441 1435->1434 1440->1430 1442 47748e-4774b6 1440->1442 1441->1440 1443 477522 1442->1443 1444 4774b8-4774f8 1442->1444 1447 477524-477564 CloseHandle call 492290 1443->1447 1445 47750e-477520 1444->1445 1446 4774fa-47750c 1444->1446 1445->1447 1446->1447 1450 477566-477574 1447->1450 1451 47758f-477597 1447->1451 1450->1451 1452 477576-477589 1450->1452 1452->1451
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • WriteFile.KERNELBASE(00000000,?,00005000,00005000,00000000,?,?,?,?,?,?), ref: 0047740F
                                                                                                                                                                                                              • CloseHandle.KERNELBASE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00477525
                                                                                                                                                                                                                • Part of subcall function 00492290: ReleaseMutex.KERNEL32(00472A8B,?,00472A8B,00000134,00000000), ref: 004922E7
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2492941459.0000000000471000.00000020.00000001.01000000.00000005.sdmp, Offset: 00470000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492924890.0000000000470000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492970593.00000000004A7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004AC000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004DB000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004DD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004F0000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2493071108.00000000004F2000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_470000_skjlipudplp.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CloseFileHandleMutexReleaseWrite
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 157576396-0
                                                                                                                                                                                                              • Opcode ID: 0bf0eabfb51cff48126d1929b5e6dd611dc91b4c1d3828d7d45bc22df5e0323a
                                                                                                                                                                                                              • Instruction ID: db2ce9a2987d4e3799655258bb992fb1263dedd82d4df6aac79d73ec45dbc958
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 0bf0eabfb51cff48126d1929b5e6dd611dc91b4c1d3828d7d45bc22df5e0323a
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 475104B2E01100DFC704DF64FD845A57BB9F784305B61857BD54A8A2B9E734A960CF8D

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 1453 491510-49152f 1454 49153b-4915b0 AllocateAndInitializeSid 1453->1454 1455 491531 1453->1455 1456 4915c0-491608 1454->1456 1457 4915b2-4915be 1454->1457 1455->1454 1458 49161e-491621 1456->1458 1459 49160a-491617 1456->1459 1457->1458 1460 491623-491646 CheckTokenMembership 1458->1460 1461 491697-4916a8 1458->1461 1459->1458 1462 491648-491661 1460->1462 1463 491667-491691 1460->1463 1462->1463 1463->1461
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • AllocateAndInitializeSid.ADVAPI32(004780AE,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,004780AE), ref: 00491592
                                                                                                                                                                                                              • CheckTokenMembership.KERNELBASE(00000000,?,?), ref: 0049163E
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2492941459.0000000000471000.00000020.00000001.01000000.00000005.sdmp, Offset: 00470000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492924890.0000000000470000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492970593.00000000004A7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004AC000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004DB000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004DD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004F0000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2493071108.00000000004F2000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_470000_skjlipudplp.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: AllocateCheckInitializeMembershipToken
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1663163955-0
                                                                                                                                                                                                              • Opcode ID: b8c957119e2f504877aa1c008d187a29f13d7567dcb06b2812b6787fa9c2f59c
                                                                                                                                                                                                              • Instruction ID: 5b5eca16fae9ee9293cf52858598239f32407c85a4cdc9e1eda289af536a3d50
                                                                                                                                                                                                              • Opcode Fuzzy Hash: b8c957119e2f504877aa1c008d187a29f13d7567dcb06b2812b6787fa9c2f59c
                                                                                                                                                                                                              • Instruction Fuzzy Hash: D541F372A02285EFCB049FA4FDC88A87F74F754340B5685BAD8429B27AD7300964CF1C
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetProcessHeap.KERNEL32(00000000,0047A48A,?,0047A48A,00000002,00000002,?,0093B3B0,?,00000001), ref: 004A59C3
                                                                                                                                                                                                              • RtlFreeHeap.NTDLL(00000000,?,0047A48A,00000002,00000002,?,0093B3B0,?,00000001), ref: 004A59CA
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2492941459.0000000000471000.00000020.00000001.01000000.00000005.sdmp, Offset: 00470000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492924890.0000000000470000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492970593.00000000004A7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004AC000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004DB000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004DD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004F0000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2493071108.00000000004F2000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_470000_skjlipudplp.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Heap$FreeProcess
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3859560861-0
                                                                                                                                                                                                              • Opcode ID: d6299adc9543e8aa6c03592e0c40f82f8718e7b26a9586598fa9726aa43ae06a
                                                                                                                                                                                                              • Instruction ID: 6e61c005f4a9c22aa39d5394c09a1813ea42808fa818e14834d76510e75b491d
                                                                                                                                                                                                              • Opcode Fuzzy Hash: d6299adc9543e8aa6c03592e0c40f82f8718e7b26a9586598fa9726aa43ae06a
                                                                                                                                                                                                              • Instruction Fuzzy Hash: BED01271088344AFC7105FA9EC49B163BACEF5D616F058160F60AC9171C7315890CF6C
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CreateFileA.KERNELBASE(?,C0000000,00000000,00000000,00000002,00000000,00000000), ref: 00485933
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2492941459.0000000000471000.00000020.00000001.01000000.00000005.sdmp, Offset: 00470000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492924890.0000000000470000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492970593.00000000004A7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004AC000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004DB000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004DD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004F0000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2493071108.00000000004F2000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_470000_skjlipudplp.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CreateFile
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 823142352-0
                                                                                                                                                                                                              • Opcode ID: e21bbb013439abc74fd546df50a10f93492036cc0e436eb0fadffa1d51b03e0e
                                                                                                                                                                                                              • Instruction ID: f0c0e1ba3cc5092e2a5be019c4f5bb7c3836bba8e7b71641604f2649d2b2bd82
                                                                                                                                                                                                              • Opcode Fuzzy Hash: e21bbb013439abc74fd546df50a10f93492036cc0e436eb0fadffa1d51b03e0e
                                                                                                                                                                                                              • Instruction Fuzzy Hash: B17135B2911648DBD754AF21FCC96A53BB0F764311F114A7AD5429A2B6EB3088B0CF8D
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CreateFileA.KERNELBASE(00000708,80000000,00000000,00000000,00000003,00000000,00000000,?,?,00000708,00000000), ref: 004970F3
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2492941459.0000000000471000.00000020.00000001.01000000.00000005.sdmp, Offset: 00470000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492924890.0000000000470000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492970593.00000000004A7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004AC000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004DB000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004DD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004F0000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2493071108.00000000004F2000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_470000_skjlipudplp.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CreateFile
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 823142352-0
                                                                                                                                                                                                              • Opcode ID: adf44ec65a46529f82c590a0b1dd5eb243468aab76bbac4ba576a39918328bd3
                                                                                                                                                                                                              • Instruction ID: 62280b53b9fcb552b39b00c77b2ba6d1df349970177aa6f1633352bb4b242589
                                                                                                                                                                                                              • Opcode Fuzzy Hash: adf44ec65a46529f82c590a0b1dd5eb243468aab76bbac4ba576a39918328bd3
                                                                                                                                                                                                              • Instruction Fuzzy Hash: CF513171601250DFEB049F25FCD57763BB4FB49321F00413AE94A8A2B2E7388892CB8D
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                • Part of subcall function 00496BE0: GetStdHandle.KERNEL32(000000F6,?,?,00495560), ref: 00496C12
                                                                                                                                                                                                                • Part of subcall function 00496BE0: GetStdHandle.KERNEL32(000000F5,?,?,00495560), ref: 00496C6A
                                                                                                                                                                                                                • Part of subcall function 00496BE0: GetStdHandle.KERNEL32(000000F4,?,?,00495560), ref: 00496D53
                                                                                                                                                                                                              • ExitProcess.KERNEL32 ref: 0049561B
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2492941459.0000000000471000.00000020.00000001.01000000.00000005.sdmp, Offset: 00470000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492924890.0000000000470000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492970593.00000000004A7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004AC000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004DB000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004DD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004F0000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2493071108.00000000004F2000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_470000_skjlipudplp.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Handle$ExitProcess
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 256993070-0
                                                                                                                                                                                                              • Opcode ID: a8f28224454f092bb13d8d143fdc5c24a2dd766ee1496be3b7966f2da9a6dec7
                                                                                                                                                                                                              • Instruction ID: 9c13e97e3fd443dedc7a2770c819cee80b16802de03955cd6fec71dfd48b13b9
                                                                                                                                                                                                              • Opcode Fuzzy Hash: a8f28224454f092bb13d8d143fdc5c24a2dd766ee1496be3b7966f2da9a6dec7
                                                                                                                                                                                                              • Instruction Fuzzy Hash: EA110476A01680DBDB10AF30FCC64193BA5F765341317843BD4028A6B6EA3C8C59CB4C
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • Sleep.KERNELBASE(000003E8,00000000,?,00472E06,?,00000708,00000000), ref: 00492D5A
                                                                                                                                                                                                                • Part of subcall function 00496F70: CreateFileA.KERNELBASE(00000708,80000000,00000000,00000000,00000003,00000000,00000000,?,?,00000708,00000000), ref: 004970F3
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2492941459.0000000000471000.00000020.00000001.01000000.00000005.sdmp, Offset: 00470000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492924890.0000000000470000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492970593.00000000004A7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004AC000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004DB000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004DD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004F0000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2493071108.00000000004F2000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_470000_skjlipudplp.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CreateFileSleep
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 2694422964-0
                                                                                                                                                                                                              • Opcode ID: 5e7f6c765a2bbf3b98af614b5a77313b327c40c6e4e2196c8695c22005472e28
                                                                                                                                                                                                              • Instruction ID: 896096a4e0724ba14bd77d19f909efbdc807477962c26aa31414ee55fa4845ff
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5e7f6c765a2bbf3b98af614b5a77313b327c40c6e4e2196c8695c22005472e28
                                                                                                                                                                                                              • Instruction Fuzzy Hash: E4813271A01700DFCB14EF25FEC6A663BB4F784700B02463BE4429A6B6EB7558A1CB4D
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • lstrlen.KERNEL32(?,00000000,?,0049045C,?,?,?), ref: 00498A81
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2492941459.0000000000471000.00000020.00000001.01000000.00000005.sdmp, Offset: 00470000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492924890.0000000000470000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492970593.00000000004A7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004AC000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004DB000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004DD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004F0000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2493071108.00000000004F2000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_470000_skjlipudplp.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlen
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1659193697-0
                                                                                                                                                                                                              • Opcode ID: 464981353e977308771678cfae1996933232ac8c38d12fbc426d91d71e16a162
                                                                                                                                                                                                              • Instruction ID: ed3cad348aaa124d181156ffea83bf65a5220a995fd01b3f022eed2e517760e0
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 464981353e977308771678cfae1996933232ac8c38d12fbc426d91d71e16a162
                                                                                                                                                                                                              • Instruction Fuzzy Hash: F1213375A02554DFD758AF78FCD80B67FA4F38A321310413BD59A862B9EB3448A2CB4C
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • OpenSCManagerA.ADVAPI32(00000000,00000000,00000002), ref: 0047546E
                                                                                                                                                                                                              • CreateServiceA.ADVAPI32(00000000,0093E648,0093E648,000F01FF,00000110,00000002,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 004754BD
                                                                                                                                                                                                              • ChangeServiceConfig2A.ADVAPI32(00000000,00000001,?), ref: 00475503
                                                                                                                                                                                                              • StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00475533
                                                                                                                                                                                                              • CloseServiceHandle.ADVAPI32(00000000), ref: 00475593
                                                                                                                                                                                                              • OpenServiceA.ADVAPI32(00000000,0093E648,00000010), ref: 004755DE
                                                                                                                                                                                                              • StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 0047566C
                                                                                                                                                                                                              • CloseServiceHandle.ADVAPI32(00000000), ref: 0047567D
                                                                                                                                                                                                              • CloseServiceHandle.ADVAPI32(00000000), ref: 004756CC
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2492941459.0000000000471000.00000020.00000001.01000000.00000005.sdmp, Offset: 00470000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492924890.0000000000470000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492970593.00000000004A7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004AC000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004DB000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004DD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004F0000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2493071108.00000000004F2000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_470000_skjlipudplp.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Service$CloseHandle$OpenStart$ChangeConfig2CreateManager
                                                                                                                                                                                                              • String ID: |Sxz
                                                                                                                                                                                                              • API String ID: 3525021261-962673421
                                                                                                                                                                                                              • Opcode ID: f26eaceffb885c33f72e323c188a51ab41c3f81eb064f60deb36852fbb6f4a59
                                                                                                                                                                                                              • Instruction ID: a2b1ce98ba719a3acbaa1e8a7580d2ddabcd95acfdee7f34ff78b21900104480
                                                                                                                                                                                                              • Opcode Fuzzy Hash: f26eaceffb885c33f72e323c188a51ab41c3f81eb064f60deb36852fbb6f4a59
                                                                                                                                                                                                              • Instruction Fuzzy Hash: CF813071A01601DFD314DF24FDC96663BB4F7A4301F50823AE8459B2B6E7B498A1CB8E
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • OpenSCManagerA.ADVAPI32(00000000,00000000,80000000,-00000001,00000000,00000001), ref: 0048643A
                                                                                                                                                                                                              • EnumServicesStatusA.ADVAPI32(00000000,00000030,00000003,?,00000024,0000000A,?,00000000), ref: 004864AC
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 004864C1
                                                                                                                                                                                                              • EnumServicesStatusA.ADVAPI32(00000000,00000030,00000003,00000000,-0000001A,0000000A,?,00000000), ref: 004865D1
                                                                                                                                                                                                              • CloseServiceHandle.ADVAPI32(00000000), ref: 00486829
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2492941459.0000000000471000.00000020.00000001.01000000.00000005.sdmp, Offset: 00470000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492924890.0000000000470000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492970593.00000000004A7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004AC000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004DB000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004DD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004F0000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2493071108.00000000004F2000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_470000_skjlipudplp.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: EnumServicesStatus$CloseErrorHandleLastManagerOpenService
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1579346331-0
                                                                                                                                                                                                              • Opcode ID: f9810cf79df3a658ba0362a17789d9262907a8fe0b55be9b71622132f32b4c57
                                                                                                                                                                                                              • Instruction ID: 6a1f59ee878dcd213e7a95c5ad58ed0868382c4f517a9ca30d08cbae1f227f70
                                                                                                                                                                                                              • Opcode Fuzzy Hash: f9810cf79df3a658ba0362a17789d9262907a8fe0b55be9b71622132f32b4c57
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 33027BB2901201DFC744EF65FDC96693BB0F784310B22467AD5869B2B6EB3449A4CF8D
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CreatePipe.KERNEL32(00000001,?,0000000C,00000000,00000000,00000000,?), ref: 0047CB8A
                                                                                                                                                                                                              • SetHandleInformation.KERNEL32(00000001,00000001,00000000), ref: 0047CBD0
                                                                                                                                                                                                              • CreatePipe.KERNEL32(?,00000000,0000000C,00000000), ref: 0047CC2C
                                                                                                                                                                                                              • SetHandleInformation.KERNEL32(00000000,00000001,00000000), ref: 0047CCA8
                                                                                                                                                                                                              • CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000001,00000044,?), ref: 0047CE0D
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 0047CE48
                                                                                                                                                                                                              • CloseHandle.KERNEL32(?), ref: 0047CE70
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000001), ref: 0047CEA0
                                                                                                                                                                                                              • CloseHandle.KERNEL32(?), ref: 0047CEB8
                                                                                                                                                                                                              • WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 0047CFA0
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 0047CFD3
                                                                                                                                                                                                              • CloseHandle.KERNEL32(?), ref: 0047CFEE
                                                                                                                                                                                                              • WaitForSingleObject.KERNEL32(?,00002710), ref: 0047D09F
                                                                                                                                                                                                              • CloseHandle.KERNEL32(?), ref: 0047D0B3
                                                                                                                                                                                                              • CloseHandle.KERNEL32(?), ref: 0047D0EB
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2492941459.0000000000471000.00000020.00000001.01000000.00000005.sdmp, Offset: 00470000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492924890.0000000000470000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492970593.00000000004A7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004AC000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004DB000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004DD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004F0000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2493071108.00000000004F2000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_470000_skjlipudplp.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Handle$Close$Create$InformationPipe$FileObjectProcessSingleWaitWrite
                                                                                                                                                                                                              • String ID: D$S')G$gI
                                                                                                                                                                                                              • API String ID: 1130065513-910259947
                                                                                                                                                                                                              • Opcode ID: 4099d7dc437936befd7c18abfacc38f4038f2c5a114e905d3f368499c37d607c
                                                                                                                                                                                                              • Instruction ID: c00cd13c776dd5e6c33d4b06c0c9db98d2d17d601b95c52f325fd48226371f64
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4099d7dc437936befd7c18abfacc38f4038f2c5a114e905d3f368499c37d607c
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 650249B1A01244DFD704DF64FDC8AA93BB5FB98300B11823AE5469B2B6E7349861CF4D
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000), ref: 004940AF
                                                                                                                                                                                                              • Process32First.KERNEL32(00000000,?), ref: 00494187
                                                                                                                                                                                                              • CreateToolhelp32Snapshot.KERNEL32(00000008,?,00000001), ref: 004943B2
                                                                                                                                                                                                              • Module32First.KERNEL32(00000000,?), ref: 004943F6
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000,0000000A,?,00000000), ref: 0049454D
                                                                                                                                                                                                              • Process32Next.KERNEL32(?,00000128), ref: 00494584
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 004945FA
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2492941459.0000000000471000.00000020.00000001.01000000.00000005.sdmp, Offset: 00470000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492924890.0000000000470000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492970593.00000000004A7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004AC000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004DB000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004DD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004F0000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2493071108.00000000004F2000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_470000_skjlipudplp.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32$Module32Next
                                                                                                                                                                                                              • String ID: "L=/
                                                                                                                                                                                                              • API String ID: 930127669-2479274474
                                                                                                                                                                                                              • Opcode ID: 43981a98705bce388642e4dc54ba11124d266ae5cbc65d2cf87740e975f1731e
                                                                                                                                                                                                              • Instruction ID: 5f5495272b6df47f12056227be3fe39aa87c78c3a0ec573027fdef6049620f41
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 43981a98705bce388642e4dc54ba11124d266ae5cbc65d2cf87740e975f1731e
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 71F13671A00240DFDB04EF61FDC9A653FB4F794311B12427AE5869A2B6EB344961CF8D
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0047B2EE
                                                                                                                                                                                                              • ReadFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 0047B326
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 0047B33F
                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 0047B37C
                                                                                                                                                                                                              • CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0047B558
                                                                                                                                                                                                              • WriteFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 0047B5AB
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 0047B5BC
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2492941459.0000000000471000.00000020.00000001.01000000.00000005.sdmp, Offset: 00470000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492924890.0000000000470000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492970593.00000000004A7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004AC000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004DB000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004DD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004F0000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2493071108.00000000004F2000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_470000_skjlipudplp.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: File$CloseCreateHandle$CountReadTickWrite
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3478262135-0
                                                                                                                                                                                                              • Opcode ID: 6282220a0e32cd3ab18d9d04e4f1778ddf9fe4731bf6eda731152b7a3f0ec32d
                                                                                                                                                                                                              • Instruction ID: e84fd62bdd45b7f5ec20f0bbfa32a9ae3e9515ea10e530f17b567de3237d3167
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6282220a0e32cd3ab18d9d04e4f1778ddf9fe4731bf6eda731152b7a3f0ec32d
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 44B106B1A01210EFD704AF25FD86BA637B4FB95300F10823AE9059F2B6E7745951CB9E
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000,00000001), ref: 0047204F
                                                                                                                                                                                                              • Process32First.KERNEL32(00000000,00000128), ref: 00472159
                                                                                                                                                                                                              • OpenProcess.KERNEL32(00000001,00000000,?), ref: 0047224D
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2492941459.0000000000471000.00000020.00000001.01000000.00000005.sdmp, Offset: 00470000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492924890.0000000000470000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492970593.00000000004A7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004AC000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004DB000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004DD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004F0000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2493071108.00000000004F2000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_470000_skjlipudplp.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CreateFirstOpenProcessProcess32SnapshotToolhelp32
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3397401024-0
                                                                                                                                                                                                              • Opcode ID: fdc014cfff6613b923a61a0280ee324370d0340d1e5acd4f09effdaf5c4174f3
                                                                                                                                                                                                              • Instruction ID: 11acc00f7ddeec9c62dfefee7bde2f6dd3c2059e7ad7a08c3f544c1ee55a0fc7
                                                                                                                                                                                                              • Opcode Fuzzy Hash: fdc014cfff6613b923a61a0280ee324370d0340d1e5acd4f09effdaf5c4174f3
                                                                                                                                                                                                              • Instruction Fuzzy Hash: DBB154B2A01211CFD714EF24FEC95A63BB4F794300B11867BD5469A2B6E7B49920CF8C
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CreateFileA.KERNEL32(?,00000000,00000000,00000000,00000003,00000000,00000000), ref: 00494A04
                                                                                                                                                                                                              • GetFileTime.KERNEL32(00000000,?,?,?), ref: 00494A4E
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 00494A6B
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2492941459.0000000000471000.00000020.00000001.01000000.00000005.sdmp, Offset: 00470000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492924890.0000000000470000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492970593.00000000004A7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004AC000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004DB000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004DD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004F0000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2493071108.00000000004F2000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_470000_skjlipudplp.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: File$CloseCreateHandleTime
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3397143404-0
                                                                                                                                                                                                              • Opcode ID: 9003933404721f26607ba5511d42749333a44b9b629f13e34514d6dd986372bf
                                                                                                                                                                                                              • Instruction ID: 740548b596602a6f05b773a54188bcc9b8f724632dc4ec5acab76cfd84a1aba2
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9003933404721f26607ba5511d42749333a44b9b629f13e34514d6dd986372bf
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6F610132A01204DFDB10CF65FDC567ABBB8FB98714B11827BE9068A6B1D7709850CB8D
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000001,?,00479ED1,00490DB0,00000001,?), ref: 0049873E
                                                                                                                                                                                                              • CreateThread.KERNEL32(00000000,00000000,00000001,?,00000000,00000000), ref: 0049876D
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000,?,00479ED1,00490DB0,00000001,?), ref: 0049877E
                                                                                                                                                                                                              • WaitForSingleObject.KERNEL32(?,000000FF,?,00479ED1,00490DB0,00000001,?), ref: 00498793
                                                                                                                                                                                                              • CloseHandle.KERNEL32(?,?,000000FF,?,00479ED1,00490DB0,00000001,?), ref: 004987B7
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2492941459.0000000000471000.00000020.00000001.01000000.00000005.sdmp, Offset: 00470000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492924890.0000000000470000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492970593.00000000004A7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004AC000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004DB000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004DD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004F0000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2493071108.00000000004F2000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_470000_skjlipudplp.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CloseCreateHandle$EventObjectSingleThreadWait
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1404307249-0
                                                                                                                                                                                                              • Opcode ID: 5838f0ea53a349f21765f945929e7c410573fb62dc65f5da9b37f3d5b4d0763a
                                                                                                                                                                                                              • Instruction ID: 2d1a6cf1fe077922ac8c73aab4727d2a9178a8e105ff6af43cd1bc11974f1ae4
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5838f0ea53a349f21765f945929e7c410573fb62dc65f5da9b37f3d5b4d0763a
                                                                                                                                                                                                              • Instruction Fuzzy Hash: AA41A2B1A01305EFD7016F26FD887503BB0F758351F21453AE5859A2B6EB3594A1CF8E
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00492807
                                                                                                                                                                                                              • ReadFile.KERNEL32(00000000,?,00005000,?,00000000), ref: 004928C5
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000,?,?,?,00000000), ref: 004929CC
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2492941459.0000000000471000.00000020.00000001.01000000.00000005.sdmp, Offset: 00470000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492924890.0000000000470000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492970593.00000000004A7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004AC000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004DB000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004DD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004F0000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2493071108.00000000004F2000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_470000_skjlipudplp.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: File$CloseCreateHandleRead
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1035965006-0
                                                                                                                                                                                                              • Opcode ID: ea55466f6657fbfb7b8207c96230ae48c4690db6cee946b6c1f522411108f5de
                                                                                                                                                                                                              • Instruction ID: 948771de7d93fcd51bd1c6e3100425e301c1429adeb9e1b677d7d5f0f67888e4
                                                                                                                                                                                                              • Opcode Fuzzy Hash: ea55466f6657fbfb7b8207c96230ae48c4690db6cee946b6c1f522411108f5de
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 40B123B5A01200DFDB04EF24FD85A693BB4F794301F11467AE4029A2B5EBB89961CF8D
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetProcessHeap.KERNEL32(00000000,00000000,?,?,0048FAC0,00000000,?), ref: 0049381D
                                                                                                                                                                                                              • RtlReAllocateHeap.NTDLL(00000000,?,0048FAC0,00000000), ref: 00493824
                                                                                                                                                                                                              • GetProcessHeap.KERNEL32(00000000,?,?,0048FAC0,00000000,?), ref: 00493842
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(00000000,?,0048FAC0,00000000,?), ref: 00493849
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2492941459.0000000000471000.00000020.00000001.01000000.00000005.sdmp, Offset: 00470000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492924890.0000000000470000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492970593.00000000004A7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004AC000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004DB000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004DD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004F0000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2493071108.00000000004F2000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_470000_skjlipudplp.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Heap$Process$AllocAllocate
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1154092256-0
                                                                                                                                                                                                              • Opcode ID: 2b039435302dfa7fcc6d43908d705df81d28375ed8484cdab8d338973c3b0cc0
                                                                                                                                                                                                              • Instruction ID: f53e56a6c6cb6df5af54d4d7b1b4552ecef1da3141feca36e1bacdf0180ef34d
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2b039435302dfa7fcc6d43908d705df81d28375ed8484cdab8d338973c3b0cc0
                                                                                                                                                                                                              • Instruction Fuzzy Hash: D81125B1A04604CBCB04AFA0FC9CA6A3FB8F744741B114272E0068A670EB759850CB6E
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetSystemTime.KERNEL32(J,G,00000001,?,?,00472C4A), ref: 004A473C
                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 004A484A
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000002.00000002.2492941459.0000000000471000.00000020.00000001.01000000.00000005.sdmp, Offset: 00470000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492924890.0000000000470000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492970593.00000000004A7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004AC000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004DB000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004DD000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2492991783.00000000004F0000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000002.00000002.2493071108.00000000004F2000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_2_2_470000_skjlipudplp.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CountSystemTickTime
                                                                                                                                                                                                              • String ID: J,G
                                                                                                                                                                                                              • API String ID: 2164215191-1405447833
                                                                                                                                                                                                              • Opcode ID: 29c1c502e27f0c1e4d2a6adac17b25e860ec56d202a055535ff7194704e5418b
                                                                                                                                                                                                              • Instruction ID: 8fee1792ac8586b348b4f7b9e968b4f1089b6712fbd3ddde9bed4721274bd3a5
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 29c1c502e27f0c1e4d2a6adac17b25e860ec56d202a055535ff7194704e5418b
                                                                                                                                                                                                              • Instruction Fuzzy Hash: CA510276A12152CBD314DF6AFD8147637F1FBA5315344823BE405CA6B9E3789860CB4D

                                                                                                                                                                                                              Execution Graph

                                                                                                                                                                                                              Execution Coverage:6.5%
                                                                                                                                                                                                              Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                              Signature Coverage:0%
                                                                                                                                                                                                              Total number of Nodes:1540
                                                                                                                                                                                                              Total number of Limit Nodes:21
                                                                                                                                                                                                              execution_graph 10962 81d0a 10963 81d4b GetProcessHeap HeapAlloc 10962->10963 10964 81d3b 10962->10964 10964->10963 10965 57307 10967 57310 10965->10967 10966 573ea WriteFile 10966->10967 10967->10966 10968 5748e CloseHandle 10967->10968 10970 72290 ReleaseMutex 10968->10970 10971 57551 10970->10971 10662 56000 10663 56085 RegisterServiceCtrlHandlerA 10662->10663 10665 56410 10663->10665 10666 5613b SetServiceStatus CreateEventA SetServiceStatus 10663->10666 10667 56220 WaitForSingleObject 10666->10667 10669 56279 10667->10669 10670 78570 WaitForSingleObject 10669->10670 10671 562b9 SetServiceStatus CloseHandle 10670->10671 10673 5637c 10671->10673 10674 56388 SetServiceStatus 10671->10674 10673->10674 10674->10665 10817 52480 10818 52498 10817->10818 10821 72510 10818->10821 10820 524c0 10822 7252f 10821->10822 10825 77730 10822->10825 10824 72607 10824->10820 10826 77750 10825->10826 10827 6f910 8 API calls 10826->10827 10828 7778e 10827->10828 10828->10824 10829 5ee80 10830 5ee8b 10829->10830 10831 5ee97 10830->10831 10832 608b0 2 API calls 10830->10832 10832->10831 10972 54f00 10973 54f0b 10972->10973 10974 57c20 8 API calls 10973->10974 10975 54f38 10974->10975 11151 60780 11152 607a0 11151->11152 11157 72260 lstrlen 11152->11157 11154 607d1 11158 77fc0 11154->11158 11157->11154 11161 51560 11158->11161 11160 607e7 11162 5158d 11161->11162 11163 5160d 11162->11163 11164 5161a 11162->11164 11165 77730 8 API calls 11163->11165 11166 606b0 8 API calls 11164->11166 11167 51618 11164->11167 11165->11167 11166->11167 11167->11160 9574 6bf0e 9576 6bece 9574->9576 9577 6bf1f 9574->9577 9575 6bf5c 9801 5af10 9575->9801 9590 7d0eb 9576->9590 9577->9575 9577->9576 9580 5e980 2 API calls 9586 6c1c3 9580->9586 9581 6c050 9582 6c0d6 9581->9582 9583 6c09e 9581->9583 9588 6c129 9581->9588 9811 848f0 9582->9811 9807 5e980 9583->9807 9588->9580 9591 7d0f0 9590->9591 9847 831e0 9591->9847 9593 7d130 9851 5a430 9593->9851 9596 831e0 2 API calls 9597 7d1ff 9596->9597 9598 5a430 2 API calls 9597->9598 9599 7d225 9598->9599 9600 831e0 2 API calls 9599->9600 9601 7d2d7 9600->9601 9602 5a430 2 API calls 9601->9602 9603 7d2f8 9602->9603 9604 831e0 2 API calls 9603->9604 9605 7d3b3 9604->9605 9606 5a430 2 API calls 9605->9606 9607 7d3d5 9606->9607 9608 831e0 2 API calls 9607->9608 9609 7d425 9608->9609 9610 5a430 2 API calls 9609->9610 9611 7d46b 9610->9611 9612 831e0 2 API calls 9611->9612 9613 7d4d9 9612->9613 9614 5a430 2 API calls 9613->9614 9615 7d4ed 9614->9615 9616 831e0 2 API calls 9615->9616 9617 7d541 9616->9617 9618 5a430 2 API calls 9617->9618 9619 7d555 9618->9619 9620 5a430 2 API calls 9619->9620 9621 7d58b 9620->9621 9855 859b0 GetProcessHeap RtlFreeHeap 9621->9855 9623 7d5f4 9856 84650 9623->9856 9625 7d603 9626 831e0 2 API calls 9625->9626 9627 7d628 GetEnvironmentVariableA 9626->9627 9628 7d67c 9627->9628 9629 5a430 2 API calls 9628->9629 9630 7d6c4 CreateMutexA CreateMutexA CreateMutexA 9629->9630 9632 7d7c6 9630->9632 9633 7d954 9632->9633 9634 7d81b GetTickCount 9632->9634 9864 57fa0 9633->9864 9635 7d83a 9634->9635 9637 831e0 2 API calls 9635->9637 9640 7d86a 9637->9640 9638 7d9c1 GetCommandLineA 9639 7da10 9638->9639 9641 831e0 2 API calls 9639->9641 9642 5a430 2 API calls 9640->9642 9644 7da7b 9641->9644 9643 7d8ff 9642->9643 9643->9633 9645 5a430 2 API calls 9644->9645 9646 7dad8 9645->9646 9647 7e64f GetCommandLineA 9646->9647 9648 831e0 2 API calls 9646->9648 10015 53e80 9647->10015 9650 7db4c 9648->9650 9653 5a430 2 API calls 9650->9653 9651 7e66d 9652 7e6be 9651->9652 10018 72260 lstrlen 9652->10018 9654 7db98 9653->9654 9657 7dbfa 9654->9657 9659 5c9b0 ExitProcess 9654->9659 9656 7e6d4 GetModuleFileNameA 10019 78a10 9656->10019 9660 831e0 2 API calls 9657->9660 9659->9657 9663 7dc36 9660->9663 9661 7e750 9662 78a10 lstrlen 9661->9662 9665 7e7cf 9662->9665 9664 5a430 2 API calls 9663->9664 9666 7dccc 9664->9666 9667 78a10 lstrlen 9665->9667 9668 7dcfb 9666->9668 9669 5c9b0 ExitProcess 9666->9669 9685 7e842 9667->9685 9967 75d80 9668->9967 9669->9668 9671 7ead8 10044 65770 9671->10044 9673 831e0 2 API calls 9674 7dd40 9673->9674 9678 5a430 2 API calls 9674->9678 9676 7eb30 9677 7eb58 9676->9677 9679 5c9b0 ExitProcess 9676->9679 10053 60950 9677->10053 9694 7dd73 9678->9694 9679->9677 9685->9671 10023 71c40 9685->10023 9688 7e8ff 10029 53740 9688->10029 9692 7eaad 9696 5c9b0 ExitProcess 9692->9696 9693 7de8c Sleep 9695 74990 5 API calls 9693->9695 9694->9693 9700 7e014 Sleep 9694->9700 9703 7e07c 9694->9703 9973 70250 9694->9973 9984 74990 CreateFileA 9694->9984 9991 57a90 GetSystemTimeAsFileTime 9694->9991 9701 7decf 9695->9701 9696->9671 9697 7e92b 9697->9692 9698 831e0 2 API calls 9697->9698 9699 7e9cf 9698->9699 10043 72260 lstrlen 9699->10043 9700->9694 9701->9694 9707 70250 5 API calls 9703->9707 9711 7e16f 9703->9711 9993 51fe0 CreateToolhelp32Snapshot 9703->9993 9707->9703 9708 7ea28 MessageBoxA 9710 5a430 2 API calls 9708->9710 9713 7ea8b 9710->9713 9719 74990 5 API calls 9711->9719 9717 5c9b0 ExitProcess 9713->9717 9717->9692 9718 7e12b Sleep 9718->9703 9718->9711 9723 7e1c9 9719->9723 9729 7e5ec 9723->9729 9736 7e240 9723->9736 9737 7e25e GetModuleFileNameA 9723->9737 10007 65eb0 9729->10007 9736->9737 9739 7e294 9737->9739 9740 7e2b8 SetFileAttributesA 9737->9740 9739->9740 9747 7e2d5 9740->9747 9748 7e304 CopyFileA 9740->9748 9747->9748 9755 831e0 2 API calls 9748->9755 9754 7e627 10012 5c9b0 9754->10012 9763 7e353 9755->9763 9764 5a430 2 API calls 9763->9764 9765 7e3a9 9764->9765 9766 7e4a2 9765->9766 9770 831e0 2 API calls 9765->9770 9768 7e574 SetFileAttributesA 9766->9768 9769 7e53c SetFileAttributesA 9766->9769 9772 7e5bd 9768->9772 9769->9772 9776 7e410 9770->9776 9772->9729 9779 5a430 2 API calls 9776->9779 9779->9766 9802 5af45 9801->9802 10556 773c0 9802->10556 9806 5afca 9806->9581 9808 5e9b9 9807->9808 9810 5ec11 9808->9810 10567 859b0 GetProcessHeap RtlFreeHeap 9808->10567 9813 84968 9811->9813 9812 85845 9812->9588 9813->9812 9814 773c0 4 API calls 9813->9814 9815 84aaf 9814->9815 9817 773c0 4 API calls 9815->9817 9845 85039 9815->9845 9816 857da 9819 85809 9816->9819 9820 857fd 9816->9820 9818 84af7 9817->9818 9824 773c0 4 API calls 9818->9824 9818->9845 9822 5e980 2 API calls 9819->9822 9821 5e980 2 API calls 9820->9821 9825 85804 9821->9825 9822->9825 9823 5e980 2 API calls 9823->9845 9826 84b20 9824->9826 9825->9588 9827 5eeb0 4 API calls 9826->9827 9836 84b66 9826->9836 9826->9845 9828 84b8f 9827->9828 9828->9845 10568 65a60 9828->10568 9831 84ce8 9835 7fe90 4 API calls 9831->9835 9832 84cfb 10579 54260 9832->10579 9837 84cf6 9835->9837 9836->9831 9836->9832 9836->9845 9838 54260 4 API calls 9837->9838 9839 84d7b 9838->9839 9840 773c0 4 API calls 9839->9840 9839->9845 9841 84e34 9840->9841 9842 54260 4 API calls 9841->9842 9841->9845 9843 84e59 9842->9843 9844 773c0 4 API calls 9843->9844 9843->9845 9846 54260 4 API calls 9843->9846 9844->9843 9845->9816 9845->9823 9846->9843 9848 8320c 9847->9848 10234 756a0 9848->10234 9850 832e3 9850->9593 9852 5a450 9851->9852 10237 859b0 GetProcessHeap RtlFreeHeap 9852->10237 9854 5a48a 9854->9596 9855->9623 9857 8468a 9856->9857 9858 84729 GetSystemTime 9857->9858 9859 84705 9857->9859 9860 8476a 9858->9860 9859->9858 9861 57a90 GetSystemTimeAsFileTime 9860->9861 9862 84831 GetTickCount 9861->9862 9863 8486a 9862->9863 9863->9625 9865 57fbe 9864->9865 9866 58072 GetVersionExA 9865->9866 10238 71510 9866->10238 9871 5824c 9872 831e0 2 API calls 9871->9872 9874 5830a 9872->9874 10259 77870 9874->10259 9875 58114 9878 581ba CreateDirectoryA 9875->9878 9880 831e0 2 API calls 9878->9880 9879 5a430 2 API calls 9882 5838c 9879->9882 9881 5820d 9880->9881 9883 5a430 2 API calls 9881->9883 10263 570d0 9882->10263 9883->9871 9885 583cb 9886 58443 9885->9886 9887 583d2 DeleteFileA RemoveDirectoryA 9885->9887 9888 5f420 6 API calls 9886->9888 9887->9886 9889 58459 9888->9889 9890 5849f CreateDirectoryA 9889->9890 9891 584fe 9890->9891 9892 75d80 lstrlen 9891->9892 9893 5859b CreateDirectoryA 9892->9893 9895 585ff 9893->9895 9896 831e0 2 API calls 9895->9896 9897 5865d 9896->9897 9898 831e0 2 API calls 9897->9898 9899 58712 9898->9899 9900 5a430 2 API calls 9899->9900 9901 58726 9900->9901 9902 77870 9 API calls 9901->9902 9903 58742 9902->9903 9904 5a430 2 API calls 9903->9904 9905 5875e 9904->9905 9906 570d0 5 API calls 9905->9906 9907 5878b 9906->9907 9908 590cb 9907->9908 9910 5883d 9907->9910 9911 587ad 9907->9911 9909 75d80 lstrlen 9908->9909 9912 590e1 SetFileAttributesA 9909->9912 9913 831e0 2 API calls 9910->9913 9914 831e0 2 API calls 9911->9914 9922 5912f 9912->9922 9916 58861 9913->9916 9915 587c3 9914->9915 9917 70cf0 wvsprintfA 9915->9917 9918 70cf0 wvsprintfA 9916->9918 9919 587fb 9917->9919 9920 5887f 9918->9920 9921 5a430 2 API calls 9919->9921 9923 5a430 2 API calls 9920->9923 9924 5882c 9921->9924 9922->9638 9923->9924 9925 588ea 9924->9925 9926 5894c CreateDirectoryA 9925->9926 9927 5898b 9926->9927 9928 75d80 lstrlen 9927->9928 9929 589ca CreateDirectoryA 9928->9929 9931 58a46 9929->9931 9932 831e0 2 API calls 9931->9932 9933 58a70 9932->9933 9934 831e0 2 API calls 9933->9934 9935 58ae6 9934->9935 9936 5a430 2 API calls 9935->9936 9937 58b6e 9936->9937 9938 77870 9 API calls 9937->9938 9939 58ba5 9938->9939 9940 5a430 2 API calls 9939->9940 9941 58bb9 9940->9941 9942 570d0 5 API calls 9941->9942 9943 58bef 9942->9943 9944 58c22 GetTempPathA 9943->9944 9966 59012 9943->9966 10280 72260 lstrlen 9944->10280 9946 58c52 9947 75d80 lstrlen 9946->9947 9948 58dd8 CreateDirectoryA 9947->9948 9949 831e0 2 API calls 9948->9949 9950 58e12 9949->9950 9951 831e0 2 API calls 9950->9951 9952 58e5b 9951->9952 9953 5a430 2 API calls 9952->9953 9954 58e91 9953->9954 9955 77870 9 API calls 9954->9955 9956 58eb1 9955->9956 9957 5a430 2 API calls 9956->9957 9958 58ed0 9957->9958 9959 570d0 5 API calls 9958->9959 9960 58f1d 9959->9960 9961 58f28 GetTempPathA 9960->9961 9960->9966 9962 58f68 9961->9962 9963 831e0 2 API calls 9962->9963 9964 58fdd 9963->9964 9965 5a430 2 API calls 9964->9965 9965->9966 9966->9908 9968 75dc3 9967->9968 9969 575a0 lstrlen 9968->9969 9970 75de1 9969->9970 9972 75e4a 9970->9972 10319 72260 lstrlen 9970->10319 9972->9673 9975 7029f CreateToolhelp32Snapshot 9973->9975 9976 70392 Process32First 9975->9976 9979 705c8 9975->9979 9978 705a0 CloseHandle 9976->9978 9981 70405 9976->9981 9978->9979 9979->9694 9980 78a10 lstrlen 9980->9981 9981->9980 9982 7048c Process32Next 9981->9982 9983 704f1 9981->9983 9982->9981 9982->9983 9983->9978 9985 74a37 GetFileTime 9984->9985 9986 74a25 9984->9986 9987 74a83 __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z 9985->9987 9988 74a58 CloseHandle 9985->9988 9986->9694 9989 74aca GetFileSize CloseHandle 9987->9989 9988->9694 9990 74b6e 9989->9990 9990->9694 9992 57b0d __aulldiv 9991->9992 9992->9694 9994 52079 9993->9994 9995 52443 9994->9995 9996 52151 Process32First 9994->9996 9995->9718 9997 523de 9996->9997 10004 5217b 9996->10004 9998 52427 CloseHandle 9997->9998 9999 52406 9997->9999 9998->9995 9999->9998 10000 78a10 lstrlen 10000->10004 10001 5236a Process32Next 10001->9997 10001->10004 10002 5223a OpenProcess 10002->10004 10003 522d6 TerminateProcess 10005 52306 CloseHandle 10003->10005 10004->10000 10004->10001 10004->10002 10004->10003 10005->10004 10008 65f1a 10007->10008 10009 65f9b CreateProcessA 10008->10009 10010 66035 CloseHandle CloseHandle 10009->10010 10011 66090 10009->10011 10010->9754 10011->9754 10320 5a640 10012->10320 10014 5c9ca ExitProcess 10322 72260 lstrlen 10015->10322 10017 53ebd 10017->9651 10018->9656 10020 78a40 lstrlen 10019->10020 10022 78aa4 10020->10022 10022->9661 10024 71c9b 10023->10024 10323 5b1d0 10024->10323 10027 65eb0 3 API calls 10028 71d10 10027->10028 10028->9688 10030 53778 10029->10030 10039 53b0c 10029->10039 10365 72260 lstrlen 10030->10365 10033 53911 10035 831e0 2 API calls 10033->10035 10034 5385d Sleep 10034->10033 10036 5393c 10035->10036 10037 5a430 2 API calls 10036->10037 10038 5397e FindFirstFileA 10037->10038 10038->10039 10041 539c2 10038->10041 10039->9697 10040 53ab2 DeleteFileA FindNextFileA 10040->10041 10042 53adf FindClose 10040->10042 10041->10040 10042->10039 10043->9708 10045 6578d 10044->10045 10046 75d80 lstrlen 10045->10046 10047 65893 10046->10047 10048 831e0 2 API calls 10047->10048 10049 658c3 10048->10049 10050 5a430 2 API calls 10049->10050 10051 658ff CreateFileA 10050->10051 10052 65951 10051->10052 10052->9676 10054 6097c 10053->10054 10055 60af9 GetComputerNameA 10054->10055 10056 60bf1 10055->10056 10057 60b4b 10055->10057 10059 831e0 2 API calls 10056->10059 10058 831e0 2 API calls 10057->10058 10061 60b67 10058->10061 10060 60c80 10059->10060 10062 5a430 2 API calls 10060->10062 10064 5a430 2 API calls 10061->10064 10063 60cbd 10062->10063 10065 77870 9 API calls 10063->10065 10064->10056 10066 60cf7 10065->10066 10366 57a50 10066->10366 10068 60d0b 10369 836d0 10068->10369 10070 60e0a 10409 72260 lstrlen 10070->10409 10072 60e9c 10410 5fdf0 10072->10410 10076 60ef4 10077 57a50 8 API calls 10076->10077 10078 60f21 10077->10078 10079 5fdf0 9 API calls 10078->10079 10080 60fa9 10079->10080 10081 5c3e0 8 API calls 10080->10081 10082 60fb8 10081->10082 10083 57a50 8 API calls 10082->10083 10084 61009 10083->10084 10085 5fdf0 9 API calls 10084->10085 10086 6102e 10085->10086 10087 5c3e0 8 API calls 10086->10087 10088 6103d 10087->10088 10089 57a50 8 API calls 10088->10089 10090 61072 10089->10090 10091 5fdf0 9 API calls 10090->10091 10092 610b1 10091->10092 10093 5c3e0 8 API calls 10092->10093 10094 610bd 10093->10094 10095 57a50 8 API calls 10094->10095 10096 610ea 10095->10096 10097 5fdf0 9 API calls 10096->10097 10098 6112e 10097->10098 10099 5c3e0 8 API calls 10098->10099 10100 6113d 10099->10100 10101 57a50 8 API calls 10100->10101 10102 611c0 10101->10102 10103 831e0 2 API calls 10102->10103 10104 611f1 10103->10104 10105 5fdf0 9 API calls 10104->10105 10106 6120c 10105->10106 10107 5c3e0 8 API calls 10106->10107 10108 6121b 10107->10108 10109 5a430 2 API calls 10108->10109 10110 61255 10109->10110 10111 57a50 8 API calls 10110->10111 10112 6127e 10111->10112 10113 5fdf0 9 API calls 10112->10113 10114 612e1 10113->10114 10115 5c3e0 8 API calls 10114->10115 10116 612ed 10115->10116 10117 57a50 8 API calls 10116->10117 10118 61351 10117->10118 10119 5fdf0 9 API calls 10118->10119 10120 61388 10119->10120 10121 5c3e0 8 API calls 10120->10121 10122 61397 10121->10122 10123 57a50 8 API calls 10122->10123 10124 613de 10123->10124 10417 81d80 10124->10417 10128 61443 10129 5fdf0 9 API calls 10128->10129 10130 6144f 10129->10130 10131 5c3e0 8 API calls 10130->10131 10132 6145e 10131->10132 10133 57a50 8 API calls 10132->10133 10134 61483 10133->10134 10135 5fdf0 9 API calls 10134->10135 10136 614dc 10135->10136 10137 5c3e0 8 API calls 10136->10137 10138 614eb 10137->10138 10426 5d1f0 10138->10426 10140 61519 10453 72070 10140->10453 10142 6152e 10456 660d0 10142->10456 10144 6154f 10460 82b00 10144->10460 10146 615b2 10468 5b670 10146->10468 10235 756be 10234->10235 10236 756e8 GetProcessHeap RtlAllocateHeap 10234->10236 10235->10236 10236->9850 10237->9854 10239 71531 10238->10239 10240 7153b AllocateAndInitializeSid 10238->10240 10239->10240 10241 715b2 10240->10241 10242 71623 CheckTokenMembership 10241->10242 10243 580ae 10241->10243 10242->10243 10244 828c0 10243->10244 10245 831e0 2 API calls 10244->10245 10246 82925 GetProcAddress 10245->10246 10247 5a430 2 API calls 10246->10247 10248 8297e 10247->10248 10249 829a3 GetCurrentProcess 10248->10249 10250 580c4 10248->10250 10249->10250 10250->9871 10251 5f420 GetWindowsDirectoryA 10250->10251 10252 5f469 10251->10252 10253 831e0 2 API calls 10252->10253 10258 5f564 10252->10258 10254 5f507 10253->10254 10255 5a430 2 API calls 10254->10255 10256 5f548 10255->10256 10281 72260 lstrlen 10256->10281 10258->9875 10260 778ae 10259->10260 10282 76d90 10260->10282 10264 570dd 10263->10264 10265 78570 WaitForSingleObject 10264->10265 10266 5714e 10265->10266 10267 571d0 CreateFileA 10266->10267 10268 5716d 10266->10268 10269 57221 10267->10269 10275 572ad 10267->10275 10270 72290 ReleaseMutex 10268->10270 10271 72290 ReleaseMutex 10269->10271 10272 571b3 10270->10272 10273 5724a 10271->10273 10272->9885 10273->9885 10274 573ea WriteFile 10274->10275 10275->10274 10276 5748e CloseHandle 10275->10276 10315 72290 10276->10315 10280->9946 10281->10258 10283 76dae 10282->10283 10288 72260 lstrlen 10283->10288 10285 76e21 10289 6fd30 10285->10289 10287 58358 10287->9879 10288->10285 10292 77bb0 10289->10292 10291 6fd52 10291->10287 10293 77bd9 10292->10293 10295 77be0 10293->10295 10297 5df30 10293->10297 10295->10291 10296 77c49 10296->10291 10298 5df62 10297->10298 10299 5df78 10298->10299 10301 6f910 10298->10301 10299->10296 10302 6f930 10301->10302 10303 6faaf 10302->10303 10305 6fa17 10302->10305 10307 6fa98 10302->10307 10311 73790 10303->10311 10306 756a0 2 API calls 10305->10306 10308 6fa27 10306->10308 10307->10299 10310 859b0 GetProcessHeap RtlFreeHeap 10308->10310 10310->10307 10312 737b1 10311->10312 10313 7382c GetProcessHeap HeapAlloc 10312->10313 10314 7380c GetProcessHeap RtlReAllocateHeap 10312->10314 10313->10307 10314->10307 10316 722ad ReleaseMutex 10315->10316 10318 57551 10316->10318 10318->9885 10319->9972 10321 5a652 10320->10321 10321->10014 10322->10017 10324 5b1fa 10323->10324 10325 5b2dc CreateFileA 10324->10325 10326 5b313 ReadFile CloseHandle 10325->10326 10342 5b5e3 10325->10342 10351 5b9f0 10326->10351 10329 5b367 GetTickCount 10353 5c640 10329->10353 10332 5b389 10357 72260 lstrlen 10332->10357 10334 5b3b9 10335 831e0 2 API calls 10334->10335 10336 5b415 10335->10336 10337 5a430 2 API calls 10336->10337 10338 5b488 10337->10338 10339 5b53e CreateFileA 10338->10339 10341 831e0 2 API calls 10338->10341 10340 5b57b 10339->10340 10340->10342 10343 5b592 WriteFile CloseHandle 10340->10343 10344 5b4be 10341->10344 10359 66c10 10342->10359 10343->10342 10358 72260 lstrlen 10344->10358 10346 5b4db 10347 70cf0 wvsprintfA 10346->10347 10348 5b4e6 10347->10348 10349 5a430 2 API calls 10348->10349 10350 5b4f8 10349->10350 10350->10339 10352 5ba19 10351->10352 10352->10329 10354 5c65d 10353->10354 10363 72260 lstrlen 10354->10363 10356 5c67c 10356->10332 10357->10334 10358->10346 10360 82a80 10359->10360 10361 5b60a 10360->10361 10364 859b0 GetProcessHeap RtlFreeHeap 10360->10364 10361->10027 10363->10356 10364->10361 10365->10034 10367 660d0 8 API calls 10366->10367 10368 57a7b 10367->10368 10368->10068 10370 836f6 10369->10370 10371 831e0 2 API calls 10370->10371 10372 838c3 10371->10372 10373 5a430 2 API calls 10372->10373 10374 8392e GetProcessHeap 10373->10374 10376 8396a 10374->10376 10375 83986 10375->10070 10376->10375 10377 831e0 2 API calls 10376->10377 10378 839f7 LoadLibraryA 10377->10378 10379 5a430 2 API calls 10378->10379 10381 83a30 10379->10381 10380 83a4f 10380->10070 10381->10380 10382 831e0 2 API calls 10381->10382 10383 83ac7 GetProcAddress 10382->10383 10384 5a430 2 API calls 10383->10384 10385 83b14 10384->10385 10386 83b8d HeapAlloc 10385->10386 10387 83b2e FreeLibrary 10385->10387 10390 83c16 10386->10390 10388 83b70 10387->10388 10388->10070 10391 83c2c FreeLibrary 10390->10391 10392 83c63 10390->10392 10391->10070 10393 83e5c 10392->10393 10394 83d07 HeapFree 10392->10394 10398 831e0 2 API calls 10393->10398 10408 8419a 10393->10408 10395 83d8d HeapAlloc 10394->10395 10396 83d73 10394->10396 10397 83dc9 10395->10397 10396->10395 10397->10393 10399 83e00 FreeLibrary 10397->10399 10400 83f22 10398->10400 10401 83e2e 10399->10401 10403 5a430 2 API calls 10400->10403 10401->10070 10402 8449e HeapFree FreeLibrary 10402->10070 10404 83f62 10403->10404 10405 831e0 2 API calls 10404->10405 10404->10408 10406 841b5 10405->10406 10407 5a430 2 API calls 10406->10407 10407->10408 10408->10402 10409->10072 10472 74c80 10410->10472 10413 5c3e0 10414 5c3f8 10413->10414 10415 660d0 8 API calls 10414->10415 10416 5c406 10415->10416 10416->10076 10418 81da8 10417->10418 10419 831e0 2 API calls 10418->10419 10420 81dcc 10419->10420 10421 5a430 2 API calls 10420->10421 10422 61419 10421->10422 10423 78000 10422->10423 10479 72260 lstrlen 10423->10479 10425 7802b 10425->10128 10427 5d22c 10426->10427 10428 831e0 2 API calls 10427->10428 10429 5d2cb 10428->10429 10430 831e0 2 API calls 10429->10430 10431 5d2ec 10430->10431 10432 831e0 2 API calls 10431->10432 10433 5d322 10432->10433 10434 5a430 2 API calls 10433->10434 10435 5d33e 10434->10435 10436 831e0 2 API calls 10435->10436 10437 5d372 10436->10437 10438 5a430 2 API calls 10437->10438 10439 5d395 10438->10439 10440 5a430 2 API calls 10439->10440 10442 5d406 10440->10442 10441 5a430 2 API calls 10444 5ddda 10441->10444 10443 5d87c 10442->10443 10447 5c2d0 9 API calls 10442->10447 10480 71a50 10442->10480 10446 5dd9a 10443->10446 10448 71a50 8 API calls 10443->10448 10449 5c2d0 9 API calls 10443->10449 10450 5dc6c 10443->10450 10444->10140 10446->10441 10447->10442 10448->10443 10449->10443 10450->10446 10451 71a50 8 API calls 10450->10451 10483 5c2d0 10450->10483 10451->10450 10454 77bb0 8 API calls 10453->10454 10455 72077 10454->10455 10455->10142 10457 660f1 10456->10457 10458 77bb0 8 API calls 10457->10458 10459 66113 10458->10459 10459->10144 10461 82b1b 10460->10461 10494 845e0 10461->10494 10463 82b5d 10464 660d0 8 API calls 10463->10464 10467 82c5f 10463->10467 10465 82c47 10464->10465 10466 66c10 2 API calls 10465->10466 10466->10467 10467->10146 10469 77370 10468->10469 10518 776e0 10469->10518 10473 74c8c 10472->10473 10478 72260 lstrlen 10473->10478 10475 74d63 10476 6fd30 8 API calls 10475->10476 10477 5fdff 10476->10477 10477->10413 10478->10475 10479->10425 10489 5c8b0 10480->10489 10482 71a5e 10482->10442 10484 781b0 10483->10484 10493 72260 lstrlen 10484->10493 10486 78209 10487 660d0 8 API calls 10486->10487 10488 78215 10487->10488 10488->10450 10490 5c8cf 10489->10490 10491 77bb0 8 API calls 10490->10491 10492 5c8da 10491->10492 10492->10482 10493->10486 10499 5e370 10494->10499 10496 845f2 10497 8463b 10496->10497 10503 52510 10496->10503 10497->10463 10500 5e395 10499->10500 10502 5e3d7 10499->10502 10501 72070 8 API calls 10500->10501 10501->10502 10502->10496 10504 5252f 10503->10504 10505 78570 WaitForSingleObject 10504->10505 10506 5264e 10505->10506 10507 831e0 2 API calls 10506->10507 10515 527d1 10506->10515 10508 52703 GetProcAddress 10507->10508 10509 5275c 10508->10509 10510 831e0 2 API calls 10509->10510 10512 52777 10510->10512 10511 72290 ReleaseMutex 10513 52a8b 10511->10513 10514 5a430 2 API calls 10512->10514 10513->10496 10516 5278b GetProcAddress 10514->10516 10515->10511 10517 5a430 2 API calls 10516->10517 10517->10515 10519 7770e 10518->10519 10520 776ea 10518->10520 10522 859b0 GetProcessHeap RtlFreeHeap 10520->10522 10522->10519 10557 773ef 10556->10557 10558 5af89 10557->10558 10559 756a0 2 API calls 10557->10559 10558->9806 10562 5eeb0 10558->10562 10560 7745e 10559->10560 10560->10558 10566 859b0 GetProcessHeap RtlFreeHeap 10560->10566 10563 5eef7 10562->10563 10564 773c0 4 API calls 10563->10564 10565 5ef55 10564->10565 10565->9806 10566->10558 10567->9808 10569 65aad 10568->10569 10570 773c0 4 API calls 10569->10570 10571 65bb8 10569->10571 10570->10571 10571->9845 10572 7fe90 10571->10572 10584 80930 10572->10584 10574 7fecd 10576 7ff9f 10574->10576 10578 7ff23 10574->10578 10626 56850 10574->10626 10576->9836 10578->10576 10636 5e4f0 10578->10636 10580 542b2 10579->10580 10581 542b8 10579->10581 10580->9837 10582 773c0 4 API calls 10581->10582 10583 5435d 10582->10583 10583->9837 10586 8099e 10584->10586 10585 809a5 10585->10574 10586->10585 10587 80ac1 10586->10587 10588 80a17 10586->10588 10589 54260 4 API calls 10587->10589 10590 80a5b 10588->10590 10593 5eeb0 4 API calls 10588->10593 10592 80b0d 10589->10592 10591 80a99 10590->10591 10594 54260 4 API calls 10590->10594 10595 80a8c 10590->10595 10591->10574 10592->10595 10597 54260 4 API calls 10592->10597 10593->10590 10594->10595 10595->10591 10596 5e980 2 API calls 10595->10596 10598 81a37 10596->10598 10599 80b2e 10597->10599 10598->10574 10599->10595 10600 773c0 4 API calls 10599->10600 10601 80b6a 10600->10601 10601->10595 10602 5eeb0 4 API calls 10601->10602 10603 80b8b 10602->10603 10603->10595 10604 773c0 4 API calls 10603->10604 10605 80bb3 10604->10605 10605->10595 10606 773c0 4 API calls 10605->10606 10607 80bfa 10606->10607 10607->10595 10608 65a60 4 API calls 10607->10608 10610 80cc9 10607->10610 10609 80c94 10608->10609 10609->10595 10611 65a60 4 API calls 10609->10611 10610->10595 10612 65a60 4 API calls 10610->10612 10611->10610 10615 80ddb 10612->10615 10613 80eaa 10613->10595 10616 817b9 10613->10616 10618 5eeb0 GetProcessHeap RtlAllocateHeap GetProcessHeap RtlFreeHeap 10613->10618 10621 566a0 GetProcessHeap RtlAllocateHeap GetProcessHeap RtlFreeHeap 10613->10621 10622 65a60 GetProcessHeap RtlAllocateHeap GetProcessHeap RtlFreeHeap 10613->10622 10623 5e4f0 4 API calls 10613->10623 10624 54260 4 API calls 10613->10624 10625 56850 4 API calls 10613->10625 10614 5e4f0 4 API calls 10614->10615 10615->10613 10615->10614 10617 8183c 10616->10617 10619 54260 4 API calls 10616->10619 10617->10595 10620 54260 4 API calls 10617->10620 10618->10613 10619->10617 10620->10595 10621->10613 10622->10613 10623->10613 10624->10613 10625->10613 10627 56887 10626->10627 10628 56a3f 10627->10628 10629 568a1 10627->10629 10654 75710 10628->10654 10631 56982 10629->10631 10632 568e9 10629->10632 10634 60420 4 API calls 10631->10634 10645 60420 10632->10645 10635 5690c 10634->10635 10635->10574 10637 5e67f 10636->10637 10639 5e542 10636->10639 10638 75710 4 API calls 10637->10638 10643 5e591 10638->10643 10640 5e57c 10639->10640 10642 5e5e5 10639->10642 10641 60420 4 API calls 10640->10641 10641->10643 10644 60420 4 API calls 10642->10644 10643->10578 10644->10643 10647 60464 10645->10647 10646 6046b 10646->10635 10647->10646 10648 60502 10647->10648 10649 54260 4 API calls 10647->10649 10650 54260 4 API calls 10648->10650 10651 60566 10648->10651 10649->10648 10650->10651 10652 5e980 2 API calls 10651->10652 10653 6061a 10652->10653 10653->10635 10655 75753 10654->10655 10656 54260 4 API calls 10655->10656 10657 7582b 10655->10657 10656->10657 10658 773c0 4 API calls 10657->10658 10659 75aa8 10657->10659 10660 7587c 10658->10660 10659->10635 10660->10659 10661 773c0 4 API calls 10660->10661 10661->10660 10980 55b09 10981 55b10 10980->10981 10983 55bc3 10981->10983 10984 802f0 10981->10984 10985 80378 10984->10985 10986 831e0 2 API calls 10985->10986 10987 804cc 10986->10987 10987->10987 10988 5a430 2 API calls 10987->10988 10989 808a5 10988->10989 10989->10981 10675 80e07 10677 80e10 10675->10677 10676 5e4f0 4 API calls 10676->10677 10677->10676 10684 80eaa 10677->10684 10678 817b9 10679 54260 4 API calls 10678->10679 10682 8183c 10678->10682 10679->10682 10680 5e980 2 API calls 10681 81a37 10680->10681 10683 54260 4 API calls 10682->10683 10685 81949 10682->10685 10683->10685 10684->10678 10684->10685 10686 5eeb0 GetProcessHeap RtlAllocateHeap GetProcessHeap RtlFreeHeap 10684->10686 10687 566a0 GetProcessHeap RtlAllocateHeap GetProcessHeap RtlFreeHeap 10684->10687 10688 65a60 GetProcessHeap RtlAllocateHeap GetProcessHeap RtlFreeHeap 10684->10688 10689 5e4f0 4 API calls 10684->10689 10690 54260 4 API calls 10684->10690 10691 56850 4 API calls 10684->10691 10685->10680 10686->10684 10687->10684 10688->10684 10689->10684 10690->10684 10691->10684 10997 6d716 10998 6d75a 10997->10998 10999 6e3a7 10998->10999 11000 6e35f 10998->11000 11012 6e1ef 10998->11012 11002 6e4f3 10999->11002 11003 6e3b0 10999->11003 11001 70cf0 wvsprintfA 11000->11001 11001->11012 11004 6e593 11002->11004 11006 6e50e 11002->11006 11005 6e441 11003->11005 11007 6e3dd 11003->11007 11009 70cf0 wvsprintfA 11004->11009 11008 70cf0 wvsprintfA 11005->11008 11011 70cf0 wvsprintfA 11006->11011 11006->11012 11010 70cf0 wvsprintfA 11007->11010 11007->11012 11008->11012 11009->11012 11010->11012 11011->11012 10692 5e210 10693 5e24d 10692->10693 10694 72070 8 API calls 10693->10694 10695 5e287 10694->10695 10700 5f090 10695->10700 10697 5e2bc 10698 72070 8 API calls 10697->10698 10699 5e34b 10698->10699 10701 5f0a1 10700->10701 10704 591b0 10701->10704 10705 591c4 10704->10705 10706 6fd30 8 API calls 10705->10706 10707 591d0 10706->10707 10707->10697 11013 53710 11018 77370 11013->11018 11019 776e0 2 API calls 11018->11019 11020 7737e 11019->11020 10708 77610 10713 5e490 10708->10713 10722 6fbe0 10713->10722 10723 5e370 8 API calls 10722->10723 10724 6fc0c 10723->10724 11021 75510 11022 75546 11021->11022 11023 5b890 2 API calls 11022->11023 11024 7554b 11023->11024 11025 76be0 3 API calls 11024->11025 11026 75560 11025->11026 11027 75605 ExitProcess 11026->11027 11168 70190 11169 701b3 11168->11169 11170 51530 8 API calls 11169->11170 11171 701e5 11170->11171 11172 51380 8 API calls 11171->11172 11173 70204 11172->11173 11028 80110 11029 845e0 12 API calls 11028->11029 11030 8012d 11029->11030 11031 660d0 8 API calls 11030->11031 11032 801b2 11031->11032 11033 82d10 11034 82d24 11033->11034 11036 82d46 11033->11036 11035 82d70 11036->11035 11037 82e65 ReadFile 11036->11037 11038 82ea3 11037->11038 11039 84510 11040 5b670 2 API calls 11039->11040 11042 8451b 11040->11042 11041 84527 11042->11041 11043 608b0 2 API calls 11042->11043 11043->11041 11044 51f19 11045 51f20 11044->11045 11046 661f0 8 API calls 11045->11046 11047 51f8d 11045->11047 11046->11045 11048 5f220 2 API calls 11047->11048 11049 51f9f 11048->11049 11050 5db18 11052 5db20 11050->11052 11051 71a50 8 API calls 11051->11052 11052->11051 11053 5c2d0 9 API calls 11052->11053 11056 5dc6c 11052->11056 11053->11052 11054 5dd9a 11055 5a430 2 API calls 11054->11055 11059 5ddda 11055->11059 11056->11054 11057 71a50 8 API calls 11056->11057 11058 5c2d0 9 API calls 11056->11058 11057->11056 11058->11056 10836 516a5 ExitProcess 10725 59220 10728 86470 10725->10728 10727 5922f 10729 8647e 10728->10729 10732 72260 lstrlen 10729->10732 10731 86489 10731->10727 10732->10731 10837 55ea0 10840 72260 lstrlen 10837->10840 10839 55ecf 10840->10839 11194 813b9 11204 80f06 11194->11204 11195 5eeb0 GetProcessHeap RtlAllocateHeap GetProcessHeap RtlFreeHeap 11195->11204 11196 5e980 2 API calls 11197 81a37 11196->11197 11198 566a0 GetProcessHeap RtlAllocateHeap GetProcessHeap RtlFreeHeap 11198->11204 11199 5e4f0 4 API calls 11199->11204 11200 54260 4 API calls 11200->11204 11201 65a60 GetProcessHeap RtlAllocateHeap GetProcessHeap RtlFreeHeap 11201->11204 11202 817b9 11205 54260 4 API calls 11202->11205 11206 8183c 11202->11206 11203 56850 4 API calls 11203->11204 11204->11195 11204->11198 11204->11199 11204->11200 11204->11201 11204->11202 11204->11203 11208 81949 11204->11208 11205->11206 11207 54260 4 API calls 11206->11207 11206->11208 11207->11208 11208->11196 9553 75535 9554 75546 9553->9554 9561 5b890 9554->9561 9556 7554b 9566 76be0 GetStdHandle 9556->9566 9558 75560 9559 755f4 9558->9559 9560 75605 ExitProcess 9559->9560 9562 5b8c1 9561->9562 9563 5b8df 9561->9563 9571 81d20 9562->9571 9563->9562 9565 5b910 9565->9556 9567 76c3f 9566->9567 9568 76c49 GetStdHandle 9566->9568 9567->9568 9569 76c82 GetStdHandle 9568->9569 9569->9558 9572 81d4b GetProcessHeap HeapAlloc 9571->9572 9573 81d3b 9571->9573 9572->9565 9573->9572 10745 51c30 10748 5fe60 10745->10748 10747 51c43 10749 5fe6b 10748->10749 10750 5df30 8 API calls 10749->10750 10751 5feee 10750->10751 10751->10747 10752 5bc30 10757 85b90 10752->10757 10755 5c3e0 8 API calls 10756 5bc72 10755->10756 10760 76a90 10757->10760 10759 5bc55 10759->10755 10761 76aa1 10760->10761 10762 5fe60 8 API calls 10761->10762 10763 76ab7 10762->10763 10763->10759 11213 70db0 11214 70ddc 11213->11214 11273 54fc0 11214->11273 11216 70eb8 11217 78830 4 API calls 11216->11217 11219 713af 11216->11219 11218 70f24 11217->11218 11220 831e0 2 API calls 11218->11220 11221 5b670 2 API calls 11219->11221 11222 70f6a 11220->11222 11223 71443 11221->11223 11224 77870 9 API calls 11222->11224 11225 70f8a 11224->11225 11226 5a430 2 API calls 11225->11226 11227 70fa6 11226->11227 11277 77250 11227->11277 11232 5c3e0 8 API calls 11233 70ff4 11232->11233 11234 5b670 2 API calls 11233->11234 11235 71007 11234->11235 11236 831e0 2 API calls 11235->11236 11237 71065 11236->11237 11238 5fdf0 9 API calls 11237->11238 11239 7107d 11238->11239 11240 5c3e0 8 API calls 11239->11240 11241 71089 11240->11241 11242 5a430 2 API calls 11241->11242 11243 710ab 11242->11243 11244 56e40 8 API calls 11243->11244 11245 710e3 11244->11245 11246 5c3e0 8 API calls 11245->11246 11247 710ec 11246->11247 11248 72510 8 API calls 11247->11248 11249 7112c 11248->11249 11283 76030 11249->11283 11251 7114f 11252 5d1f0 9 API calls 11251->11252 11253 71175 11252->11253 11340 55ee0 11253->11340 11256 831e0 2 API calls 11257 711b7 11256->11257 11258 5fdf0 9 API calls 11257->11258 11259 711e1 11258->11259 11260 5c3e0 8 API calls 11259->11260 11261 711ed 11260->11261 11262 5a430 2 API calls 11261->11262 11263 7122b 11262->11263 11264 660d0 8 API calls 11263->11264 11265 71297 11264->11265 11266 72070 8 API calls 11265->11266 11267 7131b 11266->11267 11268 831e0 2 API calls 11267->11268 11269 7133e 11268->11269 11344 66c30 11269->11344 11271 7137a 11272 5a430 2 API calls 11271->11272 11272->11219 11274 660d0 8 API calls 11273->11274 11275 54fe0 SetEvent 11274->11275 11275->11216 11448 73f00 11277->11448 11280 59170 11281 76a90 8 API calls 11280->11281 11282 5917f 11281->11282 11282->11232 11284 7606c 11283->11284 11285 831e0 2 API calls 11284->11285 11290 76195 11284->11290 11286 7615d 11285->11286 11287 77870 9 API calls 11286->11287 11288 76183 11287->11288 11289 5a430 2 API calls 11288->11289 11289->11290 11291 76297 11290->11291 11292 76369 11290->11292 11293 831e0 2 API calls 11291->11293 11295 831e0 2 API calls 11292->11295 11294 762b5 11293->11294 11296 77870 9 API calls 11294->11296 11300 763bf 11295->11300 11297 762cc 11296->11297 11298 5a430 2 API calls 11297->11298 11299 762de 11298->11299 11299->11251 11456 73860 11300->11456 11302 7641b 11303 5a430 2 API calls 11302->11303 11304 76484 11303->11304 11305 764c3 11304->11305 11306 76562 11304->11306 11307 831e0 2 API calls 11305->11307 11469 7fff0 GetModuleFileNameA 11306->11469 11309 76505 11307->11309 11311 77870 9 API calls 11309->11311 11314 76534 11311->11314 11312 76613 11316 575a0 lstrlen 11312->11316 11313 765aa 11315 831e0 2 API calls 11313->11315 11317 5a430 2 API calls 11314->11317 11318 765c0 11315->11318 11319 76647 11316->11319 11320 7654e 11317->11320 11321 77870 9 API calls 11318->11321 11471 71a70 11319->11471 11320->11251 11323 765e7 11321->11323 11324 5a430 2 API calls 11323->11324 11327 765f9 11324->11327 11327->11251 11329 831e0 2 API calls 11330 766b7 11329->11330 11331 5a430 2 API calls 11330->11331 11332 76708 11331->11332 11479 72260 lstrlen 11332->11479 11334 76720 11335 570d0 5 API calls 11334->11335 11336 76756 11335->11336 11480 5ca00 11336->11480 11339 7684c 11339->11251 11341 55efd 11340->11341 11342 591b0 8 API calls 11341->11342 11343 55f3d 11342->11343 11343->11256 11345 66c76 11344->11345 11346 57a90 GetSystemTimeAsFileTime 11345->11346 11347 66e0e 11346->11347 11568 72260 lstrlen 11347->11568 11349 66eaf 11349->11271 11351 66e6e 11351->11349 11569 72260 lstrlen 11351->11569 11352 67015 11570 72260 lstrlen 11352->11570 11354 67023 11355 831e0 2 API calls 11354->11355 11433 67740 11354->11433 11356 670cb 11355->11356 11357 77870 9 API calls 11356->11357 11358 670fd 11357->11358 11359 5a430 2 API calls 11358->11359 11360 67119 11359->11360 11361 6736a 11360->11361 11363 831e0 2 API calls 11360->11363 11362 5fdf0 9 API calls 11361->11362 11364 673e2 11362->11364 11365 6719a 11363->11365 11366 5c3e0 8 API calls 11364->11366 11367 74c80 9 API calls 11365->11367 11368 673ee 11366->11368 11369 671b7 11367->11369 11370 831e0 2 API calls 11368->11370 11371 5b670 2 API calls 11369->11371 11372 67429 11370->11372 11373 671d5 11371->11373 11374 5fdf0 9 API calls 11372->11374 11377 5a430 2 API calls 11373->11377 11375 67441 11374->11375 11376 5c3e0 8 API calls 11375->11376 11378 6744d 11376->11378 11381 6724f 11377->11381 11379 5a430 2 API calls 11378->11379 11380 6748d 11379->11380 11382 5fdf0 9 API calls 11380->11382 11381->11361 11385 72510 8 API calls 11381->11385 11383 674ca 11382->11383 11384 5c3e0 8 API calls 11383->11384 11389 674d9 11384->11389 11386 67304 11385->11386 11387 831e0 2 API calls 11386->11387 11388 67324 11387->11388 11390 77870 9 API calls 11388->11390 11394 831e0 2 API calls 11389->11394 11431 6764e 11389->11431 11392 67348 11390->11392 11391 831e0 2 API calls 11393 6769c 11391->11393 11395 5a430 2 API calls 11392->11395 11396 5fdf0 9 API calls 11393->11396 11397 67534 11394->11397 11395->11361 11398 676be 11396->11398 11399 5fdf0 9 API calls 11397->11399 11400 5c3e0 8 API calls 11398->11400 11401 6755b 11399->11401 11403 676ca 11400->11403 11402 5c3e0 8 API calls 11401->11402 11404 6756a 11402->11404 11405 5a430 2 API calls 11403->11405 11407 831e0 2 API calls 11404->11407 11406 676ea 11405->11406 11408 6770c socket 11406->11408 11410 5c3e0 8 API calls 11406->11410 11409 6758b 11407->11409 11411 677b0 11408->11411 11408->11433 11412 5a430 2 API calls 11409->11412 11410->11408 11413 67805 gethostbyname 11411->11413 11414 677c2 setsockopt 11411->11414 11420 675aa 11412->11420 11416 6784a inet_ntoa inet_addr 11413->11416 11413->11433 11414->11413 11415 677fb 11414->11415 11415->11413 11417 67913 htons connect 11416->11417 11418 678b1 11416->11418 11419 67958 11417->11419 11422 67984 11417->11422 11418->11417 11419->11271 11421 70cf0 wvsprintfA 11420->11421 11423 67604 11421->11423 11424 679b3 send 11422->11424 11425 5a430 2 API calls 11423->11425 11430 679ed 11424->11430 11426 67620 11425->11426 11427 5fdf0 9 API calls 11426->11427 11428 6763f 11427->11428 11429 5c3e0 8 API calls 11428->11429 11429->11431 11432 72070 8 API calls 11430->11432 11430->11433 11431->11391 11447 67a89 11432->11447 11433->11271 11434 67afb recv 11435 67f76 closesocket 11434->11435 11434->11447 11437 67fbf 11435->11437 11437->11433 11438 72510 8 API calls 11437->11438 11438->11433 11439 6f910 8 API calls 11439->11447 11440 660d0 8 API calls 11440->11447 11441 831e0 GetProcessHeap RtlAllocateHeap 11441->11447 11442 74c80 9 API calls 11442->11447 11443 67f6c 11443->11435 11444 5a430 GetProcessHeap RtlFreeHeap 11444->11447 11446 5b670 GetProcessHeap RtlFreeHeap 11446->11447 11447->11434 11447->11435 11447->11439 11447->11440 11447->11441 11447->11442 11447->11443 11447->11444 11447->11446 11571 81b00 11447->11571 11575 54400 11447->11575 11449 73f0b 11448->11449 11452 71e10 11449->11452 11453 71e2c 11452->11453 11454 591b0 8 API calls 11453->11454 11455 70fdf 11454->11455 11455->11280 11458 73880 11456->11458 11457 7397c 11457->11302 11458->11457 11459 5af10 4 API calls 11458->11459 11460 73a12 11459->11460 11461 5eeb0 4 API calls 11460->11461 11463 73a5a 11460->11463 11462 73a9b 11461->11462 11462->11463 11506 75b30 11462->11506 11525 82fb0 11463->11525 11465 73b5d 11513 72f30 11465->11513 11470 765a3 11469->11470 11470->11312 11470->11313 11472 71aa2 11471->11472 11473 71b87 11472->11473 11474 52510 8 API calls 11472->11474 11475 83010 11473->11475 11474->11473 11476 76699 11475->11476 11478 8305b 11475->11478 11476->11329 11477 71a70 8 API calls 11477->11478 11478->11476 11478->11477 11479->11334 11481 5ca1d 11480->11481 11482 5cb28 CreatePipe 11481->11482 11483 5cba9 SetHandleInformation 11482->11483 11486 5cb94 11482->11486 11484 5cc1e CreatePipe 11483->11484 11485 5cbf9 11483->11485 11487 5cc36 11484->11487 11488 5cc4d SetHandleInformation 11484->11488 11485->11484 11490 72070 8 API calls 11486->11490 11491 5cf1f DeleteFileA 11486->11491 11489 5ce9c CloseHandle 11487->11489 11494 5ccca 11488->11494 11489->11486 11492 5ceb4 CloseHandle 11489->11492 11490->11491 11491->11339 11492->11486 11495 5cdf2 CreateProcessA 11494->11495 11496 5ce32 CloseHandle 11495->11496 11497 5cf4e WriteFile 11495->11497 11499 5ce62 11496->11499 11500 5ce6c CloseHandle 11496->11500 11501 5cfbb CloseHandle CloseHandle 11497->11501 11502 5cfaa 11497->11502 11499->11500 11500->11489 11503 5d01e 11501->11503 11502->11501 11559 746f0 11503->11559 11528 53bc0 11506->11528 11510 75b8e 11541 7f790 11510->11541 11512 75bb0 11512->11465 11514 72f3d 11513->11514 11516 730f9 11514->11516 11547 6bfc0 11514->11547 11516->11463 11517 73039 11517->11516 11518 831e0 2 API calls 11517->11518 11524 73320 11517->11524 11519 732c5 11518->11519 11521 732e3 11519->11521 11523 5a430 2 API calls 11519->11523 11520 831e0 2 API calls 11520->11521 11521->11463 11522 734af 11522->11463 11523->11524 11524->11520 11524->11522 11526 5e980 2 API calls 11525->11526 11527 73c6c 11526->11527 11527->11302 11529 53be5 11528->11529 11530 831e0 2 API calls 11529->11530 11531 53c6e 11530->11531 11532 5a430 2 API calls 11531->11532 11533 53ca0 11532->11533 11534 55800 11533->11534 11536 55826 11534->11536 11535 55d00 11535->11510 11536->11535 11537 55a72 11536->11537 11540 802f0 4 API calls 11536->11540 11538 802f0 4 API calls 11537->11538 11539 55bc3 11537->11539 11538->11537 11539->11510 11540->11537 11542 7f817 11541->11542 11543 55800 4 API calls 11542->11543 11544 7fbac 11543->11544 11545 55800 4 API calls 11544->11545 11546 7fbc2 11545->11546 11546->11512 11548 6bffb 11547->11548 11549 5af10 4 API calls 11548->11549 11551 6c050 11549->11551 11550 5e980 2 API calls 11556 6c1c3 11550->11556 11552 6c0d6 11551->11552 11553 6c09e 11551->11553 11558 6c129 11551->11558 11554 848f0 4 API calls 11552->11554 11555 5e980 2 API calls 11553->11555 11554->11558 11557 6c0b6 11555->11557 11556->11517 11557->11517 11558->11550 11560 746fd 11559->11560 11561 72070 8 API calls 11560->11561 11562 74759 ReadFile 11561->11562 11564 5d063 WaitForSingleObject CloseHandle CloseHandle 11562->11564 11565 747a4 11562->11565 11565->11564 11566 660d0 8 API calls 11565->11566 11567 747e4 ReadFile 11566->11567 11567->11564 11567->11565 11568->11351 11569->11352 11570->11354 11572 81b1f 11571->11572 11574 81b30 11571->11574 11573 57a90 GetSystemTimeAsFileTime 11572->11573 11573->11574 11574->11447 11576 54436 11575->11576 11577 831e0 2 API calls 11576->11577 11578 54470 11577->11578 11579 74c80 9 API calls 11578->11579 11580 54488 11579->11580 11581 5b670 2 API calls 11580->11581 11582 544a2 11581->11582 11583 5a430 2 API calls 11582->11583 11584 544b4 11583->11584 11585 544cd 11584->11585 11586 831e0 2 API calls 11584->11586 11585->11447 11587 544ee 11586->11587 11588 74c80 9 API calls 11587->11588 11589 54506 11588->11589 11590 5b670 2 API calls 11589->11590 11591 5451d 11590->11591 11592 5a430 2 API calls 11591->11592 11593 54538 11592->11593 11593->11447 10764 82030 10765 8203b 10764->10765 10768 57c20 10765->10768 10769 57c5c 10768->10769 10772 60640 10769->10772 10771 57ca2 10773 5df30 8 API calls 10772->10773 10774 6065c 10773->10774 10774->10771 11594 56bb9 11596 56bc0 11594->11596 11595 56c0d Sleep 11595->11596 11596->11595 11597 57a90 GetSystemTimeAsFileTime 11596->11597 11598 56c95 11596->11598 11597->11596 10775 5d446 10778 5d450 10775->10778 10776 5a430 2 API calls 10780 5ddda 10776->10780 10777 71a50 8 API calls 10777->10778 10778->10777 10779 5c2d0 9 API calls 10778->10779 10781 5d87c 10778->10781 10779->10778 10782 5dd9a 10781->10782 10783 71a50 8 API calls 10781->10783 10784 5c2d0 9 API calls 10781->10784 10785 5dc6c 10781->10785 10782->10776 10783->10781 10784->10781 10785->10782 10786 71a50 8 API calls 10785->10786 10787 5c2d0 9 API calls 10785->10787 10786->10785 10787->10785 10788 6d243 10789 6d250 10788->10789 10791 6d2eb 10789->10791 10792 72260 lstrlen 10789->10792 10792->10791 10841 540c0 10842 540dc 10841->10842 10843 56850 4 API calls 10842->10843 10844 541df 10843->10844 11075 51140 11076 51162 11075->11076 11080 51169 SetServiceStatus 11075->11080 11077 51180 11076->11077 11078 51219 SetServiceStatus SetEvent 11076->11078 11076->11080 11077->11078 11081 51356 11080->11081 11603 855c3 11605 855d0 11603->11605 11604 857da 11606 85809 11604->11606 11607 857fd 11604->11607 11605->11604 11610 5e980 2 API calls 11605->11610 11609 5e980 2 API calls 11606->11609 11608 5e980 2 API calls 11607->11608 11611 85804 11608->11611 11609->11611 11610->11605 10849 56ad0 10852 7ffd0 10849->10852 10853 86470 lstrlen 10852->10853 10854 56adf 10853->10854 10855 5bce1 10856 5bd0b 10855->10856 10857 73790 4 API calls 10856->10857 10858 5bdb3 10856->10858 10857->10858 10859 578e0 10860 57c20 8 API calls 10859->10860 10861 57905 10860->10861 10862 52ae0 10863 52b16 10862->10863 10864 84650 3 API calls 10863->10864 10865 52c4a 10864->10865 10866 53740 10 API calls 10865->10866 10867 52c7a 10866->10867 10868 75d80 lstrlen 10867->10868 10869 52ca0 10868->10869 10870 831e0 2 API calls 10869->10870 10871 52cbe 10870->10871 10872 5a430 2 API calls 10871->10872 10874 52d41 10872->10874 10873 57a90 GetSystemTimeAsFileTime 10873->10874 10874->10873 10875 72ba0 12 API calls 10874->10875 10876 72070 8 API calls 10874->10876 10879 70250 5 API calls 10874->10879 10881 65eb0 3 API calls 10874->10881 10882 831e0 GetProcessHeap RtlAllocateHeap 10874->10882 10883 77870 9 API calls 10874->10883 10884 5a430 GetProcessHeap RtlFreeHeap 10874->10884 10885 5c3e0 8 API calls 10874->10885 10886 57a50 8 API calls 10874->10886 10888 66c30 21 API calls 10874->10888 10889 82170 50 API calls 10874->10889 10890 51700 31 API calls 10874->10890 10891 78830 10874->10891 10903 56e40 10874->10903 10875->10874 10877 535ad Sleep 10876->10877 10909 51d60 10877->10909 10879->10874 10881->10874 10882->10874 10883->10874 10884->10874 10885->10874 10886->10874 10888->10874 10889->10874 10890->10874 10892 78853 10891->10892 10893 831e0 2 API calls 10892->10893 10894 788eb 10893->10894 10895 831e0 2 API calls 10894->10895 10896 7890e 10895->10896 10918 545c0 10896->10918 10899 5a430 2 API calls 10900 78983 10899->10900 10901 5a430 2 API calls 10900->10901 10902 789b5 10901->10902 10902->10874 10904 56e5a 10903->10904 10905 660d0 8 API calls 10904->10905 10908 57011 10904->10908 10906 56fbb 10905->10906 10907 66c10 2 API calls 10906->10907 10907->10908 10908->10874 10913 51d8c 10909->10913 10910 51f9f 10910->10874 10911 51e8f DeleteFileA 10911->10913 10912 51f8d 10934 5f220 10912->10934 10913->10910 10913->10911 10917 51ee9 10913->10917 10924 5f3c0 10913->10924 10917->10912 10930 661f0 10917->10930 10919 545e5 10918->10919 10920 831e0 2 API calls 10919->10920 10921 54a9d 10920->10921 10922 5a430 2 API calls 10921->10922 10923 54ac4 10922->10923 10923->10899 10925 5f3d2 10924->10925 10938 5bed0 10925->10938 10927 5f3e9 10942 54230 10927->10942 10931 66216 10930->10931 10932 6625c 10931->10932 10946 77970 10931->10946 10932->10917 10935 5f228 10934->10935 10936 776e0 2 API calls 10935->10936 10937 7737e 10936->10937 10939 5bf12 10938->10939 10940 6f910 8 API calls 10939->10940 10941 5bf1a 10940->10941 10941->10927 10943 5423e 10942->10943 10944 54250 10943->10944 10945 85b90 8 API calls 10943->10945 10944->10913 10945->10944 10949 75e80 10946->10949 10950 75ed2 10949->10950 10951 77730 8 API calls 10950->10951 10952 76026 10951->10952 10952->10932 11102 5bb60 11103 5bb88 11102->11103 11112 72260 lstrlen 11103->11112 11105 5bbc1 11106 6f910 8 API calls 11105->11106 11107 5bbd7 11106->11107 11108 5c2d0 9 API calls 11107->11108 11109 5bbe9 11108->11109 11113 51380 11109->11113 11112->11105 11114 5138e 11113->11114 11115 660d0 8 API calls 11114->11115 11116 5139c 11115->11116 11117 71760 11118 7176b 11117->11118 11119 71777 11118->11119 11120 608b0 2 API calls 11118->11120 11120->11119 10953 524ec 10954 524f5 10953->10954 10955 78570 WaitForSingleObject 10953->10955 10956 5c9b0 ExitProcess 10954->10956 10955->10954 10957 52509 10956->10957 11616 5c9ef 11617 5ca00 11616->11617 11618 5cb28 CreatePipe 11617->11618 11619 5cba9 SetHandleInformation 11618->11619 11628 5cb94 11618->11628 11620 5cc1e CreatePipe 11619->11620 11621 5cbf9 11619->11621 11622 5cc36 11620->11622 11623 5cc4d SetHandleInformation 11620->11623 11621->11620 11624 5ce9c CloseHandle 11622->11624 11630 5ccca 11623->11630 11627 5ceb4 CloseHandle 11624->11627 11624->11628 11625 72070 8 API calls 11626 5cf1f 11625->11626 11627->11628 11628->11625 11628->11626 11631 5cdf2 CreateProcessA 11630->11631 11632 5ce32 CloseHandle 11631->11632 11633 5cf4e WriteFile 11631->11633 11635 5ce62 11632->11635 11636 5ce6c CloseHandle 11632->11636 11637 5cfbb CloseHandle CloseHandle 11633->11637 11638 5cfaa 11633->11638 11635->11636 11636->11624 11639 5d01e 11637->11639 11638->11637 11640 746f0 10 API calls 11639->11640 11641 5d063 WaitForSingleObject CloseHandle CloseHandle 11640->11641 10800 72868 10803 72870 10800->10803 10801 728b2 ReadFile 10801->10803 10802 6f910 8 API calls 10802->10803 10803->10801 10803->10802 10804 72a7e CloseHandle 10803->10804 10805 660d0 8 API calls 10803->10805 10808 729c1 CloseHandle 10803->10808 10806 72abb 10804->10806 10805->10803 10807 72290 ReleaseMutex 10806->10807 10810 72ac6 10807->10810 10809 72290 ReleaseMutex 10808->10809 10811 729f1 10809->10811 11140 59770 11141 756a0 2 API calls 11140->11141 11142 5978e 11141->11142 11143 6b37d 11144 6b385 11143->11144 11146 7d0eb 132 API calls 11144->11146 11145 6bf02 11146->11145 10958 758f8 10961 75900 10958->10961 10959 75aa8 10960 773c0 4 API calls 10960->10961 10961->10959 10961->10960
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                • Part of subcall function 000859B0: GetProcessHeap.KERNEL32(00000000,00000000,?,0006FA98,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 000859C3
                                                                                                                                                                                                                • Part of subcall function 000859B0: RtlFreeHeap.NTDLL(00000000,?,0006FA98,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 000859CA
                                                                                                                                                                                                                • Part of subcall function 00084650: GetSystemTime.KERNEL32(00052C4A,00000001,?,?,00052C4A), ref: 0008473C
                                                                                                                                                                                                              • GetEnvironmentVariableA.KERNEL32(00000000,C:\Windows\system32\config\systemprofile,00000104), ref: 0007D651
                                                                                                                                                                                                              • CreateMutexA.KERNELBASE(00000000,00000000,00000000), ref: 0007D721
                                                                                                                                                                                                              • CreateMutexA.KERNELBASE(00000000,00000000,00000000), ref: 0007D76D
                                                                                                                                                                                                              • CreateMutexA.KERNEL32(00000000,00000000,00000000), ref: 0007D7A4
                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 0007D82E
                                                                                                                                                                                                              • Sleep.KERNEL32(00000D05), ref: 0007DE9B
                                                                                                                                                                                                              • Sleep.KERNELBASE(000003E8), ref: 0007E039
                                                                                                                                                                                                              • GetCommandLineA.KERNEL32 ref: 0007D9EB
                                                                                                                                                                                                                • Part of subcall function 0005C9B0: ExitProcess.KERNEL32 ref: 0005C9E8
                                                                                                                                                                                                                • Part of subcall function 00074990: CreateFileA.KERNELBASE(?,00000000,00000000,00000000,00000003,00000000,00000000), ref: 00074A04
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000003.00000002.2507406410.0000000000051000.00000020.00000001.01000000.00000007.sdmp, Offset: 00050000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507352496.0000000000050000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507547103.0000000000087000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.000000000008C000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.00000000000C1000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.00000000000D0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507780551.00000000000D2000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_50000_xmjofjnkdlv.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Create$Mutex$HeapProcessSleep$CommandCountEnvironmentExitFileFreeLineSystemTickTimeVariable
                                                                                                                                                                                                              • String ID: 1:VB$@`$C:\Windows\system32\config\systemprofile$P$Qt$[$U"Kd$l
                                                                                                                                                                                                              • API String ID: 2753435600-907779482
                                                                                                                                                                                                              • Opcode ID: 9003dc0f8189d6ab58d51024f9807f68e6237be314da6f841c022b77c161251a
                                                                                                                                                                                                              • Instruction ID: f2c723d0853a6c44305214c9017aced0a7e010bbde7ba91c4ecc2af5625a48b8
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9003dc0f8189d6ab58d51024f9807f68e6237be314da6f841c022b77c161251a
                                                                                                                                                                                                              • Instruction Fuzzy Hash: EA1357B1A01601DFF704EF24FD89AA63BB4FB94311B11821BD486972B6EB3D8990CF55

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 437 57fa0-57fec call 5f680 440 57fee 437->440 441 57ff8-58058 437->441 440->441 442 58072-580da GetVersionExA call 71510 call 828c0 441->442 443 5805a-5806c 441->443 448 58270-582c9 442->448 449 580e0-580f4 442->449 443->442 450 582e1-58370 call 831e0 call 77870 448->450 451 582cb-582db 448->451 452 580f6-58102 449->452 453 58108-58147 call 5f420 449->453 463 58384-583d0 call 5a430 call 86190 call 74c70 call 570d0 450->463 464 58372-5837e 450->464 451->450 452->453 459 5815d-58208 call 57650 CreateDirectoryA call 831e0 453->459 460 58149-58156 453->460 469 5820d-5826e call 57650 call 5a430 459->469 460->459 480 58443-584fc call 5f420 call 57650 CreateDirectoryA 463->480 481 583d2-58439 DeleteFileA RemoveDirectoryA 463->481 464->463 469->450 486 584fe 480->486 487 58508-58537 call 801f0 480->487 481->480 486->487 490 58539-58551 487->490 491 5855b-585bc call 75d80 487->491 490->491 494 585be 491->494 495 585c8-585fd CreateDirectoryA 491->495 494->495 496 5863f-5864b 495->496 497 585ff-5863d 495->497 498 58651-58678 call 831e0 496->498 497->498 501 586a0-586da 498->501 502 5867a-5869e 498->502 503 586e7-58790 call 57650 call 831e0 call 5a430 call 77870 call 5a430 call 86190 call 74c70 call 570d0 501->503 504 586dc-586e2 501->504 502->503 521 58796-587a7 503->521 522 590cb-5914d call 75d80 SetFileAttributesA call 596f0 call 77720 503->522 504->503 524 5883d-588cd call 831e0 call 70cf0 call 5a430 521->524 525 587ad-58838 call 831e0 call 70cf0 call 5a430 521->525 543 588d3-588e8 524->543 525->543 544 58921 543->544 545 588ea-588f9 543->545 546 58923-58989 call 57650 CreateDirectoryA 544->546 545->544 547 588fb-5891f 545->547 550 58995-589df call 801f0 call 75d80 546->550 551 5898b 546->551 547->546 556 58a11-58a44 CreateDirectoryA 550->556 557 589e1-58a0b 550->557 551->550 558 58a64-58a96 call 831e0 556->558 559 58a46-58a5e 556->559 557->556 562 58abd-58b1f call 57650 call 831e0 558->562 563 58a98-58ab6 558->563 559->558 568 58b66-58b88 call 5a430 562->568 569 58b21-58b4e 562->569 563->562 574 58b9c-58bf4 call 77870 call 5a430 call 86190 call 74c70 call 570d0 568->574 575 58b8a-58b96 568->575 570 58b50-58b5a 569->570 571 58b5c 569->571 570->568 571->568 586 590c1 574->586 587 58bfa-58c0f 574->587 575->574 586->522 588 58c11-58c1c 587->588 589 58c22-58c94 GetTempPathA call 72260 587->589 588->589 592 58c96-58cb4 589->592 593 58cba-58cbe 589->593 592->593 594 58cc4 593->594 595 58d80-58f22 call 801f0 call 75d80 CreateDirectoryA call 831e0 call 57650 call 831e0 call 5a430 call 77870 call 5a430 call 86190 call 74c70 call 570d0 593->595 597 58cc9-58ce3 594->597 625 590a6-590bb 595->625 626 58f28-58f7f GetTempPathA call 801f0 595->626 598 58ce5-58cef 597->598 599 58d31-58d7a 597->599 601 58cf1-58d21 598->601 602 58d29-58d2d 598->602 599->595 601->602 604 58d23 601->604 602->597 605 58d2f 602->605 604->602 605->595 625->586 629 58fd1-59033 call 831e0 call 57650 call 5a430 626->629 630 58f81-58fab 626->630 638 59035-59051 629->638 639 5907d-5909f 629->639 630->629 631 58fad-58fcb 630->631 631->629 640 59067-5907b 638->640 641 59053-59065 638->641 639->625 642 590a1 639->642 640->625 641->625 642->625
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetVersionExA.KERNEL32(000D0FB0), ref: 0005808B
                                                                                                                                                                                                              • CreateDirectoryA.KERNELBASE(0000005C,00000000), ref: 000581E4
                                                                                                                                                                                                              • DeleteFileA.KERNELBASE(?,?,?,?,?,?,00000000), ref: 00058408
                                                                                                                                                                                                              • RemoveDirectoryA.KERNELBASE(?,?,?,?,?,?,00000000), ref: 00058433
                                                                                                                                                                                                              • CreateDirectoryA.KERNELBASE(?,00000000,?,?,?,?,?,?,?,?,00000000), ref: 000584CC
                                                                                                                                                                                                              • CreateDirectoryA.KERNELBASE(?,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 000585D1
                                                                                                                                                                                                              • CreateDirectoryA.KERNEL32(?,00000000), ref: 0005896A
                                                                                                                                                                                                              • CreateDirectoryA.KERNEL32(?,00000000), ref: 00058A1A
                                                                                                                                                                                                                • Part of subcall function 00070CF0: wvsprintfA.USER32(00001237,P,@`), ref: 00070D77
                                                                                                                                                                                                              • GetTempPathA.KERNEL32(00000104,?,?,?,?,?,?,00000000), ref: 00058C2E
                                                                                                                                                                                                                • Part of subcall function 00072260: lstrlen.KERNEL32(?,?,00057614,?,?,C:\vdjmzgowdzhfmld\,?,?,000517C4,?), ref: 00072283
                                                                                                                                                                                                              • CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 00058DEE
                                                                                                                                                                                                              • GetTempPathA.KERNEL32(00000104,?,?,?,?,?,?,00000000), ref: 00058F47
                                                                                                                                                                                                              • SetFileAttributesA.KERNELBASE(?,00000002,?,?,?,?,?,?,00000000), ref: 000590F7
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000003.00000002.2507406410.0000000000051000.00000020.00000001.01000000.00000007.sdmp, Offset: 00050000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507352496.0000000000050000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507547103.0000000000087000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.000000000008C000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.00000000000C1000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.00000000000D0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507780551.00000000000D2000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_50000_xmjofjnkdlv.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Directory$Create$FilePathTemp$AttributesDeleteRemoveVersionlstrlenwvsprintf
                                                                                                                                                                                                              • String ID: C:\Windows\system32\config\systemprofile$C:\vdjmzgowdzhfmld\$\
                                                                                                                                                                                                              • API String ID: 2935959199-2206088217
                                                                                                                                                                                                              • Opcode ID: 25103756e56b6a620685f1f61a3364033a56278a82bffaace86795292bef31b1
                                                                                                                                                                                                              • Instruction ID: c945d71f811d032db688a2507ada51c77d2e3828d197ee827670bbc97e5375e7
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 25103756e56b6a620685f1f61a3364033a56278a82bffaace86795292bef31b1
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 48928BB1A00605DFF704AF20FD89EE63BB0F794311F118166E985921B6EB3C49A9CF55

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 643 65eb0-65f2f call 596f0 646 65f31-65f44 643->646 647 65f4b-65f83 call 596f0 643->647 646->647 650 65f85-65f8f 647->650 651 65f91 647->651 652 65f9b-66033 CreateProcessA 650->652 651->652 653 66035-6608f CloseHandle * 2 652->653 654 66090-660bf 652->654
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CreateProcessA.KERNELBASE(00001237,P,00000000,00000000,00000000,00000008,00000000,00000000,00000044,@`), ref: 0006602B
                                                                                                                                                                                                              • CloseHandle.KERNEL32(P), ref: 00066043
                                                                                                                                                                                                              • CloseHandle.KERNEL32(@`), ref: 00066072
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000003.00000002.2507406410.0000000000051000.00000020.00000001.01000000.00000007.sdmp, Offset: 00050000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507352496.0000000000050000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507547103.0000000000087000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.000000000008C000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.00000000000C1000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.00000000000D0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507780551.00000000000D2000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_50000_xmjofjnkdlv.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CloseHandle$CreateProcess
                                                                                                                                                                                                              • String ID: @`$D$P$P
                                                                                                                                                                                                              • API String ID: 2922976086-2582591603
                                                                                                                                                                                                              • Opcode ID: 6a4e83362d31803c17ebca587b1d7babee1b525819d0aabd13db198eb280f902
                                                                                                                                                                                                              • Instruction ID: 00e4dd2d3a7fccd292266f0f14e41837930d80f7df8919551bb7abe2bebac885
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6a4e83362d31803c17ebca587b1d7babee1b525819d0aabd13db198eb280f902
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 3451F0766002018BF708CF68FD92BBA73B4F754711F10862AE902DB6B4E7BC9945CB51

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 655 51fe0-52077 CreateToolhelp32Snapshot 656 5208e-520ae 655->656 657 52079-5208c 655->657 658 520bf-520c1 656->658 659 520b0-520ba 656->659 657->658 660 520c7-520df 658->660 661 52443 658->661 659->658 662 520e1-520f3 660->662 663 520f9-52125 660->663 664 52445-52477 call 596f0 661->664 662->663 666 52127-5214d 663->666 667 5214f 663->667 669 52151-52175 Process32First 666->669 667->669 670 523de-52404 669->670 671 5217b 669->671 673 52427-52441 CloseHandle 670->673 674 52406-52421 670->674 672 52180-52192 671->672 675 52194-521ac 672->675 676 521ae 672->676 673->664 674->673 677 521b8-52234 call 801f0 call 78a10 call 74860 675->677 676->677 684 5236a-523d8 Process32Next 677->684 685 5223a-52267 OpenProcess 677->685 684->670 684->672 686 52269-52278 685->686 687 52298-5229a 685->687 686->687 688 5227a-52292 686->688 689 52360 687->689 690 522a0-522ca 687->690 688->687 689->684 691 522d6-52304 TerminateProcess 690->691 692 522cc 690->692 693 52306-5232a 691->693 694 5232c-52338 691->694 692->691 695 5233e-5235a CloseHandle 693->695 694->695 695->689
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000,00000001), ref: 0005204F
                                                                                                                                                                                                              • Process32First.KERNEL32(00000000,00000128), ref: 00052159
                                                                                                                                                                                                              • OpenProcess.KERNEL32(00000001,00000000,?), ref: 0005224D
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000003.00000002.2507406410.0000000000051000.00000020.00000001.01000000.00000007.sdmp, Offset: 00050000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507352496.0000000000050000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507547103.0000000000087000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.000000000008C000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.00000000000C1000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.00000000000D0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507780551.00000000000D2000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_50000_xmjofjnkdlv.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CreateFirstOpenProcessProcess32SnapshotToolhelp32
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3397401024-0
                                                                                                                                                                                                              • Opcode ID: 471431c94953a260779d7987ac10b95afa61450982f325dbd1687d5d2f09cc99
                                                                                                                                                                                                              • Instruction ID: aefc969e3be734a87dd914ace485fab2f6bb8c4bb9d38933c20b0209309535db
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 471431c94953a260779d7987ac10b95afa61450982f325dbd1687d5d2f09cc99
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 96B166B2A01605DFF714DF24FD89AA63BB5FB90301F11411BE886962B4EB3D8964CF85

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 696 70250-7029d 697 7029f-702b7 696->697 698 702bd-70308 696->698 697->698 699 70316-70338 698->699 700 7030a-70314 698->700 701 70344-7038c CreateToolhelp32Snapshot 699->701 702 7033a 699->702 700->701 703 70392-703a1 701->703 704 705c8-705e0 701->704 702->701 705 703b7-703ff Process32First 703->705 706 703a3-703b0 703->706 707 70612-70655 call 596f0 704->707 708 705e2-70606 704->708 709 70405-70408 705->709 710 705a0-705c5 CloseHandle 705->710 706->705 716 70657-70663 707->716 717 70669-7066f 707->717 708->707 711 70608 708->711 713 70410-70457 call 801f0 call 78a10 709->713 710->704 711->707 720 7045c-7048a call 74860 713->720 716->717 723 704f6-70542 720->723 724 7048c-704eb Process32Next 720->724 726 70544-70570 723->726 727 7059e 723->727 724->713 725 704f1 724->725 725->710 726->727 728 70572-7059c 726->728 727->710 728->710
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000,?,00000000), ref: 0007035F
                                                                                                                                                                                                              • Process32First.KERNEL32(00000000,?), ref: 000703DB
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000003.00000002.2507406410.0000000000051000.00000020.00000001.01000000.00000007.sdmp, Offset: 00050000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507352496.0000000000050000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507547103.0000000000087000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.000000000008C000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.00000000000C1000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.00000000000D0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507780551.00000000000D2000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_50000_xmjofjnkdlv.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CreateFirstProcess32SnapshotToolhelp32
                                                                                                                                                                                                              • String ID: P$i*Vd
                                                                                                                                                                                                              • API String ID: 2353314856-4272396731
                                                                                                                                                                                                              • Opcode ID: 1e93ecf5a9e790f8f431cc463c7ec1212f33e5df1e6467c15f4d8d2f19cb9741
                                                                                                                                                                                                              • Instruction ID: 54db54206c0d7198ac970519fa73464807cbc8c14a9f3b59e131f28f968e3206
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1e93ecf5a9e790f8f431cc463c7ec1212f33e5df1e6467c15f4d8d2f19cb9741
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 27A145B1A10605DBF704EF24FC99ABA37B0F785711F11861AD48A921B5F73C49A0CF99

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 729 74990-74a23 CreateFileA 730 74a37-74a56 GetFileTime 729->730 731 74a25-74a36 729->731 732 74a83-74b6c call 86880 GetFileSize CloseHandle 730->732 733 74a58-74a82 CloseHandle 730->733 736 74b6e 732->736 737 74b78-74b7c 732->737 736->737 738 74b90-74ba5 737->738 739 74b7e-74b8f 737->739 740 74ba7-74bc5 738->740 741 74c05-74c22 738->741 742 74bc7-74be9 740->742 743 74bea-74c04 740->743 744 74c36-74c3d 741->744 745 74c24-74c30 741->745 745->744
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CreateFileA.KERNELBASE(?,00000000,00000000,00000000,00000003,00000000,00000000), ref: 00074A04
                                                                                                                                                                                                              • GetFileTime.KERNEL32(00000000,?,?,?), ref: 00074A4E
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 00074A6B
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000003.00000002.2507406410.0000000000051000.00000020.00000001.01000000.00000007.sdmp, Offset: 00050000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507352496.0000000000050000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507547103.0000000000087000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.000000000008C000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.00000000000C1000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.00000000000D0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507780551.00000000000D2000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_50000_xmjofjnkdlv.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: File$CloseCreateHandleTime
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3397143404-0
                                                                                                                                                                                                              • Opcode ID: 6d32cbe64a003c871448002d7bd82489f5fcefb2efb5fc7800103108de1fdd9c
                                                                                                                                                                                                              • Instruction ID: 2138ea0683108a30a3dd937613c3c1db9c9e7c9255b7dd90611a9e3d058b8d39
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6d32cbe64a003c871448002d7bd82489f5fcefb2efb5fc7800103108de1fdd9c
                                                                                                                                                                                                              • Instruction Fuzzy Hash: FA61DE36A01204DFF710CF69FD85ABAB7B8FB98724B11826BE946C6670D73C9850CB45

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 746 756a0-756bc 747 756be-756d4 746->747 748 756e8-756fc GetProcessHeap RtlAllocateHeap 746->748 747->748 749 756d6-756e2 747->749 749->748
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetProcessHeap.KERNEL32(00000000,?,?,00068C4F,02053FC0,?,?,?,?,000755F4), ref: 000756EE
                                                                                                                                                                                                              • RtlAllocateHeap.NTDLL(00000000,?,00068C4F,02053FC0,?,?,?,?,000755F4), ref: 000756F5
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000003.00000002.2507406410.0000000000051000.00000020.00000001.01000000.00000007.sdmp, Offset: 00050000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507352496.0000000000050000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507547103.0000000000087000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.000000000008C000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.00000000000C1000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.00000000000D0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507780551.00000000000D2000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_50000_xmjofjnkdlv.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Heap$AllocateProcess
                                                                                                                                                                                                              • String ID: |Q.H
                                                                                                                                                                                                              • API String ID: 1357844191-517162033
                                                                                                                                                                                                              • Opcode ID: 1229c50ba02abec68589eaf1dc3997148e20e91fef2ea478af19b05970fc84b3
                                                                                                                                                                                                              • Instruction ID: 1ab735fc3de7743505fbf71ce868737f1363286e5e35e8099a549275babf1b2f
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 1229c50ba02abec68589eaf1dc3997148e20e91fef2ea478af19b05970fc84b3
                                                                                                                                                                                                              • Instruction Fuzzy Hash: C5E0ED70008B8ADFF7044F98EC88AAA3B68F309B527118000E14ACB120CA7C98508B25

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 750 570d0-5716b call 86810 call 78570 755 571d0-5721b CreateFileA 750->755 756 5716d-57190 750->756 759 57221-57269 call 72290 755->759 760 572ad-572e9 755->760 757 57192-571a2 756->757 758 571a8-571cf call 72290 756->758 757->758 770 5727c-57298 759->770 771 5726b-5727b 759->771 761 572fd-57305 760->761 762 572eb-572f7 760->762 765 57312-57330 761->765 762->761 768 57355-57389 765->768 769 57332-57353 765->769 774 57395-5745d call 5f1c0 call 5b680 WriteFile 768->774 775 5738b 768->775 769->774 772 572a6-572ac 770->772 773 5729a-5729f 770->773 773->772 780 57471-57488 774->780 781 5745f-5746b 774->781 775->774 782 57310 780->782 783 5748e-574b6 780->783 781->780 782->765 784 57522 783->784 785 574b8-574f8 783->785 788 57524-5754c CloseHandle call 72290 784->788 786 5750e-57520 785->786 787 574fa-5750c 785->787 786->788 787->788 790 57551-57564 788->790 791 57566-57574 790->791 792 5758f-57597 790->792 791->792 793 57576-57589 791->793 793->792
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                • Part of subcall function 00078570: WaitForSingleObject.KERNEL32(?,00004E20,?,0005264E,00000128,00000000,00000001,?,?,00071B87,000517D5,?), ref: 000785D7
                                                                                                                                                                                                              • CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000000,00000000,?,00000000,?,?,?,?,?,?,00000000), ref: 000571F7
                                                                                                                                                                                                              • WriteFile.KERNELBASE(00000000,?,00005000,00005000,00000000,?,?,?,?,?,?), ref: 0005740F
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000003.00000002.2507406410.0000000000051000.00000020.00000001.01000000.00000007.sdmp, Offset: 00050000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507352496.0000000000050000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507547103.0000000000087000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.000000000008C000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.00000000000C1000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.00000000000D0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507780551.00000000000D2000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_50000_xmjofjnkdlv.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: File$CreateObjectSingleWaitWrite
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3285871581-0
                                                                                                                                                                                                              • Opcode ID: 48490740e4916425c425f8dd9178123e7be72d3770adb1ad9e3099041bc801b0
                                                                                                                                                                                                              • Instruction ID: b9cac9998ea92f6508ba62bc659c6856354979645a34e9c1f52a2fe0ebb2b11a
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 48490740e4916425c425f8dd9178123e7be72d3770adb1ad9e3099041bc801b0
                                                                                                                                                                                                              • Instruction Fuzzy Hash: AEC148B2A04601CFF704DF25FD85AA637B4F784311B21811AE84AD72B5E77C99A4CF86

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 794 57307 795 57310-57330 794->795 797 57355-57389 795->797 798 57332-57353 795->798 799 57395-5745d call 5f1c0 call 5b680 WriteFile 797->799 800 5738b 797->800 798->799 805 57471-57488 799->805 806 5745f-5746b 799->806 800->799 805->795 807 5748e-574b6 805->807 806->805 808 57522 807->808 809 574b8-574f8 807->809 812 57524-57564 CloseHandle call 72290 808->812 810 5750e-57520 809->810 811 574fa-5750c 809->811 810->812 811->812 815 57566-57574 812->815 816 5758f-57597 812->816 815->816 817 57576-57589 815->817 817->816
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • WriteFile.KERNELBASE(00000000,?,00005000,00005000,00000000,?,?,?,?,?,?), ref: 0005740F
                                                                                                                                                                                                              • CloseHandle.KERNELBASE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00057525
                                                                                                                                                                                                                • Part of subcall function 00072290: ReleaseMutex.KERNEL32(00052A8B,?,00052A8B,00000128), ref: 000722E7
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000003.00000002.2507406410.0000000000051000.00000020.00000001.01000000.00000007.sdmp, Offset: 00050000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507352496.0000000000050000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507547103.0000000000087000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.000000000008C000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.00000000000C1000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.00000000000D0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507780551.00000000000D2000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_50000_xmjofjnkdlv.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CloseFileHandleMutexReleaseWrite
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 157576396-0
                                                                                                                                                                                                              • Opcode ID: b377f9d2b54c6607af695a519c5929229023427c9646c6ea70fabbad451ea122
                                                                                                                                                                                                              • Instruction ID: a43291d4793a5051e2adc83764b69fd9d646bfaf0b27dcc3b23fb3526160a2e7
                                                                                                                                                                                                              • Opcode Fuzzy Hash: b377f9d2b54c6607af695a519c5929229023427c9646c6ea70fabbad451ea122
                                                                                                                                                                                                              • Instruction Fuzzy Hash: B55136B2A00504CFF704DF64FD84AA637B5F784312B214057E84AD62B9EB3D9964CF82

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 818 57309 819 57310-57330 818->819 821 57355-57389 819->821 822 57332-57353 819->822 823 57395-5745d call 5f1c0 call 5b680 WriteFile 821->823 824 5738b 821->824 822->823 829 57471-57488 823->829 830 5745f-5746b 823->830 824->823 829->819 831 5748e-574b6 829->831 830->829 832 57522 831->832 833 574b8-574f8 831->833 836 57524-57564 CloseHandle call 72290 832->836 834 5750e-57520 833->834 835 574fa-5750c 833->835 834->836 835->836 839 57566-57574 836->839 840 5758f-57597 836->840 839->840 841 57576-57589 839->841 841->840
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • WriteFile.KERNELBASE(00000000,?,00005000,00005000,00000000,?,?,?,?,?,?), ref: 0005740F
                                                                                                                                                                                                              • CloseHandle.KERNELBASE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00057525
                                                                                                                                                                                                                • Part of subcall function 00072290: ReleaseMutex.KERNEL32(00052A8B,?,00052A8B,00000128), ref: 000722E7
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000003.00000002.2507406410.0000000000051000.00000020.00000001.01000000.00000007.sdmp, Offset: 00050000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507352496.0000000000050000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507547103.0000000000087000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.000000000008C000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.00000000000C1000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.00000000000D0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507780551.00000000000D2000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_50000_xmjofjnkdlv.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CloseFileHandleMutexReleaseWrite
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 157576396-0
                                                                                                                                                                                                              • Opcode ID: 3b4790cbc687d0f387b95cbc3defc5afdc529730c3928071ea61040e1f5e9056
                                                                                                                                                                                                              • Instruction ID: 0501c6c5336a0cadbf1a224c57e7c84b9c99598edef4b566f939fdc996c5b3fc
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3b4790cbc687d0f387b95cbc3defc5afdc529730c3928071ea61040e1f5e9056
                                                                                                                                                                                                              • Instruction Fuzzy Hash: E95125B2A00504CFF704DF64FD84AA677B5F784312B214057E84AD62B9EB3D9960CF82

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 842 71510-7152f 843 71531 842->843 844 7153b-715b0 AllocateAndInitializeSid 842->844 843->844 845 715b2-715be 844->845 846 715c0-71608 844->846 847 7161e-71621 845->847 846->847 848 7160a-71617 846->848 849 71697-716a8 847->849 850 71623-71646 CheckTokenMembership 847->850 848->847 851 71667-71691 850->851 852 71648-71661 850->852 851->849 852->851
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • AllocateAndInitializeSid.ADVAPI32(000580AE,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,000580AE), ref: 00071592
                                                                                                                                                                                                              • CheckTokenMembership.KERNELBASE(00000000,?,?), ref: 0007163E
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000003.00000002.2507406410.0000000000051000.00000020.00000001.01000000.00000007.sdmp, Offset: 00050000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507352496.0000000000050000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507547103.0000000000087000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.000000000008C000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.00000000000C1000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.00000000000D0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507780551.00000000000D2000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_50000_xmjofjnkdlv.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: AllocateCheckInitializeMembershipToken
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1663163955-0
                                                                                                                                                                                                              • Opcode ID: 8590cfaed0e239133333aff01195c18f639d025882712491f5ded4f5c9ef3e28
                                                                                                                                                                                                              • Instruction ID: 07094137a141482222e97266f875f6d335fd256d0f15bf3bf43798e54351dbac
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 8590cfaed0e239133333aff01195c18f639d025882712491f5ded4f5c9ef3e28
                                                                                                                                                                                                              • Instruction Fuzzy Hash: DE41FF76A05246EFEB048FA8ED88CA87F74FB50300B51C55AE841A32B9DB3D0564CF59

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 854 859b0-859db GetProcessHeap RtlFreeHeap
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetProcessHeap.KERNEL32(00000000,00000000,?,0006FA98,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 000859C3
                                                                                                                                                                                                              • RtlFreeHeap.NTDLL(00000000,?,0006FA98,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 000859CA
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000003.00000002.2507406410.0000000000051000.00000020.00000001.01000000.00000007.sdmp, Offset: 00050000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507352496.0000000000050000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507547103.0000000000087000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.000000000008C000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.00000000000C1000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.00000000000D0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507780551.00000000000D2000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_50000_xmjofjnkdlv.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Heap$FreeProcess
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3859560861-0
                                                                                                                                                                                                              • Opcode ID: 72791b72f8d221380f82870d37991aba76eff5547cbf42a1048a187553e1a056
                                                                                                                                                                                                              • Instruction ID: be1f80972561dd1eced7ac818c4c46730f8cbbe3286348d2ed07a0ab96fc093c
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 72791b72f8d221380f82870d37991aba76eff5547cbf42a1048a187553e1a056
                                                                                                                                                                                                              • Instruction Fuzzy Hash: B7D0C971048344DFE7105FA9EC09A563BACBB19656F018145F54A89161C73998618F65

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                • Part of subcall function 00076BE0: GetStdHandle.KERNEL32(000000F6,?,?,00075560), ref: 00076C12
                                                                                                                                                                                                                • Part of subcall function 00076BE0: GetStdHandle.KERNEL32(000000F5,?,?,00075560), ref: 00076C6A
                                                                                                                                                                                                                • Part of subcall function 00076BE0: GetStdHandle.KERNEL32(000000F4,?,?,00075560), ref: 00076D53
                                                                                                                                                                                                              • ExitProcess.KERNEL32 ref: 0007561B
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000003.00000002.2507406410.0000000000051000.00000020.00000001.01000000.00000007.sdmp, Offset: 00050000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507352496.0000000000050000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507547103.0000000000087000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.000000000008C000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.00000000000C1000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.00000000000D0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507780551.00000000000D2000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_50000_xmjofjnkdlv.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Handle$ExitProcess
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 256993070-0
                                                                                                                                                                                                              • Opcode ID: 4973aa946eb5b5b2bcbf537d26aaebaf0b5ce4e8a9765aadc8b2341b50017efc
                                                                                                                                                                                                              • Instruction ID: 09794626d96f1f50e94203b204bb5120af55e2886cbb76abc9a942118a61ce22
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4973aa946eb5b5b2bcbf537d26aaebaf0b5ce4e8a9765aadc8b2341b50017efc
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 7B113672A01A01CBFB00AF34FD8A8A937A9F7543413268126E486DB676EF3CC951CB45

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 936 5c9b0-5c9e8 call 5a640 ExitProcess
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000003.00000002.2507406410.0000000000051000.00000020.00000001.01000000.00000007.sdmp, Offset: 00050000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507352496.0000000000050000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507547103.0000000000087000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.000000000008C000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.00000000000C1000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.00000000000D0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507780551.00000000000D2000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_50000_xmjofjnkdlv.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ExitProcess
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 621844428-0
                                                                                                                                                                                                              • Opcode ID: 642d663211866b9f0b7f8ede663490bc9468d3806be3ea498616996b0cefd4fe
                                                                                                                                                                                                              • Instruction ID: 1ae3d4fd678263c77e39c9aa70a906bf2273f111125589716e115785ba38b5e3
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 642d663211866b9f0b7f8ede663490bc9468d3806be3ea498616996b0cefd4fe
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 53E0E278615308CFE304DF25FC869297B78FB89700B01822AE80887231C73CA941CF9A
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • lstrlen.KERNEL32(?,00000000,?,0005220B,?,?,?), ref: 00078A81
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000003.00000002.2507406410.0000000000051000.00000020.00000001.01000000.00000007.sdmp, Offset: 00050000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507352496.0000000000050000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507547103.0000000000087000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.000000000008C000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.00000000000C1000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.00000000000D0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507780551.00000000000D2000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_50000_xmjofjnkdlv.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlen
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1659193697-0
                                                                                                                                                                                                              • Opcode ID: de599813957eec11960f66493f2b6cc438896c55e64bb4e96cb48e5c18ea61c3
                                                                                                                                                                                                              • Instruction ID: 85298009f525d33ec98f0e0175f4f3d91644e56a3343e81a5c85897c5df9a03b
                                                                                                                                                                                                              • Opcode Fuzzy Hash: de599813957eec11960f66493f2b6cc438896c55e64bb4e96cb48e5c18ea61c3
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 42210675A01515DFF348AF78FCA94B53BE4F389321721852BD19AC25B8EB3C48A2CB45
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • OpenSCManagerA.ADVAPI32(00000000,00000000,00000002), ref: 0005546E
                                                                                                                                                                                                              • CreateServiceA.ADVAPI32(00000000,00E2E210,00E2E210,000F01FF,00000110,00000002,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 000554BD
                                                                                                                                                                                                              • ChangeServiceConfig2A.ADVAPI32(00000000,00000001,?), ref: 00055503
                                                                                                                                                                                                              • StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00055533
                                                                                                                                                                                                              • CloseServiceHandle.ADVAPI32(00000000), ref: 00055593
                                                                                                                                                                                                              • OpenServiceA.ADVAPI32(00000000,00E2E210,00000010), ref: 000555DE
                                                                                                                                                                                                              • StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 0005566C
                                                                                                                                                                                                              • CloseServiceHandle.ADVAPI32(00000000), ref: 0005567D
                                                                                                                                                                                                              • CloseServiceHandle.ADVAPI32(00000000), ref: 000556CC
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000003.00000002.2507406410.0000000000051000.00000020.00000001.01000000.00000007.sdmp, Offset: 00050000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507352496.0000000000050000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507547103.0000000000087000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.000000000008C000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.00000000000C1000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.00000000000D0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507780551.00000000000D2000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_50000_xmjofjnkdlv.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Service$CloseHandle$OpenStart$ChangeConfig2CreateManager
                                                                                                                                                                                                              • String ID: |Sxz
                                                                                                                                                                                                              • API String ID: 3525021261-962673421
                                                                                                                                                                                                              • Opcode ID: d044d1b7066b86de180fc705957aa590ac59f6597dddb35f1fa47f32a63a5fd1
                                                                                                                                                                                                              • Instruction ID: 88fdc664cfadca9580eddc704fa96d29c76069a3211001cbb481a9156f6c3bc3
                                                                                                                                                                                                              • Opcode Fuzzy Hash: d044d1b7066b86de180fc705957aa590ac59f6597dddb35f1fa47f32a63a5fd1
                                                                                                                                                                                                              • Instruction Fuzzy Hash: AE81CB71A01A02DFF304DF24FD89BA63BB5F794312F518117E885962B4EB3C9891CB56
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • OpenSCManagerA.ADVAPI32(00000000,00000000,80000000), ref: 0006643A
                                                                                                                                                                                                              • EnumServicesStatusA.ADVAPI32(00000000,00000030,00000003,?,00000024,?,?,00000000), ref: 000664AC
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 000664C1
                                                                                                                                                                                                              • EnumServicesStatusA.ADVAPI32(00000000,00000030,00000003,00000000,?,?,?,00000000), ref: 000665D1
                                                                                                                                                                                                              • CloseServiceHandle.ADVAPI32(00000000), ref: 00066829
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000003.00000002.2507406410.0000000000051000.00000020.00000001.01000000.00000007.sdmp, Offset: 00050000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507352496.0000000000050000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507547103.0000000000087000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.000000000008C000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.00000000000C1000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.00000000000D0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507780551.00000000000D2000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_50000_xmjofjnkdlv.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: EnumServicesStatus$CloseErrorHandleLastManagerOpenService
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1579346331-0
                                                                                                                                                                                                              • Opcode ID: 22b30d72acd76eb8e6de0640edda2ec587fe10e73a72b4a48ae2080121cdac27
                                                                                                                                                                                                              • Instruction ID: e887c172ce055fa8429273d19f800e98a03161d41f126240f1551fb9d1c8677b
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 22b30d72acd76eb8e6de0640edda2ec587fe10e73a72b4a48ae2080121cdac27
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 71029CB2A00601DFF704EF65FD89AA53BB5F784311B21420BD486932B5EB3D49A4CF95
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • Sleep.KERNEL32(000003E8,?,00000001), ref: 000538AD
                                                                                                                                                                                                              • FindFirstFileA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 000539A7
                                                                                                                                                                                                              • DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 00053AB9
                                                                                                                                                                                                              • FindNextFileA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 00053AD1
                                                                                                                                                                                                              • FindClose.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 00053AF2
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000003.00000002.2507406410.0000000000051000.00000020.00000001.01000000.00000007.sdmp, Offset: 00050000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507352496.0000000000050000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507547103.0000000000087000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.000000000008C000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.00000000000C1000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.00000000000D0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507780551.00000000000D2000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_50000_xmjofjnkdlv.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: FileFind$CloseDeleteFirstNextSleep
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1528862845-0
                                                                                                                                                                                                              • Opcode ID: fc832214582b6c7de8e20c1aca898a5572c33ef395210a5187b343a4a309cffc
                                                                                                                                                                                                              • Instruction ID: 67e2c66bd20c2a0a02ea183c498dae7686201ba3151a5f0627dc62bbbfa4caa6
                                                                                                                                                                                                              • Opcode Fuzzy Hash: fc832214582b6c7de8e20c1aca898a5572c33ef395210a5187b343a4a309cffc
                                                                                                                                                                                                              • Instruction Fuzzy Hash: DFA1F271601605CBF758DF24FC9AAFA37B4F794341B01821BE88687275EB7C8A94CB91
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 0005CB8A
                                                                                                                                                                                                              • SetHandleInformation.KERNEL32(?,00000001,00000000), ref: 0005CBD0
                                                                                                                                                                                                              • CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 0005CC2C
                                                                                                                                                                                                              • SetHandleInformation.KERNEL32(?,00000001,00000000), ref: 0005CCA8
                                                                                                                                                                                                              • CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,?,00000044,?), ref: 0005CE0D
                                                                                                                                                                                                              • CloseHandle.KERNEL32(?), ref: 0005CE48
                                                                                                                                                                                                              • CloseHandle.KERNEL32(?), ref: 0005CE70
                                                                                                                                                                                                              • CloseHandle.KERNEL32(?), ref: 0005CEA0
                                                                                                                                                                                                              • CloseHandle.KERNEL32(?), ref: 0005CEB8
                                                                                                                                                                                                              • WriteFile.KERNEL32(?,?,?,?,00000000), ref: 0005CFA0
                                                                                                                                                                                                              • CloseHandle.KERNEL32(?), ref: 0005CFD3
                                                                                                                                                                                                              • CloseHandle.KERNEL32(?), ref: 0005CFEE
                                                                                                                                                                                                              • WaitForSingleObject.KERNEL32(?,00002710), ref: 0005D09F
                                                                                                                                                                                                              • CloseHandle.KERNEL32(?), ref: 0005D0B3
                                                                                                                                                                                                              • CloseHandle.KERNEL32(?), ref: 0005D0EB
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000003.00000002.2507406410.0000000000051000.00000020.00000001.01000000.00000007.sdmp, Offset: 00050000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507352496.0000000000050000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507547103.0000000000087000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.000000000008C000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.00000000000C1000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.00000000000D0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507780551.00000000000D2000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_50000_xmjofjnkdlv.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Handle$Close$Create$InformationPipe$FileObjectProcessSingleWaitWrite
                                                                                                                                                                                                              • String ID: D$S')G
                                                                                                                                                                                                              • API String ID: 1130065513-1494146028
                                                                                                                                                                                                              • Opcode ID: 75fd3d37826a5005b19dbe94b95183ec1ef9852066d28f1034c16632c0098c4b
                                                                                                                                                                                                              • Instruction ID: 92281bd2f7fbc34d7a7330490e91bbf93f4eda21046964fb87192c8f55a21e51
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 75fd3d37826a5005b19dbe94b95183ec1ef9852066d28f1034c16632c0098c4b
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 490231B1A00205DFF708DF64FD89EAA3BB5FB98311B11821AE542972B4E73D8864CF55
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 000740AF
                                                                                                                                                                                                              • Process32First.KERNEL32(00000000,?), ref: 00074187
                                                                                                                                                                                                              • CreateToolhelp32Snapshot.KERNEL32(00000008,?), ref: 000743B2
                                                                                                                                                                                                              • Module32First.KERNEL32(00000000,?), ref: 000743F6
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000,0000000A,?,00000000), ref: 0007454D
                                                                                                                                                                                                              • Process32Next.KERNEL32(?,00000128), ref: 00074584
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 000745FA
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000003.00000002.2507406410.0000000000051000.00000020.00000001.01000000.00000007.sdmp, Offset: 00050000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507352496.0000000000050000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507547103.0000000000087000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.000000000008C000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.00000000000C1000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.00000000000D0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507780551.00000000000D2000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_50000_xmjofjnkdlv.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32$Module32Next
                                                                                                                                                                                                              • String ID: "L=/
                                                                                                                                                                                                              • API String ID: 930127669-2479274474
                                                                                                                                                                                                              • Opcode ID: b1913a5b8429e97598397db04ebe7324dfbfe42091baf9b1eecd3868762b2861
                                                                                                                                                                                                              • Instruction ID: c5d851d89d8fb7a692563a3cdcba37dd460f2625da774e6e144201dba6f7f29e
                                                                                                                                                                                                              • Opcode Fuzzy Hash: b1913a5b8429e97598397db04ebe7324dfbfe42091baf9b1eecd3868762b2861
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 93F15672B00601DFF714EF20FD89AB53BB4F794710B11811AE48A962B5EB3D89A1CF85
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • RegisterServiceCtrlHandlerA.ADVAPI32(00E2E210,Function_00001140), ref: 0005611E
                                                                                                                                                                                                              • SetServiceStatus.ADVAPI32(00000000,000B9C20), ref: 0005617F
                                                                                                                                                                                                              • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00056193
                                                                                                                                                                                                              • SetServiceStatus.ADVAPI32(00000000,000B9C20), ref: 00056200
                                                                                                                                                                                                              • WaitForSingleObject.KERNEL32(00000000,00001388), ref: 0005626C
                                                                                                                                                                                                              • SetServiceStatus.ADVAPI32(00000000,000B9C20), ref: 00056322
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 00056341
                                                                                                                                                                                                              • SetServiceStatus.ADVAPI32(00000000,000B9C20), ref: 000563F1
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000003.00000002.2507406410.0000000000051000.00000020.00000001.01000000.00000007.sdmp, Offset: 00050000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507352496.0000000000050000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507547103.0000000000087000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.000000000008C000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.00000000000C1000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.00000000000D0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507780551.00000000000D2000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_50000_xmjofjnkdlv.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Service$Status$CloseCreateCtrlEventHandleHandlerObjectRegisterSingleWait
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3399922960-0
                                                                                                                                                                                                              • Opcode ID: 5ed1ce1fd5cf99c59c8101c4b8871bef12e245a3c1133acd282d5f03e82046c9
                                                                                                                                                                                                              • Instruction ID: 4014cc2c5f77ffa6e5dc6ea255a8a3157876fdbd82513643288979789d7c8b64
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5ed1ce1fd5cf99c59c8101c4b8871bef12e245a3c1133acd282d5f03e82046c9
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 78A172B1602200DFF344CF29FD8A9A53BB4F79A720711851BE586876B0DB7C8894CF0A
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0005B2EE
                                                                                                                                                                                                              • ReadFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 0005B326
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 0005B33F
                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 0005B37C
                                                                                                                                                                                                              • CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0005B558
                                                                                                                                                                                                              • WriteFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 0005B5AB
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 0005B5BC
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000003.00000002.2507406410.0000000000051000.00000020.00000001.01000000.00000007.sdmp, Offset: 00050000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507352496.0000000000050000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507547103.0000000000087000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.000000000008C000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.00000000000C1000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.00000000000D0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507780551.00000000000D2000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_50000_xmjofjnkdlv.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: File$CloseCreateHandle$CountReadTickWrite
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3478262135-0
                                                                                                                                                                                                              • Opcode ID: ed7d06627799466583a1e69f04be02dd6824a885d975fa23997da8f04fd9390f
                                                                                                                                                                                                              • Instruction ID: cb987477ea6fcc5225f23a49d40403531031025ed0111b6d63b513d357f630a2
                                                                                                                                                                                                              • Opcode Fuzzy Hash: ed7d06627799466583a1e69f04be02dd6824a885d975fa23997da8f04fd9390f
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6FB12471A00201DFF704AF28FE86BBA37B4FB95711F10411AE8459B2B1E73C9955CB96
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00051A0A
                                                                                                                                                                                                              • Sleep.KERNEL32(00015F90), ref: 00051B6A
                                                                                                                                                                                                              • DeleteFileA.KERNEL32(?), ref: 00051B96
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000003.00000002.2507406410.0000000000051000.00000020.00000001.01000000.00000007.sdmp, Offset: 00050000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507352496.0000000000050000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507547103.0000000000087000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.000000000008C000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.00000000000C1000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.00000000000D0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507780551.00000000000D2000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_50000_xmjofjnkdlv.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: File$DeleteModuleNameSleep
                                                                                                                                                                                                              • String ID: @`$P
                                                                                                                                                                                                              • API String ID: 2157229623-1492636715
                                                                                                                                                                                                              • Opcode ID: 022e2e5cdb6a53ba87382429d55c7b6d49de7909416fc6226a7c2f3220280d61
                                                                                                                                                                                                              • Instruction ID: c4aad7ec51b22026683a75871bab3246b7800cdea7830bee1ac44156e8e5b7bf
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 022e2e5cdb6a53ba87382429d55c7b6d49de7909416fc6226a7c2f3220280d61
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4DC14471600600DFF714AF64FC8AEE63BB5FB84311F04821AE989822B6EB7D5994CF55
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000001,?,00059ED1,00070DB0,00000001,?), ref: 0007873E
                                                                                                                                                                                                              • CreateThread.KERNEL32(00000000,00000000,00000001,?,00000000,00000000), ref: 0007876D
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000,?,00059ED1,00070DB0,00000001,?), ref: 0007877E
                                                                                                                                                                                                              • WaitForSingleObject.KERNEL32(?,000000FF,?,00059ED1,00070DB0,00000001,?), ref: 00078793
                                                                                                                                                                                                              • CloseHandle.KERNEL32(?,?,000000FF,?,00059ED1,00070DB0,00000001,?), ref: 000787B7
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000003.00000002.2507406410.0000000000051000.00000020.00000001.01000000.00000007.sdmp, Offset: 00050000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507352496.0000000000050000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507547103.0000000000087000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.000000000008C000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.00000000000C1000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.00000000000D0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507780551.00000000000D2000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_50000_xmjofjnkdlv.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CloseCreateHandle$EventObjectSingleThreadWait
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1404307249-0
                                                                                                                                                                                                              • Opcode ID: e33543aabb8a6d9c9cf3f4f5d23f63259c63beb5002d82da24ccc411996351ac
                                                                                                                                                                                                              • Instruction ID: 9ac7ac78d38aefc25158c1e1e946440b4437975dbb1316b272bf2f888ffd7bcf
                                                                                                                                                                                                              • Opcode Fuzzy Hash: e33543aabb8a6d9c9cf3f4f5d23f63259c63beb5002d82da24ccc411996351ac
                                                                                                                                                                                                              • Instruction Fuzzy Hash: C441C4B5A41705EBF3106F25FD48B903BB0F754750F22850AE589922B5EB3E94A4CF85
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00072807
                                                                                                                                                                                                              • ReadFile.KERNEL32(00000000,?,00005000,?,00000000), ref: 000728C5
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000,?,?,?,00000000), ref: 000729CC
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000003.00000002.2507406410.0000000000051000.00000020.00000001.01000000.00000007.sdmp, Offset: 00050000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507352496.0000000000050000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507547103.0000000000087000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.000000000008C000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.00000000000C1000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.00000000000D0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507780551.00000000000D2000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_50000_xmjofjnkdlv.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: File$CloseCreateHandleRead
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1035965006-0
                                                                                                                                                                                                              • Opcode ID: fe7279e79035322f9a185ec1a9244ae64a85733e9a056305fb82d0c4f2050922
                                                                                                                                                                                                              • Instruction ID: 56fe36d8fc56bcea4d5bde120c6dfc074c8c91a8ee6d0a63a43dd2ad46d47422
                                                                                                                                                                                                              • Opcode Fuzzy Hash: fe7279e79035322f9a185ec1a9244ae64a85733e9a056305fb82d0c4f2050922
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 9DB12276A00601DFF708DF24FC86AA537B1F798301F10812AE446962B5EB7D99A5CF89
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetProcessHeap.KERNEL32(00000000,00000000,?,?,0006FAC0,00000000,?), ref: 0007381D
                                                                                                                                                                                                              • RtlReAllocateHeap.NTDLL(00000000,?,0006FAC0,00000000), ref: 00073824
                                                                                                                                                                                                              • GetProcessHeap.KERNEL32(00000000,?,?,0006FAC0,00000000,?), ref: 00073842
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(00000000,?,0006FAC0,00000000,?), ref: 00073849
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000003.00000002.2507406410.0000000000051000.00000020.00000001.01000000.00000007.sdmp, Offset: 00050000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507352496.0000000000050000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507547103.0000000000087000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.000000000008C000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.00000000000C1000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.00000000000D0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507780551.00000000000D2000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_50000_xmjofjnkdlv.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Heap$Process$AllocAllocate
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1154092256-0
                                                                                                                                                                                                              • Opcode ID: 72e181286981d9a530df96336f47efcda850b2e98f53dda9bbc7eedcd619bc42
                                                                                                                                                                                                              • Instruction ID: 7dbf4ca2b85a2fdbd3d6563fb5d2f74ce44322837e0f0b28ac3eaf741615c4d9
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 72e181286981d9a530df96336f47efcda850b2e98f53dda9bbc7eedcd619bc42
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 801125B1A04705CBF704AFA0FD98A7A3BB8F744310B114202F04A86574EB3D8951DB5A
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • wvsprintfA.USER32(00001237,P,@`), ref: 00070D77
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000003.00000002.2507406410.0000000000051000.00000020.00000001.01000000.00000007.sdmp, Offset: 00050000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507352496.0000000000050000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507547103.0000000000087000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.000000000008C000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.00000000000C1000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507617195.00000000000D0000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000003.00000002.2507780551.00000000000D2000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_3_2_50000_xmjofjnkdlv.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: wvsprintf
                                                                                                                                                                                                              • String ID: @`$P
                                                                                                                                                                                                              • API String ID: 2795597889-1492636715
                                                                                                                                                                                                              • Opcode ID: 52f3dcfa2b94d4d4bfe39708b38ab835b6039a6ee8a901a53c5bed514cde0d99
                                                                                                                                                                                                              • Instruction ID: 738d13355a38274ae894b400da7dfb9d689ad8ecf214bb6ae5b2954d4b61d35c
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 52f3dcfa2b94d4d4bfe39708b38ab835b6039a6ee8a901a53c5bed514cde0d99
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6E012975604206DFE718CF55FD8086677A6F7A8318301C22BA8598B775E339D942CF89

                                                                                                                                                                                                              Execution Graph

                                                                                                                                                                                                              Execution Coverage:4.7%
                                                                                                                                                                                                              Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                              Signature Coverage:0%
                                                                                                                                                                                                              Total number of Nodes:1529
                                                                                                                                                                                                              Total number of Limit Nodes:25
                                                                                                                                                                                                              execution_graph 11399 47d446 11402 47d450 11399->11402 11400 47dd9a 11401 47a430 2 API calls 11400->11401 11405 47ddda 11401->11405 11403 491a50 8 API calls 11402->11403 11404 47c2d0 9 API calls 11402->11404 11407 47d87c 11402->11407 11403->11402 11404->11402 11406 491a50 8 API calls 11406->11407 11407->11400 11407->11406 11408 47c2d0 9 API calls 11407->11408 11409 47dc6c 11407->11409 11408->11407 11409->11400 11410 491a50 8 API calls 11409->11410 11411 47c2d0 9 API calls 11409->11411 11410->11409 11411->11409 11607 4740c0 11608 4740dc 11607->11608 11609 476850 4 API calls 11608->11609 11610 4741df 11609->11610 11752 471140 11753 471162 11752->11753 11757 471169 SetServiceStatus 11752->11757 11754 471180 11753->11754 11755 471219 SetServiceStatus SetEvent 11753->11755 11753->11757 11754->11755 11758 471356 11757->11758 11950 4a55c3 11952 4a55d0 11950->11952 11951 4a57da 11953 4a5809 11951->11953 11954 4a57fd 11951->11954 11952->11951 11955 47e980 2 API calls 11952->11955 11957 47e980 2 API calls 11953->11957 11956 47e980 2 API calls 11954->11956 11955->11952 11958 4a5804 11956->11958 11957->11958 11615 476ad0 11618 49ffd0 11615->11618 11619 4a6470 lstrlen 11618->11619 11620 476adf 11619->11620 11419 492868 11422 492870 11419->11422 11420 4928b2 ReadFile 11420->11422 11421 48f910 8 API calls 11421->11422 11422->11420 11422->11421 11423 492a7e CloseHandle 11422->11423 11425 4860d0 8 API calls 11422->11425 11427 4929c1 CloseHandle 11422->11427 11424 492abb 11423->11424 11426 492290 ReleaseMutex 11424->11426 11425->11422 11429 492ac6 11426->11429 11428 492290 ReleaseMutex 11427->11428 11430 4929f1 11428->11430 11621 47bce1 11622 47bd0b 11621->11622 11623 493790 4 API calls 11622->11623 11624 47bdb3 11622->11624 11623->11624 11625 4778e0 11626 477c20 8 API calls 11625->11626 11627 477905 11626->11627 11628 472ae0 11629 472b16 11628->11629 11630 4a4650 3 API calls 11629->11630 11631 472c4a 11630->11631 11632 473740 10 API calls 11631->11632 11633 472c7a 11632->11633 11634 495d80 lstrlen 11633->11634 11635 472ca0 11634->11635 11636 4a31e0 2 API calls 11635->11636 11637 472cbe 11636->11637 11638 47a430 2 API calls 11637->11638 11654 472d41 11638->11654 11639 477a90 GetSystemTimeAsFileTime 11639->11654 11640 492ba0 12 API calls 11640->11654 11641 492070 8 API calls 11642 4735ad Sleep 11641->11642 11675 471d60 11642->11675 11644 490250 5 API calls 11644->11654 11646 485eb0 3 API calls 11646->11654 11647 4a31e0 GetProcessHeap RtlAllocateHeap 11647->11654 11648 497870 9 API calls 11648->11654 11649 47a430 GetProcessHeap RtlFreeHeap 11649->11654 11650 47c3e0 8 API calls 11650->11654 11651 477a50 8 API calls 11651->11654 11653 486c30 21 API calls 11653->11654 11654->11639 11654->11640 11654->11641 11654->11644 11654->11646 11654->11647 11654->11648 11654->11649 11654->11650 11654->11651 11654->11653 11655 4a2170 50 API calls 11654->11655 11656 471700 31 API calls 11654->11656 11657 498830 11654->11657 11669 476e40 11654->11669 11655->11654 11656->11654 11658 498853 11657->11658 11659 4a31e0 2 API calls 11658->11659 11660 4988eb 11659->11660 11661 4a31e0 2 API calls 11660->11661 11662 49890e 11661->11662 11684 4745c0 11662->11684 11665 47a430 2 API calls 11666 498983 11665->11666 11667 47a430 2 API calls 11666->11667 11668 4989b5 11667->11668 11668->11654 11671 476e5a 11669->11671 11670 477011 11670->11654 11671->11670 11672 4860d0 8 API calls 11671->11672 11673 476fbb 11672->11673 11674 486c10 2 API calls 11673->11674 11674->11670 11682 471d8c 11675->11682 11676 471f9f 11676->11654 11677 471f8d 11700 47f220 11677->11700 11678 471e8f DeleteFileA 11678->11682 11682->11676 11682->11678 11683 471ee9 11682->11683 11690 47f3c0 11682->11690 11683->11677 11696 4861f0 11683->11696 11685 4745e5 11684->11685 11686 4a31e0 2 API calls 11685->11686 11687 474a9d 11686->11687 11688 47a430 2 API calls 11687->11688 11689 474ac4 11688->11689 11689->11665 11691 47f3d2 11690->11691 11704 47bed0 11691->11704 11693 47f3e9 11708 474230 11693->11708 11697 486216 11696->11697 11698 48625c 11697->11698 11712 497970 11697->11712 11698->11683 11701 47f228 11700->11701 11702 4976e0 2 API calls 11701->11702 11703 49737e 11702->11703 11705 47bf12 11704->11705 11706 48f910 8 API calls 11705->11706 11707 47bf1a 11706->11707 11707->11693 11709 47423e 11708->11709 11710 474250 11709->11710 11711 4a5b90 8 API calls 11709->11711 11710->11682 11711->11710 11715 495e80 11712->11715 11716 495ed2 11715->11716 11719 497730 11716->11719 11718 496026 11718->11698 11720 497750 11719->11720 11721 48f910 8 API calls 11720->11721 11722 49778e 11721->11722 11722->11718 11782 47bb60 11783 47bb88 11782->11783 11792 492260 lstrlen 11783->11792 11785 47bbc1 11786 48f910 8 API calls 11785->11786 11787 47bbd7 11786->11787 11788 47c2d0 9 API calls 11787->11788 11789 47bbe9 11788->11789 11793 471380 11789->11793 11792->11785 11794 47138e 11793->11794 11795 4860d0 8 API calls 11794->11795 11796 47139c 11795->11796 11959 47c9ef 11960 47ca00 11959->11960 11961 47cb28 CreatePipe 11960->11961 11962 47cba9 SetHandleInformation 11961->11962 11972 47cb94 11961->11972 11963 47cc1e CreatePipe 11962->11963 11964 47cbf9 11962->11964 11965 47cc36 11963->11965 11966 47cc4d SetHandleInformation 11963->11966 11964->11963 11967 47ce9c CloseHandle 11965->11967 11973 47ccca 11966->11973 11971 47ceb4 CloseHandle 11967->11971 11967->11972 11968 492070 8 API calls 11970 47cf1f 11968->11970 11971->11972 11972->11968 11972->11970 11974 47cdf2 CreateProcessA 11973->11974 11975 47ce32 CloseHandle 11974->11975 11976 47cf4e WriteFile 11974->11976 11978 47ce62 11975->11978 11979 47ce6c CloseHandle 11975->11979 11980 47cfbb CloseHandle CloseHandle 11976->11980 11981 47cfaa 11976->11981 11978->11979 11979->11967 11982 47d01e 11980->11982 11981->11980 11985 4946f0 11982->11985 11986 4946fd 11985->11986 11987 492070 8 API calls 11986->11987 11988 494759 ReadFile 11987->11988 11990 47d063 WaitForSingleObject CloseHandle CloseHandle 11988->11990 11991 4947a4 11988->11991 11991->11990 11992 4860d0 8 API calls 11991->11992 11993 4947e4 ReadFile 11992->11993 11993->11990 11993->11991 11797 491760 11798 49176b 11797->11798 11799 491777 11798->11799 11800 4808b0 2 API calls 11798->11800 11800->11799 11723 4724ec 11724 4724f5 11723->11724 11725 498570 WaitForSingleObject 11723->11725 11726 47c9b0 ExitProcess 11724->11726 11725->11724 11727 472509 11726->11727 11728 4958f8 11731 495900 11728->11731 11729 495aa8 11730 4973c0 4 API calls 11730->11731 11731->11729 11731->11730 11804 48b37d 11805 48b385 11804->11805 11807 49d0eb 132 API calls 11805->11807 11806 48bf02 11807->11806 11808 479770 11809 4956a0 2 API calls 11808->11809 11810 47978e 11809->11810 11830 4a1d0a 11831 4a1d4b GetProcessHeap HeapAlloc 11830->11831 11832 4a1d3b 11830->11832 11832->11831 11833 477307 11834 477310 11833->11834 11835 4773ea WriteFile 11834->11835 11836 47748e CloseHandle 11834->11836 11835->11834 11838 492290 ReleaseMutex 11836->11838 11839 477551 11838->11839 10456 48bf0e 10457 48bece 10456->10457 10459 48befc 10456->10459 10462 49d0eb 10457->10462 10458 48bf02 10459->10458 10461 49d0eb 132 API calls 10459->10461 10461->10458 10463 49d0f0 10462->10463 10671 4a31e0 10463->10671 10465 49d130 10675 47a430 10465->10675 10468 4a31e0 2 API calls 10469 49d1ff 10468->10469 10470 47a430 2 API calls 10469->10470 10471 49d225 10470->10471 10472 4a31e0 2 API calls 10471->10472 10473 49d2d7 10472->10473 10474 47a430 2 API calls 10473->10474 10475 49d2f8 10474->10475 10476 4a31e0 2 API calls 10475->10476 10477 49d3b3 10476->10477 10478 47a430 2 API calls 10477->10478 10479 49d3d5 10478->10479 10480 4a31e0 2 API calls 10479->10480 10481 49d425 10480->10481 10482 47a430 2 API calls 10481->10482 10483 49d46b 10482->10483 10484 4a31e0 2 API calls 10483->10484 10485 49d4d9 10484->10485 10486 47a430 2 API calls 10485->10486 10487 49d4ed 10486->10487 10488 4a31e0 2 API calls 10487->10488 10489 49d541 10488->10489 10490 47a430 2 API calls 10489->10490 10491 49d555 10490->10491 10492 47a430 2 API calls 10491->10492 10493 49d58b 10492->10493 10679 4a59b0 GetProcessHeap RtlFreeHeap 10493->10679 10495 49d5f4 10680 4a4650 10495->10680 10497 49d603 10498 4a31e0 2 API calls 10497->10498 10499 49d628 GetEnvironmentVariableA 10498->10499 10500 49d67c 10499->10500 10501 47a430 2 API calls 10500->10501 10502 49d6c4 CreateMutexA CreateMutexA CreateMutexA 10501->10502 10504 49d7c6 10502->10504 10505 49d81b GetTickCount 10504->10505 10506 49d954 10504->10506 10507 49d83a 10505->10507 10688 477fa0 10506->10688 10509 4a31e0 2 API calls 10507->10509 10512 49d86a 10509->10512 10510 49d9c1 GetCommandLineA 10511 49da10 10510->10511 10513 4a31e0 2 API calls 10511->10513 10514 47a430 2 API calls 10512->10514 10516 49da7b 10513->10516 10515 49d8ff 10514->10515 10515->10506 10517 47a430 2 API calls 10516->10517 10518 49dad8 10517->10518 10519 49e64f GetCommandLineA 10518->10519 10520 4a31e0 2 API calls 10518->10520 10791 473e80 10519->10791 10522 49db4c 10520->10522 10523 47a430 2 API calls 10522->10523 10525 49db98 10523->10525 10524 49e66d 10794 492260 lstrlen 10524->10794 10528 49dbfa 10525->10528 10530 47c9b0 ExitProcess 10525->10530 10527 49e6d4 GetModuleFileNameA 10795 498a10 10527->10795 10531 4a31e0 2 API calls 10528->10531 10530->10528 10534 49dc36 10531->10534 10532 49e750 10533 498a10 lstrlen 10532->10533 10535 49e7cf 10533->10535 10536 47a430 2 API calls 10534->10536 10538 498a10 lstrlen 10535->10538 10537 49dccc 10536->10537 10539 49dcfb 10537->10539 10540 47c9b0 ExitProcess 10537->10540 10556 49e842 10538->10556 10811 495d80 10539->10811 10540->10539 10542 49ead8 10799 485770 10542->10799 10543 49dd2a 10544 4a31e0 2 API calls 10543->10544 10545 49dd40 10544->10545 10549 47a430 2 API calls 10545->10549 10547 49eb30 10548 49eb58 10547->10548 10808 47c9b0 10547->10808 10875 480950 10548->10875 10552 49dd73 10549->10552 10572 49ddd4 10552->10572 10556->10542 10854 491c40 10556->10854 10560 49e8ff 10860 473740 10560->10860 10565 49de8c Sleep 10567 494990 5 API calls 10565->10567 10566 49eaad 10569 47c9b0 ExitProcess 10566->10569 10567->10572 10569->10542 10570 49e92b 10570->10566 10571 4a31e0 2 API calls 10570->10571 10574 49e9cf 10571->10574 10572->10565 10573 49e014 Sleep 10572->10573 10584 49e07c 10572->10584 10817 490250 10572->10817 10828 494990 CreateFileA 10572->10828 10835 477a90 GetSystemTimeAsFileTime 10572->10835 10573->10572 10874 492260 lstrlen 10574->10874 10577 49ea28 MessageBoxA 10582 47a430 2 API calls 10577->10582 10579 490250 5 API calls 10579->10584 10585 49ea8b 10582->10585 10584->10579 10586 49e16f 10584->10586 10837 471fe0 CreateToolhelp32Snapshot 10584->10837 10589 47c9b0 ExitProcess 10585->10589 10591 494990 5 API calls 10586->10591 10589->10566 10596 49e1c9 10591->10596 10595 49e12b Sleep 10595->10584 10595->10586 10601 49e5bd 10596->10601 10607 49e25e GetModuleFileNameA 10596->10607 10849 485eb0 10601->10849 10613 49e2b8 SetFileAttributesA 10607->10613 10614 49e294 10607->10614 10622 49e2d5 10613->10622 10623 49e304 CopyFileA 10613->10623 10614->10613 10619 49e627 10629 47c9b0 ExitProcess 10619->10629 10622->10623 10626 4a31e0 2 API calls 10623->10626 10633 49e353 10626->10633 10629->10519 10635 47a430 2 API calls 10633->10635 10636 49e3a9 10635->10636 10638 49e4a2 10636->10638 10642 4a31e0 2 API calls 10636->10642 10640 49e53c SetFileAttributesA 10638->10640 10641 49e574 SetFileAttributesA 10638->10641 10640->10601 10641->10601 10646 49e410 10642->10646 10648 47a430 2 API calls 10646->10648 10648->10638 10672 4a320c 10671->10672 11056 4956a0 10672->11056 10674 4a32e3 10674->10465 10676 47a450 10675->10676 11059 4a59b0 GetProcessHeap RtlFreeHeap 10676->11059 10678 47a48a 10678->10468 10679->10495 10681 4a468a 10680->10681 10682 4a4729 GetSystemTime 10681->10682 10683 4a4705 10681->10683 10684 4a476a 10682->10684 10683->10682 10685 477a90 GetSystemTimeAsFileTime 10684->10685 10686 4a4831 GetTickCount 10685->10686 10687 4a486a 10686->10687 10687->10497 10690 477fbe 10688->10690 10689 478072 GetVersionExA 11060 491510 10689->11060 10690->10689 10695 47824c 10696 4a31e0 2 API calls 10695->10696 10698 47830a 10696->10698 11081 497870 10698->11081 10699 478114 10702 4781ba CreateDirectoryA 10699->10702 10704 4a31e0 2 API calls 10702->10704 10703 47a430 2 API calls 10706 47838c 10703->10706 10705 47820d 10704->10705 10707 47a430 2 API calls 10705->10707 11085 4770d0 10706->11085 10707->10695 10709 4783cb 10710 478443 10709->10710 10711 4783d2 DeleteFileA RemoveDirectoryA 10709->10711 10712 47f420 6 API calls 10710->10712 10711->10710 10713 478459 10712->10713 10714 47849f CreateDirectoryA 10713->10714 10715 4784fe 10714->10715 10716 495d80 lstrlen 10715->10716 10717 47859b CreateDirectoryA 10716->10717 10719 4785ff 10717->10719 10720 4a31e0 2 API calls 10719->10720 10721 47865d 10720->10721 10722 4a31e0 2 API calls 10721->10722 10723 478712 10722->10723 10724 47a430 2 API calls 10723->10724 10725 478726 10724->10725 10726 497870 9 API calls 10725->10726 10727 478742 10726->10727 10728 47a430 2 API calls 10727->10728 10729 47875e 10728->10729 10730 4770d0 5 API calls 10729->10730 10731 47878b 10730->10731 10732 4790cb 10731->10732 10733 47883d 10731->10733 10734 4787ad 10731->10734 10735 495d80 lstrlen 10732->10735 10738 4a31e0 2 API calls 10733->10738 10736 4a31e0 2 API calls 10734->10736 10737 4790e1 SetFileAttributesA 10735->10737 10739 4787c3 10736->10739 10746 47912f 10737->10746 10740 478861 10738->10740 10741 490cf0 wvsprintfA 10739->10741 10742 490cf0 wvsprintfA 10740->10742 10743 4787fb 10741->10743 10744 47887f 10742->10744 10745 47a430 2 API calls 10743->10745 10747 47a430 2 API calls 10744->10747 10748 47882c 10745->10748 10746->10510 10747->10748 10749 4788ea 10748->10749 10750 47894c CreateDirectoryA 10749->10750 10751 47898b 10750->10751 10752 495d80 lstrlen 10751->10752 10753 4789ca CreateDirectoryA 10752->10753 10755 478a46 10753->10755 10756 4a31e0 2 API calls 10755->10756 10757 478a70 10756->10757 10758 4a31e0 2 API calls 10757->10758 10759 478ae6 10758->10759 10760 47a430 2 API calls 10759->10760 10761 478b6e 10760->10761 10762 497870 9 API calls 10761->10762 10763 478ba5 10762->10763 10764 47a430 2 API calls 10763->10764 10765 478bb9 10764->10765 10766 4770d0 5 API calls 10765->10766 10767 478bef 10766->10767 10768 478c22 GetTempPathA 10767->10768 10790 479012 10767->10790 11102 492260 lstrlen 10768->11102 10770 478c52 10771 495d80 lstrlen 10770->10771 10772 478dd8 CreateDirectoryA 10771->10772 10773 4a31e0 2 API calls 10772->10773 10774 478e12 10773->10774 10775 4a31e0 2 API calls 10774->10775 10776 478e5b 10775->10776 10777 47a430 2 API calls 10776->10777 10778 478e91 10777->10778 10779 497870 9 API calls 10778->10779 10780 478eb1 10779->10780 10781 47a430 2 API calls 10780->10781 10782 478ed0 10781->10782 10783 4770d0 5 API calls 10782->10783 10784 478f1d 10783->10784 10785 478f28 GetTempPathA 10784->10785 10784->10790 10786 478f68 10785->10786 10787 4a31e0 2 API calls 10786->10787 10788 478fdd 10787->10788 10789 47a430 2 API calls 10788->10789 10789->10790 10790->10732 11141 492260 lstrlen 10791->11141 10793 473ebd 10793->10524 10793->10793 10794->10527 10796 498a40 lstrlen 10795->10796 10798 498aa4 10796->10798 10798->10532 10800 48578d 10799->10800 10801 495d80 lstrlen 10800->10801 10802 485893 10801->10802 10803 4a31e0 2 API calls 10802->10803 10804 4858c3 10803->10804 10805 47a430 2 API calls 10804->10805 10806 4858ff CreateFileA 10805->10806 10807 485951 10806->10807 10807->10547 11142 47a640 10808->11142 10810 47c9ca ExitProcess 10812 495dc3 10811->10812 10813 4775a0 lstrlen 10812->10813 10814 495de1 10813->10814 10816 495e4a 10814->10816 11144 492260 lstrlen 10814->11144 10816->10543 10818 49029f CreateToolhelp32Snapshot 10817->10818 10820 490392 Process32First 10818->10820 10823 4905c8 10818->10823 10822 4905a0 CloseHandle 10820->10822 10825 490405 10820->10825 10822->10823 10823->10572 10824 498a10 lstrlen 10824->10825 10825->10824 10826 49048c Process32Next 10825->10826 10827 4904f1 10825->10827 10826->10825 10826->10827 10827->10822 10829 494a25 10828->10829 10830 494a37 GetFileTime 10828->10830 10829->10572 10831 494a58 CloseHandle 10830->10831 10832 494a83 __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z 10830->10832 10831->10572 10833 494aca GetFileSize CloseHandle 10832->10833 10834 494b6e 10833->10834 10834->10572 10836 477b0d __aulldiv 10835->10836 10836->10572 10838 472079 10837->10838 10839 472443 10838->10839 10840 472151 Process32First 10838->10840 10839->10595 10841 4723de CloseHandle 10840->10841 10847 47217b 10840->10847 10841->10839 10843 498a10 lstrlen 10843->10847 10844 47236a Process32Next 10844->10841 10844->10847 10845 47223a OpenProcess 10845->10847 10846 4722d6 TerminateProcess 10846->10847 10847->10843 10847->10844 10847->10845 10847->10846 10848 47233e CloseHandle 10847->10848 10848->10847 10850 485f1a 10849->10850 10851 485f9b CreateProcessA 10850->10851 10852 486090 10851->10852 10853 486035 CloseHandle CloseHandle 10851->10853 10852->10619 10853->10619 10855 491c9b 10854->10855 11145 47b1d0 10855->11145 10858 485eb0 3 API calls 10859 491d10 10858->10859 10859->10560 10861 473778 10860->10861 10871 473b0c 10860->10871 11187 492260 lstrlen 10861->11187 10863 47385d Sleep 10865 473911 10863->10865 10866 4a31e0 2 API calls 10865->10866 10867 47393c 10866->10867 10868 47a430 2 API calls 10867->10868 10869 47397e FindFirstFileA 10868->10869 10870 4739c2 10869->10870 10869->10871 10872 473ab2 DeleteFileA FindNextFileA 10870->10872 10871->10570 10872->10870 10873 473adf FindClose 10872->10873 10873->10871 10874->10577 10876 48097c 10875->10876 10877 480af9 GetComputerNameA 10876->10877 10878 480b4b 10877->10878 10879 480bf1 10877->10879 10880 4a31e0 2 API calls 10878->10880 10881 4a31e0 2 API calls 10879->10881 10883 480b67 10880->10883 10882 480c80 10881->10882 10884 47a430 2 API calls 10882->10884 10887 47a430 2 API calls 10883->10887 10885 480cbd 10884->10885 10886 497870 9 API calls 10885->10886 10888 480cf7 10886->10888 10887->10879 11188 477a50 10888->11188 10890 480d0b 11191 4a36d0 10890->11191 10892 480e0a 11231 492260 lstrlen 10892->11231 10894 480e9c 11232 47fdf0 10894->11232 10898 480ef4 10899 477a50 8 API calls 10898->10899 10900 480f21 10899->10900 10901 47fdf0 9 API calls 10900->10901 10902 480fa9 10901->10902 10903 47c3e0 8 API calls 10902->10903 10904 480fb8 10903->10904 10905 477a50 8 API calls 10904->10905 10906 481009 10905->10906 10907 47fdf0 9 API calls 10906->10907 10908 48102e 10907->10908 10909 47c3e0 8 API calls 10908->10909 10910 48103d 10909->10910 10911 477a50 8 API calls 10910->10911 10912 481072 10911->10912 10913 47fdf0 9 API calls 10912->10913 10914 4810b1 10913->10914 10915 47c3e0 8 API calls 10914->10915 10916 4810bd 10915->10916 10917 477a50 8 API calls 10916->10917 10918 4810ea 10917->10918 10919 47fdf0 9 API calls 10918->10919 10920 48112e 10919->10920 10921 47c3e0 8 API calls 10920->10921 10922 48113d 10921->10922 10923 477a50 8 API calls 10922->10923 10924 4811c0 10923->10924 10925 4a31e0 2 API calls 10924->10925 10926 4811f1 10925->10926 10927 47fdf0 9 API calls 10926->10927 10928 48120c 10927->10928 10929 47c3e0 8 API calls 10928->10929 10930 48121b 10929->10930 10931 47a430 2 API calls 10930->10931 10932 481255 10931->10932 10933 477a50 8 API calls 10932->10933 10934 48127e 10933->10934 10935 47fdf0 9 API calls 10934->10935 10936 4812e1 10935->10936 10937 47c3e0 8 API calls 10936->10937 10938 4812ed 10937->10938 10939 477a50 8 API calls 10938->10939 10940 481351 10939->10940 10941 47fdf0 9 API calls 10940->10941 10942 481388 10941->10942 10943 47c3e0 8 API calls 10942->10943 10944 481397 10943->10944 10945 477a50 8 API calls 10944->10945 10946 4813de 10945->10946 11239 4a1d80 10946->11239 10950 481443 10951 47fdf0 9 API calls 10950->10951 10952 48144f 10951->10952 10953 47c3e0 8 API calls 10952->10953 10954 48145e 10953->10954 10955 477a50 8 API calls 10954->10955 10956 481483 10955->10956 10957 47fdf0 9 API calls 10956->10957 10958 4814dc 10957->10958 10959 47c3e0 8 API calls 10958->10959 10960 4814eb 10959->10960 11248 47d1f0 10960->11248 10962 481519 11275 492070 10962->11275 10964 48152e 11278 4860d0 10964->11278 10966 48154f 11282 4a2b00 10966->11282 10968 4815b2 11290 47b670 10968->11290 11057 4956e8 GetProcessHeap RtlAllocateHeap 11056->11057 11058 4956be 11056->11058 11057->10674 11058->11057 11059->10678 11061 49153b AllocateAndInitializeSid 11060->11061 11062 491531 11060->11062 11063 4915b2 11061->11063 11062->11061 11064 491623 CheckTokenMembership 11063->11064 11065 4780ae 11063->11065 11064->11065 11066 4a28c0 11065->11066 11067 4a31e0 2 API calls 11066->11067 11068 4a2925 GetProcAddress 11067->11068 11069 47a430 2 API calls 11068->11069 11070 4a297e 11069->11070 11071 4a29a3 GetCurrentProcess 11070->11071 11072 4780c4 11070->11072 11071->11072 11072->10695 11073 47f420 GetWindowsDirectoryA 11072->11073 11074 47f469 11073->11074 11075 47f564 11074->11075 11076 4a31e0 2 API calls 11074->11076 11075->10699 11077 47f507 11076->11077 11078 47a430 2 API calls 11077->11078 11079 47f548 11078->11079 11103 492260 lstrlen 11079->11103 11082 4978ae 11081->11082 11104 496d90 11082->11104 11086 4770dd 11085->11086 11087 498570 WaitForSingleObject 11086->11087 11088 47714e 11087->11088 11089 4771d0 CreateFileA 11088->11089 11090 47716d 11088->11090 11091 477221 11089->11091 11097 4772ad 11089->11097 11092 492290 ReleaseMutex 11090->11092 11093 492290 ReleaseMutex 11091->11093 11094 4771b3 11092->11094 11095 47724a 11093->11095 11094->10709 11095->10709 11096 4773ea WriteFile 11096->11097 11097->11096 11098 47748e CloseHandle 11097->11098 11137 492290 11098->11137 11102->10770 11103->11075 11105 496dae 11104->11105 11110 492260 lstrlen 11105->11110 11107 496e21 11111 48fd30 11107->11111 11109 478358 11109->10703 11110->11107 11114 497bb0 11111->11114 11113 48fd52 11113->11109 11115 497bd9 11114->11115 11117 497be0 11115->11117 11119 47df30 11115->11119 11117->11113 11118 497c49 11118->11113 11120 47df62 11119->11120 11121 47df78 11120->11121 11123 48f910 11120->11123 11121->11118 11124 48f930 11123->11124 11125 48faaf 11124->11125 11126 48fa17 11124->11126 11130 48fa98 11124->11130 11133 493790 11125->11133 11128 4956a0 2 API calls 11126->11128 11129 48fa27 11128->11129 11132 4a59b0 GetProcessHeap RtlFreeHeap 11129->11132 11130->11121 11132->11130 11134 4937b1 11133->11134 11135 49382c GetProcessHeap HeapAlloc 11134->11135 11136 49380c GetProcessHeap RtlReAllocateHeap 11134->11136 11135->11130 11136->11130 11138 4922ad ReleaseMutex 11137->11138 11140 477551 11138->11140 11140->10709 11141->10793 11143 47a652 11142->11143 11143->10810 11144->10816 11146 47b1fa 11145->11146 11147 47b2dc CreateFileA 11146->11147 11148 47b313 ReadFile CloseHandle 11147->11148 11164 47b5e3 11147->11164 11173 47b9f0 11148->11173 11151 47b367 GetTickCount 11175 47c640 11151->11175 11154 47b389 11179 492260 lstrlen 11154->11179 11156 47b3b9 11157 4a31e0 2 API calls 11156->11157 11158 47b415 11157->11158 11159 47a430 2 API calls 11158->11159 11160 47b488 11159->11160 11161 47b53e CreateFileA 11160->11161 11162 4a31e0 2 API calls 11160->11162 11163 47b57b 11161->11163 11166 47b4be 11162->11166 11163->11164 11165 47b592 WriteFile CloseHandle 11163->11165 11181 486c10 11164->11181 11165->11164 11180 492260 lstrlen 11166->11180 11168 47b4db 11169 490cf0 wvsprintfA 11168->11169 11170 47b4e6 11169->11170 11171 47a430 2 API calls 11170->11171 11172 47b4f8 11171->11172 11172->11161 11174 47ba19 11173->11174 11174->11151 11176 47c65d 11175->11176 11185 492260 lstrlen 11176->11185 11178 47c67c 11178->11154 11179->11156 11180->11168 11182 4a2a80 11181->11182 11184 47b60a 11182->11184 11186 4a59b0 GetProcessHeap RtlFreeHeap 11182->11186 11184->10858 11185->11178 11186->11184 11187->10863 11189 4860d0 8 API calls 11188->11189 11190 477a7b 11189->11190 11190->10890 11192 4a36f6 11191->11192 11193 4a31e0 2 API calls 11192->11193 11194 4a38c3 11193->11194 11195 47a430 2 API calls 11194->11195 11196 4a392e GetProcessHeap 11195->11196 11198 4a396a 11196->11198 11197 4a3986 11197->10892 11198->11197 11199 4a31e0 2 API calls 11198->11199 11200 4a39f7 LoadLibraryA 11199->11200 11201 47a430 2 API calls 11200->11201 11203 4a3a30 11201->11203 11202 4a3a4f 11202->10892 11203->11202 11204 4a31e0 2 API calls 11203->11204 11205 4a3ac7 GetProcAddress 11204->11205 11206 47a430 2 API calls 11205->11206 11207 4a3b14 11206->11207 11208 4a3b2e FreeLibrary 11207->11208 11209 4a3b8d HeapAlloc 11207->11209 11210 4a3b70 11208->11210 11212 4a3c16 11209->11212 11210->10892 11213 4a3c2c FreeLibrary 11212->11213 11214 4a3c63 11212->11214 11213->10892 11215 4a3e5c 11214->11215 11216 4a3d07 HeapFree 11214->11216 11220 4a31e0 2 API calls 11215->11220 11230 4a419a 11215->11230 11217 4a3d8d HeapAlloc 11216->11217 11218 4a3d73 11216->11218 11219 4a3dc9 11217->11219 11218->11217 11219->11215 11221 4a3e00 FreeLibrary 11219->11221 11224 4a3f22 11220->11224 11222 4a3e2e 11221->11222 11222->10892 11223 4a449e HeapFree FreeLibrary 11223->10892 11225 47a430 2 API calls 11224->11225 11226 4a3f62 11225->11226 11227 4a31e0 2 API calls 11226->11227 11226->11230 11228 4a41b5 11227->11228 11229 47a430 2 API calls 11228->11229 11229->11230 11230->11223 11231->10894 11294 494c80 11232->11294 11235 47c3e0 11236 47c3f8 11235->11236 11237 4860d0 8 API calls 11236->11237 11238 47c406 11237->11238 11238->10898 11240 4a1da8 11239->11240 11241 4a31e0 2 API calls 11240->11241 11242 4a1dcc 11241->11242 11243 47a430 2 API calls 11242->11243 11244 481419 11243->11244 11245 498000 11244->11245 11301 492260 lstrlen 11245->11301 11247 49802b 11247->10950 11249 47d22c 11248->11249 11250 4a31e0 2 API calls 11249->11250 11251 47d2cb 11250->11251 11252 4a31e0 2 API calls 11251->11252 11253 47d2ec 11252->11253 11254 4a31e0 2 API calls 11253->11254 11255 47d322 11254->11255 11256 47a430 2 API calls 11255->11256 11257 47d33e 11256->11257 11258 4a31e0 2 API calls 11257->11258 11259 47d372 11258->11259 11260 47a430 2 API calls 11259->11260 11261 47d395 11260->11261 11262 47a430 2 API calls 11261->11262 11265 47d406 11262->11265 11263 47dd9a 11264 47a430 2 API calls 11263->11264 11266 47ddda 11264->11266 11268 47d87c 11265->11268 11269 47c2d0 9 API calls 11265->11269 11302 491a50 11265->11302 11266->10962 11268->11263 11270 491a50 8 API calls 11268->11270 11271 47c2d0 9 API calls 11268->11271 11272 47dc6c 11268->11272 11269->11265 11270->11268 11271->11268 11272->11263 11273 491a50 8 API calls 11272->11273 11305 47c2d0 11272->11305 11273->11272 11276 497bb0 8 API calls 11275->11276 11277 492077 11276->11277 11277->10964 11279 4860f1 11278->11279 11280 497bb0 8 API calls 11279->11280 11281 486113 11280->11281 11281->10966 11283 4a2b1b 11282->11283 11316 4a45e0 11283->11316 11285 4a2c5f 11285->10968 11286 4a2b5d 11286->11285 11287 4860d0 8 API calls 11286->11287 11288 4a2c47 11287->11288 11289 486c10 2 API calls 11288->11289 11289->11285 11291 497370 11290->11291 11340 4976e0 11291->11340 11295 494c8c 11294->11295 11300 492260 lstrlen 11295->11300 11297 494d63 11298 48fd30 8 API calls 11297->11298 11299 47fdff 11298->11299 11299->11235 11300->11297 11301->11247 11311 47c8b0 11302->11311 11304 491a5e 11304->11265 11306 4981b0 11305->11306 11315 492260 lstrlen 11306->11315 11308 498209 11309 4860d0 8 API calls 11308->11309 11310 498215 11309->11310 11310->11272 11312 47c8cf 11311->11312 11313 497bb0 8 API calls 11312->11313 11314 47c8da 11313->11314 11314->11304 11315->11308 11321 47e370 11316->11321 11318 4a45f2 11319 4a463b 11318->11319 11325 472510 11318->11325 11319->11286 11322 47e395 11321->11322 11324 47e3d7 11321->11324 11323 492070 8 API calls 11322->11323 11323->11324 11324->11318 11326 47252f 11325->11326 11327 498570 WaitForSingleObject 11326->11327 11328 47264e 11327->11328 11329 4a31e0 2 API calls 11328->11329 11337 4727d1 11328->11337 11330 472703 GetProcAddress 11329->11330 11331 47275c 11330->11331 11332 4a31e0 2 API calls 11331->11332 11334 472777 11332->11334 11333 492290 ReleaseMutex 11335 472a8b 11333->11335 11336 47a430 2 API calls 11334->11336 11335->11318 11338 47278b GetProcAddress 11336->11338 11337->11333 11339 47a430 2 API calls 11338->11339 11339->11337 11341 49770e 11340->11341 11342 4976ea 11340->11342 11344 4a59b0 GetProcessHeap RtlFreeHeap 11342->11344 11344->11341 11439 476000 11440 476085 RegisterServiceCtrlHandlerA 11439->11440 11442 476410 11440->11442 11443 47613b SetServiceStatus CreateEventA SetServiceStatus 11440->11443 11444 476220 WaitForSingleObject 11443->11444 11446 476279 11444->11446 11447 498570 WaitForSingleObject 11446->11447 11448 4762b9 SetServiceStatus CloseHandle 11447->11448 11450 47637c 11448->11450 11451 476388 SetServiceStatus 11448->11451 11450->11451 11451->11442 11732 472480 11733 472498 11732->11733 11736 492510 11733->11736 11735 4724c0 11738 49252f 11736->11738 11737 497730 8 API calls 11739 492607 11737->11739 11738->11737 11739->11735 11740 47ee80 11741 47ee8b 11740->11741 11742 4808b0 2 API calls 11741->11742 11743 47ee97 11741->11743 11742->11743 11840 474f00 11841 474f0b 11840->11841 11842 477c20 8 API calls 11841->11842 11843 474f38 11842->11843 12006 480780 12007 4807a0 12006->12007 12012 492260 lstrlen 12007->12012 12009 4807d1 12013 497fc0 12009->12013 12012->12009 12016 471560 12013->12016 12015 4807e7 12017 47158d 12016->12017 12018 47160d 12017->12018 12019 47161a 12017->12019 12020 497730 8 API calls 12018->12020 12021 4806b0 8 API calls 12019->12021 12022 471618 12019->12022 12020->12022 12021->12022 12022->12015 11452 4a0e07 11454 4a0e10 11452->11454 11459 4a0eaa 11454->11459 11469 47e4f0 11454->11469 11455 4a17b9 11456 474260 4 API calls 11455->11456 11461 4a183c 11455->11461 11456->11461 11457 47eeb0 GetProcessHeap RtlAllocateHeap GetProcessHeap RtlFreeHeap 11457->11459 11459->11455 11459->11457 11463 4a1949 11459->11463 11464 4766a0 GetProcessHeap RtlAllocateHeap GetProcessHeap RtlFreeHeap 11459->11464 11465 485a60 GetProcessHeap RtlAllocateHeap GetProcessHeap RtlFreeHeap 11459->11465 11466 47e4f0 4 API calls 11459->11466 11478 474260 11459->11478 11483 476850 11459->11483 11462 474260 4 API calls 11461->11462 11461->11463 11462->11463 11493 47e980 11463->11493 11464->11459 11465->11459 11466->11459 11470 47e67f 11469->11470 11472 47e542 11469->11472 11506 495710 11470->11506 11473 47e57c 11472->11473 11476 47e5e5 11472->11476 11497 480420 11473->11497 11475 47e591 11475->11454 11477 480420 4 API calls 11476->11477 11477->11475 11479 4742b2 11478->11479 11480 4742b8 11478->11480 11479->11459 11481 4973c0 4 API calls 11480->11481 11482 47435d 11481->11482 11482->11459 11484 476887 11483->11484 11485 476a3f 11484->11485 11487 4768a1 11484->11487 11486 495710 4 API calls 11485->11486 11492 47690c 11486->11492 11488 476982 11487->11488 11489 4768e9 11487->11489 11491 480420 4 API calls 11488->11491 11490 480420 4 API calls 11489->11490 11490->11492 11491->11492 11492->11459 11495 47e9b9 11493->11495 11494 47ec11 11495->11494 11521 4a59b0 GetProcessHeap RtlFreeHeap 11495->11521 11499 480464 11497->11499 11498 48046b 11498->11475 11499->11498 11500 474260 4 API calls 11499->11500 11503 480502 11499->11503 11500->11503 11501 474260 4 API calls 11502 480566 11501->11502 11504 47e980 2 API calls 11502->11504 11503->11501 11503->11502 11505 48061a 11504->11505 11505->11475 11507 495753 11506->11507 11508 49582b 11507->11508 11509 474260 4 API calls 11507->11509 11511 495aa8 11508->11511 11514 4973c0 11508->11514 11509->11508 11511->11475 11512 4973c0 4 API calls 11513 49587c 11512->11513 11513->11511 11513->11512 11515 4973ef 11514->11515 11516 4956a0 2 API calls 11515->11516 11519 497467 11515->11519 11517 49745e 11516->11517 11517->11519 11520 4a59b0 GetProcessHeap RtlFreeHeap 11517->11520 11519->11513 11520->11519 11521->11495 11848 475b09 11849 475b10 11848->11849 11851 475bc3 11849->11851 11852 4a02f0 11849->11852 11853 4a0378 11852->11853 11854 4a31e0 2 API calls 11853->11854 11855 4a04cc 11854->11855 11856 47a430 2 API calls 11855->11856 11857 4a08a5 11856->11857 11857->11849 11522 48c41c 11525 48c433 11522->11525 11524 48f678 11525->11524 11526 492260 lstrlen 11525->11526 11526->11525 11527 47e210 11528 47e24d 11527->11528 11529 492070 8 API calls 11528->11529 11530 47e287 11529->11530 11535 47f090 11530->11535 11532 47e2bc 11533 492070 8 API calls 11532->11533 11534 47e34b 11533->11534 11536 47f0a1 11535->11536 11539 4791b0 11536->11539 11540 4791c4 11539->11540 11541 48fd30 8 API calls 11540->11541 11542 4791d0 11541->11542 11542->11532 11865 473710 11870 497370 11865->11870 11871 4976e0 2 API calls 11870->11871 11872 49737e 11871->11872 11543 497610 11548 47e490 11543->11548 11557 48fbe0 11548->11557 11558 47e370 8 API calls 11557->11558 11559 48fc0c 11558->11559 11873 495510 11874 495546 11873->11874 11875 47b890 2 API calls 11874->11875 11876 49554b 11875->11876 11877 496be0 3 API calls 11876->11877 11878 495560 11877->11878 11879 495605 ExitProcess 11878->11879 12042 490190 12043 4901b3 12042->12043 12044 471530 8 API calls 12043->12044 12045 4901e5 12044->12045 12046 471380 8 API calls 12045->12046 12047 490204 12046->12047 11880 4a0110 11881 4a45e0 12 API calls 11880->11881 11882 4a012d 11881->11882 11883 4860d0 8 API calls 11882->11883 11884 4a01b2 11883->11884 11885 4a2d10 11886 4a2d24 11885->11886 11888 4a2d46 11885->11888 11887 4a2d70 11888->11887 11889 4a2e65 ReadFile 11888->11889 11890 4a2ea3 11889->11890 11891 4a4510 11892 47b670 2 API calls 11891->11892 11894 4a451b 11892->11894 11893 4a4527 11894->11893 11895 4808b0 2 API calls 11894->11895 11895->11893 11896 471f19 11898 471f20 11896->11898 11897 4861f0 8 API calls 11897->11898 11898->11897 11899 471f8d 11898->11899 11900 47f220 2 API calls 11899->11900 11901 471f9f 11900->11901 11902 48d716 11903 48d75a 11902->11903 11904 48e35f 11903->11904 11905 48e3a7 11903->11905 11919 48c433 11903->11919 11906 490cf0 wvsprintfA 11904->11906 11907 48e3b0 11905->11907 11908 48e4f3 11905->11908 11906->11919 11910 48e441 11907->11910 11912 48e3dd 11907->11912 11909 48e593 11908->11909 11911 48e50e 11908->11911 11914 490cf0 wvsprintfA 11909->11914 11913 490cf0 wvsprintfA 11910->11913 11916 490cf0 wvsprintfA 11911->11916 11911->11919 11915 490cf0 wvsprintfA 11912->11915 11912->11919 11913->11919 11914->11919 11915->11919 11916->11919 11917 48f678 11919->11917 11920 492260 lstrlen 11919->11920 11920->11919 11921 47db18 11923 47db20 11921->11923 11922 491a50 8 API calls 11922->11923 11923->11922 11924 47c2d0 9 API calls 11923->11924 11925 47dc6c 11923->11925 11924->11923 11926 47dd9a 11925->11926 11928 491a50 8 API calls 11925->11928 11929 47c2d0 9 API calls 11925->11929 11927 47a430 2 API calls 11926->11927 11930 47ddda 11927->11930 11928->11925 11929->11925 11747 4716a5 ExitProcess 11560 479220 11563 4a6470 11560->11563 11562 47922f 11564 4a647e 11563->11564 11567 492260 lstrlen 11564->11567 11566 4a6489 11566->11562 11567->11566 11748 475ea0 11751 492260 lstrlen 11748->11751 11750 475ecf 11751->11750 11568 494e20 11569 494e3a 11568->11569 11572 495c30 11569->11572 11571 494e94 11573 495c57 11572->11573 11576 4806b0 11573->11576 11575 495c6c 11575->11571 11577 4806d5 11576->11577 11578 47df30 8 API calls 11577->11578 11579 480720 11578->11579 11579->11575 12052 4a13b9 12057 4a0f06 12052->12057 12053 47e980 2 API calls 12054 4a1a37 12053->12054 12055 4766a0 GetProcessHeap RtlAllocateHeap GetProcessHeap RtlFreeHeap 12055->12057 12056 47eeb0 GetProcessHeap RtlAllocateHeap GetProcessHeap RtlFreeHeap 12056->12057 12057->12055 12057->12056 12058 485a60 GetProcessHeap RtlAllocateHeap GetProcessHeap RtlFreeHeap 12057->12058 12059 47e4f0 4 API calls 12057->12059 12060 474260 4 API calls 12057->12060 12061 4a17b9 12057->12061 12062 476850 4 API calls 12057->12062 12066 4a1949 12057->12066 12058->12057 12059->12057 12060->12057 12063 474260 4 API calls 12061->12063 12064 4a183c 12061->12064 12062->12057 12063->12064 12065 474260 4 API calls 12064->12065 12064->12066 12065->12066 12066->12053 11580 471c30 11583 47fe60 11580->11583 11582 471c43 11584 47fe6b 11583->11584 11585 47df30 8 API calls 11584->11585 11586 47feee 11585->11586 11586->11582 11587 47bc30 11592 4a5b90 11587->11592 11590 47c3e0 8 API calls 11591 47bc72 11590->11591 11595 496a90 11592->11595 11594 47bc55 11594->11590 11596 496aa1 11595->11596 11597 47fe60 8 API calls 11596->11597 11598 496ab7 11597->11598 11598->11594 12071 490db0 12072 490ddc 12071->12072 12131 474fc0 12072->12131 12074 490eb8 12075 498830 4 API calls 12074->12075 12130 4913af 12074->12130 12076 490f24 12075->12076 12077 4a31e0 2 API calls 12076->12077 12079 490f6a 12077->12079 12078 47b670 2 API calls 12081 491443 12078->12081 12080 497870 9 API calls 12079->12080 12082 490f8a 12080->12082 12083 47a430 2 API calls 12082->12083 12084 490fa6 12083->12084 12135 497250 12084->12135 12089 47c3e0 8 API calls 12090 490ff4 12089->12090 12091 47b670 2 API calls 12090->12091 12092 491007 12091->12092 12093 4a31e0 2 API calls 12092->12093 12094 491065 12093->12094 12095 47fdf0 9 API calls 12094->12095 12096 49107d 12095->12096 12097 47c3e0 8 API calls 12096->12097 12098 491089 12097->12098 12099 47a430 2 API calls 12098->12099 12100 4910ab 12099->12100 12101 476e40 8 API calls 12100->12101 12102 4910e3 12101->12102 12103 47c3e0 8 API calls 12102->12103 12104 4910ec 12103->12104 12105 492510 8 API calls 12104->12105 12106 49112c 12105->12106 12141 496030 12106->12141 12108 49114f 12109 47d1f0 9 API calls 12108->12109 12110 491175 12109->12110 12198 475ee0 12110->12198 12113 4a31e0 2 API calls 12114 4911b7 12113->12114 12115 47fdf0 9 API calls 12114->12115 12116 4911e1 12115->12116 12117 47c3e0 8 API calls 12116->12117 12118 4911ed 12117->12118 12119 47a430 2 API calls 12118->12119 12120 49122b 12119->12120 12121 4860d0 8 API calls 12120->12121 12122 491297 12121->12122 12123 492070 8 API calls 12122->12123 12124 49131b 12123->12124 12125 4a31e0 2 API calls 12124->12125 12126 49133e 12125->12126 12202 486c30 12126->12202 12128 49137a 12129 47a430 2 API calls 12128->12129 12129->12130 12130->12078 12132 4860d0 8 API calls 12131->12132 12133 474fe0 SetEvent 12132->12133 12133->12074 12306 493f00 12135->12306 12138 479170 12139 496a90 8 API calls 12138->12139 12140 47917f 12139->12140 12140->12089 12142 49606c 12141->12142 12143 4a31e0 2 API calls 12142->12143 12148 496195 12142->12148 12144 49615d 12143->12144 12145 497870 9 API calls 12144->12145 12146 496183 12145->12146 12147 47a430 2 API calls 12146->12147 12147->12148 12149 496369 12148->12149 12150 496297 12148->12150 12153 4a31e0 2 API calls 12149->12153 12151 4a31e0 2 API calls 12150->12151 12152 4962b5 12151->12152 12154 497870 9 API calls 12152->12154 12157 4963bf 12153->12157 12155 4962cc 12154->12155 12156 47a430 2 API calls 12155->12156 12158 4962de 12156->12158 12314 493860 12157->12314 12158->12108 12160 49641b 12161 47a430 2 API calls 12160->12161 12162 496484 12161->12162 12163 4964c3 12162->12163 12164 496562 12162->12164 12165 4a31e0 2 API calls 12163->12165 12325 49fff0 GetModuleFileNameA 12164->12325 12166 496505 12165->12166 12169 497870 9 API calls 12166->12169 12172 496534 12169->12172 12170 4965aa 12173 4a31e0 2 API calls 12170->12173 12171 496613 12174 4775a0 lstrlen 12171->12174 12175 47a430 2 API calls 12172->12175 12176 4965c0 12173->12176 12177 496647 12174->12177 12178 49654e 12175->12178 12179 497870 9 API calls 12176->12179 12327 491a70 12177->12327 12178->12108 12181 4965e7 12179->12181 12183 47a430 2 API calls 12181->12183 12184 4965f9 12183->12184 12184->12108 12187 4a31e0 2 API calls 12188 4966b7 12187->12188 12189 47a430 2 API calls 12188->12189 12190 496708 12189->12190 12335 492260 lstrlen 12190->12335 12192 496720 12193 4770d0 5 API calls 12192->12193 12194 496756 12193->12194 12336 47ca00 12194->12336 12197 49684c 12197->12108 12199 475efd 12198->12199 12200 4791b0 8 API calls 12199->12200 12201 475f3d 12200->12201 12201->12113 12203 486c76 12202->12203 12204 477a90 GetSystemTimeAsFileTime 12203->12204 12205 486e0e 12204->12205 12506 492260 lstrlen 12205->12506 12207 486eaf 12207->12128 12209 487015 12508 492260 lstrlen 12209->12508 12210 486e6e 12210->12207 12507 492260 lstrlen 12210->12507 12212 487023 12213 4a31e0 2 API calls 12212->12213 12291 487740 12212->12291 12214 4870cb 12213->12214 12215 497870 9 API calls 12214->12215 12216 4870fd 12215->12216 12217 47a430 2 API calls 12216->12217 12219 487119 12217->12219 12218 48736a 12220 47fdf0 9 API calls 12218->12220 12219->12218 12221 4a31e0 2 API calls 12219->12221 12222 4873e2 12220->12222 12223 48719a 12221->12223 12224 47c3e0 8 API calls 12222->12224 12225 494c80 9 API calls 12223->12225 12226 4873ee 12224->12226 12227 4871b7 12225->12227 12228 4a31e0 2 API calls 12226->12228 12230 47b670 2 API calls 12227->12230 12229 487429 12228->12229 12231 47fdf0 9 API calls 12229->12231 12232 4871d5 12230->12232 12233 487441 12231->12233 12235 47a430 2 API calls 12232->12235 12234 47c3e0 8 API calls 12233->12234 12236 48744d 12234->12236 12239 48724f 12235->12239 12237 47a430 2 API calls 12236->12237 12238 48748d 12237->12238 12240 47fdf0 9 API calls 12238->12240 12239->12218 12243 492510 8 API calls 12239->12243 12241 4874ca 12240->12241 12242 47c3e0 8 API calls 12241->12242 12248 4874d9 12242->12248 12244 487304 12243->12244 12245 4a31e0 2 API calls 12244->12245 12246 487324 12245->12246 12247 497870 9 API calls 12246->12247 12249 487348 12247->12249 12251 4a31e0 2 API calls 12248->12251 12289 48764e 12248->12289 12252 47a430 2 API calls 12249->12252 12250 4a31e0 2 API calls 12253 48769c 12250->12253 12255 487534 12251->12255 12252->12218 12254 47fdf0 9 API calls 12253->12254 12256 4876be 12254->12256 12257 47fdf0 9 API calls 12255->12257 12258 47c3e0 8 API calls 12256->12258 12259 48755b 12257->12259 12260 4876ca 12258->12260 12261 47c3e0 8 API calls 12259->12261 12263 47a430 2 API calls 12260->12263 12262 48756a 12261->12262 12265 4a31e0 2 API calls 12262->12265 12264 4876ea 12263->12264 12266 48770c socket 12264->12266 12268 47c3e0 8 API calls 12264->12268 12267 48758b 12265->12267 12269 4877b0 12266->12269 12266->12291 12270 47a430 2 API calls 12267->12270 12268->12266 12271 4877c2 setsockopt 12269->12271 12272 487805 gethostbyname 12269->12272 12277 4875aa 12270->12277 12271->12272 12273 4877fb 12271->12273 12274 48784a inet_ntoa inet_addr 12272->12274 12272->12291 12273->12272 12275 4878b1 12274->12275 12276 487913 htons connect 12274->12276 12275->12276 12278 487958 12276->12278 12281 487984 12276->12281 12279 490cf0 wvsprintfA 12277->12279 12278->12128 12280 487604 12279->12280 12283 47a430 2 API calls 12280->12283 12282 4879b3 send 12281->12282 12287 4879ed 12282->12287 12284 487620 12283->12284 12285 47fdf0 9 API calls 12284->12285 12286 48763f 12285->12286 12288 47c3e0 8 API calls 12286->12288 12290 492070 8 API calls 12287->12290 12287->12291 12288->12289 12289->12250 12305 487a89 12290->12305 12291->12128 12292 487afb recv 12293 487f76 closesocket 12292->12293 12292->12305 12295 487fbf 12293->12295 12295->12291 12296 492510 8 API calls 12295->12296 12296->12291 12297 48f910 8 API calls 12297->12305 12298 4860d0 8 API calls 12298->12305 12299 4a31e0 GetProcessHeap RtlAllocateHeap 12299->12305 12300 487f6c 12300->12293 12301 47b670 GetProcessHeap RtlFreeHeap 12301->12305 12302 47a430 GetProcessHeap RtlFreeHeap 12302->12305 12304 494c80 9 API calls 12304->12305 12305->12292 12305->12293 12305->12297 12305->12298 12305->12299 12305->12300 12305->12301 12305->12302 12305->12304 12509 4a1b00 12305->12509 12513 474400 12305->12513 12307 493f0b 12306->12307 12310 491e10 12307->12310 12311 491e2c 12310->12311 12312 4791b0 8 API calls 12311->12312 12313 490fdf 12312->12313 12313->12138 12316 493880 12314->12316 12315 49397c 12315->12160 12316->12315 12319 493a5a 12316->12319 12362 47eeb0 12316->12362 12318 493a9b 12318->12319 12366 495b30 12318->12366 12385 4a2fb0 12319->12385 12321 493b5d 12373 492f30 12321->12373 12326 4965a3 12325->12326 12326->12170 12326->12171 12328 491aa2 12327->12328 12329 491b87 12328->12329 12330 472510 8 API calls 12328->12330 12331 4a3010 12329->12331 12330->12329 12332 4a305b 12331->12332 12333 496699 12331->12333 12332->12333 12334 491a70 8 API calls 12332->12334 12333->12187 12334->12332 12335->12192 12337 47ca1d 12336->12337 12338 47cb28 CreatePipe 12337->12338 12339 47cb94 12338->12339 12340 47cba9 SetHandleInformation 12338->12340 12346 492070 8 API calls 12339->12346 12348 47cf1f DeleteFileA 12339->12348 12341 47cc1e CreatePipe 12340->12341 12342 47cbf9 12340->12342 12343 47cc36 12341->12343 12344 47cc4d SetHandleInformation 12341->12344 12342->12341 12345 47ce9c CloseHandle 12343->12345 12350 47ccca 12344->12350 12345->12339 12349 47ceb4 CloseHandle 12345->12349 12346->12348 12348->12197 12349->12339 12351 47cdf2 CreateProcessA 12350->12351 12352 47ce32 CloseHandle 12351->12352 12353 47cf4e WriteFile 12351->12353 12355 47ce62 12352->12355 12356 47ce6c CloseHandle 12352->12356 12357 47cfbb CloseHandle CloseHandle 12353->12357 12358 47cfaa 12353->12358 12355->12356 12356->12345 12359 47d01e 12357->12359 12358->12357 12360 4946f0 10 API calls 12359->12360 12361 47d063 WaitForSingleObject CloseHandle CloseHandle 12360->12361 12363 47eef7 12362->12363 12364 4973c0 4 API calls 12363->12364 12365 47ef55 12364->12365 12365->12318 12388 473bc0 12366->12388 12370 495b8e 12401 49f790 12370->12401 12372 495bb0 12372->12321 12374 492f3d 12373->12374 12376 4930f9 12374->12376 12407 48bfc0 12374->12407 12376->12319 12377 4a31e0 2 API calls 12380 4932c5 12377->12380 12378 493039 12378->12376 12378->12377 12384 493320 12378->12384 12379 4a31e0 2 API calls 12381 4932e3 12379->12381 12380->12381 12383 47a430 2 API calls 12380->12383 12381->12319 12382 4934af 12382->12319 12383->12384 12384->12379 12384->12382 12386 47e980 2 API calls 12385->12386 12387 493c6c 12386->12387 12387->12160 12389 473be5 12388->12389 12390 4a31e0 2 API calls 12389->12390 12391 473c6e 12390->12391 12392 47a430 2 API calls 12391->12392 12393 473ca0 12392->12393 12394 475800 12393->12394 12396 475826 12394->12396 12395 475d00 12395->12370 12396->12395 12397 475a72 12396->12397 12400 4a02f0 4 API calls 12396->12400 12398 4a02f0 4 API calls 12397->12398 12399 475bc3 12397->12399 12398->12397 12399->12370 12400->12397 12402 49f817 12401->12402 12403 475800 4 API calls 12402->12403 12404 49fbac 12403->12404 12405 475800 4 API calls 12404->12405 12406 49fbc2 12405->12406 12406->12372 12408 48bffb 12407->12408 12410 48c09e 12408->12410 12411 48c0d6 12408->12411 12416 48c129 12408->12416 12409 47e980 2 API calls 12415 48c1c3 12409->12415 12412 47e980 2 API calls 12410->12412 12417 4a48f0 12411->12417 12414 48c0b6 12412->12414 12414->12378 12415->12378 12416->12409 12419 4a4968 12417->12419 12418 4a5845 12418->12416 12419->12418 12420 4973c0 4 API calls 12419->12420 12421 4a4aaf 12420->12421 12423 4973c0 4 API calls 12421->12423 12451 4a5039 12421->12451 12422 4a57da 12425 4a5809 12422->12425 12426 4a57fd 12422->12426 12424 4a4af7 12423->12424 12430 4973c0 4 API calls 12424->12430 12424->12451 12429 47e980 2 API calls 12425->12429 12428 47e980 2 API calls 12426->12428 12427 47e980 2 API calls 12427->12451 12431 4a5804 12428->12431 12429->12431 12432 4a4b20 12430->12432 12431->12416 12433 47eeb0 4 API calls 12432->12433 12442 4a4b66 12432->12442 12432->12451 12434 4a4b8f 12433->12434 12434->12451 12453 485a60 12434->12453 12437 4a4cfb 12440 474260 4 API calls 12437->12440 12438 4a4ce8 12439 49fe90 4 API calls 12438->12439 12443 4a4cf6 12439->12443 12440->12443 12442->12437 12442->12438 12442->12451 12444 474260 4 API calls 12443->12444 12445 4a4d7b 12444->12445 12446 4973c0 4 API calls 12445->12446 12445->12451 12447 4a4e34 12446->12447 12448 474260 4 API calls 12447->12448 12447->12451 12449 4a4e59 12448->12449 12450 4973c0 4 API calls 12449->12450 12449->12451 12452 474260 4 API calls 12449->12452 12450->12449 12451->12422 12451->12427 12452->12449 12454 485aad 12453->12454 12455 4973c0 4 API calls 12454->12455 12456 485bb8 12454->12456 12455->12456 12456->12451 12457 49fe90 12456->12457 12464 4a0930 12457->12464 12459 49ff9f 12459->12442 12460 49ff23 12460->12459 12463 47e4f0 4 API calls 12460->12463 12461 476850 4 API calls 12462 49fecd 12461->12462 12462->12459 12462->12460 12462->12461 12463->12460 12466 4a099e 12464->12466 12465 4a09a5 12465->12462 12466->12465 12467 4a0ac1 12466->12467 12468 4a0a17 12466->12468 12469 474260 4 API calls 12467->12469 12470 4a0a5b 12468->12470 12472 47eeb0 4 API calls 12468->12472 12471 4a0b0d 12469->12471 12473 4a0a99 12470->12473 12474 474260 4 API calls 12470->12474 12498 4a0a8c 12470->12498 12476 474260 4 API calls 12471->12476 12471->12498 12472->12470 12473->12462 12474->12498 12475 47e980 2 API calls 12477 4a1a37 12475->12477 12478 4a0b2e 12476->12478 12477->12462 12479 4973c0 4 API calls 12478->12479 12478->12498 12480 4a0b6a 12479->12480 12481 47eeb0 4 API calls 12480->12481 12480->12498 12482 4a0b8b 12481->12482 12483 4973c0 4 API calls 12482->12483 12482->12498 12484 4a0bb3 12483->12484 12485 4973c0 4 API calls 12484->12485 12484->12498 12486 4a0bfa 12485->12486 12487 485a60 4 API calls 12486->12487 12490 4a0cc9 12486->12490 12486->12498 12488 4a0c94 12487->12488 12489 485a60 4 API calls 12488->12489 12488->12498 12489->12490 12491 485a60 4 API calls 12490->12491 12490->12498 12493 4a0ddb 12491->12493 12492 47e4f0 4 API calls 12492->12493 12493->12492 12500 4a0eaa 12493->12500 12494 4a17b9 12495 474260 4 API calls 12494->12495 12496 4a183c 12494->12496 12495->12496 12497 474260 4 API calls 12496->12497 12496->12498 12497->12498 12498->12473 12498->12475 12499 47eeb0 GetProcessHeap RtlAllocateHeap GetProcessHeap RtlFreeHeap 12499->12500 12500->12494 12500->12498 12500->12499 12501 4766a0 GetProcessHeap RtlAllocateHeap GetProcessHeap RtlFreeHeap 12500->12501 12502 47e4f0 4 API calls 12500->12502 12503 474260 4 API calls 12500->12503 12504 485a60 GetProcessHeap RtlAllocateHeap GetProcessHeap RtlFreeHeap 12500->12504 12505 476850 4 API calls 12500->12505 12501->12500 12502->12500 12503->12500 12504->12500 12505->12500 12506->12210 12507->12209 12508->12212 12510 4a1b1f 12509->12510 12512 4a1b30 12509->12512 12511 477a90 GetSystemTimeAsFileTime 12510->12511 12511->12512 12512->12305 12514 474436 12513->12514 12515 4a31e0 2 API calls 12514->12515 12516 474470 12515->12516 12517 494c80 9 API calls 12516->12517 12518 474488 12517->12518 12519 47b670 2 API calls 12518->12519 12520 4744a2 12519->12520 12521 47a430 2 API calls 12520->12521 12522 4744b4 12521->12522 12523 4744cd 12522->12523 12524 4a31e0 2 API calls 12522->12524 12523->12305 12525 4744ee 12524->12525 12526 494c80 9 API calls 12525->12526 12527 474506 12526->12527 12528 47b670 2 API calls 12527->12528 12529 47451d 12528->12529 12530 47a430 2 API calls 12529->12530 12531 474538 12530->12531 12531->12305 11599 4a2030 11600 4a203b 11599->11600 11603 477c20 11600->11603 11604 477c5c 11603->11604 11605 480640 8 API calls 11604->11605 11606 477ca2 11605->11606 11378 495535 11379 495546 11378->11379 11386 47b890 11379->11386 11381 49554b 11391 496be0 GetStdHandle 11381->11391 11383 495560 11384 4955f4 11383->11384 11385 495605 ExitProcess 11384->11385 11387 47b8df 11386->11387 11388 47b8c1 11386->11388 11387->11388 11396 4a1d20 11388->11396 11390 47b910 11390->11381 11392 496c49 GetStdHandle 11391->11392 11393 496c3f 11391->11393 11394 496c82 GetStdHandle 11392->11394 11393->11392 11394->11383 11397 4a1d4b GetProcessHeap HeapAlloc 11396->11397 11398 4a1d3b 11396->11398 11397->11390 11398->11397 12532 476bb9 12535 476bc0 12532->12535 12533 476c0d Sleep 12533->12535 12534 477a90 GetSystemTimeAsFileTime 12534->12535 12535->12533 12535->12534 12536 476c95 12535->12536
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                • Part of subcall function 004A59B0: GetProcessHeap.KERNEL32(00000000,00000000,?,0048FA98,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 004A59C3
                                                                                                                                                                                                                • Part of subcall function 004A59B0: RtlFreeHeap.NTDLL(00000000,?,0048FA98,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 004A59CA
                                                                                                                                                                                                                • Part of subcall function 004A4650: GetSystemTime.KERNEL32(J,G,00000001,?,?,00472C4A), ref: 004A473C
                                                                                                                                                                                                              • GetEnvironmentVariableA.KERNEL32(00000000,C:\Users\user,00000104), ref: 0049D651
                                                                                                                                                                                                              • CreateMutexA.KERNELBASE(00000000,00000000,00000000), ref: 0049D721
                                                                                                                                                                                                              • CreateMutexA.KERNELBASE(00000000,00000000,00000000), ref: 0049D76D
                                                                                                                                                                                                              • CreateMutexA.KERNEL32(00000000,00000000,00000000), ref: 0049D7A4
                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 0049D82E
                                                                                                                                                                                                              • Sleep.KERNEL32(00000D05), ref: 0049DE9B
                                                                                                                                                                                                              • Sleep.KERNEL32(000003E8), ref: 0049E039
                                                                                                                                                                                                              • GetCommandLineA.KERNEL32 ref: 0049D9EB
                                                                                                                                                                                                                • Part of subcall function 0047C9B0: ExitProcess.KERNEL32 ref: 0047C9E8
                                                                                                                                                                                                                • Part of subcall function 00494990: CreateFileA.KERNEL32(?,00000000,00000000,00000000,00000003,00000000,00000000), ref: 00494A04
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000004.00000002.1746518970.0000000000471000.00000020.00000001.01000000.00000005.sdmp, Offset: 00470000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746505882.0000000000470000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746541831.00000000004A7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004AC000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004E1000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004F0000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746606817.00000000004F2000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_4_2_470000_skjlipudplp.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Create$Mutex$HeapProcessSleep$CommandCountEnvironmentExitFileFreeLineSystemTickTimeVariable
                                                                                                                                                                                                              • String ID: C:\Users\user$Qt$[$U"Kd$l
                                                                                                                                                                                                              • API String ID: 2753435600-1686413508
                                                                                                                                                                                                              • Opcode ID: 3834370f67f86dd115141c09f75134ca3ea6cc5f4c7e45bd9b7d4865143e17f6
                                                                                                                                                                                                              • Instruction ID: e43e344de53cc81eed97a5e20e2c0e2b7d2eb8212015e745eb9ba9c8d47d6a81
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 3834370f67f86dd115141c09f75134ca3ea6cc5f4c7e45bd9b7d4865143e17f6
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 531336B1A01200DFD704EF26FDC9A663BB5F794301B11823AD4429B2B6EB749861CF8D

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 437 477fa0-477fec call 47f680 440 477fee 437->440 441 477ff8-478058 437->441 440->441 442 478072-4780da GetVersionExA call 491510 call 4a28c0 441->442 443 47805a-47806c 441->443 448 478270-4782c9 442->448 449 4780e0-4780f4 442->449 443->442 450 4782e1-478370 call 4a31e0 call 497870 448->450 451 4782cb-4782db 448->451 452 4780f6-478102 449->452 453 478108-478147 call 47f420 449->453 464 478384-4783d0 call 47a430 call 4a6190 call 494c70 call 4770d0 450->464 465 478372-47837e 450->465 451->450 452->453 459 47815d-478208 call 477650 CreateDirectoryA call 4a31e0 453->459 460 478149-478156 453->460 469 47820d-47826e call 477650 call 47a430 459->469 460->459 480 478443-4784fc call 47f420 call 477650 CreateDirectoryA 464->480 481 4783d2-478439 DeleteFileA RemoveDirectoryA 464->481 465->464 469->450 486 4784fe 480->486 487 478508-478537 call 4a01f0 480->487 481->480 486->487 490 47855b-4785bc call 495d80 487->490 491 478539-478551 487->491 494 4785be 490->494 495 4785c8-4785fd CreateDirectoryA 490->495 491->490 494->495 496 47863f-47864b 495->496 497 4785ff-47863d 495->497 498 478651-478678 call 4a31e0 496->498 497->498 501 4786a0-4786da 498->501 502 47867a-47869e 498->502 503 4786e7-478790 call 477650 call 4a31e0 call 47a430 call 497870 call 47a430 call 4a6190 call 494c70 call 4770d0 501->503 504 4786dc-4786e2 501->504 502->503 521 478796-4787a7 503->521 522 4790cb-47914d call 495d80 SetFileAttributesA call 4796f0 call 497720 503->522 504->503 523 47883d-4788cd call 4a31e0 call 490cf0 call 47a430 521->523 524 4787ad-478838 call 4a31e0 call 490cf0 call 47a430 521->524 543 4788d3-4788e8 523->543 524->543 544 478921 543->544 545 4788ea-4788f9 543->545 547 478923-478989 call 477650 CreateDirectoryA 544->547 545->544 546 4788fb-47891f 545->546 546->547 550 478995-4789df call 4a01f0 call 495d80 547->550 551 47898b 547->551 556 478a11-478a44 CreateDirectoryA 550->556 557 4789e1-478a0b 550->557 551->550 558 478a46-478a5e 556->558 559 478a64-478a96 call 4a31e0 556->559 557->556 558->559 562 478abd-478b1f call 477650 call 4a31e0 559->562 563 478a98-478ab6 559->563 568 478b66-478b88 call 47a430 562->568 569 478b21-478b4e 562->569 563->562 574 478b9c-478bf4 call 497870 call 47a430 call 4a6190 call 494c70 call 4770d0 568->574 575 478b8a-478b96 568->575 570 478b50-478b5a 569->570 571 478b5c 569->571 570->568 571->568 586 4790c1 574->586 587 478bfa-478c0f 574->587 575->574 586->522 588 478c22-478c94 GetTempPathA call 492260 587->588 589 478c11-478c1c 587->589 592 478c96-478cb4 588->592 593 478cba-478cbe 588->593 589->588 592->593 594 478cc4 593->594 595 478d80-478f22 call 4a01f0 call 495d80 CreateDirectoryA call 4a31e0 call 477650 call 4a31e0 call 47a430 call 497870 call 47a430 call 4a6190 call 494c70 call 4770d0 593->595 596 478cc9-478ce3 594->596 625 4790a6-4790bb 595->625 626 478f28-478f7f GetTempPathA call 4a01f0 595->626 598 478ce5-478cef 596->598 599 478d31-478d7a 596->599 601 478cf1-478d21 598->601 602 478d29-478d2d 598->602 599->595 601->602 604 478d23 601->604 602->596 605 478d2f 602->605 604->602 605->595 625->586 629 478fd1-479033 call 4a31e0 call 477650 call 47a430 626->629 630 478f81-478fab 626->630 638 479035-479051 629->638 639 47907d-47909f 629->639 630->629 631 478fad-478fcb 630->631 631->629 641 479067-47907b 638->641 642 479053-479065 638->642 639->625 640 4790a1 639->640 640->625 641->625 642->625
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetVersionExA.KERNEL32(004F0FB0), ref: 0047808B
                                                                                                                                                                                                              • CreateDirectoryA.KERNELBASE(0000005C,00000000), ref: 004781E4
                                                                                                                                                                                                              • DeleteFileA.KERNELBASE(?,?,?,?,?,?,00000000), ref: 00478408
                                                                                                                                                                                                              • RemoveDirectoryA.KERNELBASE(?,?,?,?,?,?,00000000), ref: 00478433
                                                                                                                                                                                                              • CreateDirectoryA.KERNELBASE(?,00000000,?,?,?,?,?,?,?,?,00000000), ref: 004784CC
                                                                                                                                                                                                              • CreateDirectoryA.KERNELBASE(?,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004785D1
                                                                                                                                                                                                              • CreateDirectoryA.KERNEL32(?,00000000), ref: 0047896A
                                                                                                                                                                                                              • CreateDirectoryA.KERNEL32(?,00000000), ref: 00478A1A
                                                                                                                                                                                                                • Part of subcall function 00490CF0: wvsprintfA.USER32(00001237,009C4A18,009CBEB8), ref: 00490D77
                                                                                                                                                                                                              • GetTempPathA.KERNEL32(00000104,?,?,?,?,?,?,00000000), ref: 00478C2E
                                                                                                                                                                                                                • Part of subcall function 00492260: lstrlen.KERNEL32(?,?,00477614,?,?,C:\vdjmzgowdzhfmld\,?,?,004717C4,?), ref: 00492283
                                                                                                                                                                                                              • CreateDirectoryA.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 00478DEE
                                                                                                                                                                                                              • GetTempPathA.KERNEL32(00000104,?,?,?,?,?,?,00000000), ref: 00478F47
                                                                                                                                                                                                              • SetFileAttributesA.KERNELBASE(?,00000002,?,?,?,?,?,?,00000000), ref: 004790F7
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000004.00000002.1746518970.0000000000471000.00000020.00000001.01000000.00000005.sdmp, Offset: 00470000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746505882.0000000000470000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746541831.00000000004A7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004AC000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004E1000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004F0000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746606817.00000000004F2000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_4_2_470000_skjlipudplp.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Directory$Create$FilePathTemp$AttributesDeleteRemoveVersionlstrlenwvsprintf
                                                                                                                                                                                                              • String ID: C:\Users\user$C:\vdjmzgowdzhfmld\$\
                                                                                                                                                                                                              • API String ID: 2935959199-4240323064
                                                                                                                                                                                                              • Opcode ID: 99474317bbf7ca4224f28690a6b81f78f59661b961eab0f68e578deb2bc84def
                                                                                                                                                                                                              • Instruction ID: 070a715bad8d96d9d9ec3457210e6be3fa9a491e8334d43ef0714628178f25de
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 99474317bbf7ca4224f28690a6b81f78f59661b961eab0f68e578deb2bc84def
                                                                                                                                                                                                              • Instruction Fuzzy Hash: E092A9B1A00245DFC700AF21FDC9AA53BB0F794304F11827AE5459A2BBEB384965CF9D

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 643 4956a0-4956bc 644 4956e8-4956fc GetProcessHeap RtlAllocateHeap 643->644 645 4956be-4956d4 643->645 645->644 646 4956d6-4956e2 645->646 646->644
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetProcessHeap.KERNEL32(00000000,?,?,00488C4F,02053FC0,?,?,?,?,004955F4), ref: 004956EE
                                                                                                                                                                                                              • RtlAllocateHeap.NTDLL(00000000,?,00488C4F,02053FC0,?,?,?,?,004955F4), ref: 004956F5
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000004.00000002.1746518970.0000000000471000.00000020.00000001.01000000.00000005.sdmp, Offset: 00470000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746505882.0000000000470000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746541831.00000000004A7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004AC000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004E1000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004F0000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746606817.00000000004F2000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_4_2_470000_skjlipudplp.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Heap$AllocateProcess
                                                                                                                                                                                                              • String ID: |Q.H
                                                                                                                                                                                                              • API String ID: 1357844191-517162033
                                                                                                                                                                                                              • Opcode ID: 14084f497b62db1221f5a5232fa6ea34303fa807f4efeff9238973dcc81e6c68
                                                                                                                                                                                                              • Instruction ID: 8b97eadb1baadffb41c3a24944d8f99ebffc75cf093c35696c5fada2ea968b8b
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 14084f497b62db1221f5a5232fa6ea34303fa807f4efeff9238973dcc81e6c68
                                                                                                                                                                                                              • Instruction Fuzzy Hash: B0E0ED3100868ADFDB044F99FCCCA6A3F34F318B12B014024E10ACA221CA78A8A48B2D

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 647 4770d0-47716b call 4a6810 call 498570 652 4771d0-47721b CreateFileA 647->652 653 47716d-477190 647->653 656 477221-477269 call 492290 652->656 657 4772ad-4772e9 652->657 654 477192-4771a2 653->654 655 4771a8-4771cf call 492290 653->655 654->655 665 47727c-477298 656->665 666 47726b-47727b 656->666 658 4772fd-477305 657->658 659 4772eb-4772f7 657->659 662 477312-477330 658->662 659->658 667 477355-477389 662->667 668 477332-477353 662->668 669 4772a6-4772ac 665->669 670 47729a-47729f 665->670 671 477395-47745d call 47f1c0 call 47b680 WriteFile 667->671 672 47738b 667->672 668->671 670->669 677 477471-477488 671->677 678 47745f-47746b 671->678 672->671 679 477310 677->679 680 47748e-4774b6 677->680 678->677 679->662 681 477522 680->681 682 4774b8-4774f8 680->682 685 477524-47754c CloseHandle call 492290 681->685 683 47750e-477520 682->683 684 4774fa-47750c 682->684 683->685 684->685 687 477551-477564 685->687 688 477566-477574 687->688 689 47758f-477597 687->689 688->689 690 477576-477589 688->690 690->689
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                • Part of subcall function 00498570: WaitForSingleObject.KERNEL32(?,00004E20,?,0047264E,0000010C,00000000,00000001,?,?,00491B87,004717D5,?), ref: 004985D7
                                                                                                                                                                                                              • CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000000,00000000,?,00000000,?,?,?,?,?,?,00000000), ref: 004771F7
                                                                                                                                                                                                              • WriteFile.KERNELBASE(00000000,?,00005000,00005000,00000000,?,?,?,?,?,?), ref: 0047740F
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000004.00000002.1746518970.0000000000471000.00000020.00000001.01000000.00000005.sdmp, Offset: 00470000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746505882.0000000000470000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746541831.00000000004A7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004AC000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004E1000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004F0000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746606817.00000000004F2000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_4_2_470000_skjlipudplp.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: File$CreateObjectSingleWaitWrite
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3285871581-0
                                                                                                                                                                                                              • Opcode ID: 47af5a37f03e2a03ca830d56d55a132dce529e573625d1b3d71b9b1e90660d52
                                                                                                                                                                                                              • Instruction ID: 7d3fcc3c9e3c89a549314c56b725c1f5c4318d7d3763e33fd7e5061829954a8f
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 47af5a37f03e2a03ca830d56d55a132dce529e573625d1b3d71b9b1e90660d52
                                                                                                                                                                                                              • Instruction Fuzzy Hash: B4C135B2A01200DFC704DF21FDC566637B4F798305B52857BE80A8A2B6E7749860CF8E

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 691 477307 692 477310-477330 691->692 694 477355-477389 692->694 695 477332-477353 692->695 696 477395-47745d call 47f1c0 call 47b680 WriteFile 694->696 697 47738b 694->697 695->696 702 477471-477488 696->702 703 47745f-47746b 696->703 697->696 702->692 704 47748e-4774b6 702->704 703->702 705 477522 704->705 706 4774b8-4774f8 704->706 709 477524-477564 CloseHandle call 492290 705->709 707 47750e-477520 706->707 708 4774fa-47750c 706->708 707->709 708->709 712 477566-477574 709->712 713 47758f-477597 709->713 712->713 714 477576-477589 712->714 714->713
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • WriteFile.KERNELBASE(00000000,?,00005000,00005000,00000000,?,?,?,?,?,?), ref: 0047740F
                                                                                                                                                                                                              • CloseHandle.KERNELBASE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00477525
                                                                                                                                                                                                                • Part of subcall function 00492290: ReleaseMutex.KERNEL32(00472A8B,?,00472A8B,0000010C), ref: 004922E7
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000004.00000002.1746518970.0000000000471000.00000020.00000001.01000000.00000005.sdmp, Offset: 00470000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746505882.0000000000470000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746541831.00000000004A7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004AC000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004E1000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004F0000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746606817.00000000004F2000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_4_2_470000_skjlipudplp.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CloseFileHandleMutexReleaseWrite
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 157576396-0
                                                                                                                                                                                                              • Opcode ID: 09456383fbcf850be41021a1f89d5bc204415ba0729e4d629078955c2e15c160
                                                                                                                                                                                                              • Instruction ID: b31bb332a8308ba26283fb8b7c2b964ae4f7085f7eec7380df7a1564777a7dc0
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 09456383fbcf850be41021a1f89d5bc204415ba0729e4d629078955c2e15c160
                                                                                                                                                                                                              • Instruction Fuzzy Hash: A35103B2E01100DFC704DF64ED845A57BB9F784305B61857BE54A8A2B9EB34A960CF8D

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 715 477309 716 477310-477330 715->716 718 477355-477389 716->718 719 477332-477353 716->719 720 477395-47745d call 47f1c0 call 47b680 WriteFile 718->720 721 47738b 718->721 719->720 726 477471-477488 720->726 727 47745f-47746b 720->727 721->720 726->716 728 47748e-4774b6 726->728 727->726 729 477522 728->729 730 4774b8-4774f8 728->730 733 477524-477564 CloseHandle call 492290 729->733 731 47750e-477520 730->731 732 4774fa-47750c 730->732 731->733 732->733 736 477566-477574 733->736 737 47758f-477597 733->737 736->737 738 477576-477589 736->738 738->737
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • WriteFile.KERNELBASE(00000000,?,00005000,00005000,00000000,?,?,?,?,?,?), ref: 0047740F
                                                                                                                                                                                                              • CloseHandle.KERNELBASE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00477525
                                                                                                                                                                                                                • Part of subcall function 00492290: ReleaseMutex.KERNEL32(00472A8B,?,00472A8B,0000010C), ref: 004922E7
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000004.00000002.1746518970.0000000000471000.00000020.00000001.01000000.00000005.sdmp, Offset: 00470000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746505882.0000000000470000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746541831.00000000004A7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004AC000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004E1000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004F0000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746606817.00000000004F2000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_4_2_470000_skjlipudplp.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CloseFileHandleMutexReleaseWrite
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 157576396-0
                                                                                                                                                                                                              • Opcode ID: 0bf0eabfb51cff48126d1929b5e6dd611dc91b4c1d3828d7d45bc22df5e0323a
                                                                                                                                                                                                              • Instruction ID: db2ce9a2987d4e3799655258bb992fb1263dedd82d4df6aac79d73ec45dbc958
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 0bf0eabfb51cff48126d1929b5e6dd611dc91b4c1d3828d7d45bc22df5e0323a
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 475104B2E01100DFC704DF64FD845A57BB9F784305B61857BD54A8A2B9E734A960CF8D

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 739 491510-49152f 740 49153b-4915b0 AllocateAndInitializeSid 739->740 741 491531 739->741 742 4915c0-491608 740->742 743 4915b2-4915be 740->743 741->740 744 49161e-491621 742->744 745 49160a-491617 742->745 743->744 746 491623-491646 CheckTokenMembership 744->746 747 491697-4916a8 744->747 745->744 748 491648-491661 746->748 749 491667-491691 746->749 748->749 749->747
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • AllocateAndInitializeSid.ADVAPI32(004780AE,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,004780AE), ref: 00491592
                                                                                                                                                                                                              • CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 0049163E
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000004.00000002.1746518970.0000000000471000.00000020.00000001.01000000.00000005.sdmp, Offset: 00470000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746505882.0000000000470000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746541831.00000000004A7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004AC000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004E1000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004F0000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746606817.00000000004F2000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_4_2_470000_skjlipudplp.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: AllocateCheckInitializeMembershipToken
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1663163955-0
                                                                                                                                                                                                              • Opcode ID: b8c957119e2f504877aa1c008d187a29f13d7567dcb06b2812b6787fa9c2f59c
                                                                                                                                                                                                              • Instruction ID: 5b5eca16fae9ee9293cf52858598239f32407c85a4cdc9e1eda289af536a3d50
                                                                                                                                                                                                              • Opcode Fuzzy Hash: b8c957119e2f504877aa1c008d187a29f13d7567dcb06b2812b6787fa9c2f59c
                                                                                                                                                                                                              • Instruction Fuzzy Hash: D541F372A02285EFCB049FA4FDC88A87F74F754340B5685BAD8429B27AD7300964CF1C

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 815 4a59b0-4a59db GetProcessHeap RtlFreeHeap
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetProcessHeap.KERNEL32(00000000,00000000,?,0048FA98,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 004A59C3
                                                                                                                                                                                                              • RtlFreeHeap.NTDLL(00000000,?,0048FA98,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 004A59CA
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000004.00000002.1746518970.0000000000471000.00000020.00000001.01000000.00000005.sdmp, Offset: 00470000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746505882.0000000000470000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746541831.00000000004A7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004AC000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004E1000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004F0000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746606817.00000000004F2000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_4_2_470000_skjlipudplp.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Heap$FreeProcess
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3859560861-0
                                                                                                                                                                                                              • Opcode ID: d6299adc9543e8aa6c03592e0c40f82f8718e7b26a9586598fa9726aa43ae06a
                                                                                                                                                                                                              • Instruction ID: 6e61c005f4a9c22aa39d5394c09a1813ea42808fa818e14834d76510e75b491d
                                                                                                                                                                                                              • Opcode Fuzzy Hash: d6299adc9543e8aa6c03592e0c40f82f8718e7b26a9586598fa9726aa43ae06a
                                                                                                                                                                                                              • Instruction Fuzzy Hash: BED01271088344AFC7105FA9EC49B163BACEF5D616F058160F60AC9171C7315890CF6C

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 834 485770-48578b 835 48578d-48579f 834->835 836 4857a1-4857c5 834->836 837 4857e5-4857fa 835->837 836->837 838 4857c7-4857df 836->838 839 4857fc-48580e 837->839 840 485814-48583a 837->840 838->837 839->840 841 48583c-485851 840->841 842 485886-48594f call 495d80 call 4a31e0 call 477650 call 47a430 CreateFileA 840->842 843 48586d-485881 841->843 844 485853-48586b 841->844 853 485951-485992 842->853 854 485994-4859e2 842->854 843->842 844->842 855 4859ee-485a5e call 4796f0 853->855 854->855 856 4859e4 854->856 856->855
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CreateFileA.KERNELBASE(?,C0000000,00000000,00000000,00000002,00000000,00000000), ref: 00485933
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000004.00000002.1746518970.0000000000471000.00000020.00000001.01000000.00000005.sdmp, Offset: 00470000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746505882.0000000000470000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746541831.00000000004A7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004AC000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004E1000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004F0000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746606817.00000000004F2000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_4_2_470000_skjlipudplp.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CreateFile
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 823142352-0
                                                                                                                                                                                                              • Opcode ID: e21bbb013439abc74fd546df50a10f93492036cc0e436eb0fadffa1d51b03e0e
                                                                                                                                                                                                              • Instruction ID: f0c0e1ba3cc5092e2a5be019c4f5bb7c3836bba8e7b71641604f2649d2b2bd82
                                                                                                                                                                                                              • Opcode Fuzzy Hash: e21bbb013439abc74fd546df50a10f93492036cc0e436eb0fadffa1d51b03e0e
                                                                                                                                                                                                              • Instruction Fuzzy Hash: B17135B2911648DBD754AF21FCC96A53BB0F764311F114A7AD5429A2B6EB3088B0CF8D

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                • Part of subcall function 00496BE0: GetStdHandle.KERNEL32(000000F6,?,?,00495560), ref: 00496C12
                                                                                                                                                                                                                • Part of subcall function 00496BE0: GetStdHandle.KERNEL32(000000F5,?,?,00495560), ref: 00496C6A
                                                                                                                                                                                                                • Part of subcall function 00496BE0: GetStdHandle.KERNEL32(000000F4,?,?,00495560), ref: 00496D53
                                                                                                                                                                                                              • ExitProcess.KERNEL32 ref: 0049561B
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000004.00000002.1746518970.0000000000471000.00000020.00000001.01000000.00000005.sdmp, Offset: 00470000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746505882.0000000000470000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746541831.00000000004A7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004AC000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004E1000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004F0000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746606817.00000000004F2000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_4_2_470000_skjlipudplp.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Handle$ExitProcess
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 256993070-0
                                                                                                                                                                                                              • Opcode ID: a8f28224454f092bb13d8d143fdc5c24a2dd766ee1496be3b7966f2da9a6dec7
                                                                                                                                                                                                              • Instruction ID: 9c13e97e3fd443dedc7a2770c819cee80b16802de03955cd6fec71dfd48b13b9
                                                                                                                                                                                                              • Opcode Fuzzy Hash: a8f28224454f092bb13d8d143fdc5c24a2dd766ee1496be3b7966f2da9a6dec7
                                                                                                                                                                                                              • Instruction Fuzzy Hash: EA110476A01680DBDB10AF30FCC64193BA5F765341317843BD4028A6B6EA3C8C59CB4C

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 874 47c9b0-47c9e8 call 47a640 ExitProcess
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000004.00000002.1746518970.0000000000471000.00000020.00000001.01000000.00000005.sdmp, Offset: 00470000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746505882.0000000000470000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746541831.00000000004A7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004AC000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004E1000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004F0000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746606817.00000000004F2000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_4_2_470000_skjlipudplp.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: ExitProcess
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 621844428-0
                                                                                                                                                                                                              • Opcode ID: dc69347d7ae57c0020e48382d6c97d64f4108c619d3350eeb145feb8178bfe50
                                                                                                                                                                                                              • Instruction ID: 8094510f20af1cd545604be56562c4b4187a96b7c864fa2f4c3f7a05625f3d08
                                                                                                                                                                                                              • Opcode Fuzzy Hash: dc69347d7ae57c0020e48382d6c97d64f4108c619d3350eeb145feb8178bfe50
                                                                                                                                                                                                              • Instruction Fuzzy Hash: ACE0E278111348CFC304DF65FC8942A7BB8FB947403019136EC498A632C730A960CF9E

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 877 498a10-498a3e 878 498a58-498a76 877->878 879 498a40-498a56 877->879 880 498a7c-498a9d lstrlen 878->880 879->880 881 498aa4-498ac9 880->881 882 498acb-498adf 881->882 883 498aee-498b09 881->883 884 498b39-498b3b 882->884 885 498ae1-498aed 882->885 883->884 886 498b0b-498b33 883->886 886->884
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • lstrlen.KERNEL32(?,00000000,?,0047220B,?,?,?), ref: 00498A81
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000004.00000002.1746518970.0000000000471000.00000020.00000001.01000000.00000005.sdmp, Offset: 00470000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746505882.0000000000470000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746541831.00000000004A7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004AC000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004E1000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004F0000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746606817.00000000004F2000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_4_2_470000_skjlipudplp.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: lstrlen
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1659193697-0
                                                                                                                                                                                                              • Opcode ID: 464981353e977308771678cfae1996933232ac8c38d12fbc426d91d71e16a162
                                                                                                                                                                                                              • Instruction ID: ed3cad348aaa124d181156ffea83bf65a5220a995fd01b3f022eed2e517760e0
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 464981353e977308771678cfae1996933232ac8c38d12fbc426d91d71e16a162
                                                                                                                                                                                                              • Instruction Fuzzy Hash: F1213375A02554DFD758AF78FCD80B67FA4F38A321310413BD59A862B9EB3448A2CB4C
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • OpenSCManagerA.ADVAPI32(00000000,00000000,00000002), ref: 0047546E
                                                                                                                                                                                                              • CreateServiceA.ADVAPI32(00000000,009C49D8,009C49D8,000F01FF,00000110,00000002,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 004754BD
                                                                                                                                                                                                              • ChangeServiceConfig2A.ADVAPI32(00000000,00000001,?), ref: 00475503
                                                                                                                                                                                                              • StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 00475533
                                                                                                                                                                                                              • CloseServiceHandle.ADVAPI32(00000000), ref: 00475593
                                                                                                                                                                                                              • OpenServiceA.ADVAPI32(00000000,009C49D8,00000010), ref: 004755DE
                                                                                                                                                                                                              • StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 0047566C
                                                                                                                                                                                                              • CloseServiceHandle.ADVAPI32(00000000), ref: 0047567D
                                                                                                                                                                                                              • CloseServiceHandle.ADVAPI32(00000000), ref: 004756CC
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000004.00000002.1746518970.0000000000471000.00000020.00000001.01000000.00000005.sdmp, Offset: 00470000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746505882.0000000000470000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746541831.00000000004A7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004AC000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004E1000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004F0000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746606817.00000000004F2000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_4_2_470000_skjlipudplp.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Service$CloseHandle$OpenStart$ChangeConfig2CreateManager
                                                                                                                                                                                                              • String ID: |Sxz
                                                                                                                                                                                                              • API String ID: 3525021261-962673421
                                                                                                                                                                                                              • Opcode ID: f26eaceffb885c33f72e323c188a51ab41c3f81eb064f60deb36852fbb6f4a59
                                                                                                                                                                                                              • Instruction ID: a2b1ce98ba719a3acbaa1e8a7580d2ddabcd95acfdee7f34ff78b21900104480
                                                                                                                                                                                                              • Opcode Fuzzy Hash: f26eaceffb885c33f72e323c188a51ab41c3f81eb064f60deb36852fbb6f4a59
                                                                                                                                                                                                              • Instruction Fuzzy Hash: CF813071A01601DFD314DF24FDC96663BB4F7A4301F50823AE8459B2B6E7B498A1CB8E
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • OpenSCManagerA.ADVAPI32(00000000,00000000,80000000), ref: 0048643A
                                                                                                                                                                                                              • EnumServicesStatusA.ADVAPI32(00000000,00000030,00000003,?,00000024,?,?,00000000), ref: 004864AC
                                                                                                                                                                                                              • GetLastError.KERNEL32 ref: 004864C1
                                                                                                                                                                                                              • EnumServicesStatusA.ADVAPI32(00000000,00000030,00000003,00000000,?,?,?,00000000), ref: 004865D1
                                                                                                                                                                                                              • CloseServiceHandle.ADVAPI32(00000000), ref: 00486829
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000004.00000002.1746518970.0000000000471000.00000020.00000001.01000000.00000005.sdmp, Offset: 00470000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746505882.0000000000470000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746541831.00000000004A7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004AC000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004E1000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004F0000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746606817.00000000004F2000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_4_2_470000_skjlipudplp.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: EnumServicesStatus$CloseErrorHandleLastManagerOpenService
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1579346331-0
                                                                                                                                                                                                              • Opcode ID: e24e52a479a5eb9c40b746d9e196e3cd68e919616a573d9dbacb7ac676de08a7
                                                                                                                                                                                                              • Instruction ID: 6a1f59ee878dcd213e7a95c5ad58ed0868382c4f517a9ca30d08cbae1f227f70
                                                                                                                                                                                                              • Opcode Fuzzy Hash: e24e52a479a5eb9c40b746d9e196e3cd68e919616a573d9dbacb7ac676de08a7
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 33027BB2901201DFC744EF65FDC96693BB0F784310B22467AD5869B2B6EB3449A4CF8D
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • Sleep.KERNEL32(000003E8,?,00000001), ref: 004738AD
                                                                                                                                                                                                              • FindFirstFileA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 004739A7
                                                                                                                                                                                                              • DeleteFileA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 00473AB9
                                                                                                                                                                                                              • FindNextFileA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 00473AD1
                                                                                                                                                                                                              • FindClose.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 00473AF2
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000004.00000002.1746518970.0000000000471000.00000020.00000001.01000000.00000005.sdmp, Offset: 00470000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746505882.0000000000470000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746541831.00000000004A7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004AC000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004E1000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004F0000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746606817.00000000004F2000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_4_2_470000_skjlipudplp.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: FileFind$CloseDeleteFirstNextSleep
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1528862845-0
                                                                                                                                                                                                              • Opcode ID: 4c197b9620107c807298035a34a43fca5c5e32b29e714fb58b290e65ec980e95
                                                                                                                                                                                                              • Instruction ID: 2c52dc62a15ef6b6637a065efc9f263ddd07bc6728fe82bbcbf4d29f47a6606a
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4c197b9620107c807298035a34a43fca5c5e32b29e714fb58b290e65ec980e95
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 66A13371901244CBD314DF21FCDA5BA3BB4FB94301B01867BE4468B2B6EB7499A1CB8D

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 902 47ca00-47ca1b 903 47ca6d-47cb92 call 4796f0 CreatePipe 902->903 904 47ca1d-47ca59 902->904 908 47cb94-47cba4 903->908 909 47cba9-47cbf7 SetHandleInformation 903->909 904->903 905 47ca5b-47ca67 904->905 905->903 912 47cef7-47cf03 908->912 910 47cc1e-47cc34 CreatePipe 909->910 911 47cbf9-47cc0a 909->911 915 47cc36-47cc48 910->915 916 47cc4d-47cc65 910->916 913 47cc14 911->913 914 47cc0c-47cc12 911->914 917 47cf17-47cf24 call 492070 912->917 918 47cf05-47cf11 912->918 913->910 914->910 919 47ce9c-47ceb2 CloseHandle 915->919 920 47cc97 916->920 921 47cc67-47cc71 916->921 930 47cf2a-47cf4d 917->930 918->917 925 47ceb4-47ceb8 CloseHandle 919->925 926 47cebe-47cee5 919->926 923 47cca1-47cdcc SetHandleInformation call 4796f0 * 2 920->923 927 47cc73-47cc87 921->927 928 47cc89-47cc95 921->928 936 47cdce-47cde6 923->936 937 47cde8 923->937 925->926 931 47cee7-47ceee 926->931 932 47cef3-47cef5 926->932 927->923 928->923 931->932 932->912 932->930 938 47cdf2-47ce2c CreateProcessA 936->938 937->938 939 47ce32-47ce60 CloseHandle 938->939 940 47cf4e-47cf82 938->940 943 47ce62 939->943 944 47ce6c-47ce96 CloseHandle 939->944 941 47cf84 940->941 942 47cf8e-47cfa8 WriteFile 940->942 941->942 945 47cfbb-47d01c CloseHandle * 2 942->945 946 47cfaa-47cfb0 942->946 943->944 944->919 947 47d030-47d11c call 4946f0 WaitForSingleObject CloseHandle * 2 945->947 948 47d01e-47d02a 945->948 946->945 948->947
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 0047CB8A
                                                                                                                                                                                                              • SetHandleInformation.KERNEL32(?,00000001,00000000), ref: 0047CBD0
                                                                                                                                                                                                              • CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 0047CC2C
                                                                                                                                                                                                              • SetHandleInformation.KERNEL32(?,00000001,00000000), ref: 0047CCA8
                                                                                                                                                                                                              • CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,?,00000044,?), ref: 0047CE0D
                                                                                                                                                                                                              • CloseHandle.KERNEL32(?), ref: 0047CE48
                                                                                                                                                                                                              • CloseHandle.KERNEL32(?), ref: 0047CE70
                                                                                                                                                                                                              • CloseHandle.KERNEL32(?), ref: 0047CEA0
                                                                                                                                                                                                              • CloseHandle.KERNEL32(?), ref: 0047CEB8
                                                                                                                                                                                                              • WriteFile.KERNEL32(?,?,?,?,00000000), ref: 0047CFA0
                                                                                                                                                                                                              • CloseHandle.KERNEL32(?), ref: 0047CFD3
                                                                                                                                                                                                              • CloseHandle.KERNEL32(?), ref: 0047CFEE
                                                                                                                                                                                                              • WaitForSingleObject.KERNEL32(?,00002710), ref: 0047D09F
                                                                                                                                                                                                              • CloseHandle.KERNEL32(?), ref: 0047D0B3
                                                                                                                                                                                                              • CloseHandle.KERNEL32(?), ref: 0047D0EB
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000004.00000002.1746518970.0000000000471000.00000020.00000001.01000000.00000005.sdmp, Offset: 00470000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746505882.0000000000470000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746541831.00000000004A7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004AC000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004E1000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004F0000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746606817.00000000004F2000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_4_2_470000_skjlipudplp.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Handle$Close$Create$InformationPipe$FileObjectProcessSingleWaitWrite
                                                                                                                                                                                                              • String ID: D$S')G
                                                                                                                                                                                                              • API String ID: 1130065513-1494146028
                                                                                                                                                                                                              • Opcode ID: 4099d7dc437936befd7c18abfacc38f4038f2c5a114e905d3f368499c37d607c
                                                                                                                                                                                                              • Instruction ID: c00cd13c776dd5e6c33d4b06c0c9db98d2d17d601b95c52f325fd48226371f64
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4099d7dc437936befd7c18abfacc38f4038f2c5a114e905d3f368499c37d607c
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 650249B1A01244DFD704DF64FDC8AA93BB5FB98300B11823AE5469B2B6E7349861CF4D
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 004940AF
                                                                                                                                                                                                              • Process32First.KERNEL32(00000000,?), ref: 00494187
                                                                                                                                                                                                              • CreateToolhelp32Snapshot.KERNEL32(00000008,?), ref: 004943B2
                                                                                                                                                                                                              • Module32First.KERNEL32(00000000,?), ref: 004943F6
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000,0000000A,?,00000000), ref: 0049454D
                                                                                                                                                                                                              • Process32Next.KERNEL32(?,00000128), ref: 00494584
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 004945FA
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000004.00000002.1746518970.0000000000471000.00000020.00000001.01000000.00000005.sdmp, Offset: 00470000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746505882.0000000000470000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746541831.00000000004A7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004AC000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004E1000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004F0000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746606817.00000000004F2000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_4_2_470000_skjlipudplp.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32$Module32Next
                                                                                                                                                                                                              • String ID: "L=/
                                                                                                                                                                                                              • API String ID: 930127669-2479274474
                                                                                                                                                                                                              • Opcode ID: ae45eed37a3a5875b9c821744734a6bc15ce9cbed866cd421183966d662ec1d1
                                                                                                                                                                                                              • Instruction ID: 5f5495272b6df47f12056227be3fe39aa87c78c3a0ec573027fdef6049620f41
                                                                                                                                                                                                              • Opcode Fuzzy Hash: ae45eed37a3a5875b9c821744734a6bc15ce9cbed866cd421183966d662ec1d1
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 71F13671A00240DFDB04EF61FDC9A653FB4F794311B12427AE5869A2B6EB344961CF8D
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • RegisterServiceCtrlHandlerA.ADVAPI32(009C49D8,Function_00001140), ref: 0047611E
                                                                                                                                                                                                              • SetServiceStatus.ADVAPI32(00000000,004D9C20), ref: 0047617F
                                                                                                                                                                                                              • CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00476193
                                                                                                                                                                                                              • SetServiceStatus.ADVAPI32(00000000,004D9C20), ref: 00476200
                                                                                                                                                                                                              • WaitForSingleObject.KERNEL32(00000000,00001388), ref: 0047626C
                                                                                                                                                                                                              • SetServiceStatus.ADVAPI32(00000000,004D9C20), ref: 00476322
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 00476341
                                                                                                                                                                                                              • SetServiceStatus.ADVAPI32(00000000,004D9C20), ref: 004763F1
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000004.00000002.1746518970.0000000000471000.00000020.00000001.01000000.00000005.sdmp, Offset: 00470000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746505882.0000000000470000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746541831.00000000004A7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004AC000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004E1000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004F0000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746606817.00000000004F2000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_4_2_470000_skjlipudplp.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Service$Status$CloseCreateCtrlEventHandleHandlerObjectRegisterSingleWait
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3399922960-0
                                                                                                                                                                                                              • Opcode ID: 4df4c63484f2e176e27849bd20ec606fc5415ef6afe4477b6080f0d89d67852e
                                                                                                                                                                                                              • Instruction ID: 554f7ce46defaa7e4695e9163ea5d98eebc41921eb55236c536c4cfd47874167
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 4df4c63484f2e176e27849bd20ec606fc5415ef6afe4477b6080f0d89d67852e
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 2CA186B1A12240CFC344DF26FDD95653BF8F799710311867AD4468A6B6DB748860CF4D
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0047B2EE
                                                                                                                                                                                                              • ReadFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 0047B326
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 0047B33F
                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 0047B37C
                                                                                                                                                                                                              • CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0047B558
                                                                                                                                                                                                              • WriteFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 0047B5AB
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 0047B5BC
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000004.00000002.1746518970.0000000000471000.00000020.00000001.01000000.00000005.sdmp, Offset: 00470000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746505882.0000000000470000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746541831.00000000004A7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004AC000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004E1000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004F0000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746606817.00000000004F2000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_4_2_470000_skjlipudplp.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: File$CloseCreateHandle$CountReadTickWrite
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3478262135-0
                                                                                                                                                                                                              • Opcode ID: 12db3ea84df05965ece1651f32a0e7fc8c3a10978f77116324bc6a94171e3875
                                                                                                                                                                                                              • Instruction ID: e84fd62bdd45b7f5ec20f0bbfa32a9ae3e9515ea10e530f17b567de3237d3167
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 12db3ea84df05965ece1651f32a0e7fc8c3a10978f77116324bc6a94171e3875
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 44B106B1A01210EFD704AF25FD86BA637B4FB95300F10823AE9059F2B6E7745951CB9E
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000,00000001), ref: 0047204F
                                                                                                                                                                                                              • Process32First.KERNEL32(00000000,00000128), ref: 00472159
                                                                                                                                                                                                              • OpenProcess.KERNEL32(00000001,00000000,?), ref: 0047224D
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000004.00000002.1746518970.0000000000471000.00000020.00000001.01000000.00000005.sdmp, Offset: 00470000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746505882.0000000000470000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746541831.00000000004A7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004AC000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004E1000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004F0000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746606817.00000000004F2000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_4_2_470000_skjlipudplp.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CreateFirstOpenProcessProcess32SnapshotToolhelp32
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3397401024-0
                                                                                                                                                                                                              • Opcode ID: 72cb52a469140ee829d4d71390799f8eedcf9a25a68b4d73ca4ee0dc4a905044
                                                                                                                                                                                                              • Instruction ID: 11acc00f7ddeec9c62dfefee7bde2f6dd3c2059e7ad7a08c3f544c1ee55a0fc7
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 72cb52a469140ee829d4d71390799f8eedcf9a25a68b4d73ca4ee0dc4a905044
                                                                                                                                                                                                              • Instruction Fuzzy Hash: DBB154B2A01211CFD714EF24FEC95A63BB4F794300B11867BD5469A2B6E7B49920CF8C
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CreateFileA.KERNEL32(?,00000000,00000000,00000000,00000003,00000000,00000000), ref: 00494A04
                                                                                                                                                                                                              • GetFileTime.KERNEL32(00000000,?,?,?), ref: 00494A4E
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000), ref: 00494A6B
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000004.00000002.1746518970.0000000000471000.00000020.00000001.01000000.00000005.sdmp, Offset: 00470000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746505882.0000000000470000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746541831.00000000004A7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004AC000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004E1000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004F0000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746606817.00000000004F2000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_4_2_470000_skjlipudplp.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: File$CloseCreateHandleTime
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3397143404-0
                                                                                                                                                                                                              • Opcode ID: 9003933404721f26607ba5511d42749333a44b9b629f13e34514d6dd986372bf
                                                                                                                                                                                                              • Instruction ID: 740548b596602a6f05b773a54188bcc9b8f724632dc4ec5acab76cfd84a1aba2
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 9003933404721f26607ba5511d42749333a44b9b629f13e34514d6dd986372bf
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 6F610132A01204DFDB10CF65FDC567ABBB8FB98714B11827BE9068A6B1D7709850CB8D
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000,?,00000000), ref: 0049035F
                                                                                                                                                                                                              • Process32First.KERNEL32(00000000,?), ref: 004903DB
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000004.00000002.1746518970.0000000000471000.00000020.00000001.01000000.00000005.sdmp, Offset: 00470000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746505882.0000000000470000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746541831.00000000004A7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004AC000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004E1000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004F0000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746606817.00000000004F2000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_4_2_470000_skjlipudplp.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CreateFirstProcess32SnapshotToolhelp32
                                                                                                                                                                                                              • String ID: i*Vd
                                                                                                                                                                                                              • API String ID: 2353314856-4103011120
                                                                                                                                                                                                              • Opcode ID: 82a15604b57ee0a6ac9da716c6b3106dff3809aa5ff41e510f5291ae93b55cb9
                                                                                                                                                                                                              • Instruction ID: 4392687504953acfbd7a9529f6b5580aa1bfc57fd644d3ceab7fa92a6b8bc8fd
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 82a15604b57ee0a6ac9da716c6b3106dff3809aa5ff41e510f5291ae93b55cb9
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 37A155B1A01250DFDB00EF21FDD96B63BB0FB85311B11457AD4869A2B6E77448A0CF9D
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000001,?,00479ED1,00490DB0,00000001,?), ref: 0049873E
                                                                                                                                                                                                              • CreateThread.KERNEL32(00000000,00000000,00000001,?,00000000,00000000), ref: 0049876D
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000,?,00479ED1,00490DB0,00000001,?), ref: 0049877E
                                                                                                                                                                                                              • WaitForSingleObject.KERNEL32(?,000000FF,?,00479ED1,00490DB0,00000001,?), ref: 00498793
                                                                                                                                                                                                              • CloseHandle.KERNEL32(?,?,000000FF,?,00479ED1,00490DB0,00000001,?), ref: 004987B7
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000004.00000002.1746518970.0000000000471000.00000020.00000001.01000000.00000005.sdmp, Offset: 00470000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746505882.0000000000470000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746541831.00000000004A7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004AC000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004E1000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004F0000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746606817.00000000004F2000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_4_2_470000_skjlipudplp.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CloseCreateHandle$EventObjectSingleThreadWait
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1404307249-0
                                                                                                                                                                                                              • Opcode ID: 5838f0ea53a349f21765f945929e7c410573fb62dc65f5da9b37f3d5b4d0763a
                                                                                                                                                                                                              • Instruction ID: 2d1a6cf1fe077922ac8c73aab4727d2a9178a8e105ff6af43cd1bc11974f1ae4
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 5838f0ea53a349f21765f945929e7c410573fb62dc65f5da9b37f3d5b4d0763a
                                                                                                                                                                                                              • Instruction Fuzzy Hash: AA41A2B1A01305EFD7016F26FD887503BB0F758351F21453AE5859A2B6EB3594A1CF8E
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CreateProcessA.KERNEL32(00001237,009C4A18,00000000,00000000,00000000,00000008,00000000,00000000,00000044,009CBEB8), ref: 0048602B
                                                                                                                                                                                                              • CloseHandle.KERNEL32(009C4A18), ref: 00486043
                                                                                                                                                                                                              • CloseHandle.KERNEL32(009CBEB8), ref: 00486072
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000004.00000002.1746518970.0000000000471000.00000020.00000001.01000000.00000005.sdmp, Offset: 00470000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746505882.0000000000470000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746541831.00000000004A7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004AC000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004E1000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004F0000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746606817.00000000004F2000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_4_2_470000_skjlipudplp.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CloseHandle$CreateProcess
                                                                                                                                                                                                              • String ID: D
                                                                                                                                                                                                              • API String ID: 2922976086-2746444292
                                                                                                                                                                                                              • Opcode ID: fa3f42408af4b8a1471c49645ec729d92897ca132c99789b1a3b4841a61c164e
                                                                                                                                                                                                              • Instruction ID: 14a6dacbb3ce1a643576f4c31ad3144632958f0c5f2460aaca51620cf00e3ebe
                                                                                                                                                                                                              • Opcode Fuzzy Hash: fa3f42408af4b8a1471c49645ec729d92897ca132c99789b1a3b4841a61c164e
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 4151D0716012009BC708DF64EDA2BBA77B5F794701F10863AEA06CB7B4E7B89905CB4D
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00492807
                                                                                                                                                                                                              • ReadFile.KERNEL32(00000000,?,00005000,?,00000000), ref: 004928C5
                                                                                                                                                                                                              • CloseHandle.KERNEL32(00000000,?,?,?,00000000), ref: 004929CC
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000004.00000002.1746518970.0000000000471000.00000020.00000001.01000000.00000005.sdmp, Offset: 00470000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746505882.0000000000470000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746541831.00000000004A7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004AC000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004E1000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004F0000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746606817.00000000004F2000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_4_2_470000_skjlipudplp.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: File$CloseCreateHandleRead
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1035965006-0
                                                                                                                                                                                                              • Opcode ID: 6ed57852780929ab7ccc70267a07b4fa4faa90bcd8229c1410d76536b13c3930
                                                                                                                                                                                                              • Instruction ID: 948771de7d93fcd51bd1c6e3100425e301c1429adeb9e1b677d7d5f0f67888e4
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 6ed57852780929ab7ccc70267a07b4fa4faa90bcd8229c1410d76536b13c3930
                                                                                                                                                                                                              • Instruction Fuzzy Hash: 40B123B5A01200DFDB04EF24FD85A693BB4F794301F11467AE4029A2B5EBB89961CF8D
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetProcessHeap.KERNEL32(00000000,00000000,?,?,0048FAC0,00000000,?), ref: 0049381D
                                                                                                                                                                                                              • RtlReAllocateHeap.NTDLL(00000000,?,0048FAC0,00000000), ref: 00493824
                                                                                                                                                                                                              • GetProcessHeap.KERNEL32(00000000,?,?,0048FAC0,00000000,?), ref: 00493842
                                                                                                                                                                                                              • HeapAlloc.KERNEL32(00000000,?,0048FAC0,00000000,?), ref: 00493849
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000004.00000002.1746518970.0000000000471000.00000020.00000001.01000000.00000005.sdmp, Offset: 00470000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746505882.0000000000470000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746541831.00000000004A7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004AC000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004E1000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004F0000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746606817.00000000004F2000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_4_2_470000_skjlipudplp.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Heap$Process$AllocAllocate
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 1154092256-0
                                                                                                                                                                                                              • Opcode ID: 2b039435302dfa7fcc6d43908d705df81d28375ed8484cdab8d338973c3b0cc0
                                                                                                                                                                                                              • Instruction ID: f53e56a6c6cb6df5af54d4d7b1b4552ecef1da3141feca36e1bacdf0180ef34d
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 2b039435302dfa7fcc6d43908d705df81d28375ed8484cdab8d338973c3b0cc0
                                                                                                                                                                                                              • Instruction Fuzzy Hash: D81125B1A04604CBCB04AFA0FC9CA6A3FB8F744741B114272E0068A670EB759850CB6E
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                              • GetSystemTime.KERNEL32(J,G,00000001,?,?,00472C4A), ref: 004A473C
                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 004A484A
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 00000004.00000002.1746518970.0000000000471000.00000020.00000001.01000000.00000005.sdmp, Offset: 00470000, based on PE: true
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746505882.0000000000470000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746541831.00000000004A7000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004AC000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004E1000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746555345.00000000004F0000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              • Associated: 00000004.00000002.1746606817.00000000004F2000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_4_2_470000_skjlipudplp.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: CountSystemTickTime
                                                                                                                                                                                                              • String ID: J,G
                                                                                                                                                                                                              • API String ID: 2164215191-1405447833
                                                                                                                                                                                                              • Opcode ID: 29c1c502e27f0c1e4d2a6adac17b25e860ec56d202a055535ff7194704e5418b
                                                                                                                                                                                                              • Instruction ID: 8fee1792ac8586b348b4f7b9e968b4f1089b6712fbd3ddde9bed4721274bd3a5
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 29c1c502e27f0c1e4d2a6adac17b25e860ec56d202a055535ff7194704e5418b
                                                                                                                                                                                                              • Instruction Fuzzy Hash: CA510276A12152CBD314DF6AFD8147637F1FBA5315344823BE405CA6B9E3789860CB4D
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                • Part of subcall function 004E59B0: GetProcessHeap.KERNEL32(00000000,00000000,?,004CFA98,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 004E59C3
                                                                                                                                                                                                                • Part of subcall function 004E59B0: RtlFreeHeap.NTDLL(00000000,?,004CFA98,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 004E59CA
                                                                                                                                                                                                                • Part of subcall function 004E4650: GetSystemTime.KERNEL32(J,K,00000001,?,?,004B2C4A), ref: 004E473C
                                                                                                                                                                                                              • GetEnvironmentVariableA.KERNEL32(00000000,C:\Windows\system32\config\systemprofile,00000104), ref: 004DD651
                                                                                                                                                                                                              • CreateMutexA.KERNELBASE(00000000,00000000,00000000), ref: 004DD721
                                                                                                                                                                                                              • CreateMutexA.KERNELBASE(00000000,00000000,00000000), ref: 004DD76D
                                                                                                                                                                                                              • CreateMutexA.KERNEL32(00000000,00000000,00000000), ref: 004DD7A4
                                                                                                                                                                                                              • GetTickCount.KERNEL32 ref: 004DD82E
                                                                                                                                                                                                              • Sleep.KERNEL32(00000D05), ref: 004DDE9B
                                                                                                                                                                                                              • Sleep.KERNELBASE(000003E8), ref: 004DE039
                                                                                                                                                                                                              • GetCommandLineA.KERNEL32 ref: 004DD9EB
                                                                                                                                                                                                                • Part of subcall function 004BC9B0: ExitProcess.KERNEL32 ref: 004BC9E8
                                                                                                                                                                                                                • Part of subcall function 004D4990: CreateFileA.KERNELBASE(?,00000000,00000000,00000000,00000003,00000000,00000000), ref: 004D4A04
                                                                                                                                                                                                              Strings
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.2971552707.00000000004B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 004B0000, based on PE: true
                                                                                                                                                                                                              • Associated: 0000000A.00000002.2971485487.00000000004B0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 0000000A.00000002.2971594933.00000000004E7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 0000000A.00000002.2971611809.00000000004EC000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 0000000A.00000002.2971611809.0000000000521000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 0000000A.00000002.2971611809.0000000000530000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 0000000A.00000002.2971704639.0000000000532000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_4b0000_xmjofjnkdlv.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: Create$Mutex$HeapProcessSleep$CommandCountEnvironmentExitFileFreeLineSystemTickTimeVariable
                                                                                                                                                                                                              • String ID: C:\Windows\system32\config\systemprofile$Qt$[$U"Kd$s|$w|$l
                                                                                                                                                                                                              • API String ID: 2753435600-1230430831
                                                                                                                                                                                                              • Opcode ID: 7577f6c5d264f0fc3ea03d0ce8af82b10c2b07316373288448bb9d44df914827
                                                                                                                                                                                                              • Instruction ID: ae6e238d7d5900ba039ef7aa1aeb10e921bd4814e368a7e3c6a69b9d645de7e1
                                                                                                                                                                                                              • Opcode Fuzzy Hash: 7577f6c5d264f0fc3ea03d0ce8af82b10c2b07316373288448bb9d44df914827
                                                                                                                                                                                                              • Instruction Fuzzy Hash: EB1357B1A00201DFD714EF21FD996763BB0FBA5300B11812AD4429B3B6EB74586AEF5D

                                                                                                                                                                                                              Control-flow Graph

                                                                                                                                                                                                              • Executed
                                                                                                                                                                                                              • Not Executed
                                                                                                                                                                                                              control_flow_graph 697 4b70d0-4b716b call 4e6810 call 4d8570 702 4b716d-4b7190 697->702 703 4b71d0-4b721b CreateFileA 697->703 704 4b71a8-4b71cf call 4d2290 702->704 705 4b7192-4b71a2 702->705 706 4b72ad-4b72e9 703->706 707 4b7221-4b7269 call 4d2290 703->707 705->704 708 4b72eb-4b72f7 706->708 709 4b72fd-4b7305 706->709 715 4b726b-4b727b 707->715 716 4b727c-4b7298 707->716 708->709 712 4b7312-4b7330 709->712 717 4b7332-4b7353 712->717 718 4b7355-4b7389 712->718 719 4b729a-4b729f 716->719 720 4b72a6-4b72ac 716->720 721 4b7395-4b745d call 4bf1c0 call 4bb680 WriteFile 717->721 718->721 722 4b738b 718->722 719->720 727 4b745f-4b746b 721->727 728 4b7471-4b7488 721->728 722->721 727->728 729 4b748e-4b74b6 728->729 730 4b7310 728->730 731 4b74b8-4b74f8 729->731 732 4b7522 729->732 730->712 733 4b74fa-4b750c 731->733 734 4b750e-4b7520 731->734 735 4b7524-4b754c CloseHandle call 4d2290 732->735 733->735 734->735 737 4b7551-4b7564 735->737 738 4b758f-4b7597 737->738 739 4b7566-4b7574 737->739 739->738 740 4b7576-4b7589 739->740 740->738
                                                                                                                                                                                                              APIs
                                                                                                                                                                                                                • Part of subcall function 004D8570: WaitForSingleObject.KERNEL32(?,00004E20,?,004B264E,0000010C,00000000,00000001,?,?,004D1B87,004B17D5,?), ref: 004D85D7
                                                                                                                                                                                                              • CreateFileA.KERNELBASE(?,40000000,00000000,00000000,00000002,00000000,00000000,?,00000000,?,?,?,?,?,?,00000000), ref: 004B71F7
                                                                                                                                                                                                              • WriteFile.KERNELBASE(00000000,?,00005000,00005000,00000000,?,?,?,?,?,?), ref: 004B740F
                                                                                                                                                                                                              Memory Dump Source
                                                                                                                                                                                                              • Source File: 0000000A.00000002.2971552707.00000000004B1000.00000020.00000001.01000000.00000007.sdmp, Offset: 004B0000, based on PE: true
                                                                                                                                                                                                              • Associated: 0000000A.00000002.2971485487.00000000004B0000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 0000000A.00000002.2971594933.00000000004E7000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 0000000A.00000002.2971611809.00000000004EC000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 0000000A.00000002.2971611809.0000000000521000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 0000000A.00000002.2971611809.0000000000530000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              • Associated: 0000000A.00000002.2971704639.0000000000532000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                              Joe Sandbox IDA Plugin
                                                                                                                                                                                                              • Snapshot File: hcaresult_10_2_4b0000_xmjofjnkdlv.jbxd
                                                                                                                                                                                                              Similarity
                                                                                                                                                                                                              • API ID: File$CreateObjectSingleWaitWrite
                                                                                                                                                                                                              • String ID:
                                                                                                                                                                                                              • API String ID: 3285871581-0
                                                                                                                                                                                                              • Opcode ID: db0dde257fbe2bea0da9a7d96c0e855b45ac53aff396105a0f496c90d40868a7
                                                                                                                                                                                                              • Instruction ID: 4987cdc1ea5ce9b768ec157fed97ff146cadd3878ccf24f867f9bb9691bb746a
                                                                                                                                                                                                              • Opcode Fuzzy Hash: db0dde257fbe2bea0da9a7d96c0e855b45ac53aff396105a0f496c90d40868a7
                                                                                                                                                                                                              • Instruction Fuzzy Hash: FDC145B2A01200DFD714DF25FD856B237B4FBA5301B11846AE846872B4E7349879EF9A